M-11-11, Continued Implementation of to Homeland Security Presidential Directive (HSPD) 12- Policy for a Common Identification Standard for Federal Employees and Contractors for control details. Incident Response (IR) Security Baselines Control Control Name/Requirement Number Low High Incident Response Training Incident Response Training Information System Security IR-2 Refer to CITR-006: X X X Training for Significant Roles for control details. Incident Response Testing Incident Response Testing The DOC requires the OUs to test the incident response capability for the information system at annually using OU-defined tests to determine IR-3 X X the incident response effectiveness and documents the results. Responding to a genuine security incident will fulfill the annual testing requirement. Incident Monitoring Incident Monitoring The DOC requires the OUs to track and document IR-5 X X X information system security incidents on an ongoing basis. Incident Reporting Incident Reporting The DOC requires the OUs to: a. Require personnel to report suspected security incidents and PII breaches to the organizational incident response capability as soon as possible. The organizational incident response capability must IR-6 X X X report the PII incident to the DOC Chief Privacy Officer, DOC-CIRT (where DOC-CIRT is not the receiving CIRT), and US-CERT within one (1) hour of discovery/detection; and b. Report security incident information to the servicing incident response team. Incident Response Assistance Incident Response Assistance IR-7 X X X
to M-11-11, Continued Implementation of Homeland Security Presidential Directive (HSPD) 12- Policy for a Common Identification Standard for Federal Employees and Contractors for control details. Incident Response (IR) Control Number Control Name/Requirement Security Baselines Low High Incident Response Training IR-2 Incident Response Training Refer to CITR-006: Information System Security Training for Significant Roles for control details. X X X Incident Response Testing IR-3 Incident Response Testing The DOC requires the OUs to test the incident response capability for the information system at annually using OU-defined tests to determine the incident response effectiveness and documents the results. Responding to a genuine security incident will fulfill the annual testing requirement. X X Incident Monitoring IR-5 Incident Monitoring The DOC requires the OUs to track and document information system security incidents on an ongoing basis. X X X Incident Reporting IR-6 Incident Reporting The DOC requires the OUs to: a. Require personnel to report suspected security incidents and PII breaches to the organizational incident response capability as soon as possible. The organizational incident response capability must report the PII incident to the DOC Chief Privacy Officer, DOC-CIRT (where DOC-CIRT is not the receiving CIRT), and US-CERT within one (1) hour of discovery/detection; and b. Report security incident information to the servicing incident response team. X X X Incident Response Assistance IR-7 Incident Response Assistance X X X