The incident response plan is the document everyone asks to see. IR-8 spells out what it must hold and how you keep it alive. The list is more specific than most people expect.
800-53 binds US federal systems and anyone held to it by contract. Others can use it as a reference, and as a checklist when a customer sends a request for your plan.
What the plan must contain
According to the statement, the plan:
- Provides a roadmap for implementing your incident response capability.
- Describes the structure and organization of that capability.
- Gives a high level approach for how it fits the overall organization.
- Meets your own unique requirements for mission, size, structure and functions.
- Defines reportable incidents.
- Provides metrics for measuring the capability.
- Defines resources and management support needed to maintain and mature it.
- Addresses sharing of incident information.
- Is reviewed and approved by designated personnel.
- Explicitly designates responsibility for incident response to named people or roles.
What you must do with it
Distribute copies to defined personnel. Update it for system and organizational changes and for problems met during implementation, execution or testing. Communicate changes to the same personnel. Protect the plan from unauthorized disclosure and modification.
What it means in practice
NIST asks for a coordinated approach and says structure follows mission and business functions. It also asks you to consider sharing with external organizations, including service providers and others in the supply chain. For incidents involving personal data, which it calls breaches, include a process to decide whether to notify oversight bodies or affected individuals, and then do so. IR-8.1 Breaches is the enhancement for that.
Evidence to collect
- The current plan with version, approval signature and date.
- Distribution list and proof of delivery.
- Revision history tied to tests and incidents.
- Defined metrics and the latest values, such as time to detect and time to contain.
- Access controls on the plan's storage location, including an offline copy.
Click through it at your own pace, or open it full screen.
Common gaps
A plan stored only in the system that may be down. Metrics promised and never measured. No definition of a reportable incident. No update after the last real event. Nobody beyond the author has read it.
How to implement it
Draft from the list above, one heading each. Keep an offline copy. Put a review into the calendar after every tabletop. Add the breach decision process and test it with a data exposure scenario.
Quick check
Why protect the plan itself from disclosure?
IR-8 requires it. A plan reveals contacts, thresholds and weaknesses that an attacker could use.
What does IR-8 say to include for incidents involving personal data?
A process to determine whether notice to oversight organizations or affected individuals is appropriate, and to provide that notice.
