# Incident Response Policy

**Template version:** 1.0.0 · **Baseline:** Privacy · **Edition:** Annotated (with guidance) · **NIST basis:** SP 800-53 Rev. 5, release 5.2.0

*Tailor this template before adoption; it is not legal advice.* Latest version: <https://kston83.github.io/nist-guide/templates/policies/ir/>. Dedicated to the public domain under CC0 1.0 (<https://creativecommons.org/publicdomain/zero/1.0/>): adopt and change it without attribution.

> **Guidance:** The sections before and after Policy statements meet IR-1, which asks for a policy that addresses purpose, scope, roles, responsibilities, management commitment, coordination and compliance, plus procedures, dissemination, a designated official and a review cycle. Assessors check each element, so keep every section even when it is short. Each statement cites the IR-1 item it meets. If you adopt several family policies, the same sections repeat in each; that is expected, and it lets each policy stand alone.

## Purpose

This policy states what [Organization name] requires for Incident Response, and who is accountable for meeting those requirements. (IR-1a.1(a))

## Scope

This policy applies at the [Select one or more: organization-level; mission/business process-level; system-level. Typical: organization-level] to every system that [Organization name] owns or operates, or that is operated on its behalf, and to every person with access to those systems, including employees, contractors and partners. (IR-1a.1(a))

## Roles and responsibilities

- The [Chief Information Security Officer] is accountable for this policy and shall approve exceptions to it. (IR-1a.1(a))
- The [Fill in: an official to manage the incident response policy and procedures. Typical: Chief Information Security Officer] shall manage the development, documentation and dissemination of this policy and its procedures. (IR-1b)
- Each [System owner] shall implement this policy for their system and document how in the system security plan. (IR-1a.1(a))
- Each person within scope shall follow this policy and report suspected violations to the [Chief Information Security Officer]. (IR-1a.1(a))

## Management commitment

The [Senior leader] approves this policy and shall provide the resources needed to implement it. (IR-1a.1(a))

## Coordination

The [Chief Information Security Officer] shall coordinate this policy with the legal, privacy, human resources and procurement functions, and with the owners of related policies, before each approval. (IR-1a.1(a))

## Compliance

- This policy shall be consistent with the laws, executive orders, directives, regulations, policies, standards and guidelines that apply to [Organization name], including [Fill in: laws, regulations and standards that apply to the organization]. (IR-1a.1(b))
- The [Chief Information Security Officer] shall review compliance with this policy through the organization's assessment and continuous monitoring activities. (IR-1a.1(a))
- An exception to this policy shall be requested in writing, approved by the [Chief Information Security Officer], time-limited and recorded with its compensating measures. (IR-1a.1(a))
- Violations of this policy shall be handled through the organization's sanctions process. (IR-1a.1(a))

## Procedures

The [Fill in: an official to manage the incident response policy and procedures. Typical: Chief Information Security Officer] shall ensure that documented procedures exist to implement this policy and its associated controls. (IR-1a.2)

## Dissemination

- The [Fill in: an official to manage the incident response policy and procedures. Typical: Chief Information Security Officer] shall disseminate this policy to [Fill in: personnel or roles to whom the incident response policy is to be disseminated. Typical: everyone within its scope, through the policy library]. (IR-1a)
- The [Fill in: an official to manage the incident response policy and procedures. Typical: Chief Information Security Officer] shall disseminate the procedures that implement this policy to [Fill in: personnel or roles to whom the incident response procedures are to be disseminated. Typical: the people who carry them out, and the system owners]. (IR-1a)

## Policy statements

> **Guidance:** Each statement below comes from the clause for one control or enhancement in the chosen baseline. The reference at the end of each statement names the control item it meets.

### Incident response training (IR-2)

- The [Incident response team] shall provide incident response training, consistent with assigned roles and responsibilities, to system users within [Fill in: a time period within which incident response training is to be provided to system users assuming an incident response role or responsibility. Typical: 30 days] of their assuming an incident response role or responsibility or acquiring system access. (IR-2a.1)
- The [Incident response team] shall provide that training when system changes require it. (IR-2a.2)
- The [Incident response team] shall provide that training [Fill in: frequency at which to provide incident response training to users. Typical: annually] thereafter. (IR-2a.3)
- The [Incident response team] shall review and update incident response training content [Fill in: frequency at which to review and update incident response training content. Typical: annually] and following [Fill in: events that initiate a review of the incident response training content. Typical: a change to the incident response plan, and lessons learned from an incident or exercise]. (IR-2b)

