Incident Response Policy

Approval #

Revision History #

Review cycle: Every year, under the Policy and Procedure Management Policy.

1. Purpose and Scope #

In this policy, the CISO sets the Organization’s requirements for incident response in every information system that the Organization operates or that others operate for it. The CISO issues the policy under these authorities:

• The Federal Information Security Modernization Act (FISMA) of 2014.
• National Institute of Standards and Technology (NIST) Special Publication 800-53 Revision 5.
• Office of Management and Budget (OMB) Circular A-130, Managing Information as a Strategic Resource.
• The OMB memoranda and Executive Orders that apply.

The Organization also uses this policy to carry out the NIST Cybersecurity Framework (CSF) 2.0, which Executive Order 13800 and OMB Circular A-130 require.

1.1 Program Objectives #

This policy covers how the Organization prepares for, detects, handles, and reports security incidents. Incidents will happen, and the Organization must manage each one. The Organization must meet the FISMA and OMB M-25-04 incident requirements. It must keep a trained and exercised response capability, report to the Cybersecurity and Infrastructure Security Agency (CISA) through the CISA Incident Reporting Form within 1 hour, and define severity levels and escalation paths. It must coordinate with counsel and privacy officials on incidents that involve personally identifiable information (PII). After every significant incident, the Organization must run a lessons-learned review and turn the results into measurable control improvements.

This policy applies to everyone in the program: executives who accept risk, System Owners who fund the controls, security officers who run them, and every user. By following it, the Organization meets its FISMA obligations for this control family and shows its maturity in the annual Inspector General (IG) FISMA evaluation. The Organization’s target is Level 4 (Managed and Measurable). The CISO tracks progress with the performance measures and the improvement commitments later in this policy.

1.2 CSF 2.0 Alignment #

The controls in this policy support these CSF 2.0 categories:

• DE.CM — Continuous Monitoring (Detect function)
• DE.AE — Adverse Event Analysis (Detect function)
• RS.MA — Incident Management (Respond function)
• RS.AN — Incident Analysis (Respond function)
• RS.CO — Incident Response Reporting and Communication (Respond function)
• RS.MI — Incident Mitigation (Respond function)
• RC.RP — Recovery Plan Execution (Recover function)
• RC.CO — Recovery Communication (Recover function)

These categories fall under the Detect, Recover, Respond function(s) of CSF 2.0. The Organization’s CSF 2.0 Profile maps each category to the NIST SP 800-53 controls in this policy.

This policy covers every incident response control in the low baseline of FIPS 200 and NIST SP 800-53B:

• IR-01 — Policy and Procedures
• IR-02 — Incident Response Training
• IR-02(3) — Breach
• IR-03 — Incident Response Testing
• IR-04 — Incident Handling
• IR-05 — Incident Monitoring
• IR-06 — Incident Reporting
• IR-07 — Incident Response Assistance
• IR-08 — Incident Response Plan
• IR-08(1) — Breaches

2. Authority and References #

The CISO issues this policy under the authority of:

• FISMA 2014 (44 U.S.C. § 3551 et seq.) — Statutory mandate for federal information security programs
• NIST SP 800-53 Rev 5 — Security and Privacy Controls for Information Systems and Organizations
• OMB Circular A-130 — Managing Information as a Strategic Resource
• OMB Circular A-123 — Management’s Responsibility for Internal Control (revised March 10, 2026)
• NIST CSF 2.0 — Cybersecurity Framework (mandated by EO 13800 and OMB Circular A-130)
• EO 13800 — Strengthening the Cybersecurity of Federal Networks and Critical Infrastructure
• OMB M-26-14: Ensuring Effective and Efficient Agency Logging and Network Visibility to Defend Against Evolving Cyber Threats, May 22, 2026.
• OMB M-17-12: Preparing for and Responding to a Breach of Personally Identifiable Information, May 22, 2017.
• Executive Order 14028: Improving the Nation’s Cybersecurity, May 12, 2021.

2.1 Derived Governance Requirements #

The requirements below come from federal governance sources and apply to the IR control family. They add to the NIST SP 800-53 control requirements in the Policy section.

