Incident Response Plan

Approval #

Revision History #

Review cycle: Every year.

Mandate. Four authorities require this plan or set what it must say:

• National Institute of Standards and Technology (NIST) SP 800-53 IR-8, which directs the Organization to develop, disseminate, and maintain an incident response plan.
• Federal Information Security Modernization Act (FISMA), 44 U.S.C. §3554(b)(7), which requires procedures for detecting, reporting, and responding to security incidents, including notice to the Cybersecurity and Infrastructure Security Agency (CISA).
• Office of Management and Budget (OMB) M-25-04, which sets federal incident and major incident reporting requirements.
• The CISA Federal Incident Notification Guidelines, which set the 1-hour report to CISA and the data it must contain.

The plan follows NIST SP 800-61 Rev 3, which ties incident response to the functions of the NIST Cybersecurity Framework 2.0. Every year, the CISO reviews and approves the plan and sends it to all incident response personnel.

1. Purpose and Scope #

The Organization uses this plan to detect, report, and respond to incidents. The plan covers the structure of the incident response capability, the incidents the Organization reports, the reports and their deadlines, the measures of the capability, and the resources it needs. The plan applies to all information systems operated by or on behalf of the Organization, and to all personnel who operate, maintain, or use those systems.

2. Mission Alignment #

The incident response capability protects the confidentiality, integrity, and availability of the information and systems the mission depends on. The CISO aligns incident response priorities with the Organization’s risk management strategy and the Federal Information Processing Standards (FIPS) 199 categorization of affected systems. Incidents that affect High Value Assets get priority handling under OMB M-19-03.

3. Incident Response Structure #

4. Incident Response Phases (NIST SP 800-61 Rev 3) #

4.1 Preparation #

The Organization keeps the tools, access, and training needed to respond:

• Endpoint detection and response across the enterprise (OMB M-22-01).
• Logging that the top-level security operations center can reach, kept for the periods OMB M-26-14 requires: searchable for 6 months and retrievable for 12 months.
• An on-call roster for the SOC Manager role, so someone can report to CISA at any hour.
• A Login.gov account with an official email address for each person who reports to CISA.
• Pre-approved containment authorities.

Technology supporting this capability:

(No technology inventory entries for this family.)

4.2 Detection and Analysis #

The SOC detects events through the SIEM system, endpoint telemetry, user reports, and outside notices, including CISA advisories. For each event:

1. The SOC correlates the alerts in the SIEM system and decides whether the event is an incident.
2. The SOC opens an incident ticket in the ticketing system and links the alerts to it. The ticket is the record of the incident from the first report to closure.
3. The SOC Manager records in the ticket the time the SOC identified the incident. The 1-hour clock for the CISA report starts then.
4. The SOC assigns an initial severity from the severity ladder in this plan and activates the Incident Response Team on the ladder’s timeline.
5. When PII may be involved, the SOC notifies the SAOP without delay. The SAOP decides whether to activate the Breach Response Plan.
6. The Incident Response Team establishes the scope, the affected systems and data, and the attack vector before eradication starts.

4.3 Containment, Eradication, and Recovery #

The Incident Response Team chooses containment actions that weigh mission impact against spread.

1. The Incident Response Team contains the incident through network isolation, account disablement, credential rotation, or blocking at boundary controls. The System Owner and the ISSO take the system-level actions and preserve evidence.
2. The Incident Response Team removes the adversary’s access and artifacts.
3. The System Owner restores the affected systems from a verified-clean state and applies missing safeguards.
4. The SOC watches the restored systems closely for a recurrence.
5. The System Owner verifies recovery before the systems return to normal operations.

4.4 Evidence Handling #

NIST SP 800-61 Rev 3 and NIST SP 800-86 guide how the team collects and keeps evidence.

1. First responders isolate an affected system from the network. They do not log in to it, reboot it, or power it off until the Incident Response Team says so.
2. The Incident Response Team captures volatile data first, such as memory, running processes, and network connections. The team then takes forensic images of disks where the incident calls for them.
3. The SOC Manager keeps a chain-of-custody record for each item of evidence. The record shows who collected the item, when, how, and every later transfer.
4. When criminal or civil action is possible, the CISO calls in General Counsel before the team collects evidence. The team then handles the evidence to the standard a court requires.

Evidence: the chain-of-custody records, the forensic images and their hash values, and the collection notes in the incident ticket.

