IR-4 · Incident Response · NIST SP 800-53 Rev5
IR-4: Incidents are handled through detection, analysis, containment, and recovery
How NIST SP 800-53 Rev5 control IR-4 (Incident Response) maps to FedRAMP 20x Key Security Indicators, and the evidence scm.cc collects for it.
Educational resource only. scm.cc is not a FedRAMP Recognized Independent Assessor (3PAO) and is not FedRAMP-authorized; it grants no authorization, certification, or assessment outcome. FedRAMP.gov is the authoritative source. This is not legal advice.
What IR-4 requires
Incidents are handled through detection, analysis, containment, and recovery.
Paraphrased from NIST SP 800-53 Rev. 5 — Security and Privacy Controls for Information Systems and Organizations (checked 2026-10-31). scm.cc does not reproduce the official control text; read the NIST catalog for the normative wording.
FedRAMP 20x KSIs that cover IR-4
These Key Security Indicators officially cite IR-4 as a related SP 800-53 control, so satisfying them is how a 20x package demonstrates this control.
KSI-CNA-RVP — Reviewing Protections
Cloud Native Architecture · official related-control citation: ir-4.2
KSI-IAM-ELP — Ensuring Least Privilege
Identity and Access Management · official related-control citation: ir-4.6
KSI-IAM-JIT — Authorizing Just-in-Time
Identity and Access Management · official related-control citation: ir-4.6
KSI-IAM-SUS — Responding to Suspicious Activity
Identity and Access Management · official related-control citation: ir-4.2, ir-4.6
KSI-INR-AAR — Generating After Action Reports
Incident Response · official related-control citation: ir-4, ir-4.1
KSI-INR-RIR — Reviewing Incident Response Procedures
Incident Response · official related-control citation: ir-4, ir-4.1, ir-4.11
KSI-INR-RPI — Reviewing Past Incidents
Incident Response · official related-control citation: ir-4, ir-4.1, ir-4.11, ir-4.4
KSI-MLA-OSM — Operating SIEM Capability
Monitoring, Logging, and Auditing · official related-control citation: ir-4.1
KSI-PIY-RIS — Reviewing Investments in Security
Policy and Inventory · official related-control citation: ir-4.11
Evidence scm.cc collects for IR-4
scm.cc tracks this as a document you attach; it validates that the artifact is present and replays it for a reviewer.
Related Incident Response controls
- IR-8 — An incident-response plan is documented, distributed, and maintained