IR-3 / IR-4 / A.5.24 / A.5.25 / CIS-17.1 NIST SP 800-53 Rev 5

Incident response readiness

Demonstrate that the organization maintains documented, tested, and operationally ready incident response capabilities with trained personnel who can execute response procedures effectively during security events.

Description

What this control does

Incident response readiness ensures that an organization maintains documented procedures, trained personnel, and technical capabilities to detect, analyze, contain, and recover from security incidents in a timely manner. This control includes maintaining current incident response plans, runbooks for common scenarios, regular tabletop exercises or simulations, and verified communication channels with internal stakeholders and external partners. Effective readiness reduces mean time to detect (MTTD) and mean time to respond (MTTR), minimizing business impact and data exposure during active incidents.

Control objective

What auditing this proves

Associated risks

Risks this control addresses

Delayed incident detection or containment due to lack of documented procedures or trained responders
Unauthorized data exfiltration continuing undetected while responders determine appropriate actions
Ineffective containment allowing lateral movement or reinfection due to incomplete or untested playbooks
Loss of forensic evidence through improper handling or premature system remediation
Regulatory penalties or breach notification failures from missed timelines or inadequate documentation
Communication breakdown between technical teams, legal, PR, and executive leadership during active incidents
Inability to coordinate with external parties such as law enforcement, forensic vendors, or incident response retainers when escalation is required

Live threat patterns this control mitigates:

Testing procedure

How an auditor verifies this control

Obtain and review the current incident response plan, including documented roles, escalation paths, communication templates, and procedures for common incident types
Verify the plan includes specific runbooks or playbooks for at least ransomware, data breach, denial-of-service, and insider threat scenarios
Identify designated incident response team members and confirm they have completed role-specific training within the past 12 months
Review records of tabletop exercises, simulations, or actual incident post-mortems conducted within the past 12 months
Examine evidence that response procedures include forensic evidence preservation, chain-of-custody protocols, and legal/regulatory notification requirements
Test availability and functionality of critical incident response tools including SIEM access, ticketing systems, secure communication channels, and forensic collection utilities
Interview at least two incident response team members to assess their familiarity with procedures, escalation criteria, and access to necessary tools
Validate that third-party incident response retainers, forensic vendors, or law enforcement contacts are documented with current contact information and engagement terms

Evidence required Auditor collects the incident response plan document with version control metadata and approval signatures; training completion certificates or records for incident response team members; tabletop exercise reports, simulation findings, or incident post-mortem documentation from the past year; screenshots of SIEM dashboards, ticketing queues, and secure communication platforms demonstrating active configuration; contact lists for external incident response vendors or law enforcement liaisons; and interview notes confirming responder knowledge and tool access.

Pass criteria The control passes if a current incident response plan exists with documented procedures for key incident types, designated team members have completed training within the past 12 months, at least one readiness exercise or actual incident review occurred within the past year, and critical response tools are accessible and functional.