### Breach (IR-2(3))

> **Guidance:** IR-2(3) is in the Privacy baseline only. NIST's discussion says that, for federal agencies, an incident that involves personally identifiable information is a breach: a loss of control, compromise, unauthorized disclosure or acquisition, or similar occurrence where someone other than an authorized user accesses or potentially accesses the information, or an authorized user does so for other than authorized purposes. The training stresses that everyone must report both confirmed and suspected breaches, in any medium or form, including paper, oral and electronic, and it includes tabletop exercises that simulate a breach. Most breaches start with an ordinary mistake, such as an email to the wrong recipient or a lost printout, so the people who need this training most are users, not only responders. The [tabletop exercise kit](https://kston83.github.io/nist-guide/templates/plans/tabletop-exercise-kit/) has a breach scenario, and section 5.8 of the [incident handling playbook](https://kston83.github.io/nist-guide/templates/procedures/incident-handling-playbook/) is the response the training teaches.

- For a system that processes personally identifiable information, the [Incident response team] shall provide incident response training on how to identify and respond to a breach, including the organization's process for reporting a breach. (IR-2(3))
- The training shall teach that every person must report both confirmed and suspected breaches involving information in any medium or form, including paper, oral and electronic, within the time the incident reporting statement sets (IR-6a), and shall give examples drawn from the system's own information. (IR-2(3))
- The [Senior privacy official] shall review the breach content of incident response training each time the content is reviewed under IR-2b, and after each breach. (IR-2(3))
- The [Incident response team] shall include, in each annual cycle of incident response training, a tabletop exercise that simulates a breach for the personnel the incident response plan gives breach response roles. (IR-2(3))

#### Federal systems

[OMB Memorandum M-17-12](https://www.whitehouse.gov/wp-content/uploads/legacy_drupal_files/omb/memoranda/2017/m-17-12_0.pdf), Preparing for and Responding to a Breach of Personally Identifiable Information (January 3, 2017), sets agency breach policy; OMB's FY 2026 SAOP FISMA reporting metrics (August 2026) still cite it. Section IV requires each agency to train all individuals with access to its Federal information and information systems, including detailees, contractors, grantees, volunteers and interns, on how to identify and respond to a breach, including the agency's internal reporting process, before they access Federal information or systems and in annual privacy and security awareness training. Section VI requires everyone with access to report a suspected or confirmed breach "as soon as possible and without unreasonable delay", in any medium or form, without waiting for confirmation. Section X.A requires the senior agency official for privacy to convene the breach response team for a tabletop exercise periodically, but not less than annually. [OMB Circular A-130](https://www.whitehouse.gov/wp-content/uploads/legacy_drupal_files/omb/circulars/A130/a130revised.pdf), Appendix I, section 4.f(7), also requires training and awareness for employees and contractors on how to report and respond to incidents. As of October 2026.

- Breach training shall be given to every individual with access to agency information or information systems, including detailees, contractors, grantees, volunteers and interns, before they are granted access and in the annual privacy and security awareness training, as OMB M-17-12, section IV, requires. (IR-2(3))
- The training shall teach that a suspected or confirmed breach is reported as soon as possible and without unreasonable delay, without waiting for confirmation, as OMB M-17-12, section VI, requires. (IR-2(3))
- The [Senior privacy official] shall convene the agency's breach response team for a breach tabletop exercise at least annually, as OMB M-17-12, section X.A, requires. (IR-2(3))

### Incident response testing (IR-3)

- The [Incident response team] shall test the effectiveness of the incident response capability for the system [Fill in: frequency at which to test the effectiveness of the incident response capability for the system. Typical: annually] using [Fill in: tests used to test the effectiveness of the incident response capability for the system. Typical: a tabletop exercise based on a realistic scenario, and a functional test of notification and escalation]. (IR-3)

### Incident handling (IR-4)

> **Guidance:** IR-4a names the phases of the incident handling life cycle from NIST SP 800-61 Rev. 2. Its successor, [SP 800-61 Rev. 3](https://csrc.nist.gov/pubs/sp/800/61/r3/final) (April 2025), organizes incident response around the CSF 2.0 Functions instead; the Incident Response Plan template follows Rev. 3 and still covers every IR-4a phase. Assessors ask for records of recent incidents that show each phase, and for evidence that a lesson learned changed a procedure.

