Incident Response Policy

Incident Response Policy template: Ready-to-adopt Incident Response policy template for NIST SP 800-53 Rev. 5, with a statement group for each control and a variant per baseline (Low, Moderate, High, Privacy).

Type	Program stage	Status	Template version	NIST basis
Policy	Core	Draft	1.0.0	SP 800-53 release 5.2.0

What it is

The Incident Response policy states what the organization requires for incident response and who is accountable for it. It meets IR-1 through the sections every family policy shares, and adds one statement group per control. Each baseline variant includes only the controls in that baseline, taken from the NIST SP 800-53B profiles.

Adopt the ready-to-adopt edition: fill every highlighted field, delete any “Federal systems” section that does not apply, and have the accountable official approve it. The annotated edition adds guidance on why each section exists and what assessors look for.

Controls satisfied

“Yes” marks the baseline variants that include the control’s statements. IR-1 is met by the common sections.

Control	Title	Low	Moderate	High	Privacy
IR-1	Policy and Procedures	Yes	Yes	Yes	Yes
IR-2	Incident Response Training	Yes	Yes	Yes	Yes
IR-2(1)	Simulated Events			Yes
IR-2(2)	Automated Training Environments			Yes
IR-2(3)	Breach				Yes
IR-3	Incident Response Testing		Yes	Yes	Yes
IR-3(2)	Coordination with Related Plans		Yes	Yes
IR-4	Incident Handling	Yes	Yes	Yes	Yes
IR-4(1)	Automated Incident Handling Processes		Yes	Yes
IR-4(4)	Information Correlation			Yes
IR-4(11)	Integrated Incident Response Team			Yes
IR-5	Incident Monitoring	Yes	Yes	Yes	Yes
IR-5(1)	Automated Tracking, Data Collection, and Analysis			Yes
IR-6	Incident Reporting	Yes	Yes	Yes	Yes
IR-6(1)	Automated Reporting		Yes	Yes
IR-6(3)	Supply Chain Coordination		Yes	Yes
IR-7	Incident Response Assistance	Yes	Yes	Yes	Yes
IR-7(1)	Automation Support for Availability of Information and Support		Yes	Yes
IR-8	Incident Response Plan	Yes	Yes	Yes	Yes
IR-8(1)	Breaches				Yes

Decisions to make first

The policy has 31 organization-defined parameters across all variants; each appears as a highlighted field with its typical value where one is given. Settle these first:

Decision	Controls	Typical	Who decides
Who runs incident response, and who is on call outside business hours?	IR-4, IR-7	An internal incident response team with a named lead and an on-call rotation, backed by a retained incident response provider for major incidents.	Chief Information Security Officer
Which outside parties must be notified of an incident, and who decides to notify them?	IR-6	Regulators, customers and partners named in laws and contracts; legal counsel decides, with the Chief Information Security Officer.	Chief Information Security Officer

Record your values in the Incident Response decision worksheet, which lists every parameter with its typical value.

Downloads

Variant	Ready to adopt	Annotated
Low	Word · Markdown	Word · Markdown
Moderate	Word · Markdown	Word · Markdown
High	Word · Markdown	Word · Markdown
Privacy	Word · Markdown	Word · Markdown

Everything for this family in one file: IR pack (.zip), with every variant and edition of the policy and the decision worksheets.

Preview (Moderate baseline, annotated)

Guidance

The sections before and after Policy statements meet IR-1, which asks for a policy that addresses purpose, scope, roles, responsibilities, management commitment, coordination and compliance, plus procedures, dissemination, a designated official and a review cycle. Assessors check each element, so keep every section even when it is short. Each statement cites the IR-1 item it meets. If you adopt several family policies, the same sections repeat in each; that is expected, and it lets each policy stand alone.

Purpose

This policy states what Organization name requires for Incident Response, and who is accountable for meeting those requirements. (IR-1a.1(a))

Scope

This policy applies at the Select one or more: organization-level; mission/business process-level; system-level Typical: organization-level to every system that Organization name owns or operates, or that is operated on its behalf, and to every person with access to those systems, including employees, contractors and partners. (IR-1a.1(a))

Roles and responsibilities

• The Chief Information Security Officer is accountable for this policy and shall approve exceptions to it. (IR-1a.1(a))
• The Fill in: an official to manage the incident response policy and procedures Typical: Chief Information Security Officer shall manage the development, documentation and dissemination of this policy and its procedures. (IR-1b)
• Each System owner shall implement this policy for their system and document how in the system security plan. (IR-1a.1(a))
• Each person within scope shall follow this policy and report suspected violations to the Chief Information Security Officer. (IR-1a.1(a))

