IR-5(1)

Requirement

Track incidents and collect and analyze incident information using [Assignment: organization-defined automated mechanisms].

Discussion

Automated mechanisms for tracking incidents and collecting and analyzing incident information include Computer Incident Response Centers or other electronic databases of incidents and network monitoring devices.

NIST 800-53A Assessment Guidance

Examine

[SELECT FROM: Incident response policy; procedures addressing incident monitoring; incident response records and documentation; system security plan; incident response plan; other relevant documents or records].

Interview

[SELECT FROM: Organizational personnel with incident monitoring responsibilities; organizational personnel with information security responsibilities].

Test

[SELECT FROM: Incident monitoring capability for the organization; automated mechanisms supporting and/or implementing the tracking and documenting of system security incidents].

ID	Assessment Objectives
IR-05(01)[01]	incidents are tracked using <IR-05(01)_ODP[01] automated mechanisms>;
IR-05(01)[02]	incident information is collected using <IR-05(01)_ODP[02] automated mechanisms>;
IR-05(01)[03]	incident information is analyzed using <IR-05(01)_ODP[03] automated mechanisms>.

Our CMMC Overview Course simplifies CMMC. Enroll so you can make informed decisions!