OMB M-22-01: Improving Detection of Cybersecurity Vulnerabilities and Incidents through EDR

• The organization must collaborate with CISA on EDR deployment to enable government-wide incident response, including sharing endpoint data for threat hunting and coordinated response to advanced threats. (OMB M-22-01, §3)

NIST SP 800-61 Rev 3: Incident Response Recommendations and Considerations for Cybersecurity Risk Management

• The organization must organize incident response around the CSF 2.0 Functions (Govern, Identify, Protect, Detect, Respond, and Recover) within cybersecurity risk management. (NIST SP 800-61r3, §2)
• The organization must conduct post-incident lessons-learned reviews after significant incidents, documenting root cause, impact, remediation actions, and process improvements. Lessons learned must be shared across the organization. (NIST SP 800-61r3, §3.4)

CISA: Federal Incident Notification Guidelines

• The organization must report each information security incident that potentially compromises the confidentiality, integrity, or availability of a federal information system to CISA within one hour of identification by the organization’s top-level incident response team, SOC, or IT department, with the data elements CISA requires. Deadline: 1 hour from identification. (CISA Federal Incident Notification Guidelines; 44 U.S.C. § 3554(b)(7)(C)(ii))
• The organization must include in each incident report to CISA the functional impact, information impact, and recoverability, and the attack vectors when they are known. (CISA Federal Incident Notification Guidelines, Submitting Incident Notifications)

FISMA 2014: Federal Information Security Modernization Act of 2014

• The organization must maintain procedures for detecting, reporting, and responding to security incidents that mitigate risk before substantial damage is done and that include notifying and consulting with CISA’s federal information security incident center. (44 U.S.C. § 3554(b)(7))
• The organization must notify the appropriate congressional committees of a major incident within 7 days after there is a reasonable basis to conclude that it occurred. Deadline: Within 7 days. (44 U.S.C. § 3554(b)(7)(C)(iii)(III))

OMB M-26-14: Ensuring Effective and Efficient Agency Logging and Network Visibility to Defend Against Evolving Cyber Threats

• The organization must provide logs and other relevant data to CISA and the FBI upon request, in a format and by a means agreed with them, in the event of a known or suspected compromise of federal networks, and provide access within the requested timeframes to the greatest extent practicable, consistent with applicable law. (OMB M-26-14, Log Access Requirements)

OMB M-25-04: FY 2025 Guidance on Federal Information Security and Privacy Management Requirements

• The organization must assess each incident against OMB’s major incident definition, which includes any breach of personally identifiable information on 100,000 or more people. (OMB M-25-04, Major Incident Definition)
• The organization must report a major incident to CISA and the OMB Office of the Federal CIO within 1 hour of determining that it occurred. Deadline: Within 1 hour of the determination. (OMB M-25-04, Reporting Major Incidents)
• The organization must report to CISA an event that has been under investigation for 72 hours without a finding of its root cause or nature (malicious, suspicious, or benign). Deadline: At 72 hours of investigation. (OMB M-25-04, section X, Incident Reporting)
• The organization must notify the appropriate congressional committees and the Office of Inspector General of a major incident no later than 7 days after the agency has a reasonable basis to conclude it occurred, and send Congress updates as new facts are found. Deadline: Within 7 days of the determination. (OMB M-25-04, section X, Reporting to Congress and Inspectors General; 44 U.S.C. § 3554(b)(7)(C)(iii)(III))
• The organization must for a breach that is a major incident, send Congress a further report within 30 days of discovering the breach, covering how it happened, the number of people affected and their risk of harm, and when they will be notified. Deadline: Within 30 days of discovering the breach. (OMB M-25-04, section X, Reporting to Congress and Inspectors General; 44 U.S.C. § 3553 note)

NARA GRS 3.2: General Records Schedule 3.2: Information Systems Security Records

• The organization must keep computer security incident handling, reporting, and follow-up records under NARA General Records Schedule 3.2, and destroy them only when the schedule allows. (NARA GRS 3.2, item 020; 44 U.S.C. § 3303a)

CISA Incident Reporting System: Incident Reporting Form (CISA Services Portal)

• The organization must report incidents to CISA through the CISA Incident Reporting Form on the CISA Services Portal, and record the CISA incident ID the form returns in the incident record. Deadline: Within 1 hour of identification. (CISA Incident Reporting Form (https://myservices.cisa.gov/irf); CISA Federal Incident Notification Guidelines)