Management commitment

The Senior leader approves this policy and shall provide the resources needed to implement it. (IR-1a.1(a))

Coordination

The Chief Information Security Officer shall coordinate this policy with the legal, privacy, human resources and procurement functions, and with the owners of related policies, before each approval. (IR-1a.1(a))

Compliance

• This policy shall be consistent with the laws, executive orders, directives, regulations, policies, standards and guidelines that apply to Organization name, including Fill in: laws, regulations and standards that apply to the organization. (IR-1a.1(b))
• The Chief Information Security Officer shall review compliance with this policy through the organization’s assessment and continuous monitoring activities. (IR-1a.1(a))
• An exception to this policy shall be requested in writing, approved by the Chief Information Security Officer, time-limited and recorded with its compensating measures. (IR-1a.1(a))
• Violations of this policy shall be handled through the organization’s sanctions process. (IR-1a.1(a))

Procedures

The Fill in: an official to manage the incident response policy and procedures Typical: Chief Information Security Officer shall ensure that documented procedures exist to implement this policy and its associated controls. (IR-1a.2)

Dissemination

• The Fill in: an official to manage the incident response policy and procedures Typical: Chief Information Security Officer shall disseminate this policy to Fill in: personnel or roles to whom the incident response policy is to be disseminated Typical: everyone within its scope, through the policy library. (IR-1a)
• The Fill in: an official to manage the incident response policy and procedures Typical: Chief Information Security Officer shall disseminate the procedures that implement this policy to Fill in: personnel or roles to whom the incident response procedures are to be disseminated Typical: the people who carry them out, and the system owners. (IR-1a)

Policy statements

Guidance

Each statement below comes from the clause for one control or enhancement in the chosen baseline. The reference at the end of each statement names the control item it meets.

Incident response training (IR-2)

• The Incident response team shall provide incident response training, consistent with assigned roles and responsibilities, to system users within Fill in: a time period within which incident response training is to be provided to system users assuming an incident response role or responsibility Typical: 30 days of their assuming an incident response role or responsibility or acquiring system access. (IR-2a.1)
• The Incident response team shall provide that training when system changes require it. (IR-2a.2)
• The Incident response team shall provide that training Fill in: frequency at which to provide incident response training to users Typical: annually thereafter. (IR-2a.3)
• The Incident response team shall review and update incident response training content Fill in: frequency at which to review and update incident response training content Typical: annually and following Fill in: events that initiate a review of the incident response training content Typical: a change to the incident response plan, and lessons learned from an incident or exercise. (IR-2b)

Incident response testing (IR-3)

• The Incident response team shall test the effectiveness of the incident response capability for the system Fill in: frequency at which to test the effectiveness of the incident response capability for the system Typical: annually using Fill in: tests used to test the effectiveness of the incident response capability for the system Typical: a tabletop exercise based on a realistic scenario, and a functional test of notification and escalation. (IR-3)

Coordination with related plans (IR-3(2))

• The Incident response team shall coordinate incident response testing with the organizational elements responsible for related plans, such as contingency, continuity and crisis communications plans. (IR-3(2))

Incident handling (IR-4)

Guidance

IR-4a names the phases of the incident handling life cycle from NIST SP 800-61 Rev. 2. Its successor, SP 800-61 Rev. 3 (April 2025), organizes incident response around the CSF 2.0 Functions instead; the Incident Response Plan template follows Rev. 3 and still covers every IR-4a phase. Assessors ask for records of recent incidents that show each phase, and for evidence that a lesson learned changed a procedure.

• The Incident response team shall implement an incident handling capability, consistent with the incident response plan, that includes preparation, detection and analysis, containment, eradication and recovery. (IR-4a)
• The Incident response team shall coordinate incident handling activities with contingency planning activities. (IR-4b)
• The Incident response team shall incorporate lessons learned from incident handling into incident response procedures, training and testing, and implement the resulting changes. (IR-4c)
• The Chief Information Security Officer shall ensure the rigor, intensity, scope and results of incident handling are comparable and predictable across the organization. (IR-4d)

Automated incident handling processes (IR-4(1))

• The Incident response team shall support the incident handling process using Fill in: automated mechanisms used to support the incident handling process Typical: the case management system and automated playbooks in the security operations platform. (IR-4(1))

Incident monitoring (IR-5)

• The Incident response team shall track and document incidents. (IR-5)

Incident reporting (IR-6)

• All personnel shall report suspected incidents to the Incident response team within Fill in: time period for personnel to report suspected incidents to the organizational incident response capability Typical: 1 hour of discovery. (IR-6a)
• The Incident response team shall report incident information to Fill in: authorities to whom incident information is to be reported Typical: senior leadership, legal counsel, and any regulator, customer or partner that law or contract requires be notified. (IR-6b)

Federal systems

Federal agencies notify the Cybersecurity and Infrastructure Security Agency (CISA) of incidents under FISMA (44 U.S.C. §§ 3553 and 3554). As of September 2026, the CISA Federal Incident Notification Guidelines (effective April 1, 2017) set the time frame: within one hour of the incident being identified by the agency’s top-level incident response team, security operations center or IT department.