4.5 Post-Incident Activity #

Every incident of severity Moderate or higher gets an after-action report within 30 days of closure. The report covers the timeline, root cause, control failures, and corrective actions. The ISSO enters each corrective action for a system weakness as a POA&M item in the GRC system, and the SOC records the item number in the ticket. The CISO adds the lessons learned to this plan, the family procedures, and the detection content in the SIEM system.

The SOC Manager closes the incident ticket only after these are recorded in it: the final update to CISA, every notice in the reporting table, the POA&M item numbers, and the lessons learned.

The SOC keeps each incident ticket, its evidence, and its follow-up documents for 3 years after all follow-up actions are complete. This period comes from the National Archives and Records Administration (NARA) General Records Schedule (GRS) 3.2. A legal hold extends the period. The SOC keeps audit logs tied to an incident with the case file for the same period, even when normal log retention has ended.

5. Severity Ladder and Reporting Timelines #

The SOC assigns each incident an internal severity. Each internal level maps to a level of the CISA National Cyber Incident Scoring System (NCISS), so CISA’s rating and the internal rating can be compared.

The SOC Manager reports each incident to CISA within one hour, as the CISA Federal Incident Notification Guidelines require. The report uses CISA’s terms for the functional impact, the information impact, the recoverability, and the attack vector. The SOC Manager sends the best estimate known at the time and updates the report as facts change. When CISA rates an incident High (Orange) or above, the CISO starts the major incident review. The SOC reports suspected PII incidents to the SAOP without delay. The SAOP handles them under the Breach Response Plan, whatever their security severity.

Evidence: the CISA incident ID and NCISS rating for each report, and the report updates in the incident ticket.

5.1 Who We Report To, When, and How #

The SOC Manager records each report in the incident ticket in the ticketing system, with its time and the person who sent it.

Contractors and cloud service providers report to the SOC. The times they must meet are under “Reports From Contractors and Cloud Service Providers” in this plan.

5.2 Reporting an Incident to CISA #

CISA moved its incident reporting form to the CISA Services Portal on August 29, 2024. The form is at https://myservices.cisa.gov/irf. A person can submit it without signing in, but a person who signs in through Login.gov with an official email address can save a draft, track the report, and update it.

1. The SOC Manager confirms that the incident may have compromised the confidentiality, integrity, or availability of federal information or a federal information system.
2. The SOC gathers what the form asks for: contacts, the organization, a description, functional impact, information impact, recoverability, the systems and users affected, and when the incident started and was detected.
3. The SOC adds what it knows of the attack vector, indicators of compromise, and actions taken. It does not wait for complete facts.
4. The SOC Manager leaves PII out of the report unless CISA needs it to understand the incident.
5. The SOC Manager submits the form within 1 hour of the time the SOC identified the incident.
6. The SOC Manager records the CISA incident ID, the submission time, and CISA’s severity rating in the ticket.
7. When the SOC has a malware sample, the SOC Manager sends it through CISA’s malware analysis form, quoting the CISA incident ID.

Evidence: the incident ticket with the identification time, the CISA incident ID, and the submission time.

5.3 When the CISA Form Cannot Be Used #

1. When only Login.gov is down, the SOC Manager submits the form without signing in.
2. When the form is down, the SOC Manager calls CISA Central at (888) 282-0870, or emails report@cisa.gov, within the same hour.
3. The SOC Manager records in the ticket the time of the call, the CISA contact, and any CISA incident ID given.
4. When the form works again, the SOC Manager enters the report in it, quoting the CISA incident ID.

The CISO’s office checks these contacts every quarter, with the rest of the contact roster.

5.4 Updating and Closing the CISA Report #

1. The SOC Manager updates the CISA report, quoting the CISA incident ID, when the impact, the attack vector, or the scope changes.
2. When the CISO determines a major incident, the SOC Manager marks the report as a major incident, or a major breach for a breach.
3. When the incident closes, the SOC Manager sends a final update with the cause and the actions taken.

6. Major Incidents #

OMB’s current FISMA guidance, M-25-04, defines a major incident. OMB had not issued later FISMA guidance as of October 21, 2026. A major incident is one likely to cause demonstrable harm to national security, foreign relations, the economy, public confidence, civil liberties, or public health and safety. CISA scores of High (Orange), Severe (Red), and Emergency (Black) fall within this definition. Any breach that involves the PII of 100,000 or more people is always a major incident.

