IR-8 Incident Response Plan The organization: Develops an incident response plan that: Provides the organization with a roadmap for implementing its incident response capability; Describes the structure and organization of the incident response capability; Provides a high-level approach for how the incident response capability fits into the overall organization; Meets the unique requirements of the organization, which relate to mission, size, structure, and functions; Defines reportable incidents; Provides metrics for measuring the incident response capability within the organization. Defines the resources and management support needed to effectively maintain and mature an incident response capability; and Is reviewed and approved by [DoD Assignment: at a minimum, the ISSM and ISSO]; IR-8(a) Additional DoD Requirement: CSOs will provide, either as part of their Incident Response Plan or through an Incident Response Plan Addendum, their approach to fulfilling DoD Cyber Defense integration requirements to specifically address cyber incidents and data breaches, where a “breach” or cyber incident includes the loss of control, compromise, unauthorized acquisition, unauthorized access, or any similar term referring to situations where any unauthorized person has access or potential access to government data, whether in electronic or non-electronic form, for any unauthorized purpose. CSPs must ensure that the plan or addendum addresses all incidents regardless of the time, day, or location of the incident and must provide for notice to the Government of any breach of its data. The plan or addendum must incorporate any other policies or procedures that the Government may require to be followed in the event of an incident, including, but not limited to: To whom within the Government, the incident will be reported in accordance with the incident reporting process; Specific steps to be taken in order to mitigate or remedy the incident, including time periods for taking such steps (e.g., reporting of Personally Identifiable Information (PII) data breaches within one hour, Negligent Disclosure of Classified Information (NDCIs) which are commonly referred to as spillages); How and under what circumstances any individuals or entities affected by an incident will be notified and by whom; and Any other special instructions for handling computer security incidents affecting, or potentially affecting U.S. Government data; consistent with guidance and policy directives issued by DoD, NIST, US-CERT and CNSS for incident management, classification, and remediation; or other applicable law, regulation, order, or policy. Distributes copies of the incident response plan to [DoD Assignment: all
IR-8 Incident Response Plan The organization: Develops an incident response plan that: Provides the organization with a roadmap for implementing its incident response capability; Describes the structure and organization of the incident response capability; Provides a high-level approach for how the incident response capability fits into the overall organization; Meets the unique requirements of the organization, which relate to mission, size, structure, and functions; Defines reportable incidents; Provides metrics for measuring the incident response capability within the organization. Defines the resources and management support needed to effectively maintain and mature an incident response capability; and Is reviewed and approved by [DoD Assignment: at a minimum, the ISSM and ISSO]; IR-8(a) Additional DoD Requirement: CSOs will provide, either as part of their Incident Response Plan or through an Incident Response Plan Addendum, their approach to fulfilling DoD Cyber Defense integration requirements to specifically address cyber incidents and data breaches, where a “breach” or cyber incident includes the loss of control, compromise, unauthorized acquisition, unauthorized access, or any similar term referring to situations where any unauthorized person has access or potential access to government data, whether in electronic or non-electronic form, for any unauthorized purpose. CSPs must ensure that the plan or addendum addresses all incidents regardless of the time, day, or location of the incident and must provide for notice to the Government of any breach of its data. The plan or addendum must incorporate any other policies or procedures that the Government may require to be followed in the event of an incident, including, but not limited to: To whom within the Government, the incident will be reported in accordance with the incident reporting process; Specific steps to be taken in order to mitigate or remedy the incident, including time periods for taking such steps (e.g., reporting of Personally Identifiable Information (PII) data breaches within one hour, Negligent Disclosure of Classified Information (NDCIs) which are commonly referred to as spillages); How and under what circumstances any individuals or entities affected by an incident will be notified and by whom; and Any other special instructions for handling computer security incidents affecting, or potentially affecting U.S. Government data; consistent with guidance and policy directives issued by DoD, NIST, US-CERT and CNSS for incident management, classification, and remediation; or other applicable law, regulation, order, or policy. Distributes copies of the incident response plan to [DoD Assignment: all