If you open the Rev 5 catalog and look for IR-10 Integrated Information Security Analysis Team, you will find a title and nothing else. The control has no statement and no guidance. That is because it is withdrawn.
800-53 binds US federal systems and anyone under contract to follow it. If you are outside that group, read this note so a questionnaire reference to IR-10 does not send you hunting for a requirement that no longer exists.
What the catalog says
The NIST OSCAL catalog marks IR-10 with a status of withdrawn and a link that says it moved to IR-4.11. IR-4.11 is titled Integrated Incident Response Team, an enhancement of IR-4 Incident Handling. Because the record for IR-10 is empty, this post does not describe its old wording. Check the catalog if you need the history.
What it means in practice
Nothing to implement under IR-10 itself. There is no evidence to collect against a withdrawn control, and an auditor working from Rev 5 should not test it.
If a customer asks about the idea, the relevant question sits in IR-4.11: can you bring together people from different functions, such as security, IT, legal and communications, as an incident team? A simple answer is a documented roster, roles and an on call method.
Common gaps
Treating a withdrawn control as a gap in a spreadsheet. Citing IR-10 in a policy as if it were active. Check which revision your customer uses before answering.
Quick check
Where did IR-10 move?
According to the Rev 5 OSCAL catalog, to IR-4.11 Integrated Incident Response Team.
