IR-7 (1) Incident Response Assistance | Automation Support for Availability of Information / Support (M) (H)

NIST 800-53 (r4) Control:

The organization employs automated mechanisms to increase the availability of incident response related information and support.

NIST 800-53 (r4) Supplemental Guidance:

Automated mechanisms can provide a push and/or pull capability for users to obtain incident response assistance. For example, individuals might have access to a website to query the assistance capability, or conversely, the assistance capability may have the ability to proactively send information to users (general distribution or targeted) as part of increasing understanding of current response capabilities and support.

References: None.

NIST 800-53 (r5) Discussion:

Automated mechanisms can provide a push or pull capability for users to obtain incident response assistance. For example, individuals may have access to a website to query the assistance capability, or the assistance capability can proactively send incident response information to users (general distribution or targeted) as part of increasing understanding of current response capabilities and support.

38North Guidance:

Meets Minimum Requirement:

• Automated mechanisms are used to increase the availability of incident response related information and support. Examples of automated mechanisms include a ticketing system, incident response database or document repository that can be queried and filtered, email, etc.

Best Practice:

• TBD

Unofficial FedRAMP Guidance:

• TBD

Assessment Evidence:

• Examples of the automated mechanisms used, such as previous incident tickets, emails pertaining to incidents, screenshot of the document repository where incident response related information is stored.

CSP Implementation Tips:

• Amazon Web Services (AWS): TBD

• Microsoft Azure: TBD

• Google Cloud Platform: TBD