OMB M-17-12: Preparing for and Responding to a Breach of Personally Identifiable Information

• The organization must have the principal security operations center report each breach to CISA under the incident notification guidelines, and report that a breach is a major incident as soon as there is a reasonable basis to conclude it is one. (OMB M-17-12, section VII.D.1)
• The organization must name in the breach response plan the officials who notify law enforcement, the Office of Inspector General, and General Counsel, and report to law enforcement promptly when a breach warrants it, even before the breach is confirmed. (OMB M-17-12, section VII.D.2)

36 CFR Part 1230: Unlawful or Accidental Removal, Defacing, Alteration, or Destruction of Records

• The organization must report promptly to NARA any unlawful or accidental removal, defacing, alteration, or destruction of federal records, with a description of the records, the office, the circumstances, the safeguards put in place, and any recovery. Deadline: Promptly. (36 CFR 1230.14)

FedRAMP CR26: FedRAMP Consolidated Rules for 2026 (including 20x Key Security Indicators)

• The organization must give each FedRAMP certified cloud service provider the Organization’s incident reporting procedure, so the provider can send its initial, ongoing, and final incident reports to the Organization. (FedRAMP Consolidated Rules for 2026, IEC-CSO-IIR, IEC-CSO-OIR, IEC-CSO-FIR)

NIST SP 800-86: Guide to Integrating Forensic Techniques into Incident Response

• The organization should keep a documented chain of custody for incident evidence that records who collected each item, when, where it was stored, and who accessed it. (NIST SP 800-86, §3; NIST SP 800-61r3)

3. Policy #

The Organization must implement and maintain its incident response controls to meet the following requirements:

IR-01 — Policy and Procedures #

Baselines: Low / Moderate / High / Privacy CSF 2.0: DE.CM (Continuous Monitoring), RS.MA (Incident Management)

Requirement:

1. Develop, document, and disseminate to [Assignment: organization-defined personnel or roles — to be defined]:

1. [Selection (one or more): organization-level; mission/business process-level; system-level — to be defined] incident response policy that:

1. Addresses purpose, scope, roles, responsibilities, management commitment, coordination among organizational entities, and compliance; and
2. Is consistent with applicable laws, executive orders, directives, regulations, policies, standards, and guidelines; and

2. Procedures to facilitate the implementation of the incident response policy and the associated incident response controls;

2. Designate an [Assignment: organization-defined official — to be defined] to manage the development, documentation, and dissemination of the incident response policy and procedures; and
3. Review and update the current incident response:

1. Policy at least every 3 years and following significant changes; and
2. Procedures at least annually and following [Assignment: organization-defined events — to be defined].

Implementation guidance:

The Organization must keep an incident response policy and the procedures that put it into practice. The CISO owns both documents. The CISO develops them, documents them, and distributes them to the Authorizing Official, System Owners, Information System Security Officers (ISSOs), and other key stakeholders when they are issued and after every revision. The policy states its purpose and scope, assigns roles and responsibilities, records management’s commitment, and sets expectations for coordination and compliance. It follows the response lifecycle that NIST SP 800-61r3 describes. The policy must stay consistent with the laws, directives, and standards that apply to the Organization. The CISO reviews and updates the policy and the procedures every year, and sooner when a newly identified threat or attack method changes what the documents must say.

IR-02 — Incident Response Training #

Baselines: Low / Moderate / High / Privacy CSF 2.0: DE.CM (Continuous Monitoring), RS.MA (Incident Management)

Requirement:

1. Provide incident response training to system users consistent with assigned roles and responsibilities:

1. Within ten (10) days for privileged users, thirty (30) days for Incident Response roles of assuming an incident response role or responsibility or acquiring system access;
2. When required by system changes; and
3. at least annually thereafter; and

2. Review and update incident response training content at least annually and following [Assignment: organization-defined events — to be defined].

Implementation guidance:

All personnel must complete incident response training that matches their assigned roles. They must complete it within 10 days of taking on an incident response role or gaining system access, again when a system change alters what response requires, and every year after that. General users learn to recognize and report suspicious activity. Administrators and responders learn the handling steps their roles require. The CISO owns the curriculum and must review and update its content every year and when new adversary tactics and tools appear. Supervisors must make sure their personnel complete training on schedule.

