THREATNOIR
Subscribe
NIST SP 800-53 Rev. 5 · IR-5

Incident Monitoring

US National Institute of Standards and Technology (NIST) · cited in 14 of our lessons

Explanation

What it asks for. Incidents must be tracked and documented.

In practice. Doing this well means recording every incident in a tracking system with timeline, affected assets, classification, actions taken, evidence collected and closure details. The records support trend analysis, regulatory reporting and lessons learned. Auditors expect incident records, consistent classification and metrics derived from them. Records should show who handled each incident and when key decisions were made. Linking incidents to affected assets and root causes helps reveal recurring weaknesses and supports reporting to management and regulators.

Common gaps. Incidents handled informally by chat or email often leave no proper record. Inconsistent classification makes trends and reporting unreliable. Near misses and minor incidents are often not recorded, hiding useful patterns.

Open SP 800-53 at NIST
The official text
Track and document incidents. Discussion: Documenting incidents includes maintaining records about each incident, the status of the incident, and other pertinent information necessary for forensics as well as evaluating incident details, trends, and handling. Incident information can be obtained from a variety of sources, including network monitoring, incident reports, incident response teams, user complaints, supply chain partners, audit monitoring, physical access monitoring, and user and administrator reports. [IR-4](#ir-4) provides information on the types of incidents that are appropriate for monitoring.

From NIST SP 800-53 Rev. 5, a work of the US government in the public domain.

Lessons that cite it

Real incidents where this item mattered: the latest 12 of 14.