Incident_Response_Requirements_and_Process_Clarification.docx

FedRAMP is revising the IR-6 test case language and submitting the changes for public comment. FedRAMP has noted weaknesses with some Cloud Service Providers (CSPs) in their notification of required stakeholders during potential or actual security incidents. New test case language has been inserted to help ensure that CSP incident reporting policies, procedures, and plans include notification of the FedRAMP Program Management Office and US-CERT, and that actual testing is conducted to verify that these stakeholders would be notified.

In order to achieve this objective, FedRAMP has added some language to the IR-6 control requirements. Please review this IR-6 document which includes the IR-6 control language, the test cases, and the highlighted areas with the new test case language.

FedRAMP seeks industry and expert comment and feedback on the proposed changes - including if you believe changes might be more appropriate in other controls or requirements to meet the stated objectives. The 30 day open public comment starts August 20 and ends September 19. There is no specified format for feedback. Please send any suggestions or changes to Info@FedRAMP.gov.

IR-6 Incident reporting control The organization:

(a) Requires personnel to report suspected security incidents to the organizational incident response capability within [Assignment: organization-defined time period]; and

(b) Reports security incident information to designated authorities.

IR-6 incident reporting Test cases Examine incident response policy, procedures addressing incident reporting, incident response plan, or other relevant documents for the time period required to report suspected security incidents to the organizational incident response capability. Incidents involving systems supporting Federal data shall be reported using US-CERT incident reporting timelines as specified in NIST Special Publication 800-61 (as amended).

Examine incident response policy, procedures addressing incident reporting, incident response plan, or other relevant documents for the requirement that personnel are to report suspected security incidents to the organizational incident response capability within the organization-defined time period.

Interview a sample of organizational personnel with incident reporting responsibilities for further evidence that personnel are required to report suspected security incidents to the organizational response capability within the organization-defined time period.

Examine incident response policy, procedures addressing incident reporting, incident response plan, or other relevant documents for the organization-defined authorities to whom security incident information should be reported.

Examine incident response policy, procedures addressing incident reporting, incident response plan, or other relevant documents to ensure that the FedRAMP PMO and US-CERT are notified of incidents and that notification occurs within the time-frames prescribed by US-CERT guidance.

Examine incident response policy, procedures addressing incident reporting, incident response plan, or other relevant documents for the measures to be employed to report security incident information to the authorities. Examine a sample of security incident reports or other relevant security incident information provided to the authorities for evidence that the measures are being applied.

Interview a sample of organizational personnel with incident reporting responsibilities and the authorities for evidence that the measures are being applied.

Test incident response policies and procedures to ensure that the FedRAMP PMO and US-CERT are notified of all applicable incidents as part of the annual response testing.

image1.jpeg