IR-4 (6) IR-4 (6) CCI-002782 High High High The organization Moderate Moderate Moderate conducting the Low Low Low inspection/assessment obtains and examines the incident response plan as well as a sampling of incident action reports to ensure the organization being inspected/assessed implements incident handling capability for insider threats. IR-4 (7) IR-4 (7) CCI-002783 High High High The organization Moderate Moderate Moderate conducting the Low Low Low inspection/assessment obtains and examines the incident response plan to ensure the organization being inspected/assessed coordinates incident handling capability for insider threats across components or elements of the organization defined in IR-4 (7), CCI 2784. IR-4 (7) IR-4 (7) CCI-002784 High High High The organization Moderate Moderate Moderate conducting the Low Low Low inspection/assessment obtains and examines the documented components or elements to ensure the organization being inspected/assessed defines components or elements of the organization in which incident handling capability for insider threats will be coordinated. DoD has determined the components or elements are not appropriate to define at the Enterprise level. IR-4 (8) IR-4 (8) CCI-002785 High High High The organization Moderate Moderate Moderate conducting the Low Low Low inspection/assessment obtains and examines reports, meeting minutes, or evidence that the organization being inspected/assessed is coordinating with external organizations defined in (8), CCI 2786 to correlate and share incident information defined in IR-4 (8), CCI 2787 to achieve a cross-organization perspective on incident awareness and more effective incident responses.
IR-4 (6) IR-4 (6) CCI-002782 High Moderate Low High Moderate Low High Moderate Low The organization conducting the inspection/assessment obtains and examines the incident response plan as well as a sampling of incident action reports to ensure the organization being inspected/assessed implements incident handling capability for insider threats. IR-4 (7) IR-4 (7) CCI-002783 High Moderate Low High Moderate Low High Moderate Low The organization conducting the inspection/assessment obtains and examines the incident response plan to ensure the organization being inspected/assessed coordinates incident handling capability for insider threats across components or elements of the organization defined in IR-4 (7), CCI 2784. IR-4 (7) IR-4 (7) CCI-002784 High Moderate Low High Moderate Low High Moderate Low The organization conducting the inspection/assessment obtains and examines the documented components or elements to ensure the organization being inspected/assessed defines components or elements of the organization in which incident handling capability for insider threats will be coordinated. DoD has determined the components or elements are not appropriate to define at the Enterprise level. IR-4 (8) IR-4 (8) CCI-002785 High Moderate Low High Moderate Low High Moderate Low The organization conducting the inspection/assessment obtains and examines reports, meeting minutes, or evidence that the organization being inspected/assessed is coordinating with external organizations defined in (8), CCI 2786 to correlate and share incident information defined in IR-4 (8), CCI 2787 to achieve a cross-organization perspective on incident awareness and more effective incident responses.
RMF_Incident-Response-Plan.docx