When an employee thinks something is wrong, where do they go for advice? IR-7 requires an incident response support resource, built into your incident response capability, that offers advice and assistance to users for handling and reporting incidents.
800-53 binds US federal systems and contract holders. Other companies can use it as a reference for how a security help channel should work.
What it means in practice
NIST lists help desks, assistance groups, automated ticketing systems that open and track incident tickets, and access to forensics services or consumer redress services when needed. The point is that reporting is easy and help is available.
A security mailbox, a chat channel with a stated response time and an on call rota can satisfy it for a small team.
Evidence to collect
- The published channel and hours, and where staff find it.
- Ticket samples showing user requests answered.
- A retainer or contact record for external forensics support.
- Enhancements, where adopted: IR-7.1 Automation Support for Availability of Information and Support and IR-7.2 Coordination with External Providers.
Common gaps
Support that works only in business hours with no overnight route. A forensics firm contacted for the first time during a breach.
How to implement it
Put the channel in onboarding and on the intranet home page. Sign a retainer with an external responder before you need one.
Quick check
Name two forms an IR-7 support resource can take.
A help desk, an assistance group, an automated ticketing system, or access to forensics services.
