IR-6(2)

Requirement

Report system vulnerabilities associated with reported incidents to [Assignment: organization-defined personnel or roles].

Discussion

Reported incidents that uncover system vulnerabilities are analyzed by organizational personnel including system owners, mission and business owners, senior agency information security officers, senior agency officials for privacy, authorizing officials, and the risk executive (function). The analysis can serve to prioritize and initiate mitigation actions to address the discovered system vulnerability.

NIST 800-53A Assessment Guidance

Examine

[SELECT FROM: Incident response policy; procedures addressing incident reporting; incident response plan; system security plan; privacy plan; security incident reports and associated system vulnerabilities; other relevant documents or records].

Interview

[SELECT FROM: Organizational personnel with incident reporting responsibilities; organizational personnel with information security and privacy responsibilities; system/network administrators; personnel to whom vulnerabilities associated with security incidents are to be reported].

Test

[SELECT FROM: Organizational processes for incident reporting; mechanisms supporting and/or implementing the reporting of vulnerabilities associated with security incidents].

ID	Assessment Objectives
IR-06(02)	system vulnerabilities associated with reported incidents are reported to <IR-06(02)_ODP personnel or roles>.

Our CMMC Overview Course simplifies CMMC. Enroll so you can make informed decisions!