Incident Response Decision Worksheet

Incident Response Decision Worksheet template: Every decision the Incident Response family of NIST SP 800-53 Rev. 5 forces, with typical values and who decides, per baseline, as a spreadsheet.

Type	Program stage	Status	Template version	NIST basis
Decision worksheet	Core	Draft	1.0.0	SP 800-53 release 5.2.0

What it is

Every decision the Incident Response family asks your organization to make before its policy and procedures can be final: the family’s key questions, then each organization-defined parameter of every IR control in the baseline, with a typical value where the Incident Response Policy gives one. Download the spreadsheet, fill the “Your value” column with the people who decide, and carry the values into the policy’s highlighted fields.

Typical values are starting points, not recommendations for every system. “Who decides” defaults to the role accountable for the family policy; many organizations delegate system-level values to the system owner.

Downloads

Variant	Spreadsheet
Low	CSV
Moderate	CSV
High	CSV
Privacy	CSV

Decisions (Moderate baseline)

28 decisions.

Decision	Control	Typical value	Who decides
Who runs incident response, and who is on call outside business hours?	IR-4, IR-7	An internal incident response team with a named lead and an on-call rotation, backed by a retained incident response provider for major incidents.	Chief Information Security Officer
Which outside parties must be notified of an incident, and who decides to notify them?	IR-6	Regulators, customers and partners named in laws and contracts; legal counsel decides, with the Chief Information Security Officer.	Chief Information Security Officer
Personnel or roles to whom the incident response policy is to be disseminated	IR-1	Everyone within its scope, through the policy library	Chief Information Security Officer
Personnel or roles to whom the incident response procedures are to be disseminated	IR-1	The people who carry them out, and the system owners	Chief Information Security Officer
Select one or more: organization-level; mission/business process-level; system-level	IR-1	Organization-level	Chief Information Security Officer
An official to manage the incident response policy and procedures	IR-1	Chief Information Security Officer	Chief Information Security Officer
The frequency at which the current incident response policy is reviewed and updated	IR-1	Annually	Chief Information Security Officer
Events that would require the current incident response policy to be reviewed and updated	IR-1	Assessment or audit findings, security incidents or breaches, and changes in applicable laws, executive orders, directives, regulations, policies, standards or guidelines	Chief Information Security Officer
The frequency at which the current incident response procedures are reviewed and updated	IR-1	Annually	Chief Information Security Officer
Events that would require the incident response procedures to be reviewed and updated	IR-1	The same events as the policy, and changes to the systems, tools or services the procedures describe	Chief Information Security Officer
A time period within which incident response training is to be provided to system users assuming an incident response role or responsibility	IR-2	30 days	Chief Information Security Officer
Frequency at which to provide incident response training to users	IR-2	Annually	Chief Information Security Officer
Frequency at which to review and update incident response training content	IR-2	Annually	Chief Information Security Officer
Events that initiate a review of the incident response training content	IR-2	A change to the incident response plan, and lessons learned from an incident or exercise	Chief Information Security Officer
Frequency at which to test the effectiveness of the incident response capability for the system	IR-3	Annually	Chief Information Security Officer
Tests used to test the effectiveness of the incident response capability for the system	IR-3	A tabletop exercise based on a realistic scenario, and a functional test of notification and escalation	Chief Information Security Officer
Automated mechanisms used to support the incident handling process	IR-4(1)	The case management system and automated playbooks in the security operations platform	Chief Information Security Officer
Time period for personnel to report suspected incidents to the organizational incident response capability	IR-6	1 hour of discovery	Chief Information Security Officer
Authorities to whom incident information is to be reported	IR-6	Senior leadership, legal counsel, and any regulator, customer or partner that law or contract requires be notified	Chief Information Security Officer
Automated mechanisms used for reporting incidents	IR-6(1)	The incident report form and case management system, which notify the incident response team automatically	Chief Information Security Officer
Automated mechanisms used to increase the availability of incident response information and support	IR-7(1)	A self-service reporting portal and an incident response page on the intranet	Chief Information Security Officer
Personnel or roles that review and approve the incident response plan	IR-8	The Chief Information Security Officer	Chief Information Security Officer
The frequency at which to review and approve the incident response plan	IR-8	Annually	Chief Information Security Officer
Entities, personnel, or roles with designated responsibility for incident response	IR-8	The incident response team, led by its designated lead	Chief Information Security Officer
Incident response personnel (identified by name and/or by role) to whom copies of the incident response plan are to be distributed	IR-8	The incident response team members, by role	Chief Information Security Officer
Organizational elements to which copies of the incident response plan are to be distributed	IR-8	The security operations, legal, communications and human resources functions	Chief Information Security Officer
Incident response personnel (identified by name and/or by role) to whom changes to the incident response plan is/are communicated	IR-8	Everyone who received the plan	Chief Information Security Officer
Organizational elements to which changes to the incident response plan are communicated	IR-8	See the row above	Chief Information Security Officer