NIST800 53 · Control IR-4(3) · Priority: critical · Component: Incident Response

What this control covers

Organization-defined classes of incidents and taking specified actions to ensure continuity of mission and business functions. Actions include system degradation, shutdown, or alternative operations, using tools like incident management systems to maintain operations, aligning with IR-3, CP-2, and CP-4. This control supports the Incident Response Management System capability within the Incident Response family.

Why it matters

How quickly and methodically you contain an incident determines the regulatory consequence — most fines are not for the breach itself but for the slow or absent response.

How to implement

AWS

Wire GuardDuty, Security Hub and Macie findings into your ticketing/SIEM via EventBridge. Maintain documented playbooks for IAM-key compromise, EC2 instance compromise, S3 data exposure, and run quarterly tabletop exercises.

Azure

Use Defender for Cloud + Microsoft Sentinel with playbooks (Logic Apps) for automated containment — disable user, isolate VM (NSG), revoke session tokens. Keep an on-call rotation in Teams with PagerDuty.

GCP

Org Policy Service for guardrails and Config Validator in CI to pre-check Terraform plans against policy as code (Rego).

GitHub

Subscribe to secret-scanning alerts and Dependabot security advisories; require triage SLAs by severity. For exposed secrets, rotate at the cloud provider FIRST then revoke at GitHub — order matters.

Evidence to collect

  • ticketing_workflow — See the iCompaas Evidence library for the canonical source for this evidence type.

Workflow metrics (ServiceNow, Jira) show approvals and remediation. Focus: Continuity Of Operations.

Quick checklist

  • Response — Management / Actions
  • Shutdown — Management / Actions
  • System — Management / Actions
  • Control — Management / Actions
  • Alternative — Management / Actions
  • Change — Management / Actions

Related articles on this site