IR-8 Incident Response Plan

Guidance: draftPolicy clause: draftWhat these mean

Baselines	Implementation level	Enhancements
Low, Moderate, High, Privacy	Organization	1 (1 in a baseline)

Related controls: AC-2, CP-2, CP-4, IR-4, IR-7, IR-9, PE-6, PL-2, SA-15, SI-12, SR-8

Control statement

a. Develop an incident response plan that:
- 1. Provides the organization with a roadmap for implementing its incident response capability;
- 2. Describes the structure and organization of the incident response capability;
- 3. Provides a high-level approach for how the incident response capability fits into the overall organization;
- 4. Meets the unique requirements of the organization, which relate to mission, size, structure, and functions;
- 5. Defines reportable incidents;
- 6. Provides metrics for measuring the incident response capability within the organization;
- 7. Defines the resources and management support needed to effectively maintain and mature an incident response capability;
- 8. Addresses the sharing of incident information;
- 9. Is reviewed and approved by [Assignment: organization-defined personnel or roles] [Assignment: organization-defined frequency] ; and
- 10. Explicitly designates responsibility for incident response to [Assignment: organization-defined entities, personnel, or roles].
b. Distribute copies of the incident response plan to [Assignment: organization-defined incident response personnel];
c. Update the incident response plan to address system and organizational changes or problems encountered during plan implementation, execution, or testing;
d. Communicate incident response plan changes to [Assignment: organization-defined incident response personnel (identified by name and/or by role) and organizational elements] ; and
e. Protect the incident response plan from unauthorized disclosure and modification.

NIST discussion

It is important that organizations develop and implement a coordinated approach to incident response. Organizational mission and business functions determine the structure of incident response capabilities. As part of the incident response capabilities, organizations consider the coordination and sharing of information with external organizations, including external service providers and other organizations involved in the supply chain. For incidents involving personally identifiable information (i.e., breaches), include a process to determine whether notice to oversight organizations or affected individuals is appropriate and provide that notice accordingly.

Control enhancements

IR-8(1) Breaches

Baselines: Privacy

Include the following in the Incident Response Plan for breaches involving personally identifiable information:

(a) A process to determine if notice to individuals or other organizations, including oversight organizations, is needed;
(b) An assessment process to determine the extent of the harm, embarrassment, inconvenience, or unfairness to affected individuals and any mechanisms to mitigate such harms; and
(c) Identification of applicable privacy requirements.

Discussion and assessment objectives for IR-8(1)

Organizations may be required by law, regulation, or policy to follow specific procedures relating to breaches, including notice to individuals, affected organizations, and oversight bodies; standards of harm; and mitigation or other specific requirements.

Determine if:

IR-08(01)(a) the incident response plan for breaches involving personally identifiable information includes a process to determine if notice to individuals or other organizations, including oversight organizations, is needed;
IR-08(01)(b) the incident response plan for breaches involving personally identifiable information includes an assessment process to determine the extent of the harm, embarrassment, inconvenience, or unfairness to affected individuals and any mechanisms to mitigate such harms;
IR-08(01)(c) the incident response plan for breaches involving personally identifiable information includes the identification of applicable privacy requirements.

Examine: Incident response policy; procedures addressing incident response planning; incident response plan; system security plan; privacy plan; records of incident response plan reviews and approvals; other relevant documents or records.

Interview: Organizational personnel with incident response planning responsibilities; organizational personnel with information security and privacy responsibilities.

Test: Organizational incident response plan and related organizational processes.

Assessment objectives (SP 800-53A)

Objectives and methods for IR-8

Determine if:

IR-08a.
- IR-08a.01 an incident response plan is developed that provides the organization with a roadmap for implementing its incident response capability;
- IR-08a.02 an incident response plan is developed that describes the structure and organization of the incident response capability;
- IR-08a.03 an incident response plan is developed that provides a high-level approach for how the incident response capability fits into the overall organization;
- IR-08a.04 an incident response plan is developed that meets the unique requirements of the organization with regard to mission, size, structure, and functions;
- IR-08a.05 an incident response plan is developed that defines reportable incidents;
- IR-08a.06 an incident response plan is developed that provides metrics for measuring the incident response capability within the organization;
- IR-08a.07 an incident response plan is developed that defines the resources and management support needed to effectively maintain and mature an incident response capability;
- IR-08a.08 an incident response plan is developed that addresses the sharing of incident information;
- IR-08a.09 an incident response plan is developed that is reviewed and approved by [Assignment: organization-defined personnel or roles] [Assignment: organization-defined frequency];
- IR-08a.10 an incident response plan is developed that explicitly designates responsibility for incident response to [Assignment: organization-defined entities, personnel, or roles].
IR-08b.
- IR-08b.[01] copies of the incident response plan are distributed to [Assignment: organization-defined incident response personnel];
- IR-08b.[02] copies of the incident response plan are distributed to [Assignment: organization-defined organizational elements];
IR-08c. the incident response plan is updated to address system and organizational changes or problems encountered during plan implementation, execution, or testing;
IR-08d.
- IR-08d.[01] incident response plan changes are communicated to [Assignment: organization-defined incident response personnel];
- IR-08d.[02] incident response plan changes are communicated to [Assignment: organization-defined organizational elements];
IR-08e.
- IR-08e.[01] the incident response plan is protected from unauthorized disclosure;
- IR-08e.[02] the incident response plan is protected from unauthorized modification.