1. The CISO leads the major incident determination for every incident that is not a breach. The SAOP leads it for a breach. The CIO, the System Owner, and the CISO take part in both.
2. The CISO or SAOP records the determination in the incident ticket, with the date there was a reasonable basis to conclude a major incident occurred.
3. The CIO tells the agency head of the major incident at once.
4. Within 1 hour of the determination, the CISO reports the major incident to CISA and to the OMB Office of the Federal Chief Information Officer, as M-25-04 requires. The CISO contacts each one directly.
5. Within 7 days of that date, the legislative affairs official notifies the appropriate congressional committees, and the CISO notifies the Inspector General. 44 U.S.C. 3554(b)(7)(C)(iii)(III) sets this deadline.
6. The legislative affairs official sends the committees supplemental updates as the facts develop.
7. For a breach, the SAOP also follows the congressional reporting steps in the Breach Response Plan. These include a report within 30 days of discovering the breach, under FISMA 2014.
8. Each year, the CISO counts the incidents and breaches reported to CISA from the tickets in the ticketing system. The CISO describes each major incident for the agency head’s FISMA letter.

A major incident is also a significant cyber incident, so CISA may bring in the federal coordination group for significant cyber incidents.

Evidence: the signed determination with its date, the reports to CISA and OMB, and the notices to Congress and the Inspector General.

7. Referrals #

1. The CISO notifies the Inspector General promptly of any incident that may involve criminal activity, misuse by an authorized user, or theft of equipment. The CISO also notifies the Inspector General of each incident the SOC reports to CISA.
2. The CISO decides on any referral to law enforcement together with General Counsel and the Inspector General. When a breach calls for a report to law enforcement, the CISO makes it promptly, even if the breach is not yet confirmed.
3. The CISO tells the insider threat program about any incident that involves a trusted insider.
4. The CISO notifies the Contracting Officer when a contractor employee breaks policy, or when a supplier’s product or service is involved.
5. The Agency Records Officer reports to NARA promptly when an incident destroyed, removed, or changed federal records without authority, as 36 CFR 1230.14 requires.
6. The CUI Program Manager handles an incident that involves CUI under the misuse process in 32 CFR 2002.54. The CUI Program Manager tells the designating agency when the CUI came from another agency.

Evidence: the referral notices and their dates in the incident ticket.

8. Reports From Contractors and Cloud Service Providers #

1. The Contracting Officer puts incident reporting terms in each contract for a system or service that handles the Organization’s information. The terms require a report to the SOC within 8 hours of discovery, the time in the proposed Federal Acquisition Regulation (FAR) rule on contractor incident reporting, or a shorter time the contract sets.
2. The CISO gives each cloud service provider the SOC’s reporting contact and these steps. Under the Federal Risk and Authorization Management Program (FedRAMP) Consolidated Rules for 2026, a provider sends an initial, ongoing, and final report to each agency customer.
3. The time for a provider’s initial report depends on its FedRAMP certification class and the impact it estimates. It ranges from 15 minutes to 1 business day.
4. A contractor that holds the Organization’s CUI also reports a CUI incident within 8 hours of discovery. The proposed FAR rule on CUI would allow 72 hours, so the Organization’s terms are stricter. The Contractor Systems That Handle CUI section of the System and Services Acquisition procedure has the steps.
5. The SOC opens a ticket for each report and follows the CISA reporting steps when the Organization’s information or systems may be affected. The Organization’s 1-hour clock starts when the SOC identifies the incident.

The FAR rule on contractor incident reporting under Executive Order 14028 was still a proposed rule (FR 2023-21328) on October 21, 2026. The FAR rule on CUI (FR 2026-12559), which would require contractor reports within 72 hours of discovery, was also still proposed. Until each is final, the contract terms set what a contractor must report, and the Organization’s standard terms use 8 hours.

The Cyber Incident Reporting for Critical Infrastructure Act of 2022 (CIRCIA) rule was not final on October 21, 2026 either. Its proposed rule (FR 2024-06526) leaves an agency’s own incidents under FISMA reporting to CISA, so it adds no report for the Organization’s systems.

9. Communications #

Internal status updates follow the escalation ladder above at defined intervals until closure. Only the offices named under the incident response structure release external communications, including those to Congress, the media, and affected individuals. The CISO’s office keeps the contact rosters as a controlled appendix and verifies them every quarter.

