Incident Response Procedure

Approval #

Revision History #

Review cycle: Every year, under the Policy and Procedure Management Policy.

1. Purpose #

The people named in this procedure use it to carry out the IR control family policy (POL-IR). It covers every control in the incident response family. The steps, the people responsible, and the evidence below show how the Organization meets those National Institute of Standards and Technology (NIST) SP 800-53 Rev. 5 controls. They also support the Inspector General (IG) Federal Information Security Modernization Act (FISMA) reporting metrics.

This general procedure covers every control in the IR family. A system that departs from it, or adds to it, has its own system-specific procedure for those controls.

2. Scope #

This procedure applies to every information system that the Organization operates, or that others operate for it, under the low security baseline.

2.1 CSF 2.0 Alignment #

The steps in this procedure support these NIST Cybersecurity Framework (CSF) 2.0 categories:

• DE.CM — Continuous Monitoring (Detect function)
• DE.AE — Adverse Event Analysis (Detect function)
• RS.MA — Incident Management (Respond function)
• RS.AN — Incident Analysis (Respond function)
• RS.CO — Incident Response Reporting and Communication (Respond function)
• RS.MI — Incident Mitigation (Respond function)
• RC.RP — Recovery Plan Execution (Recover function)
• RC.CO — Recovery Communication (Recover function)

3. Controls Covered #

This procedure covers the following 10 controls in the IR family:

3.1 Derived Governance Requirements #

The requirements below come from federal governance sources and apply to the IR control family. They add to the NIST SP 800-53 control requirements that the Procedure section carries out.

OMB M-22-01: Improving Detection of Cybersecurity Vulnerabilities and Incidents through EDR

• The organization must collaborate with CISA on EDR deployment to enable government-wide incident response, including sharing endpoint data for threat hunting and coordinated response to advanced threats. (OMB M-22-01, §3)

NIST SP 800-61 Rev 3: Incident Response Recommendations and Considerations for Cybersecurity Risk Management

• The organization must organize incident response around the CSF 2.0 Functions (Govern, Identify, Protect, Detect, Respond, and Recover) within cybersecurity risk management. (NIST SP 800-61r3, §2)
• The organization must conduct post-incident lessons-learned reviews after significant incidents, documenting root cause, impact, remediation actions, and process improvements. Lessons learned must be shared across the organization. (NIST SP 800-61r3, §3.4)

CISA: Federal Incident Notification Guidelines

• The organization must report each information security incident that potentially compromises the confidentiality, integrity, or availability of a federal information system to CISA within one hour of identification by the organization’s top-level incident response team, SOC, or IT department, with the data elements CISA requires. Deadline: 1 hour from identification. (CISA Federal Incident Notification Guidelines; 44 U.S.C. § 3554(b)(7)(C)(ii))
• The organization must include in each incident report to CISA the functional impact, information impact, and recoverability, and the attack vectors when they are known. (CISA Federal Incident Notification Guidelines, Submitting Incident Notifications)

FISMA 2014: Federal Information Security Modernization Act of 2014

• The organization must maintain procedures for detecting, reporting, and responding to security incidents that mitigate risk before substantial damage is done and that include notifying and consulting with CISA’s federal information security incident center. (44 U.S.C. § 3554(b)(7))
• The organization must notify the appropriate congressional committees of a major incident within 7 days after there is a reasonable basis to conclude that it occurred. Deadline: Within 7 days. (44 U.S.C. § 3554(b)(7)(C)(iii)(III))

OMB M-26-14: Ensuring Effective and Efficient Agency Logging and Network Visibility to Defend Against Evolving Cyber Threats

• The organization must provide logs and other relevant data to CISA and the FBI upon request, in a format and by a means agreed with them, in the event of a known or suspected compromise of federal networks, and provide access within the requested timeframes to the greatest extent practicable, consistent with applicable law. (OMB M-26-14, Log Access Requirements)

OMB M-25-04: FY 2025 Guidance on Federal Information Security and Privacy Management Requirements

