Incident Reporting IR-6

Source: NIST SP 800-53 Rev.5, Incident Response family NIST SP 800-53 Rev.5. The baseline shows the lowest SP 800-53B baseline (Low / Moderate / High) this control appears in NIST SP 800-53B.

Control guide — plain-English, per NIST SP 800-53

IR-6 (Incident Reporting) requires personnel to report a suspected incident within a defined time period, and requires the organization to report incident information to designated authorities - internal roles and, where required, external ones. At the Moderate baseline you support reporting with automated mechanisms (enhancement IR-6(1)).

What good looks like

• Require staff to report suspected incidents within a defined time window.
• Define what gets reported, to whom, and how fast.
• Report incident information to designated internal roles and any required external authorities.
• Use automated mechanisms to assist reporting (enhancement IR-6(1)).

Framework mapping

• NIST CSF 2.0 — RS.CO-02 — Internal and external stakeholders are notified of incidents
• CIS Controls v8 — Control 17.2 — Establish and maintain contacts for reporting security incidents

How to move it toward Implemented

• You can already produce the artifact - plumbwatch --report, the dashboard Save-report button, and the as-built capture generate plain-English incident evidence - but no one is named to receive it and no timeline is set.
• Define the reporting targets and cadence: who is notified on an alert, within what window, and which external authority (if any) applies to this Moderate asset.
• Wire an automated notification (for example an email or webhook fired on a Fail2Ban or Suricata alert) to satisfy IR-6(1).
• Attach the reporting procedure and one sample report as evidence naming IR-6 to move it from 'partial' toward 'Completed'.