Interview: Organizational personnel with incident response planning responsibilities; organizational personnel with information security and privacy responsibilities.

Test: Organizational incident response plan and related organizational processes.

Policy statement

The Chief Information Security Officer shall develop an incident response plan that provides a roadmap for implementing the incident response capability. (IR-8a.1)
The plan shall describe the structure and organization of the incident response capability. (IR-8a.2)
The plan shall describe at a high level how the incident response capability fits into the overall organization. (IR-8a.3)
The plan shall meet the organization’s unique requirements related to its mission, size, structure and functions. (IR-8a.4)
The plan shall define reportable incidents. (IR-8a.5)
The plan shall provide metrics for measuring the incident response capability. (IR-8a.6)
The plan shall define the resources and management support needed to maintain and mature the incident response capability. (IR-8a.7)
The plan shall address the sharing of incident information. (IR-8a.8)
The plan shall be reviewed and approved by Fill in: personnel or roles that review and approve the incident response plan Typical: the Chief Information Security Officer Fill in: the frequency at which to review and approve the incident response plan Typical: annually. (IR-8a.9)
The plan shall explicitly designate responsibility for incident response to Fill in: entities, personnel, or roles with designated responsibility for incident response Typical: the incident response team, led by its designated lead. (IR-8a.10)
The Chief Information Security Officer shall distribute copies of the plan to Fill in: incident response personnel (identified by name and/or by role) to whom copies of the incident response plan are to be distributed Typical: the incident response team members, by role and Fill in: organizational elements to which copies of the incident response plan are to be distributed Typical: the security operations, legal, communications and human resources functions. (IR-8b)
The Chief Information Security Officer shall update the plan to address system and organizational changes, and problems found during its implementation, execution or testing. (IR-8c)
The Chief Information Security Officer shall communicate changes to the plan to Fill in: incident response personnel (identified by name and/or by role) and organizational elements Typical: everyone who received the plan. (IR-8d)
The Chief Information Security Officer shall protect the plan from unauthorized disclosure and modification. (IR-8e)

IR-8(1) Breaches

For breaches involving personally identifiable information, the incident response plan shall include a process, led by the Senior privacy official, to determine whether notice to individuals or other organizations, including oversight organizations, is needed. (IR-8(1)(a))
The plan shall include an assessment process to determine the extent of the harm, embarrassment, inconvenience or unfairness to affected individuals, and the mechanisms available to mitigate those harms. (IR-8(1)(b))
The plan shall identify the privacy requirements that apply to breaches, including each law, regulation, policy and contract that sets a notice, a standard of harm or a mitigation duty, with the notice each requires, to whom and by when. (IR-8(1)(c))
The Incident response team shall notify the Senior privacy official of every incident that involves, or may involve, personally identifiable information as soon as it is identified, and the Senior privacy official shall take part in its response. (IR-8(1))
The Senior privacy official shall record each harm assessment, notification decision and mitigation decision in the incident record, with who decided and when. (IR-8(1))
The Senior privacy official shall review the list of applicable privacy requirements each time the plan is reviewed, and when a law, regulation or contract changes. (IR-8(1)(c))

Federal systems

The Privacy Act requires each agency that maintains a system of records to establish appropriate administrative, technical and physical safeguards to protect against threats or hazards to the records’ security or integrity “which could result in substantial harm, embarrassment, inconvenience, or unfairness to any individual on whom information is maintained” (5 U.S.C. § 552a(e)(10), United States Code, 2024 edition), the standard of harm IR-8(1)(b) repeats. OMB Circular A-130, Appendix I, section 4.f(7), requires incident response capabilities and mechanisms that include notification to affected individuals; section 4.f(9) requires agencies to report incidents to OMB, DHS, the CIO, the senior agency official for privacy, their inspectors general and general counsel, law enforcement and Congress in accordance with procedures issued by OMB; and section 4.j(2)(e) requires incident response procedures for systems operated on the agency’s behalf, including timelines for notification of affected individuals.

