accrediting authority. DoD SCI organizations will provide reporting directly to the DIA Information Assurance Protection Center (IAPC). Member organizations operating under the authority of the NSA, NRO, and NGA shall report to their agency authority IAW internal agency policy. DoD IC members will report all reportable events directly to the IC-IRC within established reporting timelines. The reporting timelines establish the minimum requirements and timeframes by which incidents will be reported. USCYBERCOM may issue changes to reporting requirements and timeframes based on ongoing operations or activities. The reporting timelines are designed to expedite reporting of incidents where national-level coordination and action may serve to mitigate or prevent damage to the DoD information networks. Category Impact Initial Notification to Next Tier Initial Report to Next Tier Initial submission to JIMS Minimum Reporting 1- Root Level Intrusion (Incident) High Within 15 minutes Within 4 hours Within 6 hours Tier I Moderate Within 2 hours Within 8 Within 12 hours Tier I Low Within 4 hours Within 12 Within 24 hours Tier I 2- User Intrusion (Incident) High Within 15 minutes Within 4 hours Within 6 hours Tier I Moderate Within 2 hours Within 8 hours Within 12 hours Tier I Low Within 4 hours Within 12 hours Within 24 hours Tier I 3- Unsuccessful Activity Attempt (Event) Any Within 4 hours Within 12 hours Within 24 hours Tier II 4- Denial of Service (Incident) High Within 15 minutes Within 4 hours Within 6 hours Tier I Moderate Within 15 minutes Within 4 hours Within 6 hours discovery Tier I Low As directed by CC/S/A/FA Guidance As directed by CC/S/A/FA Guidance As directed by CC/S/A/FA Guidance Tier I 5- Non- Compliance Activity (Event) All Events Within 4 hours Within 12 hours Within 48 hours Tier II 6 – (Event) Any As directed by CC/S/A/FA Guidance As directed by CC/S/A/FA Guidance As directed by CC/S/A/FA Guidance Tier II 7 - Malicious Logic (Incident) High Within 15 minutes Within 4 hours Within 6 hours Tier I
Impact is assessed based on the degree to which an incident or event adversely affects, or has the potential to affect, the successful accomplishment of operational missions and the confidentiality, integrity, or availability of DoD information networks and ISs. Each cyber event or incident is assessed and assigned an impact as part of the incident handling process. An impact assessment is one of the determining factors when assigning priority to an incident or event. The category and impact guide reporting timelines and response actions should be commensurate with the magnitude of the incident or event. The following describes the categorization system for assigning impact levels to incidents or events. This table is intended to provide a high-level overview of each security objective and define impact levels across these objectives. Potential Impact Security Objective Low Moderate High Confidentiality. Preserving authorized restrictions on information access and disclosure, including means for protecting personal privacy and proprietary information. [44 U.S.C. 3542]. The unauthorized disclosure of information could be expected to have a limited adverse effect on organizational operations, organizational assets, or individuals. The unauthorized disclosure of information could be expected to have a serious adverse effect on organizational operations, organizational assets, or individuals. The unauthorized disclosure of information could be expected to have a severe or catastrophic adverse effect on organizational operations, organizational assets, or individuals. Integrity. Guarding against improper information modification or destruction, and includes ensuring information nonrepudiation and authenticity. [44 U.S.C. 3542]. The unauthorized modification or destruction of information could be expected to have a limited adverse effect on organizational operations, organizational assets, or individuals. The unauthorized modification or destruction of information could be expected to have a serious adverse effect on organizational operations, organizational assets, or individuals. The unauthorized modification or destruction of information be expected to have a severe or catastrophic adverse effect on organizational operations, organizational assets, or individuals. Availability. Ensuring timely and reliable access to and use of information. [44 The disruption of access to or use of information or an information system be expected to have a limited adverse effect on organizational operations, organizational assets, or individuals. The disruption of access to or use of information or an information system could be expected to have a serious adverse effect on organizational operations, organizational assets, or individuals. The disruption of access to or use of information or an information system could be expected to have a severe or catastrophic adverse effect on organizational operations, organizational assets, or individuals. Table - Impact Levels
IR-1 IR-1 (a) (2) CCI-000810 High Moderate Low High Moderate Low High Moderate Low 6510.01F "Information Assurance and Support to Computer Network Defense," CJCSM 6510.01B, "Cyber Incident Handling Program," DoDD O-8530.1, and DoDI meet the DoD requirements for incident response policy and procedures. DoD Components are automatically compliant with this CCI because they are covered by the DoD level with the following policies: CJCSI 6510.01F, CJCSM 6510.01B, DoDD and DoDI O-8530.2. DoD has defined the roles as all personnel identified as stakeholders in the incident response process, as well as the ISSM and ISSO. Automatically compliant with this CCI because they are covered at the DoD level IR-1 IR-1 (b) (1) CCI-000808 High Moderate Low High Moderate Low High Moderate Low The organization inspected/assessed is automatically compliant with this CCI because they are covered at the DoD level. DoD has defined the frequency as reviewed annually - updated as appropriate but at least within 10 years of date of issuance. Automatically compliant with this CCI because they are covered at the DoD level IR-1 IR-1 (b) (1) CCI-000807 High Moderate Low High Moderate Low High Moderate Low CJCSI 6510.01F "Information Assurance and Support to Computer Network Defense," CJCSM 6510.01B, "Cyber Incident Handling Program," DoDD O-8530.1, and DoDI meet the DoD requirements for incident response policy and procedures. DoD Components are automatically compliant with this CCI because they are covered by the DoD level with the following policies: CJCSI 6510.01F, CJCSM 6510.01B, DoDD and DoDI O-8530.2. Automatically compliant with this CCI because they are covered at the DoD level
