accrediting authority. DoD SCI organizations will provide reporting directly to the DIA Information Assurance Protection Center (IAPC). Member organizations operating under the authority of the NSA, NRO, and NGA shall report to their agency authority IAW internal agency policy. DoD IC members will report all reportable events directly to the IC-IRC within established reporting timelines. The reporting timelines establish the minimum requirements and timeframes by which incidents will be reported. USCYBERCOM may issue changes to reporting requirements and timeframes based on ongoing operations or activities. The reporting timelines are designed to expedite reporting of incidents where national-level coordination and action may serve to mitigate or prevent damage to the DoD information networks. Category Impact Initial Report to Minimum Initial Initial submission Next Tier Reporting Notification to to JIMS Next Tier Within 15 1- Root Level High Within 4 hours Within 6 hours Tier I minutes Intrusion Moderate Within 2 hours Within 8 Within 12 hours Tier I (Incident) Low Within 4 hours Within 12 Within 24 hours Tier I Within 15 2- User High Within 4 hours Within 6 hours Tier I minutes Intrusion Moderate Within 2 hours Within 8 hours Within 12 hours Tier I (Incident) Low Within 4 hours Within 12 hours Within 24 hours Tier I 3- Unsuccessful Any Within 4 hours Within 12 hours Within 24 hours Tier II Activity Attempt (Event) Within 15 High Within 4 hours Within 6 hours Tier I 4- Denial of minutes Service (Incident) Within 15 Within 6 hours Moderate Within 4 hours Tier I minutes discovery Low As directed by As directed by As directed by Tier I CC/S/A/FA CC/S/A/FA CC/S/A/FA Guidance Guidance Guidance 5- Non- Within 4 hours Within 12 hours Within 48 hours Tier II All Compliance Activity (Event) Events Any As directed by As directed by As directed by Tier II 6 – CC/S/A/FA CC/S/A/FA CC/S/A/FA Guidance Guidance Guidance (Event) Within 15 7 - Malicious High Within 4 hours Within 6 hours Tier I minutes Logic (Incident)
accrediting authority. DoD SCI organizations will provide reporting directly to the DIA Information Assurance Protection Center (IAPC). Member organizations operating under the authority of the NSA, NRO, and NGA shall report to their agency authority IAW internal agency policy. DoD IC members will report all reportable events directly to the IC-IRC within established reporting timelines. The reporting timelines establish the minimum requirements and timeframes by which incidents will be reported. USCYBERCOM may issue changes to reporting requirements and timeframes based on ongoing operations or activities. The reporting timelines are designed to expedite reporting of incidents where national-level coordination and action may serve to mitigate or prevent damage to the DoD information networks. Category Impact Initial Notification to Next Tier Initial Report to Next Tier Initial submission to JIMS Minimum Reporting 1- Root Level Intrusion (Incident) High Within 15 minutes Within 4 hours Within 6 hours Tier I Moderate Within 2 hours Within 8 Within 12 hours Tier I Low Within 4 hours Within 12 Within 24 hours Tier I 2- User Intrusion (Incident) High Within 15 minutes Within 4 hours Within 6 hours Tier I Moderate Within 2 hours Within 8 hours Within 12 hours Tier I Low Within 4 hours Within 12 hours Within 24 hours Tier I 3- Unsuccessful Activity Attempt (Event) Any Within 4 hours Within 12 hours Within 24 hours Tier II 4- Denial of Service (Incident) High Within 15 minutes Within 4 hours Within 6 hours Tier I Moderate Within 15 minutes Within 4 hours Within 6 hours discovery Tier I Low As directed by CC/S/A/FA Guidance As directed by CC/S/A/FA Guidance As directed by CC/S/A/FA Guidance Tier I 5- Non- Compliance Activity (Event) All Events Within 4 hours Within 12 hours Within 48 hours Tier II 6 – (Event) Any As directed by CC/S/A/FA Guidance As directed by CC/S/A/FA Guidance As directed by CC/S/A/FA Guidance Tier II 7 - Malicious Logic (Incident) High Within 15 minutes Within 4 hours Within 6 hours Tier I
RMF_Incident-Response-Plan.docx