• The organization must assess each incident against OMB’s major incident definition, which includes any breach of personally identifiable information on 100,000 or more people. (OMB M-25-04, Major Incident Definition)
• The organization must report a major incident to CISA and the OMB Office of the Federal CIO within 1 hour of determining that it occurred. Deadline: Within 1 hour of the determination. (OMB M-25-04, Reporting Major Incidents)
• The organization must report to CISA an event that has been under investigation for 72 hours without a finding of its root cause or nature (malicious, suspicious, or benign). Deadline: At 72 hours of investigation. (OMB M-25-04, section X, Incident Reporting)
• The organization must notify the appropriate congressional committees and the Office of Inspector General of a major incident no later than 7 days after the agency has a reasonable basis to conclude it occurred, and send Congress updates as new facts are found. Deadline: Within 7 days of the determination. (OMB M-25-04, section X, Reporting to Congress and Inspectors General; 44 U.S.C. § 3554(b)(7)(C)(iii)(III))
• The organization must for a breach that is a major incident, send Congress a further report within 30 days of discovering the breach, covering how it happened, the number of people affected and their risk of harm, and when they will be notified. Deadline: Within 30 days of discovering the breach. (OMB M-25-04, section X, Reporting to Congress and Inspectors General; 44 U.S.C. § 3553 note)

NARA GRS 3.2: General Records Schedule 3.2: Information Systems Security Records

• The organization must keep computer security incident handling, reporting, and follow-up records under NARA General Records Schedule 3.2, and destroy them only when the schedule allows. (NARA GRS 3.2, item 020; 44 U.S.C. § 3303a)

CISA Incident Reporting System: Incident Reporting Form (CISA Services Portal)

• The organization must report incidents to CISA through the CISA Incident Reporting Form on the CISA Services Portal, and record the CISA incident ID the form returns in the incident record. Deadline: Within 1 hour of identification. (CISA Incident Reporting Form (https://myservices.cisa.gov/irf); CISA Federal Incident Notification Guidelines)

OMB M-17-12: Preparing for and Responding to a Breach of Personally Identifiable Information

• The organization must have the principal security operations center report each breach to CISA under the incident notification guidelines, and report that a breach is a major incident as soon as there is a reasonable basis to conclude it is one. (OMB M-17-12, section VII.D.1)
• The organization must name in the breach response plan the officials who notify law enforcement, the Office of Inspector General, and General Counsel, and report to law enforcement promptly when a breach warrants it, even before the breach is confirmed. (OMB M-17-12, section VII.D.2)

36 CFR Part 1230: Unlawful or Accidental Removal, Defacing, Alteration, or Destruction of Records

• The organization must report promptly to NARA any unlawful or accidental removal, defacing, alteration, or destruction of federal records, with a description of the records, the office, the circumstances, the safeguards put in place, and any recovery. Deadline: Promptly. (36 CFR 1230.14)

FedRAMP CR26: FedRAMP Consolidated Rules for 2026 (including 20x Key Security Indicators)

• The organization must give each FedRAMP certified cloud service provider the Organization’s incident reporting procedure, so the provider can send its initial, ongoing, and final incident reports to the Organization. (FedRAMP Consolidated Rules for 2026, IEC-CSO-IIR, IEC-CSO-OIR, IEC-CSO-FIR)

NIST SP 800-86: Guide to Integrating Forensic Techniques into Incident Response

• The organization should keep a documented chain of custody for incident evidence that records who collected each item, when, where it was stored, and who accessed it. (NIST SP 800-86, §3; NIST SP 800-61r3)

4. Procedure #

4.1 General Implementation Approach #

The Organization implements the IR controls in two ways: as organization-wide common controls that systems inherit, and as system-specific implementations where a system needs them. The control-specific procedures below cover each control in the Incident Response family.

The Common Control Provider (CCP) implements controls marked inherited for the whole Organization. The CCP and each System Owner share the work for controls marked hybrid. Each System Owner implements controls marked customer-configured for the system.

Responsible party: The Incident Response Team carries out the steps in this procedure unless a control-specific procedure names someone else. The System Owner is accountable for funding and completing the work. The CISO oversees the procedure and receives its performance measures. See the IR policy (POL-IR) for the role definitions.

