IR-1 is the foundation of the Incident Response family. Before you test a plan or train a team, you need a policy that says what incident response means in your organization and who is accountable for it.
800-53 binds US federal systems and contract holders. If you are outside that group, it is a reference, and most security questionnaires include an incident response policy question that IR-1 answers well.
What the control asks
Develop, document and disseminate an incident response policy that covers purpose, scope, roles, responsibilities, management commitment, coordination among organizational entities and compliance, and that is consistent with applicable laws and regulations. Develop procedures that implement the policy and the IR controls. Designate an official to manage both. Review and update the policy and procedures at a frequency you set and after events you define.
What it means in practice
NIST says the policy and procedures address the IR controls across systems and the organization, and that the risk management strategy is a factor. It adds that security and privacy programs should collaborate on them. For a small company, one short policy and a procedure set stored next to the incident runbooks is enough.
Evidence to collect
- The signed policy with version, approver and date.
- The procedure set: how to report, triage, escalate, contain, communicate and close.
- The named owner of incident response.
- Distribution proof, such as acknowledgments or onboarding records.
- The last review record and the trigger that caused any update, such as a real incident.
Common gaps
A policy written for an audit and never used. No owner. Review dates that have lapsed. Procedures that exist only as a diagram.
How to implement it
Write the policy in plain language, link each statement to a procedure and name the on call role. Review it after every significant incident and at least once a year.
Quick check
What separates a policy from a procedure in IR-1?
The policy states purpose, scope, roles and commitment. Procedures describe how the policy and the other IR controls are carried out.
