Incident Response¶
Generating After Action Reports¶
KSI-INR-AAR
Changelog:
-
2026-10-13: Updated control mappings: added ir-5.1, ir-9.3.
-
2026-06-24: Official launch of the FedRAMP Consolidated Rules for 2026.
Incident after action reports are generated and lessons learned are persistently incorporated.
Related SP 800-53 Controls: IR-03, IR-04, IR-04 (01), IR-05 (01), IR-08, IR-09 (03)
Terms: Incident, Persistently
Reviewing Incident Response Procedures¶
KSI-INR-RIR
Changelog:
-
2026-10-13: Updated control mappings: added ir-4.11, ir-9.3.
-
2026-06-24: Official launch of the FedRAMP Consolidated Rules for 2026.
The effectiveness of documented incident response procedures is persistently reviewed.
Related SP 800-53 Controls: IR-04, IR-04 (01), IR-04 (11), IR-06, IR-06 (01), IR-06 (03), IR-07, IR-07 (01), IR-08, IR-08 (01), IR-09 (03), SI-04 (05)
Terms: Incident, Persistently, Vulnerability Response
Reviewing Past Incidents¶
KSI-INR-RPI
Changelog:
-
2026-10-13: Updated control mappings: added ir-4.11, ir-4.4, ir-5.1, ra-5.8.
-
2026-06-24: Official launch of the FedRAMP Consolidated Rules for 2026.
Past incidents are persistently reviewed for patterns or vulnerabilities that were not previously apparent or identified.
Related SP 800-53 Controls: IR-03, IR-04, IR-04 (01), IR-04 (11), IR-04 (04), IR-05, IR-05 (01), IR-08, RA-05 (08)
Terms: Incident, Persistently, Vulnerability