4.2 Control-Specific Procedures #

IR-01 — Policy and Procedures #

Baselines: Low / Moderate / High / Privacy CSF 2.0: DE.CM (Continuous Monitoring), RS.MA (Incident Management)

1. Develop, document, and disseminate to [Assignment: organization-defined personnel or roles — to be defined]:

1. [Selection (one or more): organization-level; mission/business process-level; system-level — to be defined] incident response policy that:

1. Addresses purpose, scope, roles, responsibilities, management commitment, coordination among organizational entities, and compliance; and
2. Is consistent with applicable laws, executive orders, directives, regulations, policies, standards, and guidelines; and

2. Procedures to facilitate the implementation of the incident response policy and the associated incident response controls;

2. Designate an [Assignment: organization-defined official — to be defined] to manage the development, documentation, and dissemination of the incident response policy and procedures; and
3. Review and update the current incident response:

1. Policy at least every 3 years and following significant changes; and
2. Procedures at least annually and following [Assignment: organization-defined events — to be defined].

Procedure:

The CISO’s office keeps the master copies of POL-IR and PROC-IR and runs their review. The CISO’s office starts a revision every year, and immediately when a new attack method or adversary tactic appears that the current procedures do not cover. The Security Operations Center (SOC) observations, lessons learned from incidents, and federal advisories can each start that revision. The assigned author adds what recent incidents and exercises showed and sends the draft to the Authorizing Official, System Owners, Information System Security Officers (ISSOs), and key stakeholders for comment.

The CISO decides each comment and approves the final text. The CISO’s office publishes the documents in the policy library and sends a distribution notice to every named stakeholder. The review record in the document management system shows when the review opened, who commented, and when the CISO approved the revision.

Evidence: the version history of both documents, the comment record with each decision, the approval signatures, the distribution notices, and the review record with its dates.

IR-02 — Incident Response Training #

Baselines: Low / Moderate / High / Privacy CSF 2.0: DE.CM (Continuous Monitoring), RS.MA (Incident Management)

1. Provide incident response training to system users consistent with assigned roles and responsibilities:

1. Within ten (10) days for privileged users, thirty (30) days for Incident Response roles of assuming an incident response role or responsibility or acquiring system access;
2. When required by system changes; and
3. at least annually thereafter; and

2. Review and update incident response training content at least annually and following [Assignment: organization-defined events — to be defined].

Procedure:

A role assignment starts the training. When a person takes on an incident response role or gains system access, the learning management system (LMS) assigns the training with a 10-day completion deadline. General users complete the recognition and reporting module. SOC analysts and responders complete role-specific content on detection, containment, and evidence handling. A system change that alters response duties reopens the assignment, and the LMS assigns the yearly refresher automatically.

The CISO’s team reviews the content every year and when new adversary tactics or tools appear. The review adds lessons from incidents and exercises. The team keeps the review record and each version of the content.

Evidence: completion records in the LMS against the 10-day and yearly deadlines, the training assignment records, the content review records, and the version history of the materials.

IR-02(3) — Breach #

Baselines: Privacy

Provide incident response training on how to identify and respond to a breach, including the organization’s process for reporting a breach.

Procedure:

The CISO’s staff and the Privacy Officer update the breach portion of the incident response training. The Senior Agency Official for Privacy (SAOP) approves the content before release. The Privacy Officer delivers the training to personnel with incident response roles and records attendance.

The CISO and the Privacy Officer run a breach tabletop exercise with the SOC, selected System Owners, and General Counsel. Participants practice opening a breach ticket in the ticketing system, alerting the Privacy Officer, and preparing the Cybersecurity and Infrastructure Security Agency (CISA) notice. After the exercise, the CISO writes an after-action report. The CISO assigns each improvement to an owner, and the Privacy Officer updates the training to match.

Evidence: the approved training content, the attendance records, the exercise scenario, the practice tickets in the ticketing system, and the after-action report with assigned improvements.

IR-03 — Incident Response Testing #

Baselines: Moderate / High / Privacy CSF 2.0: DE.CM (Continuous Monitoring), RS.MA (Incident Management)

Test the effectiveness of the incident response capability for the system [Assignment: organization-defined frequency — to be defined] using the following tests: [Assignment: organization-defined tests — to be defined].

Procedure:

The CISO sets the [IR-03 parameter 1 — to be defined] test calendar by system impact level. The CISO picks a likely threat scenario for each test, such as ransomware, credential compromise, or a personally identifiable information (PII) breach. Low- and moderate-impact systems run tabletop exercises. High-impact systems and High Value Assets (HVAs) run functional exercises, in which responders take the response steps on the systems and tools they would use. When a System Owner combines the test with the contingency plan test, the System Owner lists in the exercise plan the incident response steps it covers. Those steps include detection, reporting to CISA, containment, and the major incident and breach decisions.