- The [Incident response team] shall implement an incident handling capability, consistent with the incident response plan, that includes preparation, detection and analysis, containment, eradication and recovery. (IR-4a)
- The [Incident response team] shall coordinate incident handling activities with contingency planning activities. (IR-4b)
- The [Incident response team] shall incorporate lessons learned from incident handling into incident response procedures, training and testing, and implement the resulting changes. (IR-4c)
- The [Chief Information Security Officer] shall ensure the rigor, intensity, scope and results of incident handling are comparable and predictable across the organization. (IR-4d)

### Incident monitoring (IR-5)

- The [Incident response team] shall track and document incidents. (IR-5)

### Incident reporting (IR-6)

- All personnel shall report suspected incidents to the [Incident response team] within [Fill in: time period for personnel to report suspected incidents to the organizational incident response capability. Typical: 1 hour of discovery]. (IR-6a)
- The [Incident response team] shall report incident information to [Fill in: authorities to whom incident information is to be reported. Typical: senior leadership, legal counsel, and any regulator, customer or partner that law or contract requires be notified]. (IR-6b)

#### Federal systems

Federal agencies notify the Cybersecurity and Infrastructure Security Agency (CISA) of incidents under FISMA (44 U.S.C. §§ 3553 and 3554). As of September 2026, the [CISA Federal Incident Notification Guidelines](https://www.cisa.gov/federal-incident-notification-guidelines) (effective April 1, 2017) set the time frame: within one hour of the incident being identified by the agency's top-level incident response team, security operations center or IT department.

- The [Incident response team] shall report incidents to CISA within one hour of identification, as the CISA Federal Incident Notification Guidelines require. (IR-6b)

### Incident response assistance (IR-7)

- The [Incident response team] shall provide an incident response support resource, as part of the incident response capability, that offers system users advice and assistance with handling and reporting incidents. (IR-7)

### Incident response plan (IR-8)

- The [Chief Information Security Officer] shall develop an incident response plan that provides a roadmap for implementing the incident response capability. (IR-8a.1)
- The plan shall describe the structure and organization of the incident response capability. (IR-8a.2)
- The plan shall describe at a high level how the incident response capability fits into the overall organization. (IR-8a.3)
- The plan shall meet the organization's unique requirements related to its mission, size, structure and functions. (IR-8a.4)
- The plan shall define reportable incidents. (IR-8a.5)
- The plan shall provide metrics for measuring the incident response capability. (IR-8a.6)
- The plan shall define the resources and management support needed to maintain and mature the incident response capability. (IR-8a.7)
- The plan shall address the sharing of incident information. (IR-8a.8)
- The plan shall be reviewed and approved by [Fill in: personnel or roles that review and approve the incident response plan. Typical: the Chief Information Security Officer] [Fill in: the frequency at which to review and approve the incident response plan. Typical: annually]. (IR-8a.9)
- The plan shall explicitly designate responsibility for incident response to [Fill in: entities, personnel, or roles with designated responsibility for incident response. Typical: the incident response team, led by its designated lead]. (IR-8a.10)
- The [Chief Information Security Officer] shall distribute copies of the plan to [Fill in: incident response personnel (identified by name and/or by role) to whom copies of the incident response plan are to be distributed. Typical: the incident response team members, by role] and [Fill in: organizational elements to which copies of the incident response plan are to be distributed. Typical: the security operations, legal, communications and human resources functions]. (IR-8b)
- The [Chief Information Security Officer] shall update the plan to address system and organizational changes, and problems found during its implementation, execution or testing. (IR-8c)
- The [Chief Information Security Officer] shall communicate changes to the plan to [Fill in: incident response personnel (identified by name and/or by role) and organizational elements. Typical: everyone who received the plan]. (IR-8d)
- The [Chief Information Security Officer] shall protect the plan from unauthorized disclosure and modification. (IR-8e)

