Control: The organisation:
Incident Reporting Supplemental Guidance:
The intent of this control is to address both specific incident reporting requirements within an organisation and the formal incident reporting requirements for federal agencies and their subordinate organisations. Suspected security incidents include, for example, the receipt of suspicious email communications that can potentially contain malicious code. The types of security incidents reported, the content and timeliness of the reports, and the designated reporting authorities reflect applicable federal laws, Executive Orders, directives, regulations, policies, standards, and guidance. Current federal policy requires that all federal agencies (unless specifically exempted from such requirements) report security incidents to the United States Computer Emergency Readiness Team (US-CERT) within specified time frames designated in the US-CERT Concept of Operations for Federal Cyber Security Incident Handling.
Incident Reporting Control Enhancements:
IR-6 (1) Incident Reporting - Automated Reporting
The organisation employs automated mechanisms to assist in the reporting of security incidents.
Supplemental Guidance: Related control: IR-7.
IR-6 (2) Incident Reporting - Vulnerabilities related to Incidents
The organisation reports information system vulnerabilities associated with reported security incidents to [Assignment: organisation-defined personnel or roles].
IR-6 (3) Incident Reporting - Coordination with Supply Chain
The organisation provides security incident information to other organisations involved in the supply chain for information systems or information system components related to the incident.
Supplemental Guidance: Organisations involved in supply chain activities include, for example, system/product developers, integrators, manufacturers, packagers, assemblers, distributors, vendors, and resellers. Supply chain incidents include, for example, compromises/breaches involving information system components, information technology products, development processes or personnel, and distribution processes or warehousing facilities. Organisations determine the appropriate information to share considering the value gained from support by external organisations with the potential for harm due to sensitive information being released to outside organisations of perhaps questionable trustworthiness.