Each exercise ends with an after-action report that states what the team exercised, what failed, and what must improve. Each deficiency becomes a corrective action in the governance, risk, and compliance (GRC) system with an owner and a due date. The CISO tracks closure before the next test cycle.

Evidence: the approved test calendar, the exercise plans, the after-action reports, and the corrective action records with their closure dates.

IR-04 — Incident Handling #

Baselines: Low / Moderate / High / Privacy / HVA overlay CSF 2.0: DE.CM (Continuous Monitoring), DE.AE (Adverse Event Analysis), RS.MA (Incident Management), RS.AN (Incident Analysis)

1. Implement an incident handling capability for incidents that is consistent with the incident response plan and includes preparation, detection and analysis, containment, eradication, and recovery;
2. Coordinate incident handling activities with contingency planning activities;
3. Incorporate lessons learned from ongoing incident handling activities into incident response procedures, training, and testing, and implement the resulting changes accordingly; and
4. Ensure the rigor, intensity, scope, and results of incident handling activities are comparable and predictable across the organization.

Procedure:

Detection starts in the tools. The security information and event management (SIEM) system correlates log telemetry into incidents, and the endpoint detection and response (EDR) tools raise endpoint detections with containment actions ready to run. The SOC triages each incident in the ticketing system, classifies its severity, and works the phases in order. Analysis scopes the incident. Containment stops the spread, and this includes network isolation of endpoints through the EDR tool where the SOC judges it necessary. Eradication removes the attacker’s foothold. The SOC coordinates recovery with contingency plans when restoration is involved.

The Incident Response Team captures volatile data first and then takes forensic images where needed. The SOC Manager records each evidence item in a chain-of-custody log that shows who collected it, when, and every later transfer. The Incident Response Plan describes the full evidence handling steps.

After a significant incident, the CISO convenes the lessons-learned review. Accepted changes update procedures, training content, and the next test scenario, and the CISO tracks each change to closure in the ticketing system. The CISO also reviews handling records across incidents to confirm that rigor matches severity. The SOC brings the SAOP into the response for any breach that involves PII.

Evidence: the SIEM system incident records, the EDR tool containment logs, chain-of-custody logs, incident tickets with phase timelines, lessons-learned minutes, and the resulting change tickets.

IR-05 — Incident Monitoring #

Baselines: Low / Moderate / High / Privacy / HVA overlay CSF 2.0: DE.CM (Continuous Monitoring), DE.AE (Adverse Event Analysis), RS.MA (Incident Management), RS.AN (Incident Analysis)

Track and document incidents.

Procedure:

The SOC opens a ticketing system record for each incident. The record can start from a SIEM system correlation, an endpoint detection in the EDR tools, or a user report through the service desk. The record holds the incident’s history: status changes, analysis notes, containment and eradication actions, evidence preserved for forensics, referrals, and the closure summary. The SOC updates the record as the work happens, and the SIEM system keeps the technical timeline beside it.

The SOC leaves the record’s disposal date blank while any follow-up action is open. When the last follow-up action is complete, the SOC sets the disposal date to 3 years after that date, under National Archives and Records Administration (NARA) General Records Schedule (GRS) 3.2. A later follow-up action moves the date later. The SOC copies the audit logs tied to the incident into the case file so they outlast normal log retention. A legal hold stops disposal until General Counsel releases it.

Closed incidents appear in trend reports by category and severity. The CISO reviews the trends and adjusts detection content, training emphasis, or procedures where a pattern warrants a change.

Evidence: the incident records with their disposal dates, the SIEM system incident exports, legal hold notices, and the trend reports with the adjustments they led to.

IR-06 — Incident Reporting #

Baselines: Low / Moderate / High / Privacy CSF 2.0: DE.CM (Continuous Monitoring), DE.AE (Adverse Event Analysis), RS.MA (Incident Management), RS.AN (Incident Analysis)

1. Require personnel to report suspected incidents to the organizational incident response capability within 1 hour; and
2. Report incident information to [Assignment: organization-defined authorities — to be defined].

