# Incident Response Policy

**Template version:** 1.0.0 · **Baseline:** High · **Edition:** Annotated (with guidance) · **NIST basis:** SP 800-53 Rev. 5, release 5.2.0

*Tailor this template before adoption; it is not legal advice.* Latest version: <https://kston83.github.io/nist-guide/templates/policies/ir/>. Dedicated to the public domain under CC0 1.0 (<https://creativecommons.org/publicdomain/zero/1.0/>): adopt and change it without attribution.

> **Guidance:** The sections before and after Policy statements meet IR-1, which asks for a policy that addresses purpose, scope, roles, responsibilities, management commitment, coordination and compliance, plus procedures, dissemination, a designated official and a review cycle. Assessors check each element, so keep every section even when it is short. Each statement cites the IR-1 item it meets. If you adopt several family policies, the same sections repeat in each; that is expected, and it lets each policy stand alone.

## Purpose

This policy states what [Organization name] requires for Incident Response, and who is accountable for meeting those requirements. (IR-1a.1(a))

## Scope

This policy applies at the [Select one or more: organization-level; mission/business process-level; system-level. Typical: organization-level] to every system that [Organization name] owns or operates, or that is operated on its behalf, and to every person with access to those systems, including employees, contractors and partners. (IR-1a.1(a))

## Roles and responsibilities

- The [Chief Information Security Officer] is accountable for this policy and shall approve exceptions to it. (IR-1a.1(a))
- The [Fill in: an official to manage the incident response policy and procedures. Typical: Chief Information Security Officer] shall manage the development, documentation and dissemination of this policy and its procedures. (IR-1b)
- Each [System owner] shall implement this policy for their system and document how in the system security plan. (IR-1a.1(a))
- Each person within scope shall follow this policy and report suspected violations to the [Chief Information Security Officer]. (IR-1a.1(a))

## Management commitment

The [Senior leader] approves this policy and shall provide the resources needed to implement it. (IR-1a.1(a))

## Coordination

The [Chief Information Security Officer] shall coordinate this policy with the legal, privacy, human resources and procurement functions, and with the owners of related policies, before each approval. (IR-1a.1(a))

## Compliance

- This policy shall be consistent with the laws, executive orders, directives, regulations, policies, standards and guidelines that apply to [Organization name], including [Fill in: laws, regulations and standards that apply to the organization]. (IR-1a.1(b))
- The [Chief Information Security Officer] shall review compliance with this policy through the organization's assessment and continuous monitoring activities. (IR-1a.1(a))
- An exception to this policy shall be requested in writing, approved by the [Chief Information Security Officer], time-limited and recorded with its compensating measures. (IR-1a.1(a))
- Violations of this policy shall be handled through the organization's sanctions process. (IR-1a.1(a))

## Procedures

The [Fill in: an official to manage the incident response policy and procedures. Typical: Chief Information Security Officer] shall ensure that documented procedures exist to implement this policy and its associated controls. (IR-1a.2)

## Dissemination

- The [Fill in: an official to manage the incident response policy and procedures. Typical: Chief Information Security Officer] shall disseminate this policy to [Fill in: personnel or roles to whom the incident response policy is to be disseminated. Typical: everyone within its scope, through the policy library]. (IR-1a)
- The [Fill in: an official to manage the incident response policy and procedures. Typical: Chief Information Security Officer] shall disseminate the procedures that implement this policy to [Fill in: personnel or roles to whom the incident response procedures are to be disseminated. Typical: the people who carry them out, and the system owners]. (IR-1a)

## Policy statements

> **Guidance:** Each statement below comes from the clause for one control or enhancement in the chosen baseline. The reference at the end of each statement names the control item it meets.

### Incident response training (IR-2)

- The [Incident response team] shall provide incident response training, consistent with assigned roles and responsibilities, to system users within [Fill in: a time period within which incident response training is to be provided to system users assuming an incident response role or responsibility. Typical: 30 days] of their assuming an incident response role or responsibility or acquiring system access. (IR-2a.1)
- The [Incident response team] shall provide that training when system changes require it. (IR-2a.2)
- The [Incident response team] shall provide that training [Fill in: frequency at which to provide incident response training to users. Typical: annually] thereafter. (IR-2a.3)
- The [Incident response team] shall review and update incident response training content [Fill in: frequency at which to review and update incident response training content. Typical: annually] and following [Fill in: events that initiate a review of the incident response training content. Typical: a change to the incident response plan, and lessons learned from an incident or exercise]. (IR-2b)

