[{"data":1,"prerenderedAt":-1},["ShallowReactive",2],{"framework:nist-800-53\u002Fir-6":3},{"item":4,"lessons":18,"controls":68,"related":98},{"family":5,"item":6,"code":7,"title":8,"citations":9,"publisher":10,"summary_md":11,"official_text":12,"official_attribution":13,"official_url":14,"link_label":15,"note":16,"updated_at":17},"nist-800-53","ir-6","IR-6","Incident Reporting",210,"US National Institute of Standards and Technology (NIST)","**What it asks for.** Personnel must report suspected incidents to the internal incident response capability within a defined time, and incident information must be reported to defined authorities.\n\n**In practice.** Good practice is a simple, well-publicised reporting route such as a phishing report button, a hotline or a ticket form, plus clear criteria for when and how incidents are reported to regulators, customers and other external parties. Auditors expect reporting procedures, records of reports with timestamps and evidence of external notifications. European organisations should align this with NIS2, DORA and GDPR notification deadlines.\n\n**Common gaps.** Staff often do not know what counts as an incident or fear blame for reporting. External reporting duties are frequently not mapped to who decides and who sends the notification.","a. Require personnel to report suspected incidents to the organizational incident response capability within [Assignment: organization-defined time period] ; and\n  b. Report incident information to [Assignment: organization-defined authorities].\nDiscussion: The types of incidents reported, the content and timeliness of the reports, and the designated reporting authorities reflect applicable laws, executive orders, directives, regulations, policies, standards, and guidelines. Incident information can inform risk assessments, control effectiveness assessments, security requirements for acquisitions, and selection criteria for technology products.","From NIST SP 800-53 Rev. 5, a work of the US government in the public domain.","https:\u002F\u002Fcsrc.nist.gov\u002Fpubs\u002Fsp\u002F800\u002F53\u002Fr5\u002Fupd1\u002Ffinal","Open SP 800-53 at NIST",null,"2026-10-18T15:18:43.663+00:00",{"total":9,"list":19},[20,24,28,32,36,40,44,48,52,56,60,64],{"slug":21,"title":22,"published_at":23},"bae-systems-breach-cripples-us-bankruptcy-court-noticing-system","BAE Systems Breach Cripples US Bankruptcy Court Noticing System","2026-10-16T16:20:16.497+00:00",{"slug":25,"title":26,"published_at":27},"burger-king-japan-app-breach-exposes-11m-member-records","Burger King Japan App Breach Exposes 11M Member Records","2026-10-16T12:21:23.341+00:00",{"slug":29,"title":30,"published_at":31},"bae-systems-contractor-incident-cripples-us-bankruptcy-court-notifications","BAE Systems Contractor Incident Cripples US Bankruptcy Court Notifications","2026-10-16T12:20:16.174+00:00",{"slug":33,"title":34,"published_at":35},"bae-systems-breach-disrupts-federal-court-infrastructure-via-supply-chain-attack","BAE Systems Breach Disrupts Federal Court Infrastructure via Supply Chain Attack","2026-10-16T08:20:29.888+00:00",{"slug":37,"title":38,"published_at":39},"hard-coded-credentials-in-eseecloud-ip-cameras-leave-users-exposed","Hard-Coded Credentials in EseeCloud IP Cameras Leave Users Exposed","2026-10-15T18:21:38.566+00:00",{"slug":41,"title":42,"published_at":43},"international-csam-crackdown-highlights-platform-accountability-and-reporting-gaps","International CSAM Crackdown Highlights Platform Accountability and Reporting Gaps","2026-10-15T12:20:23.726+00:00",{"slug":45,"title":46,"published_at":47},"olvx-cybercrime-marketplace-operator-charged-after-500k-in-stolen-data-sales","OLVX Cybercrime Marketplace Operator Charged After $500K in Stolen Data Sales","2026-10-14T22:20:20.643+00:00",{"slug":49,"title":50,"published_at":51},"billion-message-phishing-campaign-disrupted-by-microsoft-coalition","Billion-Message Phishing Campaign Disrupted by Microsoft Coalition","2026-10-14T20:21:09.517+00:00",{"slug":53,"title":54,"published_at":55},"russian-ai-powered-influence-operation-targets-latin-american-institutions","Russian AI-Powered Influence Operation Targets Latin American Institutions","2026-10-14T14:20:33.123+00:00",{"slug":57,"title":58,"published_at":59},"billion-message-phishing-network-dismantled-lessons-in-credential-theft-at-scale","Billion-Message Phishing Network Dismantled: Lessons in Credential Theft at Scale","2026-10-14T14:20:19.344+00:00",{"slug":61,"title":62,"published_at":63},"ransomware-groups-escalate-to-physical-threats-against-employees-and-families","Ransomware Groups Escalate to Physical Threats Against Employees and Families","2026-10-14T06:20:17.072+00:00",{"slug":65,"title":66,"published_at":67},"insider-threat-hidden-recorder-found-in-openai-executive-conference-room","Insider Threat: Hidden Recorder Found in OpenAI Executive Conference Room","2026-10-14T04:20:18.348+00:00",[69,74,79,84,89,94],{"slug":70,"name":71,"problem":72,"stories":73},"endpoint-detection-response","Endpoint detection and response (EDR and XDR)","Malware and hands-on-keyboard attackers on laptops and servers get spotted and stopped.",46,{"slug":75,"name":76,"problem":77,"stories":78},"identity-threat-detection","Identity threat detection and response (ITDR)","Attackers who log in with real, stolen credentials get noticed.",40,{"slug":80,"name":81,"problem":82,"stories":83},"patch-management","Automated patch management","Known holes get closed in days, not months.",37,{"slug":85,"name":86,"problem":87,"stories":88},"phishing-resistant-mfa","Phishing-resistant MFA","A stolen password, or a user who taps Approve on a push prompt, is no longer enough to log in.",35,{"slug":90,"name":91,"problem":92,"stories":93},"email-security","Email security","Phishing, malware and invoice fraud are filtered out before they reach inboxes.",31,{"slug":95,"name":96,"problem":97,"stories":93},"security-awareness-training","Security awareness training and phishing simulation","People recognise and report attacks instead of falling for them.",[99,104,110,115,121,126,131,136],{"family":100,"item":101,"code":102,"title":102,"together":103},"itil","overview","ITIL",120,{"family":105,"item":106,"code":107,"title":108,"together":109},"gdpr","33","Article 33","Notification of a personal data breach to the supervisory authority",96,{"family":105,"item":111,"code":112,"title":113,"together":114},"32","Article 32","Security of processing",95,{"family":116,"item":117,"code":118,"title":119,"together":120},"cis","6","Control 6","Access Control Management",82,{"family":5,"item":122,"code":123,"title":124,"together":125},"ac-2","AC-2","Account Management",72,{"family":116,"item":127,"code":128,"title":129,"together":130},"17","Control 17","Incident Response Management",66,{"family":116,"item":132,"code":133,"title":134,"together":135},"14","Control 14","Security Awareness and Skills Training",58,{"family":116,"item":137,"code":138,"title":139,"together":140},"3","Control 3","Data Protection",54]