IR-9 (3) Information Spillage Response | Post-Spill Operations (M) (H)

NIST 800-53 (r4) Control:

The organization implements [Assignment: organization-defined procedures] to ensure that organizational personnel impacted by information spills can continue to carry out assigned tasks while contaminated systems are undergoing corrective actions.

NIST 800-53 (r4) Supplemental Guidance:

Correction actions for information systems contaminated due to information spillages may be very time-consuming. During those periods, personnel may not have access to the contaminated systems, which may potentially affect their ability to conduct organizational business.

References: None.

NIST 800-53 (r5) Discussion:

Corrective actions for systems contaminated due to information spillages may be time-consuming. Personnel may not have access to the contaminated systems while corrective actions are being taken, which may potentially affect their ability to conduct organizational business.

38North Guidance:

Meets Minimum Requirement:

• The organization defines and documents the steps that should be taken during an information spill, to include what actions should be taken to allow personnel impacted by information spills to continue to carry out their tasks while contaminated systems are undergoing corrective actions.

• The organization implements those actions, if needed, during an information spill.

Best Practice: None

Unofficial FedRAMP Guidance: None

Assessment Evidence:

• Incident response procedures detailing what actions to take to ensure that personnel impacted by information spills can continue to carry out assigned tasks while the contaminated systems are undergoing corrective actions.

• Evidence shows that those procedures were followed if there was an information spill in the past year, such as tickets or after action report, etc.

CSP Implementation Tips:

• Amazon Web Services (AWS): TBD

• Microsoft Azure: TBD

• Google Cloud Platform: TBD