### Simulated events (IR-2(1))

- The [Incident response team] shall incorporate simulated events into incident response training so personnel practice the required response to crisis situations. (IR-2(1))

### Automated training environments (IR-2(2))

- The [Incident response team] shall provide an incident response training environment using [Fill in: automated mechanisms used in an incident response training environment. Typical: a cyber range or isolated lab that replays realistic attack activity]. (IR-2(2))

### Incident response testing (IR-3)

- The [Incident response team] shall test the effectiveness of the incident response capability for the system [Fill in: frequency at which to test the effectiveness of the incident response capability for the system. Typical: annually] using [Fill in: tests used to test the effectiveness of the incident response capability for the system. Typical: a tabletop exercise based on a realistic scenario, and a functional test of notification and escalation]. (IR-3)

### Coordination with related plans (IR-3(2))

- The [Incident response team] shall coordinate incident response testing with the organizational elements responsible for related plans, such as contingency, continuity and crisis communications plans. (IR-3(2))

### Incident handling (IR-4)

> **Guidance:** IR-4a names the phases of the incident handling life cycle from NIST SP 800-61 Rev. 2. Its successor, [SP 800-61 Rev. 3](https://csrc.nist.gov/pubs/sp/800/61/r3/final) (April 2025), organizes incident response around the CSF 2.0 Functions instead; the Incident Response Plan template follows Rev. 3 and still covers every IR-4a phase. Assessors ask for records of recent incidents that show each phase, and for evidence that a lesson learned changed a procedure.

- The [Incident response team] shall implement an incident handling capability, consistent with the incident response plan, that includes preparation, detection and analysis, containment, eradication and recovery. (IR-4a)
- The [Incident response team] shall coordinate incident handling activities with contingency planning activities. (IR-4b)
- The [Incident response team] shall incorporate lessons learned from incident handling into incident response procedures, training and testing, and implement the resulting changes. (IR-4c)
- The [Chief Information Security Officer] shall ensure the rigor, intensity, scope and results of incident handling are comparable and predictable across the organization. (IR-4d)

### Automated incident handling processes (IR-4(1))

- The [Incident response team] shall support the incident handling process using [Fill in: automated mechanisms used to support the incident handling process. Typical: the case management system and automated playbooks in the security operations platform]. (IR-4(1))

### Information correlation (IR-4(4))

- The [Incident response team] shall correlate incident information and individual incident responses to achieve an organization-wide perspective on incident awareness and response. (IR-4(4))

### Integrated incident response team (IR-4(11))

- The [Chief Information Security Officer] shall establish and maintain an integrated incident response team that can be deployed to any location the organization identifies within [Fill in: the time period within which an integrated incident response team can be deployed. Typical: 24 hours]. (IR-4(11))

### Incident monitoring (IR-5)

- The [Incident response team] shall track and document incidents. (IR-5)

### Automated tracking, data collection and analysis (IR-5(1))

- The [Incident response team] shall track incidents and collect and analyze incident information using [Fill in: automated mechanisms. Typical: the incident case management system integrated with the security operations platform]. (IR-5(1))

### Incident reporting (IR-6)

- All personnel shall report suspected incidents to the [Incident response team] within [Fill in: time period for personnel to report suspected incidents to the organizational incident response capability. Typical: 1 hour of discovery]. (IR-6a)
- The [Incident response team] shall report incident information to [Fill in: authorities to whom incident information is to be reported. Typical: senior leadership, legal counsel, and any regulator, customer or partner that law or contract requires be notified]. (IR-6b)

#### Federal systems

Federal agencies notify the Cybersecurity and Infrastructure Security Agency (CISA) of incidents under FISMA (44 U.S.C. §§ 3553 and 3554). As of September 2026, the [CISA Federal Incident Notification Guidelines](https://www.cisa.gov/federal-incident-notification-guidelines) (effective April 1, 2017) set the time frame: within one hour of the incident being identified by the agency's top-level incident response team, security operations center or IT department.