IR-02(3) — Breach #

Baselines: Privacy

Requirement:

Provide incident response training on how to identify and respond to a breach, including the organization’s process for reporting a breach.

Implementation guidance:

The CISO and the Senior Agency Official for Privacy (SAOP) must include breach content in incident response training. The training must teach personnel how to recognize a breach of personally identifiable information (PII) on paper, in conversation, or in electronic form. It must teach them to report every suspected or confirmed breach to the Security Operations Center (SOC) as soon as they notice it. The training must explain how the SOC records the breach in the ticketing system, alerts the Privacy Officer, and notifies CISA within one hour of identification. Personnel with incident response roles must also take part in a tabletop exercise that simulates a breach.

IR-03 — Incident Response Testing #

Baselines: Moderate / High / Privacy CSF 2.0: DE.CM (Continuous Monitoring), RS.MA (Incident Management)

Requirement:

Test the effectiveness of the incident response capability for the system [Assignment: organization-defined frequency — to be defined] using the following tests: [Assignment: organization-defined tests — to be defined].

Implementation guidance:

System Owners must test the incident response capability of each system [IR-03 parameter 1 — to be defined]. The CISO must build each test on a likely threat scenario, such as ransomware, credential compromise, or a breach of PII. Low- and moderate-impact systems run tabletop exercises. High-impact systems and High Value Assets (HVAs) run functional exercises, in which responders carry out the response steps on the systems and tools they would use. A System Owner may combine the test with the system’s contingency plan test. The combined test must still exercise detection, reporting to CISA, containment, and the major incident and breach decisions. Tests follow the exercise methods in NIST SP 800-84. The CISO must approve the [IR-03 parameter 1 — to be defined] test schedule. System Owners must run the tests for their systems and must record every finding as a corrective action with an owner and a due date.

IR-04 — Incident Handling #

Baselines: Low / Moderate / High / Privacy CSF 2.0: DE.CM (Continuous Monitoring), DE.AE (Adverse Event Analysis), RS.MA (Incident Management), RS.AN (Incident Analysis)

Requirement:

1. Implement an incident handling capability for incidents that is consistent with the incident response plan and includes preparation, detection and analysis, containment, eradication, and recovery;
2. Coordinate incident handling activities with contingency planning activities;
3. Incorporate lessons learned from ongoing incident handling activities into incident response procedures, training, and testing, and implement the resulting changes accordingly; and
4. Ensure the rigor, intensity, scope, and results of incident handling activities are comparable and predictable across the organization.

Implementation guidance:

The Organization must operate an incident handling capability that carries out the incident response plan through every phase: preparation, detection and analysis, containment, eradication, and recovery. The capability follows the lifecycle that NIST SP 800-61r3 defines. First responders must isolate an affected system from the network but must not log in, reboot, or power it off until the Incident Response Team approves. The SOC must keep a chain-of-custody record for each item of evidence, following NIST SP 800-86. When criminal or civil action is possible, the CISO must bring in General Counsel before anyone collects evidence. The CISO must coordinate incident handling with contingency planning so that recovery decisions use both. The CISO must feed lessons from incident handling into procedures, training, and testing, and must make sure the resulting changes are put in place. The CISO must apply the same rigor to incidents of the same severity, wherever they occur. The CISO must bring the SAOP into the response from the start of any breach that involves PII.

IR-05 — Incident Monitoring #

Baselines: Low / Moderate / High / Privacy CSF 2.0: DE.CM (Continuous Monitoring), DE.AE (Adverse Event Analysis), RS.MA (Incident Management), RS.AN (Incident Analysis)

Requirement:

Track and document incidents.

Implementation guidance:

The SOC must track and document every incident from the first report to closure. The record holds its status, the actions taken, the evidence gathered, and the details a later investigation or trend analysis would need. The ticketing system is the system of record for incident documentation. The incident records that the security information and event management (SIEM) system generates feed it. The SOC must update each record while the incident runs, so that no one has to reconstruct it afterward. The record must show what happened, who acted, and when. The SOC must keep each incident record, its evidence, and its follow-up documents for 3 years after all follow-up actions are complete, as National Archives and Records Administration (NARA) General Records Schedule (GRS) 3.2 requires. A legal hold extends that period. Audit logs tied to an incident stay with the case file for the same period. The CISO must review incident trends and use them to direct the program.

