THREATNOIR
Subscribe
NIST SP 800-53 Rev. 5 · IR-6

Incident Reporting

US National Institute of Standards and Technology (NIST) · cited in 210 of our lessons

Explanation

What it asks for. Personnel must report suspected incidents to the internal incident response capability within a defined time, and incident information must be reported to defined authorities.

In practice. Good practice is a simple, well-publicised reporting route such as a phishing report button, a hotline or a ticket form, plus clear criteria for when and how incidents are reported to regulators, customers and other external parties. Auditors expect reporting procedures, records of reports with timestamps and evidence of external notifications. European organisations should align this with NIS2, DORA and GDPR notification deadlines.

Common gaps. Staff often do not know what counts as an incident or fear blame for reporting. External reporting duties are frequently not mapped to who decides and who sends the notification.

Open SP 800-53 at NIST
The official text
a. Require personnel to report suspected incidents to the organizational incident response capability within [Assignment: organization-defined time period] ; and b. Report incident information to [Assignment: organization-defined authorities]. Discussion: The types of incidents reported, the content and timeliness of the reports, and the designated reporting authorities reflect applicable laws, executive orders, directives, regulations, policies, standards, and guidelines. Incident information can inform risk assessments, control effectiveness assessments, security requirements for acquisitions, and selection criteria for technology products.

From NIST SP 800-53 Rev. 5, a work of the US government in the public domain.

Lessons that cite it

Real incidents where this item mattered: the latest 12 of 210.