- The [Incident response team] shall report incidents to CISA within one hour of identification, as the CISA Federal Incident Notification Guidelines require. (IR-6b)

### Automated reporting (IR-6(1))

- The [Incident response team] shall report incidents using [Fill in: automated mechanisms used for reporting incidents. Typical: the incident report form and case management system, which notify the incident response team automatically]. (IR-6(1))

### Supply chain coordination (IR-6(3))

- The [Incident response team] shall provide incident information to the provider of the product or service, and to other organizations in the supply chain, for system components related to an incident. (IR-6(3))

### Incident response assistance (IR-7)

- The [Incident response team] shall provide an incident response support resource, as part of the incident response capability, that offers system users advice and assistance with handling and reporting incidents. (IR-7)

### Automation support for availability of information and support (IR-7(1))

- The [Incident response team] shall increase the availability of incident response information and support using [Fill in: automated mechanisms used to increase the availability of incident response information and support. Typical: a self-service reporting portal and an incident response page on the intranet]. (IR-7(1))

### Incident response plan (IR-8)

- The [Chief Information Security Officer] shall develop an incident response plan that provides a roadmap for implementing the incident response capability. (IR-8a.1)
- The plan shall describe the structure and organization of the incident response capability. (IR-8a.2)
- The plan shall describe at a high level how the incident response capability fits into the overall organization. (IR-8a.3)
- The plan shall meet the organization's unique requirements related to its mission, size, structure and functions. (IR-8a.4)
- The plan shall define reportable incidents. (IR-8a.5)
- The plan shall provide metrics for measuring the incident response capability. (IR-8a.6)
- The plan shall define the resources and management support needed to maintain and mature the incident response capability. (IR-8a.7)
- The plan shall address the sharing of incident information. (IR-8a.8)
- The plan shall be reviewed and approved by [Fill in: personnel or roles that review and approve the incident response plan. Typical: the Chief Information Security Officer] [Fill in: the frequency at which to review and approve the incident response plan. Typical: annually]. (IR-8a.9)
- The plan shall explicitly designate responsibility for incident response to [Fill in: entities, personnel, or roles with designated responsibility for incident response. Typical: the incident response team, led by its designated lead]. (IR-8a.10)
- The [Chief Information Security Officer] shall distribute copies of the plan to [Fill in: incident response personnel (identified by name and/or by role) to whom copies of the incident response plan are to be distributed. Typical: the incident response team members, by role] and [Fill in: organizational elements to which copies of the incident response plan are to be distributed. Typical: the security operations, legal, communications and human resources functions]. (IR-8b)
- The [Chief Information Security Officer] shall update the plan to address system and organizational changes, and problems found during its implementation, execution or testing. (IR-8c)
- The [Chief Information Security Officer] shall communicate changes to the plan to [Fill in: incident response personnel (identified by name and/or by role) and organizational elements. Typical: everyone who received the plan]. (IR-8d)
- The [Chief Information Security Officer] shall protect the plan from unauthorized disclosure and modification. (IR-8e)

## Review and update

- The [Fill in: an official to manage the incident response policy and procedures. Typical: Chief Information Security Officer] shall review and update this policy [Fill in: the frequency at which the current incident response policy is reviewed and updated. Typical: annually] and following [Fill in: events that would require the current incident response policy to be reviewed and updated. Typical: assessment or audit findings, security incidents or breaches, and changes in applicable laws, executive orders, directives, regulations, policies, standards or guidelines]. (IR-1c.1)
- The [Fill in: an official to manage the incident response policy and procedures. Typical: Chief Information Security Officer] shall review and update the procedures that implement this policy [Fill in: the frequency at which the current incident response procedures are reviewed and updated. Typical: annually] and following [Fill in: events that would require the incident response procedures to be reviewed and updated. Typical: the same events as the policy, and changes to the systems, tools or services the procedures describe]. (IR-1c.2)

### Federal systems

For federal information systems, this policy also carries out the agency's information security responsibilities under the Federal Information Security Modernization Act of 2014 ([44 U.S.C. § 3554](https://uscode.house.gov/view.xhtml?req=granuleid:USC-prelim-title44-section3554&num=0&edition=prelim), Federal agency responsibilities) and [OMB Circular A-130](https://www.whitehouse.gov/wp-content/uploads/legacy_drupal_files/omb/circulars/A130/a130revised.pdf), Appendix I, Responsibilities for Protecting and Managing Federal Information Resources.

- Where the agency's organization-wide policy sets a value for a parameter in this policy, each system shall use that value or a stricter one. (IR-1a.1(b))