• The Incident response team shall report incidents to CISA within one hour of identification, as the CISA Federal Incident Notification Guidelines require. (IR-6b)

Automated reporting (IR-6(1))

• The Incident response team shall report incidents using Fill in: automated mechanisms used for reporting incidents Typical: the incident report form and case management system, which notify the incident response team automatically. (IR-6(1))

Supply chain coordination (IR-6(3))

• The Incident response team shall provide incident information to the provider of the product or service, and to other organizations in the supply chain, for system components related to an incident. (IR-6(3))

Incident response assistance (IR-7)

• The Incident response team shall provide an incident response support resource, as part of the incident response capability, that offers system users advice and assistance with handling and reporting incidents. (IR-7)

Automation support for availability of information and support (IR-7(1))

• The Incident response team shall increase the availability of incident response information and support using Fill in: automated mechanisms used to increase the availability of incident response information and support Typical: a self-service reporting portal and an incident response page on the intranet. (IR-7(1))

Incident response plan (IR-8)

• The Chief Information Security Officer shall develop an incident response plan that provides a roadmap for implementing the incident response capability. (IR-8a.1)
• The plan shall describe the structure and organization of the incident response capability. (IR-8a.2)
• The plan shall describe at a high level how the incident response capability fits into the overall organization. (IR-8a.3)
• The plan shall meet the organization’s unique requirements related to its mission, size, structure and functions. (IR-8a.4)
• The plan shall define reportable incidents. (IR-8a.5)
• The plan shall provide metrics for measuring the incident response capability. (IR-8a.6)
• The plan shall define the resources and management support needed to maintain and mature the incident response capability. (IR-8a.7)
• The plan shall address the sharing of incident information. (IR-8a.8)
• The plan shall be reviewed and approved by Fill in: personnel or roles that review and approve the incident response plan Typical: the Chief Information Security Officer Fill in: the frequency at which to review and approve the incident response plan Typical: annually. (IR-8a.9)
• The plan shall explicitly designate responsibility for incident response to Fill in: entities, personnel, or roles with designated responsibility for incident response Typical: the incident response team, led by its designated lead. (IR-8a.10)
• The Chief Information Security Officer shall distribute copies of the plan to Fill in: incident response personnel (identified by name and/or by role) to whom copies of the incident response plan are to be distributed Typical: the incident response team members, by role and Fill in: organizational elements to which copies of the incident response plan are to be distributed Typical: the security operations, legal, communications and human resources functions. (IR-8b)
• The Chief Information Security Officer shall update the plan to address system and organizational changes, and problems found during its implementation, execution or testing. (IR-8c)
• The Chief Information Security Officer shall communicate changes to the plan to Fill in: incident response personnel (identified by name and/or by role) and organizational elements Typical: everyone who received the plan. (IR-8d)
• The Chief Information Security Officer shall protect the plan from unauthorized disclosure and modification. (IR-8e)

Review and update

• The Fill in: an official to manage the incident response policy and procedures Typical: Chief Information Security Officer shall review and update this policy Fill in: the frequency at which the current incident response policy is reviewed and updated Typical: annually and following Fill in: events that would require the current incident response policy to be reviewed and updated Typical: assessment or audit findings, security incidents or breaches, and changes in applicable laws, executive orders, directives, regulations, policies, standards or guidelines. (IR-1c.1)
• The Fill in: an official to manage the incident response policy and procedures Typical: Chief Information Security Officer shall review and update the procedures that implement this policy Fill in: the frequency at which the current incident response procedures are reviewed and updated Typical: annually and following Fill in: events that would require the incident response procedures to be reviewed and updated Typical: the same events as the policy, and changes to the systems, tools or services the procedures describe. (IR-1c.2)

Federal systems

For federal information systems, this policy also carries out the agency’s information security responsibilities under the Federal Information Security Modernization Act of 2014 (44 U.S.C. § 3554, Federal agency responsibilities) and OMB Circular A-130, Appendix I, Responsibilities for Protecting and Managing Federal Information Resources.

• Where the agency’s organization-wide policy sets a value for a parameter in this policy, each system shall use that value or a stricter one. (IR-1a.1(b))