Incident Handling IR-4

Source: NIST SP 800-53 Rev.5, Incident Response family NIST SP 800-53 Rev.5. The baseline shows the lowest SP 800-53B baseline (Low / Moderate / High) this control appears in NIST SP 800-53B.

Control guide — plain-English, per NIST SP 800-53

IR-4 (Incident Handling) requires an operational capability covering the full incident lifecycle: preparation, detection and analysis, containment, eradication, and recovery - with lessons learned fed back into the process. It coordinates with contingency planning. At Moderate you support handling with automated mechanisms (enhancement IR-4(1)).

What good looks like

• Run every phase: prepare, detect and analyze, contain, eradicate, and recover.
• Coordinate incident handling with contingency planning so recovery uses tested backups and a known-good baseline.
• Feed lessons learned from each incident back into procedures and controls.
• Use automated mechanisms to support detection and containment (enhancement IR-4(1)).

Framework mapping

• NIST CSF 2.0 — RS.MA-01 — The incident response plan is executed once an incident is declared
• CIS Controls v8 — Control 17 — Incident Response Management

How to move it toward Implemented

• The host already covers detect (Suricata and PlumbWatch alerts, auditd and AIDE tamper flags) and automated containment (Fail2Ban auto-bans SSH brute-force), plus a recovery snapshot - the missing piece is the human workflow that links them.
• Write a short triage-and-eradication playbook: how to confirm an alert is real, isolate the host (for example tighten UFW (Uncomplicated Firewall) to the management subnet only), remove the root cause, then recover from the pinkteam-baseline snapshot.
• Add a lessons-learned step so each incident updates the runbook.
• Attach the playbook plus one tabletop or live run as evidence naming IR-4 to move it from 'partial' toward 'Completed'.