Procedure:

A person who suspects an incident contacts the Organization IT Service Desk or the SOC. The service desk records the report in the ticketing system and routes it to the SOC immediately. User training covers the required reporting expectation, and the ticket timestamps show when the report arrived and when the desk routed it. The SOC validates the report against the alerts in the SIEM system and classifies its severity.

When the SOC identifies an incident that may have compromised federal information or a federal information system, the SOC Manager records that time in the ticket. Within 1 hour of that time, the SOC Manager submits the CISA Incident Reporting Form with the best facts known. The report classifies the incident by functional impact, information impact, recoverability, and attack vector. The SOC Manager records the CISA incident ID in the ticket and updates the report as facts change. When the form is down, the SOC Manager calls CISA Central and enters the report later.

The CISO decides on referrals as the Incident Response Plan describes. The CISO notifies the Office of Inspector General, coordinates law enforcement referrals with General Counsel, informs the insider threat program of insider cases, and notifies the Contracting Officer of contractor or supplier cases. The CISO’s office records each referral in the ticket. The reporter receives a status update when the ticket closes.

Evidence: report tickets with intake and routing timestamps, the identification time, CISA incident IDs and submission times, CISA report updates, referral records, and the reporter notifications.

IR-07 — Incident Response Assistance #

Baselines: Low / Moderate / High / Privacy CSF 2.0: DE.CM (Continuous Monitoring), RS.MA (Incident Management), RS.CO (Incident Response Reporting and Communication), RS.MI (Incident Mitigation)

Provide an incident response support resource, integral to the organizational incident response capability, that offers advice and assistance to users of the system for the handling and reporting of incidents.

Procedure:

The Organization IT Service Desk answers user questions about suspicious activity, opens a ticketing system ticket when a report is warranted, and connects the user to the SOC when the question needs specialist help. The SOC gives the deeper help: what to preserve, what to disconnect, and what happens next. Forensic support joins through the same path when an incident needs it.

The service desk tracks every request for help as a ticket, even when no incident results, so the demand stays visible. The CISO’s team uses recurring question themes in the training content review, so training covers what confuses people.

Evidence: assistance tickets, escalation records to the SOC, and the theme summaries passed to the training review.

IR-08 — Incident Response Plan #

Baselines: Low / Moderate / High / Privacy CSF 2.0: DE.CM (Continuous Monitoring), DE.AE (Adverse Event Analysis), RS.MA (Incident Management), RS.CO (Incident Response Reporting and Communication)

1. Develop an incident response plan that:

1. Provides the organization with a roadmap for implementing its incident response capability;
2. Describes the structure and organization of the incident response capability;
3. Provides a high-level approach for how the incident response capability fits into the overall organization;
4. Meets the unique requirements of the organization, which relate to mission, size, structure, and functions;
5. Defines reportable incidents;
6. Provides metrics for measuring the incident response capability within the organization;
7. Defines the resources and management support needed to effectively maintain and mature an incident response capability;
8. Addresses the sharing of incident information;
9. Is reviewed and approved by [Assignment: organization-defined personnel or roles — to be defined] at least annually; and
10. Explicitly designates responsibility for incident response to [Assignment: organization-defined entities, personnel, or roles — to be defined].

2. Distribute copies of the incident response plan to see additional FedRAMP Requirements and Guidance;
3. Update the incident response plan to address system and organizational changes or problems encountered during plan implementation, execution, or testing;
4. Communicate incident response plan changes to [Assignment: organization-defined incident response personnel (identified by name and/or by role) and organizational elements — to be defined]; and
5. Protect the incident response plan from unauthorized disclosure and modification.

Procedure:

The CISO’s office keeps the plan under version control and restricts access to the people who need it, because the plan describes the Organization’s response structure in detail. The CISO’s office reviews the plan every year and after any major incident. The review compares the plan with what happened during response: the response structure, the definitions of reportable incidents, the metrics, the resourcing, and the information sharing arrangements. The CISO approves each revision.

The CISO’s office sends the approved plan, with a change summary, to all computer emergency response team (CERT) members, senior executives, the Chief Information Officer (CIO), ISSOs, System Owners, and Information Owners. The office records the distribution. Problems found during response or testing become plan-change tickets in the ticketing system, and the CISO’s office works them to closure.

Evidence: the version history with approvals, the distribution records, and the plan-change tickets.