### Breaches (IR-8(1))

> **Guidance:** IR-8(1) is in the Privacy baseline only. It adds three things to the incident response plan for breaches involving personally identifiable information: a process to decide whether to notify individuals or other organizations, including oversight bodies; an assessment of the harm, embarrassment, inconvenience or unfairness to affected individuals, with ways to reduce it; and a list of the privacy requirements that apply. NIST's discussion notes that laws, regulations and policies may set specific breach procedures, including notice, standards of harm and mitigation. [NIST SP 800-122](https://csrc.nist.gov/pubs/sp/800/122/final) (April 2010), section 5, recommends building breach handling into the existing incident response plan, planning in advance how, when and to whom notice is given, and deciding when to offer remedial help such as credit monitoring. The [Incident Response Plan](https://kston83.github.io/nist-guide/templates/plans/incident-response-plan/) has a breach section for these, and section 5.8 of the [incident handling playbook](https://kston83.github.io/nist-guide/templates/procedures/incident-handling-playbook/) carries them out.

- For breaches involving personally identifiable information, the incident response plan shall include a process, led by the [Senior privacy official], to determine whether notice to individuals or other organizations, including oversight organizations, is needed. (IR-8(1)(a))
- The plan shall include an assessment process to determine the extent of the harm, embarrassment, inconvenience or unfairness to affected individuals, and the mechanisms available to mitigate those harms. (IR-8(1)(b))
- The plan shall identify the privacy requirements that apply to breaches, including each law, regulation, policy and contract that sets a notice, a standard of harm or a mitigation duty, with the notice each requires, to whom and by when. (IR-8(1)(c))
- The [Incident response team] shall notify the [Senior privacy official] of every incident that involves, or may involve, personally identifiable information as soon as it is identified, and the [Senior privacy official] shall take part in its response. (IR-8(1))
- The [Senior privacy official] shall record each harm assessment, notification decision and mitigation decision in the incident record, with who decided and when. (IR-8(1))
- The [Senior privacy official] shall review the list of applicable privacy requirements each time the plan is reviewed, and when a law, regulation or contract changes. (IR-8(1)(c))

#### Federal systems

The Privacy Act requires each agency that maintains a system of records to establish appropriate administrative, technical and physical safeguards to protect against threats or hazards to the records' security or integrity "which could result in substantial harm, embarrassment, inconvenience, or unfairness to any individual on whom information is maintained" ([5 U.S.C. § 552a(e)(10)](https://www.govinfo.gov/link/uscode/5/552a?link-type=html), United States Code, 2024 edition), the standard of harm IR-8(1)(b) repeats. [OMB Circular A-130](https://www.whitehouse.gov/wp-content/uploads/legacy_drupal_files/omb/circulars/A130/a130revised.pdf), Appendix I, section 4.f(7), requires incident response capabilities and mechanisms that include notification to affected individuals; section 4.f(9) requires agencies to report incidents to OMB, DHS, the CIO, the senior agency official for privacy, their inspectors general and general counsel, law enforcement and Congress in accordance with procedures issued by OMB; and section 4.j(2)(e) requires incident response procedures for systems operated on the agency's behalf, including timelines for notification of affected individuals.

[OMB Memorandum M-17-12](https://www.whitehouse.gov/wp-content/uploads/legacy_drupal_files/omb/memoranda/2017/m-17-12_0.pdf) (January 3, 2017), which OMB's FY 2026 SAOP FISMA reporting metrics (August 2026) still cite, sets the breach procedures OMB issued. Section VII requires the senior agency official for privacy to develop and implement a breach response plan, as part of the agency's formal incident response plan, with at least these elements: the breach response team; identifying applicable privacy compliance documentation (system of records notices, privacy impact assessments and privacy notices); information sharing to respond to a breach; reporting requirements and the officials responsible; assessing the risk of harm to individuals; mitigating that risk; and notifying individuals. Section VII.A has the head of the agency designate the breach response team, led by the senior agency official for privacy and including at least the CIO or designee, the senior agency information security officer, legal counsel, and legislative affairs and communications officials; the team is always convened when a breach is a major incident. Section VII.E requires the senior agency official for privacy to conduct and document an assessment of the risk of harm, considering the nature and sensitivity of the information, the likelihood of access and use, and the type of breach. Under section VII.G, the senior agency official for privacy advises the head of the agency, who makes the final decision on whether to notify; notice is given as expeditiously as practicable and without unreasonable delay (section VII.G.2). Section VIII has the principal security operations center track and document each breach and keep the senior agency official for privacy aware of it; section IX has that center report the status of each breach to the senior agency official for privacy at the end of each quarter of the fiscal year, for that official to review and validate; and section X.B requires that official to review the plan at the end of each fiscal year.

