{"data":{"id":"IR-05","name":"Incident Monitoring","family":"IR","family_name":"Incident Response","withdrawn":false,"description":"Track and document incidents.","supplemental_guidance":"Documenting incidents includes maintaining records about each incident, the status of the incident, and other pertinent information necessary for forensics as well as evaluating incident details, trends, and handling. Incident information can be obtained from a variety of sources, including network monitoring, incident reports, incident response teams, user complaints, supply chain partners, audit monitoring, physical access monitoring, and user and administrator reports. IR-04 provides information on the types of incidents that are appropriate for monitoring.","enhancements":[{"id":"IR-05(01)","name":"Automated Tracking, Data Collection, and Analysis","statement":"Track incidents and collect and analyze incident information using [Assignment: organization-defined automated mechanisms].","baselines":["high"]}],"baseline_low":true,"baseline_moderate":true,"baseline_high":true,"nist_800_53":{"rev5":{"id":"IR-05","name":"Incident Monitoring","description":"Track and document incidents.","discussion":"Documenting incidents includes maintaining records about each incident, the status of the incident, and other pertinent information necessary for forensics as well as evaluating incident details, trends, and handling. Incident information can be obtained from a variety of sources, including network monitoring, incident reports, incident response teams, user complaints, supply chain partners, audit monitoring, physical access monitoring, and user and administrator reports. IR-04 provides information on the types of incidents that are appropriate for monitoring.","related_controls":["AU-06","AU-07","IR-04","IR-06","IR-08","PE-06","PM-05","SC-05","SC-07","SI-03","SI-04","SI-07"],"baseline_low":true,"baseline_moderate":true,"baseline_high":true,"baseline_privacy":true,"new_in_rev5":false,"changes_from_rev4":"Control text eliminates ‘information system security' incidents Discussion adds reference to IR-04"}},"compliance_mappings":{"iso_27001_2022":["A.5.25"],"iso_27002_2022":["5.25","5.26"],"cobit_2019":["DSS02","DSS03"],"pci_dss_v4":["12.10"],"nist_csf_2":["DE.AE-03","DE.AE-08","RS.AN-08","RS.MA-02","RS.MA-03","RS.MA-04"],"cis_controls_v8":["CIS 17","CIS 17.9"],"soc2_tsc":["CC7.4","CC7.4-POF6"],"finos_ccc":["CCC-C15"],"iso_42001_2023":["A.8.4"],"iec_62443":[],"asd_e8":[],"nis2":["Art. 21(2)(b)"],"apra_cps_234":[],"mas_trm":[],"pra_op_resilience":[],"bsi_grundschutz":["DER.1","DER.2.1"],"anssi":["Hygiene.29","Hygiene.39","SecNumCloud.17.1"],"osfi_b13":["B-13.2.5","B-13.3.3"],"finma_circular":["IV.A(41)","IV.A(44)","IV.C(66)","IV.C(67)"],"gdpr":["Art.33(3)(d)","Art.33(5)"],"dora":["Art.17(3)(c)","Art.18(1)"],"bio2":["5.25","5.26"],"rbi_csf":["Annex1.19","ITGRCA.27"],"fisc":["FISC.O4"],"lgpd_bcb":["BCB.Art.5","BCB.Art.5-Supp","BCB.Art.7","LGPD.Art.48"],"hkma_tme1":["TME1.5.4","TME1.7.5"],"mlps_2":["8.1.5.4","8.1.10.10"],"dnb_good_practice":["DNB.15.2"],"cra":["CRA.Art14"],"swift_cscf":["SWIFT.7.1"],"cbb_tm":["TM-13"],"cbuae":["CR-9"],"nca_ecc":["2-13"],"qatar_nia":["IM"],"sama_csf":["3.6"],"uae_ia":["T11"],"bog_cisd":["CISD-VII"],"bom_ctrm":["5.1","5.3"],"cbe_csf":["CD-2"],"cbn_csf":["Part3.6"],"popia":["s22"],"sa_js2":["JS2-7.4"],"bot_cyber":["Ch4.1"],"cpmi_pfmi":["CG.LE","CG.RR","PFMI.P17"],"eba_ict":["3.5(d)"],"ecb_croe":["CROE.2.5.1","CROE.2.8.1"],"ffiec_is":["III.C","III.D"],"hipaa_sr":["§164.308(a)(6)(i)","§164.308(a)(6)(ii)"],"iosco_cyber":["LE-1","RR-1"],"nydfs_500":["500.16"],"sebi_cscrf":["RS.AN","RS.IM","RS.MA","SOC"],"cmmc_2":["IR"],"nerc_cip":["CIP-008-6"],"nrc_73_54":[],"tsa_psd":[],"ieee_1686":[],"ferc_cip":[],"doe_c2m2":["RESPONSE","SITUATION"],"api_1164":["Sec 10"],"awia":["AWWA Sec 5","AWWA Sec 6"],"iaea_nss":["Sec 7"],"pci_pts":[],"fips_140":[],"cbest":["CBEST.5"],"tiber_eu":["TIBER.BT","TIBER.CLOSE"],"pci_hsm":[],"common_criteria":[],"isae_3402":[],"fca_sysc_13":[],"fda_21_cfr_11":[],"fda_cyber":["INC-1","INC-2","VR-1"],"hitrust_csf":["11.a","11.b"],"iso_27799":["16.2"],"lloyds_ms":["MS8.5"],"naic_ds":["4F-a","5"],"nhs_dspt":["NDG-6.1","NDG-6.3"],"pra_ss1_23":[],"solvency_ii":["EIOPA-ICT-4.9"],"owasp_masvs_v2":[],"csa_ccm_v4":["SEF-06"],"csa_aicm":["SEF-06"],"ccss_v9":["1.02.8"],"mica":["Art.62(8)"],"basel_sco60":["SCO60.23","SCO60.55","SCO60.73"],"bssc":["GSP-05"],"sec_custody_digital":["SEC-CD-11"],"dpdpa":["Rules.7(2)"]},"attack_techniques":[],"metadata":{"last_reviewed":"2026-10-03","review_notes":"2026-10-03: nist_csf_2 DE.AE-03, RS.MA-04 added from NIST's CSF 2.0 to SP 800-53 Rev 5.2.0 crosswalk (OLIR entry 186), which OSA's mapping now takes as its base.","mapping_status":"complete"},"function":"corrective","used_by_patterns":["SP-001","SP-002","SP-006","SP-007","SP-023","SP-025","SP-029","SP-030","SP-031","SP-036","SP-043"]}}