10. Testing and Maintenance #

The incident response team exercises this plan at least [IR-03 parameter 1 — to be defined]: a tabletop at a minimum, and a functional exercise for scenarios that involve High Value Assets. Each exercise includes a practice report through the CISA reporting steps, stopping before submission. The ISSO tracks after-action items as POA&M items. The CISO reviews and updates the plan every year, and after any significant incident, organizational change, or change to federal reporting requirements.

Appendix A: Response Steps for Common Incidents #

Phishing.

1. The SOC collects the message headers and blocks the sender’s indicators.
2. The SOC finds the users who opened a link or attachment, and resets any exposed credentials.
3. The SOC reports to CISA as an incident only a phishing message that led to a compromise.
4. The SOC sends other phishing messages and their indicators to CISA through CISA’s phishing reporting channel.

Lost or stolen device.

1. The user reports the loss at once to the service desk and the SOC.
2. The SOC wipes the device remotely and disables the accounts and certificates it holds.
3. If the device was not encrypted, or held PII, the SOC treats the loss as an incident and a possible breach.
4. If the device was encrypted and shows no sign of misuse, the SOC does not report it to CISA.

Ransomware.

1. The SOC isolates the affected systems and preserves evidence under Evidence Handling in this plan.
2. The SOC Manager reports the incident to CISA within 1 hour of identifying it and answers the form’s questions about any ransom demand.
3. The CISO refers the incident to law enforcement through General Counsel.
4. If email or chat is affected, the incident response team uses the out-of-band contact list and channel it keeps for this case.
5. System Owners restore from backups the attacker could not reach, after the SOC confirms the backups are clean, in the order the contingency plans set.
6. The CISO starts the major incident review.

Each year, the CISO checks the Organization’s readiness against the NIST ransomware profile, NIST IR 8374 Rev. 1, Ransomware Risk Management: A CSF 2.0 Community Profile. The check covers phishing training, patching, allowing only approved software, multi-factor authentication and least privilege, isolated and tested backups, and a current contact list that includes law enforcement and legal counsel. The CISO records each gap in the CSF Organizational Profile and tracks it as a POA&M item. (NIST IR 8374 Rev. 1)

Evidence: the incident ticket, the remote wipe record, and the report to CISA when one is required.

References #

These are the sources this document cites, with a link to each official text.

• 32 CFR Part 2002: Controlled Unclassified Information, September 14, 2016.
• 36 CFR Part 1230: Unlawful or Accidental Removal, Defacing, Alteration, or Destruction of Records, March 30, 2018.
• CISA Incident Reporting System: Incident Reporting Form (CISA Services Portal): Incident Reporting Form (CISA Services Portal), August 29, 2024.
• Cyber Incident Reporting for Critical Infrastructure Act of 2022 (CIRCIA) (6 U.S.C. §§ 681-681g), March 15, 2022.
• Executive Order 14028: Improving the Nation’s Cybersecurity, May 12, 2021.
• FAR: Revolutionary Federal Acquisition Regulation Overhaul — Parts 1, 2, 4, 33, 39, 40, and 53 (proposed rule), June 23, 2026.
• Federal Acquisition Regulation: Cyber Threat and Incident Reporting and Information Sharing (proposed rule, FAR Case 2021-017), October 3, 2023.
• Federal Incident Notification Guidelines, April 1, 2017.
• Federal Information Security Modernization Act of 2014 (44 U.S.C. § 3551 et seq.), December 18, 2014.
• FR 2024-06526: Cyber Incident Reporting for Critical Infrastructure Act (CIRCIA) Reporting Requirements (proposed rule), April 4, 2024.
• NIST Cybersecurity Framework 2.0, February 26, 2024.
• NIST IR 8374 Rev. 1: Ransomware Risk Management: A CSF 2.0 Community Profile, June 11, 2026.
• NIST SP 800-61 Rev. 3: Incident Response Recommendations and Considerations for Cybersecurity Risk Management, April 2025.
• NIST SP 800-86: Guide to Integrating Forensic Techniques into Incident Response, August 2006.
• OMB M-19-03: Strengthening the Cybersecurity of Federal Agencies by Enhancing the High Value Asset Program, December 26, 2018.
• OMB M-22-01: Improving Detection of Cybersecurity Vulnerabilities and Incidents on Federal Government Systems through Endpoint Detection and Response (EDR), October 8, 2021.
• OMB M-25-04: FY 2025 Guidance on Federal Information Security and Privacy Management Requirements, January 15, 2025.
• OMB M-26-14: Ensuring Effective and Efficient Agency Logging and Network Visibility to Defend Against Evolving Cyber Threats, May 22, 2026.