[OMB Memorandum M-25-04](https://www.whitehouse.gov/wp-content/uploads/2025/01/M-25-04-Fiscal-Year-2025-Guidance-on-Federal-Information-Security-and-Privacy-Management-Requirements.pdf), Fiscal Year 2025 Guidance on Federal Information Security and Privacy Management Requirements (January 15, 2025), is the most recent FISMA guidance memorandum. Section X defines a major incident, including a breach of personally identifiable information likely to result in demonstrable harm to the national security interests, foreign relations or economy of the United States, or to the public confidence, civil liberties or public health and safety of the American people, and requires a major incident determination for any unauthorized modification, deletion, exfiltration of, or access to the personally identifiable information of 100,000 or more people. Agencies report a major incident to CISA and the OMB Office of the Federal Chief Information Officer within 1 hour of determining it is major, notify the appropriate congressional committees and their Office of Inspector General within 7 days of having a reasonable basis to conclude it occurred, and, for a breach that is a major incident, supplement the congressional report within 30 days of discovering the breach. Its footnote 37 keeps the major incident analysis separate from the M-17-12 assessment of the risk of harm to individuals. As of October 2026.

- The incident response plan's breach section shall serve as the agency's breach response plan under OMB M-17-12, section VII, with each element that section lists, and the [Senior privacy official] shall review it at the end of each fiscal year as section X.B requires. (IR-8(1))
- The breach section shall name the breach response team the head of the agency designates under OMB M-17-12, section VII.A, the criteria for convening it, and the officials responsible for reporting a breach to CISA, law enforcement, inspectors general, general counsel and Congress (section VII.D). (IR-8(1)(a))
- The harm assessment shall follow OMB M-17-12, section VII.E, and the [Senior privacy official] shall advise the head of the agency on whether and when to notify individuals, as section VII.G provides. (IR-8(1)(a), IR-8(1)(b))
- The breach section shall apply the major incident criteria of OMB M-25-04, section X, including the required determination for a breach affecting 100,000 or more people, and its reporting: CISA and the OMB Office of the Federal Chief Information Officer within 1 hour of the determination, the congressional committees and the Office of Inspector General within 7 days, and a supplemental report within 30 days of discovering the breach. (IR-8(1)(a))
- The plan's list of applicable privacy requirements shall include the Privacy Act for each system of records, OMB M-17-12 and OMB M-25-04, and any other breach notification requirement that applies to the system's information, such as one for health information. (IR-8(1)(c))
- The [Senior privacy official] shall ensure that contracts and agreements for systems operated on the agency's behalf set timelines for reporting breaches to the agency and for notifying affected individuals, as OMB Circular A-130, Appendix I, section 4.j(2)(e), requires. (IR-8(1))

## Review and update

- The [Fill in: an official to manage the incident response policy and procedures. Typical: Chief Information Security Officer] shall review and update this policy [Fill in: the frequency at which the current incident response policy is reviewed and updated. Typical: annually] and following [Fill in: events that would require the current incident response policy to be reviewed and updated. Typical: assessment or audit findings, security incidents or breaches, and changes in applicable laws, executive orders, directives, regulations, policies, standards or guidelines]. (IR-1c.1)
- The [Fill in: an official to manage the incident response policy and procedures. Typical: Chief Information Security Officer] shall review and update the procedures that implement this policy [Fill in: the frequency at which the current incident response procedures are reviewed and updated. Typical: annually] and following [Fill in: events that would require the incident response procedures to be reviewed and updated. Typical: the same events as the policy, and changes to the systems, tools or services the procedures describe]. (IR-1c.2)

### Federal systems

For federal information systems, this policy also carries out the agency's information security responsibilities under the Federal Information Security Modernization Act of 2014 ([44 U.S.C. § 3554](https://uscode.house.gov/view.xhtml?req=granuleid:USC-prelim-title44-section3554&num=0&edition=prelim), Federal agency responsibilities) and [OMB Circular A-130](https://www.whitehouse.gov/wp-content/uploads/legacy_drupal_files/omb/circulars/A130/a130revised.pdf), Appendix I, Responsibilities for Protecting and Managing Federal Information Resources.

- Where the agency's organization-wide policy sets a value for a parameter in this policy, each system shall use that value or a stricter one. (IR-1a.1(b))