IRO-11: Incident Reporting Assistance
Mechanisms exist to provide incident response advice and assistance to users of Technology Assets, Applications and/or Services (TAAS) for the handling and reporting of actual and potential cybersecurity and data protection incidents.
Control Question: Does the organization provide incident response advice and assistance to users of Technology Assets, Applications and/or Services (TAAS) for the handling and reporting of actual and potential cybersecurity and data protection incidents?
General (23)
| Framework | Mapping Values |
|---|---|
| CSA CCM 4 | TVM-09 |
| Generally Accepted Privacy Principles (GAPP) | 1.2.7 |
| GovRAMP Low | IR-07 |
| GovRAMP Low+ | IR-07 |
| GovRAMP Moderate | IR-07 |
| GovRAMP High | IR-07 |
| NIST 800-53 R4 | IR-7 |
| NIST 800-53 R4 (low) | IR-7 |
| NIST 800-53 R4 (moderate) | IR-7 |
| NIST 800-53 R4 (high) | IR-7 |
| NIST 800-53 R5 (source) | IR-7 |
| NIST 800-53B R5 (privacy) (source) | IR-7 |
| NIST 800-53B R5 (low) (source) | IR-7 |
| NIST 800-53B R5 (moderate) (source) | IR-7 |
| NIST 800-53B R5 (high) (source) | IR-7 |
| NIST 800-82 R3 LOW OT Overlay | IR-7 |
| NIST 800-82 R3 MODERATE OT Overlay | IR-7 |
| NIST 800-82 R3 HIGH OT Overlay | IR-7 |
| NIST 800-161 R1 | IR-7 |
| NIST 800-171 R3 (source) | 03.06.02.d |
| NIST 800-171A R3 (source) | A.03.06.02.d |
| SCF CORE ESP Level 2 Critical Infrastructure | IRO-11 |
| SCF CORE ESP Level 3 Advanced Threats | IRO-11 |
US (18)
| Framework | Mapping Values |
|---|---|
| US CERT RMM 1.2 | IMC:SG2.SP2 |
| US CJIS Security Policy 5.9.3 (source) | IR-7 |
| US CMS MARS-E 2.0 | IR-7 |
| US FedRAMP R4 | IR-7 |
| US FedRAMP R4 (low) | IR-7 |
| US FedRAMP R4 (moderate) | IR-7 |
| US FedRAMP R4 (high) | IR-7 |
| US FedRAMP R4 (LI-SaaS) | IR-7 |
| US FedRAMP R5 (source) | IR-7 |
| US FedRAMP R5 (low) (source) | IR-7 |
| US FedRAMP R5 (moderate) (source) | IR-7 |
| US FedRAMP R5 (high) (source) | IR-7 |
| US FedRAMP R5 (LI-SaaS) (source) | IR-7 |
| US HIPAA HICP Large Practice | 9.L.D |
| US IRS 1075 | IR-7 |
| US - TX DIR Control Standards 2.0 | IR-7 |
| US - TX TX-RAMP Level 1 | IR-7 |
| US - TX TX-RAMP Level 2 | IR-7 |
EMEA (1)
| Framework | Mapping Values |
|---|---|
| EMEA EU DORA | 14.1 14.2 14.3 |
APAC (1)
| Framework | Mapping Values |
|---|---|
| APAC New Zealand NZISM 3.6 | 7.3.12.C.01 |
Americas (1)
| Framework | Mapping Values |
|---|---|
| Americas Canada ITSP-10-171 | 03.06.02.D |
Capability Maturity Model
Level 0 — Not Performed
There is no evidence of a capability to provide incident response advice and assistance to users of Technology Assets, Applications and/or Services (TAAS) for the handling and reporting of actual and potential cybersecurity and data protection incidents.
Level 1 — Performed Informally
C|P-CMM1 is N/A, since a structured process is required to provide incident response advice and assistance to users of Technology Assets, Applications and/or Services (TAAS) for the handling and reporting of actual and potential cybersecurity and data protection incidents.
Level 2 — Planned & Tracked
Incident Response (IRO) efforts are requirements-driven and governed at a local/regional level, but are not consistent across the organization. CMM Level 2 control maturity would reasonably expect all, or at least most, the following criteria to exist: o Identify cybersecurity and data protection controls that are appropriate to address applicable statutory, regulatory and contractual requirements for incident response operations. o Implement and maintain an incident response capability using a documented and tested Incident Response Plan (IRP) to facilitate incident management operations that cover preparation, detection and analysis, containment, eradication and recovery.
- Incident response operations are decentralized (e.g., a localized/regionalized function) and uses non-standardized methods to implement secure, resilient and compliant practices.
- IT/cybersecurity personnel:
Level 3 — Well Defined
Incident Response (IR) processes are standardized across the organization and centrally managed, where technically feasible, to ensure consistency. CMM Level 3 control maturity would reasonably expect all, or at least most, the following criteria to exist:
- An Integrated Security Incident Response Team (ISIRT), or similar function, exists to form an on-demand, scalable and integrated team of formally-assigned cybersecurity, IT, data protection and business function representatives that can perform coordinated incident response.
- The ISIRT, or similar function, develops and maintains a documented, program-level Integrated Incident Response Program (IIRP) that provides operational and tactical-level guidance for cybersecurity and data protection response operations.
- A Security Operations Center (SOC), or similar function, facilitates incident management operations that includes preparation, detection and analysis, containment, eradication and recovery.
- Business Process Owners (BPOs), in conjunction with the SOC and ISIRT functions, develop and maintain a documented Incident Response Plan (IRP) specific to the business process / business unit but inclusive of the organization's larger approach to incident response operations.
- An IT Asset Management (ITAM) function, or similar function, categorizes endpoint devices according to the data the asset stores, transmits and/ or processes and provides that information to the SOC for Incident Response Operations (IRO).
Level 4 — Quantitatively Controlled
Incident Response (IR) is metrics driven and provides sufficient management insight (based on a quantitative understanding of process of process capabilities) to predict optimal performance, ensure continued operations and identify areas for improvement. In addition to CMM Level 3 criteria, CMM Level 4 control maturity would reasonably expect all, or at least most, the following criteria to exist:
- Metrics reporting includes quantitative analysis of Key Performance Indicators (KPIs).
- Metrics reporting includes quantitative analysis of Key Risk Indicators (KRIs).
- Scope of metrics, KPIs and KRIs covers organization-wide cybersecurity and data protection controls, including functions performed by third-parties.
- Organizational leadership maintains a formal process to objectively review and respond to metrics, KPIs and KRIs (e.g., monthly or quarterly review).
- Based on metrics analysis, process improvement recommendations are submitted for review and are handled in accordance with change control processes.
- Both business and technical stakeholders are involved in reviewing and approving proposed changes.
Level 5 — Continuously Improving
See C|P-CMM4. There are no defined C|P-CMM5 criteria, since it is reasonable to assume a continuously-improving process is not necessary to provide incident response advice and assistance to users of Technology Assets, Applications and/or Services (TAAS) for the handling and reporting of actual and potential cybersecurity and data protection incidents.
Assessment Objectives
- IRO-11_A01 an incident response support resource that offers advice and assistance to system users on handling and reporting incidents is provided.
- IRO-11_A02 the incident response support resource offers advice and assistance to users of the system for the response and reporting of incidents.