IR-6 Incident reporting

FedRAMP Moderate · Rev 5

What the standard requires

a. Require personnel to report suspected incidents to the organizational incident response capability within [time period] ; and b. Report incident information to [authorities].

Quoted verbatim from NIST SP 800-53 Rev 5 (OSCAL catalog), which is in the public domain.

Maps to 2 controls in 2 other frameworks

Framework	Control
HITRUST CSF v11	11.a.01 Information security events are reported through appropriate management channels
NIST Cybersecurity Framework (1.1, legacy)	RS.CO-2 Incidents reported consistent with criteria

Mappings are CMDash’s own, seeded with the product and shown on both frameworks they connect. In the product they mean evidence you attach here also counts against the controls listed above.

Track IR-6 with evidence behind it

In CMDash this control is a row with an owner, a status, uploaded evidence kept with its full history, and an export an assessor can read.

Start free trial All FedRAMP Moderate controls