Two reporting duties live in IR-6. Inside the company, personnel must report suspected incidents to the incident response capability within a time you define. Outside, you must report incident information to defined authorities.
800-53 binds US federal systems and contract holders. For other organizations it is a reference. The outside duty is usually set by your own contracts and laws, so the guidance here is where to look, not what to file.
What it means in practice
NIST says the types of incidents reported, the content and timeliness of reports and the reporting authorities reflect applicable laws, directives, regulations, policies and standards. It adds that incident information can feed risk assessments, control effectiveness assessments, acquisition security requirements and product selection.
For most companies the outside list includes customers with notification clauses, regulators for the data you hold, insurers and sometimes law enforcement. Each has its own clock, and clocks can be short. Confirm the exact requirement with counsel, because they vary by jurisdiction and contract.
Evidence to collect
- The internal reporting rule: how to report, to whom, and the time limit.
- Awareness material showing staff know the channel.
- A register of external reporting obligations with the deadline and owner for each.
- Examples of reports made or a record that the decision was reviewed and none was due.
- Template notifications approved in advance.
Common gaps
Staff unsure who to tell. No list of customer notification clauses. Reports drafted from scratch under pressure. No record of the decision when a report was judged unnecessary.
The enhancements are IR-6.1 Automated Reporting, IR-6.2 Vulnerabilities Related to Incidents and IR-6.3 Supply Chain Coordination. IR-6.3 matters when an incident involves a supplier's component or service.
How to implement it
Publish one reporting address and one chat channel. State a maximum time to report internally, such as immediately and no later than a few hours. Build the obligations register from your contracts and review it each time a contract changes. Keep a decision log for every incident review.
Quick check
What two parts does IR-6 contain?
Requiring personnel to report suspected incidents to the incident response capability within a defined time, and reporting incident information to defined authorities.
Who sets the outside reporting deadlines?
Applicable laws, regulations and contracts. The control leaves the specifics to them.