IR-06 — Incident Reporting #

Baselines: Low / Moderate / High / Privacy CSF 2.0: DE.CM (Continuous Monitoring), DE.AE (Adverse Event Analysis), RS.MA (Incident Management), RS.AN (Incident Analysis)

Requirement:

1. Require personnel to report suspected incidents to the organizational incident response capability within 1 hour; and
2. Report incident information to [Assignment: organization-defined authorities — to be defined].

Implementation guidance:

All personnel must report a suspected incident to the Organization IT Service Desk or the SOC within 1 hour of discovery. The service desk records each report in the ticketing system and routes it to the SOC without delay. The SOC Manager must report to CISA each incident that may have compromised the confidentiality, integrity, or availability of federal information or a federal information system. The report must reach CISA within 1 hour of the time the SOC identifies the incident, as CISA’s Federal Incident Notification Guidelines set. The SOC Manager must submit it through the CISA Incident Reporting Form and record the CISA incident ID in the incident ticket. Each CISA report must classify the incident by functional impact, information impact, recoverability, and attack vector, in CISA’s current terms. The SOC Manager must update the report as facts change and when the incident closes. The CISO must promptly notify the Office of Inspector General of any incident that may involve criminal activity, misuse by an authorized user, or theft of equipment. The CISO must coordinate any law enforcement referral with General Counsel. The CISO must also inform the insider threat program of incidents that involve a trusted insider, and the Contracting Officer of incidents that involve a contractor or a supplier’s product.

IR-07 — Incident Response Assistance #

Baselines: Low / Moderate / High / Privacy CSF 2.0: DE.CM (Continuous Monitoring), RS.MA (Incident Management), RS.CO (Incident Response Reporting and Communication), RS.MI (Incident Mitigation)

Requirement:

Provide an incident response support resource, integral to the organizational incident response capability, that offers advice and assistance to users of the system for the handling and reporting of incidents.

Implementation guidance:

The Organization must provide an incident response support resource, as part of the response capability, that gives system users advice and help with handling and reporting incidents. Users can ask the service desk about suspicious activity before they are sure it is an incident. The Organization IT Service Desk is the first point of contact. The ticketing system holds the tickets behind it. The SOC provides the specialist help behind the service desk, including access to forensics support when an incident requires it. The CISO must keep the support resource staffed, reachable, and known to the workforce.

IR-08 — Incident Response Plan #

Baselines: Low / Moderate / High / Privacy CSF 2.0: DE.CM (Continuous Monitoring), DE.AE (Adverse Event Analysis), RS.MA (Incident Management), RS.CO (Incident Response Reporting and Communication)

Requirement:

1. Develop an incident response plan that:

1. Provides the organization with a roadmap for implementing its incident response capability;
2. Describes the structure and organization of the incident response capability;
3. Provides a high-level approach for how the incident response capability fits into the overall organization;
4. Meets the unique requirements of the organization, which relate to mission, size, structure, and functions;
5. Defines reportable incidents;
6. Provides metrics for measuring the incident response capability within the organization;
7. Defines the resources and management support needed to effectively maintain and mature an incident response capability;
8. Addresses the sharing of incident information;
9. Is reviewed and approved by [Assignment: organization-defined personnel or roles — to be defined] at least annually; and
10. Explicitly designates responsibility for incident response to [Assignment: organization-defined entities, personnel, or roles — to be defined].

2. Distribute copies of the incident response plan to see additional FedRAMP Requirements and Guidance;
3. Update the incident response plan to address system and organizational changes or problems encountered during plan implementation, execution, or testing;
4. Communicate incident response plan changes to [Assignment: organization-defined incident response personnel (identified by name and/or by role) and organizational elements — to be defined]; and
5. Protect the incident response plan from unauthorized disclosure and modification.

