What this control covers
This control ensures that system security incidents are tracked, documented, and reported in a timely manner. It mandates reporting incidents to the organizational incident response team and relevant authorities within a specified time period. Additionally, it provides resources for system users to receive assistance in handling and reporting incidents, ensuring effective incident response and support. This control supports the Incident Monitoring and Reporting capability within the Incident Response (3.6) family.
Why it matters
How quickly and methodically you contain an incident determines the regulatory consequence — most fines are not for the breach itself but for the slow or absent response.
How to implement
AWS
Wire GuardDuty, Security Hub and Macie findings into your ticketing/SIEM via EventBridge. Maintain documented playbooks for IAM-key compromise, EC2 instance compromise, S3 data exposure, and run quarterly tabletop exercises.
Azure
Use Defender for Cloud + Microsoft Sentinel with playbooks (Logic Apps) for automated containment — disable user, isolate VM (NSG), revoke session tokens. Keep an on-call rotation in Teams with PagerDuty.
GCP
Org Policy Service for guardrails and Config Validator in CI to pre-check Terraform plans against policy as code (Rego).
Google Workspace
Forward the Admin, Login, Drive, Token and Mobile audit logs to Cloud Logging (Workspace BigQuery export). Alert on impossible-travel logins, OAuth-scope grants for high-risk scopes, and external Drive sharing of sensitive labels.
GitHub
Subscribe to secret-scanning alerts and Dependabot security advisories; require triage SLAs by severity. For exposed secrets, rotate at the cloud provider FIRST then revoke at GitHub — order matters.
Evidence to collect
ticketing_workflow— See the iCompaas Evidence library for the canonical source for this evidence type.infra_scan— See the iCompaas Evidence library for the canonical source for this evidence type.
Workflow metrics (ServiceNow, Jira) show approvals and remediation. Focus: Incident Monitoring, Reporting, and Response Assistance.
Quick checklist
- Response — Management / Time
- Time — Management / Time
- System — Management / Time
- Incident — Management / Time
- Security — Management / Time
Related articles on this site
- NIST 800-171 3.14.3 Monitor system security alerts and advisories and take action in response.
- NIST 800-171 3.14.1 Identify, report, and correct system flaws in a timely manner.
- NIST 800-171 3.3.1 Create and retain system audit logs and records to the extent needed to enable the monitoring, analysis, investigation, and reporting of unlawful or unauthorized system activity
- NIST 800-171 3.6.1 Establish an operational incident-handling capability for organizational systems that includes preparation, detection, analysis, containment, recovery, and user response activities.