{"$schema":"https://json-schema.org/draft/2020-12/schema","$id":"https://fedramp.gov/schemas/fedramp-incident-report-schema-2026-06-24.json","$schemaVersion":"0.2.1","type":"object","title":"FedRAMP Incident Report (IEC-CSO-IIR / IEC-CSO-OIR / IEC-CSO-FIR)","description":"Unified schema for the three incident report types in the IEC-CSO lifecycle: Initial (IEC-CSO-IIR), Ongoing (IEC-CSO-OIR), and Final (IEC-CSO-FIR).","required":["certificationPackageOverviewUri","reportType","providerTrackingId"],"properties":{"certificationPackageOverviewUri":{"$ref":"https://fedramp.gov/schemas/fedramp-common-definitions-schema-2026-06-24.json#/$defs/certificationPackageOverviewUri"},"reportType":{"type":"string","title":"Report Type","description":"Initial = IEC-CSO-IIR; Ongoing = IEC-CSO-OIR; Final = IEC-CSO-FIR.","enum":["Initial","Ongoing","Final"]},"providerTrackingId":{"type":"string","title":"Provider Tracking ID","description":"Provider's internally assigned identifier for this incident. Must be consistent across IIR, OIR, and FIR reports for the same incident."},"federalIncidentCoordinator":{"type":"string","title":"Federal Incident Response Coordinator","description":"Contact information for the provider's federal incident response coordinator."},"incidentDescription":{"type":"string","title":"Incident Description","description":"Description of the incident."},"timeline":{"type":"object","title":"Timeline","description":"Timeline of the incident per IEC-CSO-IIR field 4.","properties":{"startedAt":{"type":"string","format":"date-time","title":"Started At","description":"When the incident started."},"detectedAt":{"type":"string","format":"date-time","title":"Detected At","description":"When the incident was detected."},"detectionSource":{"type":"string","title":"Detection Source","description":"Source of the incident detection."},"evaluationCompletedAt":{"type":"string","format":"date-time","title":"FedRAMP Reportable Incident Evaluation Completed At","description":"When the FedRAMP reportable incident evaluation was completed."},"milestones":{"type":"array","title":"Milestones","description":"Major events in the incident lifecycle.","items":{"$ref":"#/$defs/milestone"}}}},"potentialImpact":{"type":"object","title":"Potential Impact","description":"Describe the current and historical potential impact to your system.","properties":{"historicalRating":{"type":"array","title":"Historical Rating","description":"Historical rating of the incident.","items":{"$ref":"https://fedramp.gov/schemas/fedramp-common-definitions-schema-2026-06-24.json#/$defs/nRating"}},"currentRating":{"$ref":"https://fedramp.gov/schemas/fedramp-common-definitions-schema-2026-06-24.json#/$defs/nRating","title":"Current Rating","description":"Current rating of the incident."},"evaluationNotes":{"type":"string","title":"Evaluation Notes","description":"Explanation of the PAIN evaluation per IEC-CSO-EFI. Required if applicable."}}},"functionalImpact":{"type":"string","title":"Functional Impact","description":"Describe the actual or potential impact to federal agency customers."},"recoveryPlan":{"type":"string","title":"Recovery Plan","description":"Estimated recovery plan, milestones, and timelines."},"affectedAgencies":{"type":"array","title":"Likely Affected Customer Agencies","description":"List of customer agencies that may be affected by the incident.","items":{"type":"string"}},"observedActivity":{"type":"string","title":"Observed Incident Activity","description":"Per IEC-CSO-OIR."},"indicatorsOfCompromise":{"type":"array","title":"Indicators of Compromise","description":"Per IEC-CSO-OIR.","items":{"type":"string"}},"relatedCveIds":{"type":"array","title":"Related CVE Identifiers","description":"Per IEC-CSO-OIR. Include if applicable.","items":{"type":"string","pattern":"^CVE-[0-9]{4}-[0-9]{4,}$"}},"rootCause":{"type":"string","title":"Root Cause","description":"Per IEC-CSO-OIR."},"responseAndRecoveryActivities":{"type":"string","title":"Response and Recovery Activities","description":"Per IEC-CSO-OIR."},"resolvedAt":{"type":"string","format":"date-time","title":"Resolved At","description":"When the incident was resolved and recovery completed. Required for Final reports (IEC-CSO-FIR)."}},"if":{"required":["reportType"],"properties":{"reportType":{"title":"Report Type","description":"Initial = IEC-CSO-IIR; Ongoing = IEC-CSO-OIR; Final = IEC-CSO-FIR.","const":"Final"}}},"then":{"required":["resolvedAt"]},"$defs":{"milestone":{"type":"object","title":"Incident Milestone","description":"Major events in the incident lifecycle.","required":["occurredAt","milestoneDescription"],"properties":{"occurredAt":{"type":"string","format":"date-time","title":"Occurred At","description":"When the milestone occurred."},"milestoneDescription":{"type":"string","title":"Description","description":"Description of the milestone."}}}}}