Implementation guidance:

The Organization must keep an incident response plan. The plan describes the structure and organization of the incident response capability and how the capability fits the Organization’s mission, size, and functions. It defines which incidents are reportable and the metrics that measure the capability. It states the resources and management support the capability needs to mature, and how the Organization shares incident information. The CISO must assign incident response responsibility in the plan to the System Owner, ISSO, SOC Manager, and CISO. The CISO must review and approve the plan at least every year and after any major incident. The CISO’s office must send copies to all members of the computer emergency response team (CERT), senior executives, the Chief Information Officer (CIO), the CISO, ISSOs, System Owners, and Information Owners. The CISO’s office must tell the same people about changes. The CISO’s office must protect the plan from unauthorized disclosure and modification.

IR-08(1) — Breaches #

Baselines: Privacy

Requirement:

Include the following in the Incident Response Plan for breaches involving personally identifiable information: (a) A process to determine if notice to individuals or other organizations, including oversight organizations, is needed; (b) An assessment process to determine the extent of the harm, embarrassment, inconvenience, or unfairness to affected individuals and any mechanisms to mitigate such harms; and (c) Identification of applicable privacy requirements.

Implementation guidance:

The CISO and the Senior Agency Official for Privacy (SAOP) must include a breach section in the Incident Response Plan for breaches of personally identifiable information (PII). The section must state who decides whether to notify affected individuals, other organizations, and oversight bodies, and how that decision is made. It must set out how the SAOP rates the risk of harm to affected individuals and chooses steps to reduce that harm. It must also list the privacy laws, regulations, and policies that apply to each type of PII the Organization holds. General Counsel must review the breach section before the CIO approves the plan.

Incident Reporting #

This section says who reports an incident, to whom, and how fast. The Incident Response Plan has the full table of reports, and the Incident Response procedure has the steps. The incident ticket in the ticketing system is the record of each incident and each report. Federal agencies report incidents to CISA through the CISA Incident Reporting Form at https://myservices.cisa.gov/irf.

• Every employee and contractor must report a suspected incident or breach to the Service Desk or the Security Operations Center at once, whatever the medium.
• The Security Operations Center must open an incident ticket in the ticketing system for each report. The ticket is the record of the incident from the first report to closure.
• The Security Operations Center must use the SIEM system to detect and correlate events, and must link the alerts behind each incident to its ticket.
• The SOC Manager must report to CISA each incident that may have compromised the confidentiality, integrity, or availability of federal information or a federal information system.
• The SOC Manager must send that report within 1 hour of the time the Security Operations Center identifies the incident. The SOC Manager must not wait for complete facts.
• The SOC Manager must send each report through the CISA Incident Reporting Form. When the form cannot be used, the SOC Manager must call CISA Central at (888) 282-0870 within the same hour.
• The SOC Manager must record the CISA incident ID in the ticket. The SOC Manager must update the CISA report as facts change and when the incident closes.
• The SOC Manager must also report to CISA any event that is still under investigation after 72 hours with no finding of its cause or nature.
• The CISO must tell the CIO and the agency head without delay of each incident CISA rates High (Orange) or above, and of each possible major incident.
• The Contracting Officer must put terms in each contract that handles the Organization’s information that require the contractor to report incidents to the Security Operations Center within 8 hours of discovery.
• The CISO must give each cloud service provider the Organization’s incident reporting contact. Providers report Federal Risk and Authorization Management Program (FedRAMP) Reportable Incidents under the FedRAMP incident rules.
• The Agency Records Officer must report promptly to the National Archives and Records Administration (NARA) any unauthorized destruction, removal, or change of federal records (36 CFR 1230.14).
• The Controlled Unclassified Information (CUI) Program Manager must handle an incident that involves CUI under the misuse reporting process the CUI Senior Agency Official sets (32 CFR 2002.54).
• The SOC Manager may close an incident ticket only after the final CISA update, the required notices, and the lessons learned are recorded in it.
• The ISSO must record each corrective action for a system weakness as a plan of action and milestones (POA&M) item in the governance, risk, and compliance (GRC) system. The ticket names the POA&M item.