IR-08(1) — Breaches #

Baselines: Privacy

Include the following in the Incident Response Plan for breaches involving personally identifiable information: (a) A process to determine if notice to individuals or other organizations, including oversight organizations, is needed; (b) An assessment process to determine the extent of the harm, embarrassment, inconvenience, or unfairness to affected individuals and any mechanisms to mitigate such harms; and (c) Identification of applicable privacy requirements.

Procedure:

When the Security Operations Center (SOC) confirms that an incident involves PII, the SOC marks the ticketing system incident ticket as a breach and alerts the Privacy Officer. The SOC Manager reports it to CISA within one hour of identification. The SOC Manager uses the CISA Incident Reporting Form and records the CISA incident ID.

The SAOP meets with the Privacy Officer, the System Owner, and General Counsel to rate the risk of harm to the affected individuals. The group identifies the privacy requirements that apply to the data involved and selects steps to reduce the harm. The SAOP then decides whether to notify affected individuals, other organizations, and oversight bodies. The Privacy Officer records the risk rating, the decision, and the reasons in the ticket and sends any notices.

Evidence: the CISA report, the harm assessment, the SAOP notification decision with its reasons, and copies of notices sent, all kept in the document management system with the breach case file.

4.3 Reporting Incidents to CISA and Other Parties #

These steps start when someone reports a suspected incident or the SIEM system raises an alert. The 1-hour clock comes from the CISA Federal Incident Notification Guidelines. The incident ticket in the ticketing system holds every time, report, and notice. The major incident steps are under “Major Incident Reporting, Referrals, and Evidence Handling”.

Step 1: Take the report and open the ticket #

Every report reaches the Security Operations Center and gets one ticket.

Step 2: Report to CISA within 1 hour #

Give CISA the facts known within the hour, through the CISA Incident Reporting Form.

Entry criteria: The Security Operations Center has identified an incident that may have compromised the confidentiality, integrity, or availability of federal information or a federal information system.

Exit criteria: The ticket shows the CISA incident ID and a submission time within 1 hour of identification.

Step 3: Use the fallback when the form cannot be used #

Meet the 1-hour clock when the form or Login.gov is down.

Step 4: Update CISA and tell leaders #

Keep CISA’s record current and bring in leaders when the incident is serious.

Step 5: Take reports from contractors and cloud providers #

Make sure incidents at contractors and providers reach the Security Operations Center.

Step 6: Report records and CUI incidents #

Meet the separate reporting rules for federal records and Controlled Unclassified Information (CUI).

Step 7: Close the ticket #

Close the incident only when every report and corrective action is recorded.

Evidence: the incident ticket with the identification time, the CISA incident ID, and each CISA update. The ticket also holds contractor and provider reports, any notice to NARA or about CUI, the POA&M item numbers, the closure record, and the disposal date.

Source: CISA Federal Incident Notification Guidelines (effective April 1, 2017; checked October 21, 2026); CISA Incident Reporting Form at https://myservices.cisa.gov/irf (OMB control number 1670-0037; checked October 21, 2026); OMB M-25-04, section X; OMB M-17-12; 44 U.S.C. 3554(b)(7)(C)(ii); FedRAMP Consolidated Rules for 2026, Incident Evaluation and Communication; 36 CFR 1230.14; 32 CFR 2002.16(a)(6) and 2002.54.

4.4 Major Incident Reporting, Referrals, and Evidence Handling #

These steps start when the CISO or the SAOP considers whether an incident in the ticketing system is a major incident. The reporting times come from Office of Management and Budget (OMB) M-25-04 and 44 U.S.C. 3554. The evidence steps follow NIST SP 800-86.

Step 1: Decide whether it is a major incident #

Apply the OMB definition and record the decision.

Step 2: Notify Congress and the Inspector General #

Meet the deadlines in 44 U.S.C. 3554 and OMB M-25-04.

Step 3: Make the required referrals #

Bring in the offices that have their own duties.

Step 4: Preserve the evidence #

Collect evidence so it can support a legal action.

Step 5: Respond to common incident types #

Short response steps for the most frequent reports.

