Frameworks / NIST SP 800-53 Revision 5.1 HIGH / IR-1 NIST SP 800-53 Revision 5.1 HIGH
IR Incident Response
NIST SP 800-53 Revision 5.1 HIGH IR-1: Policy and Procedures Requires an incident response policy and supporting procedures to be developed, documented, disseminated, reviewed and updated on a defined cycle.
What else in your programme already covers this This control maps to 42 controls across 19 other frameworks. If you already hold one of them, the evidence you collected for it is the starting point here rather than new work.
SOC2-CC5.3 COSO principle 12: Deploys control activities through policies and procedures SOC2-CC7.1 Detection and monitoring procedures for security events are in place SOC2-CC7.2 Monitors system components for anomalies indicating malicious acts SOC2-CC7.3 Evaluates security events to determine incident status SOC2-CC7.4 Responds to identified security incidents through defined procedures CIS-13.1 Centralize Security Event Alerting CIS-13.3 Deploy a Network Intrusion Detection Solution CIS-17.9 Establish and Maintain Security Incident Thresholds CIS-8.11 Conduct Audit Log Reviews 5.24 Information security incident management planning and preparation 5.25 Assessment and decision on information security events 5.26 Response to information security incidents 8.16 Monitoring activities 5.24 Information security incident management planning and preparation 5.25 Assessment and decision on information security events 5.26 Response to information security incidents 8.16 Monitoring activities 10.7.1 Critical security control failure detection (SP) 11.5.1 IDS/IPS in place 12.10.1 Incident response plan 12.10.5 IRP includes monitoring and response to security control alerts ASBv3-GS-7 Define and implement logging, threat detection and incident response strategy C5-SIM-01 Policy for security incident management CFTC-SS-16 Security Incident Response Plan and Testing Every mapping shown was judged rather than inferred from wording similarity, and the ones that failed review are published too. See the coverage reports and what was rejected .
Other controls in IR Incident Response Query this from an agent The graph holds this control, the 42 it maps to, and the evidence behind each claim, over MCP and REST.