OMB Memorandum M-17-12 (January 3, 2017), which OMB’s FY 2026 SAOP FISMA reporting metrics (August 2026) still cite, sets the breach procedures OMB issued. Section VII requires the senior agency official for privacy to develop and implement a breach response plan, as part of the agency’s formal incident response plan, with at least these elements: the breach response team; identifying applicable privacy compliance documentation (system of records notices, privacy impact assessments and privacy notices); information sharing to respond to a breach; reporting requirements and the officials responsible; assessing the risk of harm to individuals; mitigating that risk; and notifying individuals. Section VII.A has the head of the agency designate the breach response team, led by the senior agency official for privacy and including at least the CIO or designee, the senior agency information security officer, legal counsel, and legislative affairs and communications officials; the team is always convened when a breach is a major incident. Section VII.E requires the senior agency official for privacy to conduct and document an assessment of the risk of harm, considering the nature and sensitivity of the information, the likelihood of access and use, and the type of breach. Under section VII.G, the senior agency official for privacy advises the head of the agency, who makes the final decision on whether to notify; notice is given as expeditiously as practicable and without unreasonable delay (section VII.G.2). Section VIII has the principal security operations center track and document each breach and keep the senior agency official for privacy aware of it; section IX has that center report the status of each breach to the senior agency official for privacy at the end of each quarter of the fiscal year, for that official to review and validate; and section X.B requires that official to review the plan at the end of each fiscal year.

OMB Memorandum M-25-04, Fiscal Year 2025 Guidance on Federal Information Security and Privacy Management Requirements (January 15, 2025), is the most recent FISMA guidance memorandum. Section X defines a major incident, including a breach of personally identifiable information likely to result in demonstrable harm to the national security interests, foreign relations or economy of the United States, or to the public confidence, civil liberties or public health and safety of the American people, and requires a major incident determination for any unauthorized modification, deletion, exfiltration of, or access to the personally identifiable information of 100,000 or more people. Agencies report a major incident to CISA and the OMB Office of the Federal Chief Information Officer within 1 hour of determining it is major, notify the appropriate congressional committees and their Office of Inspector General within 7 days of having a reasonable basis to conclude it occurred, and, for a breach that is a major incident, supplement the congressional report within 30 days of discovering the breach. Its footnote 37 keeps the major incident analysis separate from the M-17-12 assessment of the risk of harm to individuals. As of October 2026.

The incident response plan’s breach section shall serve as the agency’s breach response plan under OMB M-17-12, section VII, with each element that section lists, and the Senior privacy official shall review it at the end of each fiscal year as section X.B requires. (IR-8(1))
The breach section shall name the breach response team the head of the agency designates under OMB M-17-12, section VII.A, the criteria for convening it, and the officials responsible for reporting a breach to CISA, law enforcement, inspectors general, general counsel and Congress (section VII.D). (IR-8(1)(a))
The harm assessment shall follow OMB M-17-12, section VII.E, and the Senior privacy official shall advise the head of the agency on whether and when to notify individuals, as section VII.G provides. (IR-8(1)(a), IR-8(1)(b))
The breach section shall apply the major incident criteria of OMB M-25-04, section X, including the required determination for a breach affecting 100,000 or more people, and its reporting: CISA and the OMB Office of the Federal Chief Information Officer within 1 hour of the determination, the congressional committees and the Office of Inspector General within 7 days, and a supplemental report within 30 days of discovering the breach. (IR-8(1)(a))
The plan’s list of applicable privacy requirements shall include the Privacy Act for each system of records, OMB M-17-12 and OMB M-25-04, and any other breach notification requirement that applies to the system’s information, such as one for health information. (IR-8(1)(c))
The Senior privacy official shall ensure that contracts and agreements for systems operated on the agency’s behalf set timelines for reporting breaches to the agency and for notifying affected individuals, as OMB Circular A-130, Appendix I, section 4.j(2)(e), requires. (IR-8(1))

From the Incident Response Policy template (draft). Highlighted fields are values your organization sets.

How to apply it

IR-8 asks for a written incident response plan that sets out how the capability is organized, what counts as a reportable incident, how the capability is measured and resourced, and who is responsible. The plan is approved, distributed, kept current and protected. Start from the Incident Response Plan template, which covers each IR-8a element.

Common implementations. One organization-wide plan, approved by the Chief Information Security Officer, with system-specific appendices for contacts and recovery steps. Reportable incidents defined by severity with examples. Metrics such as time to detect, time to contain and number of incidents by type. The plan stored in a controlled document repository with access limited to the response team and named functions, and a copy kept offline so it is available during an outage.