1. Phishing: the Security Operations Center collects the message headers, blocks the sender’s indicators, finds the users who clicked, and resets exposed credentials. It reports a successful compromise to CISA as an incident. It sends other phishing indicators through CISA’s phishing reporting channel.
2. Lost or stolen device or Personal Identity Verification (PIV) card: the user reports it to the service desk at once. The Security Operations Center wipes the device remotely, and the PIV issuer revokes the card’s certificates.
3. Unencrypted device or device with PII: the Security Operations Center handles the loss as an incident, and the SAOP assesses it as a possible breach. An encrypted device with no sign of misuse is not reported to CISA.
4. Ransomware: the Security Operations Center isolates the affected systems and reports to CISA within 1 hour, answering the form’s ransom questions. The CISO refers the incident to law enforcement through General Counsel and starts the major incident review.

Evidence: the incident ticket with its CISA incident IDs, the dated determination, the report to OMB, the notices to Congress and the Inspector General, the referrals, and the chain-of-custody records.

Source: OMB M-25-04, Fiscal Year 2025 Guidance on Federal Information Security and Privacy Management Requirements (January 2025; still the current FISMA guidance on October 21, 2026), section X; 44 U.S.C. 3554(b)(7)(C)(iii)(III) and 44 U.S.C. 3553 note; OMB M-17-12, section VII.D; CISA Federal Incident Notification Guidelines; CISA Incident Reporting Form; NIST SP 800-61 Rev. 3; NIST SP 800-86; NARA General Records Schedule 3.2.

5. Parameters (ODP Values) #

The following organization-defined parameters apply to controls in this family:

6. Evidence Artifacts #

Carrying out this procedure produces these records:

• Incident Response Plan
• Incident reports and tickets
• IR team roster and contact information
• After-action reports
• Evidence for IG FISMA metric IR.01
• Evidence for IG FISMA metric IR.02
• Evidence for IG FISMA metric IR.32

7. Performance Measurement #

The CISO measures this procedure with the indicators below, which meet IG FISMA Level 4 (Managed and Measurable). The ISSO collects the data, and the CISO trends and reports it. When a measure moves away from its target, the CISO starts corrective action through the POA&M process.

8. Training Requirements #

Before they carry out the steps in this procedure, and every year after, the people who perform them must complete:

• General security awareness training, which all personnel take under POL-AT.
• Role-based training on this procedure’s steps, tools, and evidence.
• Training on the technology platforms listed under Technology Implementation, matched to their duties.

Completion is a condition of continued access. The Agency Learning Management System (LMS) holds the completion records.

9. Governance References #

• OMB Circular A-130: Managing Information as a Strategic Resource, July 28, 2016.
• Executive Order 14028: Improving the Nation’s Cybersecurity, May 12, 2021.
• Federal Information Security Modernization Act of 2014 (44 U.S.C. § 3551 et seq.), December 18, 2014.
• OMB M-17-12: Preparing for and Responding to a Breach of Personally Identifiable Information, May 22, 2017.
• OMB M-26-14: Ensuring Effective and Efficient Agency Logging and Network Visibility to Defend Against Evolving Cyber Threats, May 22, 2026.
• NIST SP 800-53 Rev. 5: Security and Privacy Controls for Information Systems and Organizations, September 2020.
• 32 CFR Part 2002: Controlled Unclassified Information, September 14, 2016.
• 36 CFR Part 1230: Unlawful or Accidental Removal, Defacing, Alteration, or Destruction of Records, March 30, 2018.
• CISA Incident Reporting System: Incident Reporting Form (CISA Services Portal): Incident Reporting Form (CISA Services Portal), August 29, 2024.
• Examination by Archivist of lists and schedules of records lacking preservation value; disposal prohibited (44 U.S.C. § 3303a).
• Federal Incident Notification Guidelines, April 1, 2017.
• FedRAMP Consolidated Rules for 2026 (including 20x Key Security Indicators), June 24, 2026.
• NARA General Records Schedule 3.2: Information Systems Security Records.
• NIST Cybersecurity Framework 2.0, February 26, 2024.
• NIST SP 800-61 Rev. 3: Incident Response Recommendations and Considerations for Cybersecurity Risk Management, April 2025.
• NIST SP 800-86: Guide to Integrating Forensic Techniques into Incident Response, August 2006.
• OMB M-22-01: Improving Detection of Cybersecurity Vulnerabilities and Incidents on Federal Government Systems through Endpoint Detection and Response (EDR), October 8, 2021.
• OMB M-25-04: FY 2025 Guidance on Federal Information Security and Privacy Management Requirements, January 15, 2025.