Source: CISA Federal Incident Notification Guidelines (effective April 1, 2017; checked October 21, 2026); CISA Incident Reporting Form at https://myservices.cisa.gov/irf (OMB control number 1670-0037; checked October 21, 2026); OMB M-25-04, section X; OMB M-17-12; 44 U.S.C. 3554(b)(7)(C)(ii); FedRAMP Consolidated Rules for 2026, Incident Evaluation and Communication; 36 CFR 1230.14; 32 CFR 2002.16(a)(6) and 2002.54.

Major Incidents, Referrals, and Evidence #

A major incident is an incident or breach that meets the definition in the current OMB guidance on federal information security and privacy management. That guidance is OMB M-25-04. The definition includes unauthorized access to the PII of 100,000 or more people. It also includes any incident CISA scores at level 3 (orange) or higher. The routine report to CISA within 1 hour is under “Incident Reporting”.

• The CISO must lead the major incident determination with the CIO and the System Owner. For a breach, the Senior Agency Official for Privacy (SAOP) must lead it with the CISO.
• The CISO must record each determination and its date in the incident ticket in the ticketing system.
• The CIO must tell the agency head of each major incident at once.
• The CISO must report a major incident to CISA and to the OMB Office of the Federal Chief Information Officer within 1 hour of the determination, contacting each one directly.
• The legislative affairs official must notify the appropriate congressional committees within 7 days of the determination. The CISO must notify the Inspector General within the same 7 days.
• The legislative affairs official must send Congress updates on a major incident as new facts are found.
• For a breach that is a major incident, the legislative affairs official and the SAOP must send Congress a further report within 30 days of discovering the breach.
• The CISO must make the referrals in the Incident Response procedure to the Inspector General, law enforcement, the insider threat program, and the Contracting Officer.
• No one may log in to, reboot, or power off an affected system until the Incident Response Team approves.
• The Security Operations Center must keep incident records for 3 years after all follow-up actions are complete, or longer under a legal hold.
• The CISO must count the incidents and breaches reported to CISA, and describe each major incident, for the agency head’s annual FISMA letter.

Source: OMB M-25-04, Fiscal Year 2025 Guidance on Federal Information Security and Privacy Management Requirements (January 2025; still the current FISMA guidance on October 21, 2026), section X; 44 U.S.C. 3554(b)(7)(C)(iii)(III) and 44 U.S.C. 3553 note; OMB M-17-12, section VII.D; CISA Federal Incident Notification Guidelines; CISA Incident Reporting Form; NIST SP 800-61 Rev. 3; NIST SP 800-86; NARA General Records Schedule 3.2.

Related Required Processes #

• A contractor reports a CUI incident on its own system to the Contracting Officer and the Security Operations Center within 8 hours of discovery, as its contract requires. The proposed Federal Acquisition Regulation (FAR) rule on CUI would allow 72 hours of discovery; the Organization’s contracts set the shorter time. The steps are in the System and Services Acquisition procedure.

4. Roles and Responsibilities #

These roles apply across this policy. Each System Owner records the system-specific assignments in the system’s System Security and Privacy Plan (SSPP).

5. Performance Measurement #

The CISO manages this policy with the measures below, which meet the IG FISMA maturity model’s Level 4 (Managed and Measurable) criteria. The CISO collects and trends the measures and reports them to the CIO and the Authorizing Officials. When a measure moves away from its target, the CISO starts corrective action through the POA&M process.

The CISO keeps the measurement data for the annual IG FISMA evaluation and for trend analysis across reporting periods.

6. Compliance and Enforcement #

Every employee, contractor, and other user with access to an information system that the Organization operates, or that others operate for it, must comply with this policy. The CISO records each case of non-compliance as a finding in the Organization’s continuous monitoring program. The ISSO tracks the finding to resolution as a POA&M item, as OMB Circular A-130 and NIST SP 800-37 Rev. 2 describe.

A violation of this policy can lead to suspension of system access, withdrawal of the system’s authorization to operate (ATO), and administrative or disciplinary action under applicable law, regulation, and human capital policy.

The Inspector General assesses the maturity of incident response controls each year through the IG FISMA reporting metrics. The target maturity level for this policy area is Level 4: Managed and Measurable.

