Control index

94/409 fetchable across every Rev5 baseline

- orphanIR-01 — Policy and Procedures — No page: no KSI reaches this control, so there is nothing to show beyond its baseline membership.
- KSI onlyIR-02 — Incident Response Training
- orphanIR-02 (01) — Simulated Events — No page: no KSI reaches this control, so there is nothing to show beyond its baseline membership.
- orphanIR-02 (02) — Automated Training Environments — No page: no KSI reaches this control, so there is nothing to show beyond its baseline membership.
- recipe · 2 recipesIR-03 — Incident Response Testing
- KSI onlyIR-03 (02) — Coordination with Related Plans
- recipe · 3 recipesIR-04 — Incident Handling
- recipe · 3 recipesIR-04 (01) — Automated Incident Handling Processes
- orphanIR-04 (02) — Dynamic Reconfiguration — No page: no KSI reaches this control, so there is nothing to show beyond its baseline membership.
- orphanIR-04 (04) — Information Correlation — No page: no KSI reaches this control, so there is nothing to show beyond its baseline membership.
- orphanIR-04 (06) — Insider Threats — No page: no KSI reaches this control, so there is nothing to show beyond its baseline membership.
- orphanIR-04 (11) — Integrated Incident Response Team — No page: no KSI reaches this control, so there is nothing to show beyond its baseline membership.
- recipe · 1 recipeIR-05 — Incident Monitoring
- orphanIR-05 (01) — Automated Tracking, Data Collection, and Analysis — No page: no KSI reaches this control, so there is nothing to show beyond its baseline membership.
- recipe · 1 recipeIR-06 — Incident Reporting
- recipe · 1 recipeIR-06 (01) — Automated Reporting
- recipe · 1 recipeIR-06 (03) — Supply Chain Coordination
- recipe · 1 recipeIR-07 — Incident Response Assistance
- recipe · 1 recipeIR-07 (01) — Automation Support for Availability of Information and Support
- recipe · 3 recipesIR-08 — Incident Response Plan
- orphanIR-09 — Information Spillage Response — No page: no KSI reaches this control, so there is nothing to show beyond its baseline membership.
- orphanIR-09 (02) — Training — No page: no KSI reaches this control, so there is nothing to show beyond its baseline membership.
- orphanIR-09 (03) — Post-spill Operations — No page: no KSI reaches this control, so there is nothing to show beyond its baseline membership.
- orphanIR-09 (04) — Exposure to Unauthorized Personnel — No page: no KSI reaches this control, so there is nothing to show beyond its baseline membership.
- reached, in no baseline
  - KSI onlyIR-02 (03) — Breach
  - KSI onlyIR-08 (01) — Breaches
- All IR in the catalog

209 of these have a page: a control no indicator reaches is hollow, and hollow rows are listed rather than linked.

IR-06 (03) Supply Chain Coordinationir-6.3

Whether an AWS call fetches evidence for this control, and what to run. Its Rev5 baselines, the indicators that reach it and the FedRAMP guidance attached to it open below.

Partial1 of 1 recipe reaches IR-06 (03), and none is rated full — the output narrows the question, a human judgement closes it.

Amazon CloudWatch · Amazon GuardDuty · AWS Security Hub · AWS Systems Manager1 recipe · 6 calls

The calls

Collect evidence (1)

Authored AWS recipes whose output is evidence for IR-06 (03). This mapping is this project’s opinion (overlay v3.0.0), versioned separately from the dataset — the upstream FedRAMP rules name none of these tools.

partialSecurity Hub finding workflow status plus GuardDuty detection coverage, showing incident response procedures are exercised: enabled insights, automated response actions routed through EventBridge, automated notifications, and Systems Manager Automation documents that encode response stepsmonthlycli
securityhub-incident-review-proceduresAWS Security Hub · Amazon GuardDuty · AWS Systems Manager · Amazon CloudWatch
IR-4 wants incident handling capability, IR-4.1 wants automated incident handling, IR-6/6.1/6.3 want reporting to authorities with automated support, IR-7/7.1 want response assistance/coordination, IR-8/8.1 want the incident response plan and its updates, and SI-4.5 wants system monitoring. The evidence here is the infrastructure of response, not the act of responding: resolved findings show the workflow was used, enabled GuardDuty features show detection is active, EventBridge rules show automated routing exists, SSM Automation documents show response steps are encoded as code, and CloudWatch alarms show monitoring. What none of this proves is that the procedures are effective, that notifications reached the right authorities within SLA, or that the incident response plan was actually updated after the event. Those are narrative gaps filled by the plan document, notification records, and AARs. The workflow status is the only pass/fail field here — a finding stuck in NEW or NOTIFIED rather than RESOLVED is a control failure. Substitute your detector ID.

What NIST requires of IR-06 (03)

The control statement from NIST 800-53 Rev5, verbatim. Square brackets are organization-defined parameters — yours to set, not FedRAMP's to dictate.

Provide incident information to the provider of the product or service and other organizations involved in the supply chain or supply chain governance for systems or system components related to the incident.

NIST SP 800-53 Rev5 catalog 5.2.0, from usnistgov/oscal-content at 78650f0. The FedRAMP dataset carries no control text; this is borrowed and pinned.

Rev5 baseline membership

Membership is the whole relationship — a baseline is a set of control ids. Class A carries no baseline at all. The Low/Moderate/High labels are an interpretation from control counts, not a dataset fact.

Class Bour reading: Rev5 Low

not in baseline

Class B readiness

Class Cour reading: Rev5 Moderate

in baseline

Class C readiness

Class Dour reading: Rev5 High

in baseline

Class D readiness

KSI indicators reaching this control (2)

Under 20x, these indicators are how this control is demonstrated — automated KSI evidence stands in for narrative control evidence.

FedRAMP guidance & parameters

Where you read the rule. Guidance names an FRR document, never a clause, so the links below offer the whole document and leave the reading to you.

Follow the FedRAMP Incident Evaluation and Communication rules.
This guidance points at the Incident Evaluation and Communication rules (IEC, 8 requirements).
All 8 IEC requirements
IEC-FRP-ORV IEC-CSO-EFR IEC-CSO-DPR IEC-CSO-IIR IEC-CSO-OIR IEC-CSO-FIR IEC-CSO-EFI IEC-CSO-AIR

Pages exist for the 209 controls reached by at least one KSI. Baseline-only controls are the orphans on /coverage. Control titles and full text live in the NIST catalog, not this dataset.

Keyboard shortcuts

Go

Move

Act