Organization-defined parameters. Typical values, which your organization may set differently:

Parameter	Typical value
Who reviews and approves the plan (a.9)	The Chief Information Security Officer
Review and approval frequency (a.9)	Annually
Who holds responsibility for incident response (a.10)	The incident response team, led by its designated lead
Who receives copies (b)	The incident response team members, by role, and the security operations, legal, communications and human resources functions
Who is told of changes (d)	Everyone who received the plan

Evidence assessors ask for.

The current plan, with its approval signature and date
The distribution list and evidence the latest version reached it
The change history, including changes made after tests or incidents (IR-8c)
Access controls on the plan’s storage location

Inheritance. The organization-wide plan is usually a common control. The system provides its appendix and confirms the plan covers its incident types.

Common findings.

The plan not reviewed or re-approved in over a year.
No definition of a reportable incident, or one that differs from the reporting procedure.
Metrics listed in the plan but never collected.
Changes after an exercise made in practice but not in the plan.

Enhancements in the Moderate baseline. None.

Enhancements in the Privacy baseline. IR-8(1) breaches: for breaches involving personally identifiable information, the plan includes a process to decide whether to notify individuals or other organizations, including oversight organizations; an assessment of the extent of harm, embarrassment, inconvenience or unfairness to affected individuals, with ways to mitigate it; and the privacy requirements that apply. NIST’s discussion notes that laws, regulations and policies may set specific breach procedures, including notice, standards of harm and mitigation. IR-8(1) has no parameters. In the Incident Response policy, the senior privacy official leads the notification decision, is told of every incident that may involve personally identifiable information as soon as it is identified, records each harm assessment and decision in the incident record, and reviews the list of requirements with each plan review. The Incident Response Plan template’s breach section, under section 5, holds the three elements and the list, and section 5.8 of the incident handling playbook carries them out. NIST SP 800-122 (April 2010; current as of October 2026), section 5, recommends building breach handling into the existing incident response plan, planning in advance how, when and to whom notice is given, and deciding when to offer remedial help such as credit monitoring. Assessors ask for the plan’s breach section, the list of applicable requirements, and for a past breach the harm assessment and notification decision, including decisions not to notify.

Federal systems (as of October 2026). The Privacy Act requires each agency that maintains a system of records to set safeguards against threats or hazards that “could result in substantial harm, embarrassment, inconvenience, or unfairness to any individual on whom information is maintained” (5 U.S.C. § 552a(e)(10), United States Code, 2024 edition), the standard of harm IR-8(1)(b) uses. OMB Circular A-130, Appendix I, requires incident response mechanisms that include notification to affected individuals (section 4.f(7)), reporting of incidents to OMB, DHS, the CIO, the senior agency official for privacy, inspectors general and general counsel, law enforcement and Congress in accordance with procedures issued by OMB (section 4.f(9)), and, for systems operated on the agency’s behalf, incident response procedures with timelines for notifying affected individuals (section 4.j(2)(e)).

OMB Memorandum M-17-12 (January 3, 2017), which OMB’s FY 2026 senior agency official for privacy FISMA reporting metrics (August 2026) still cite, is the federal version of IR-8(1). Section VII requires the senior agency official for privacy to develop a breach response plan as part of the agency’s formal incident response plan. The plan covers the breach response team, applicable privacy compliance documentation, information sharing, reporting, assessing and mitigating the risk of harm, and notifying individuals. The head of the agency designates the team, which the senior agency official for privacy leads (section VII.A). That official documents a risk-of-harm assessment (section VII.E) and advises the head of the agency, who decides whether to notify (section VII.G), and reviews the plan at the end of each fiscal year (section X.B). OMB Memorandum M-25-04 (January 15, 2025), the most recent FISMA guidance memorandum, section X, makes a breach a major incident when it is likely to result in demonstrable harm to national interests or public confidence, and always requires a major incident determination when the personally identifiable information of 100,000 or more people is affected. A major breach is reported to CISA and the OMB Office of the Federal Chief Information Officer within 1 hour of the determination, and to the congressional committees and the Office of Inspector General within 7 days. A supplemental report goes to Congress within 30 days of discovering the breach. Its footnote 37 keeps that analysis separate from the M-17-12 risk-of-harm assessment. The IR-8(1) clause’s federal block carries these into the policy, and the incident handling playbook’s federal block adds them to its steps.

Artifacts

Independent guidance, not an official NIST publication. Control text is from NIST SP 800-53 Rev. 5 and SP 800-53A (public domain). Original content is licensed CC BY 4.0; program templates and the downloadable kit are dedicated to the public domain under CC0 1.0.