The statement of IR-5 is just this: track and document incidents. The control does not ask you to detect them. That belongs to other controls. It asks that once an incident exists, you keep a proper record of it.
800-53 binds US federal systems and contract holders. For others it is a reference, and an incident log is one of the first things reviewers request.
What it means in practice
NIST says documentation includes records about each incident, its status and other information needed for forensics and for evaluating details, trends and handling. Sources of incident information include network monitoring, reports, response teams, user complaints, supply chain partners, audit and physical monitoring and user and administrator reports. IR-4 provides additional detail on handling.
A good record answers: what happened, when it was detected, who handled it, what was affected, what was done, when it closed and what changed afterward. A trend view across records tells you where to invest.
Evidence to collect
- The incident register or ticket export for the audit period, including minor events.
- A completed record with timeline, impact and status history.
- A periodic trend report, such as counts by type and time to resolve.
- Proof that the register is access controlled and cannot be edited silently.
Common gaps
Only major incidents recorded. Records closed with no root cause. Different teams keeping separate spreadsheets. A register with no entries and no explanation, which auditors read as a sign of weak detection.
The enhancement IR-5.1 Automated Tracking, Data Collection, and Analysis covers tooling support.
How to implement it
Use one system of record. Make severity, status and cause required fields. Review trends quarterly.
Quick check
Why would an empty incident register worry an auditor?
It suggests incidents are not being detected or recorded, rather than that none occurred.
