IR-5 Incident Monitoring
Review IR-5
1. Set its parameters
No parameters to set for IR-5.
2. Record its status
Track and document incidents.
Discussion
Documenting incidents includes maintaining records about each incident, the status of the incident, and other pertinent information necessary for forensics as well as evaluating incident details, trends, and handling. Incident information can be obtained from a variety of sources, including network monitoring, incident reports, incident response teams, user complaints, supply chain partners, audit monitoring, physical access monitoring, and user and administrator reports. [IR-4](#ir-4) provides information on the types of incidents that are appropriate for monitoring.
Enhancements
Review IR-5(1)
1. Set its parameters
No parameters to set for IR-5(1).
2. Record its status
Track incidents and collect and analyze incident information using [Assignment: organization-defined automated mechanisms].
Discussion
Automated mechanisms for tracking incidents and collecting and analyzing incident information include Computer Incident Response Centers or other electronic databases of incidents and network monitoring devices.
No Enhancements match this Baseline.
ISO/IEC 27001:2022 Crosswalk
No ISO 27001 mapping published for this control.