7. Continuous Improvement #

Level 4 is the minimum the Organization aims for. To meet the IG FISMA maturity model’s Level 5 (Optimized) criteria, the CISO improves incident response through these commitments:

1. Review the performance measures in this document at least annually; where a measure has met its target for four consecutive periods, tighten the target or replace the measure with a more demanding indicator.
2. Conduct an annual effectiveness review of this policy area using IG FISMA audit results, assessment findings, incident data, and metric trends; document resulting changes in the revision history.
3. Feed lessons learned from incidents, assessments, and exercises into updates of this document and its procedures within 90 days of the triggering event.
4. Benchmark against the IG FISMA maturity model annually and maintain a documented plan to reach and sustain Level 4 (Managed and Measurable), with a roadmap toward Level 5 (Optimized).
5. Automate containment playbooks (SOAR) for common incident classes and measure containment-time improvement.
6. Exercise cross-organizational scenarios (supply chain, HVA compromise) and track corrective actions to closure.

8. Exceptions and Waivers #

The CISO may grant an exception to this policy only when compliance is not technically feasible or would harm the mission. To request one, the System Owner sends the CISO a written request that includes:

1. A business justification and a risk assessment.
2. Compensating controls that reduce the risk the exception creates, following the NIST SP 800-53B guidance on compensating controls.
3. A proposed end date no more than one year away.

The CISO decides each request in coordination with the Authorizing Official. An exception that involves privacy risk also needs the agreement of the Senior Agency Official for Privacy (SAOP). The CISO re-evaluates each exception when it comes up for renewal. The System Owner records each approved exception in the system’s SSPP, and the ISSO tracks it as a POA&M item.

9. References #

These are the sources this document cites, with a link to each official text.

• 32 CFR Part 2002: Controlled Unclassified Information, September 14, 2016.
• 36 CFR Part 1230: Unlawful or Accidental Removal, Defacing, Alteration, or Destruction of Records, March 30, 2018.
• CISA Incident Reporting System: Incident Reporting Form (CISA Services Portal): Incident Reporting Form (CISA Services Portal), August 29, 2024.
• Examination by Archivist of lists and schedules of records lacking preservation value; disposal prohibited (44 U.S.C. § 3303a).
• Executive Order 13800: Strengthening the Cybersecurity of Federal Networks and Critical Infrastructure, May 11, 2017.
• Executive Order 14028: Improving the Nation’s Cybersecurity, May 12, 2021.
• Federal Incident Notification Guidelines, April 1, 2017.
• Federal Information Security Modernization Act of 2014 (44 U.S.C. § 3551 et seq.), December 18, 2014.
• FedRAMP Consolidated Rules for 2026 (including 20x Key Security Indicators), June 24, 2026.
• FIPS 200: Minimum Security Requirements for Federal Information and Information Systems, March 2006.
• NARA General Records Schedule 3.2: Information Systems Security Records.
• NIST Cybersecurity Framework 2.0, February 26, 2024.
• NIST SP 800-37 Rev. 2: Risk Management Framework for Information Systems and Organizations, December 2018.
• NIST SP 800-53 Rev. 5: Security and Privacy Controls for Information Systems and Organizations, September 2020.
• NIST SP 800-53B: Control Baselines for Information Systems and Organizations, September 2020.
• NIST SP 800-61 Rev. 3: Incident Response Recommendations and Considerations for Cybersecurity Risk Management, April 2025.
• NIST SP 800-84: Guide to Test, Training, and Exercise Programs for IT Plans and Capabilities, September 2006.
• NIST SP 800-86: Guide to Integrating Forensic Techniques into Incident Response, August 2006.
• OMB Circular A-123: Management’s Responsibility for Internal Control, March 10, 2026.
• OMB Circular A-130: Managing Information as a Strategic Resource, July 28, 2016.
• OMB M-17-12: Preparing for and Responding to a Breach of Personally Identifiable Information, May 22, 2017.
• OMB M-22-01: Improving Detection of Cybersecurity Vulnerabilities and Incidents on Federal Government Systems through Endpoint Detection and Response (EDR), October 8, 2021.
• OMB M-25-04: FY 2025 Guidance on Federal Information Security and Privacy Management Requirements, January 15, 2025.
• OMB M-26-14: Ensuring Effective and Efficient Agency Logging and Network Visibility to Defend Against Evolving Cyber Threats, May 22, 2026.