IR-1 IR-1 (b) (2) CCI-000812 High Moderate Low High Moderate Low High Moderate Low The organization inspected/assessed is automatically compliant with this CCI because they are covered at the DoD level. DoD has defined the frequency as reviewed annually - updated as appropriate. Automatically compliant with this CCI because they are covered at the DoD level IR-1 IR-1 (b) (2) CCI-000811 High Moderate Low High Moderate Low High Moderate Low CJCSI 6510.01F "Information Assurance and Support to Computer Network Defense," CJCSM 6510.01B, "Cyber Incident Handling Program," DoDD O-8530.1, and DoDI meet the DoD requirements for incident response policy and procedures. DoD Components are automatically compliant with this CCI because they are covered at the DoD level with the following policies: CJCSI 6510.01F, CJCSM 6510.01B, DoDD and DoDI O-8530.2. DoD has defined the frequency as reviewed annually - updated as appropriate. Automatically compliant with this CCI because they are covered at the DoD level IR-10 IR-10 CCI-002822 High Moderate High Moderate High Moderate The organization conducting the inspection/assessment obtains and examines appointments to the integrated team as well as the documented roles and responsibilities to ensure the organization being inspected/assessed establishes an integrated team of forensic/malicious code analysts, tool developers, and real-time operations personnel. Note: Code Analysis, tool development and real-time operations are Tier-2 responsibilities and outside the scope of this Organization IR-2 (1) IR-2 (1) CCI-000816 High High High The organization conducting the inspection/assessment obtains and examines incident response training materials and a record of training events to ensure that simulated events have been included. The system is not considered a HIGH level. Therefore, this AP is not applicable.
IR-4 (2) IR-4 (2) CCI-000826 blank blank blank The organization conducting the inspection/assessment obtains and examines the incident response plan and verifies it has procedures addressing dynamic reconfiguration of information system components defined in IR-4 (2), CCI 2781 as part of the incident response capability IAW CM-3. NIST has not allocated this AP. Therefore, this AP is not applicable. IR-4 (2) IR-4 (2) CCI-002781 blank blank blank The organization conducting the inspection/assessment obtains and examines the documented information system components to ensure the organization being inspected/assessed defines the information system components for dynamic reconfiguration as part of the incident response capability. NIST has not allocated this AP. Therefore, this AP is not applicable. IR-4 (3) IR-4 (3) CCI-000827 High Moderate High Moderate High Moderate CJCSM 6510.01B has already identified DoD's classes of incidents. The organization being inspected/assessed is automatically compliant with this CCI because they are covered at the DoD level. DoD has defined the classes of incidents as classes of incidents defined in CJCSM 6510.01B Appendix A- Enclosure B.6510.01M Automatically compliant with this CCI because they are covered at the DoD level IR-4 (3) IR-4 (3) CCI-000828 High Moderate High Moderate High Moderate CJCSM 6510.01B has already identified DoD's actions to take in response to classes of incidents. The organization being inspected/assessed is automatically compliant with this CCI because they are covered at the DoD level. DoD has defined the actions as actions defined in CJCSM 6510.01B. Automatically compliant with this CCI because they are covered at the DoD level
IR-4 (6) IR-4 (6) CCI-002782 High Moderate Low High Moderate Low High Moderate Low The organization conducting the inspection/assessment obtains and examines the incident response plan as well as a sampling of incident action reports to ensure the organization being inspected/assessed implements incident handling capability for insider threats. IR-4 (7) IR-4 (7) CCI-002783 High Moderate Low High Moderate Low High Moderate Low The organization conducting the inspection/assessment obtains and examines the incident response plan to ensure the organization being inspected/assessed coordinates incident handling capability for insider threats across components or elements of the organization defined in IR-4 (7), CCI 2784. IR-4 (7) IR-4 (7) CCI-002784 High Moderate Low High Moderate Low High Moderate Low The organization conducting the inspection/assessment obtains and examines the documented components or elements to ensure the organization being inspected/assessed defines components or elements of the organization in which incident handling capability for insider threats will be coordinated. DoD has determined the components or elements are not appropriate to define at the Enterprise level. IR-4 (8) IR-4 (8) CCI-002785 High Moderate Low High Moderate Low High Moderate Low The organization conducting the inspection/assessment obtains and examines reports, meeting minutes, or evidence that the organization being inspected/assessed is coordinating with external organizations defined in (8), CCI 2786 to correlate and share incident information defined in IR-4 (8), CCI 2787 to achieve a cross-organization perspective on incident awareness and more effective incident responses.
IR-6 IR-6 (b) CCI-000836 High Moderate Low High Moderate Low High Moderate Low The organization conducting the inspection/assessment obtains and examines a sample of previous security incidents to ensure the incidents were reported to the appropriate CIRT/CERT (such as US-CERT, DoD IC CERT) any security incidents IAW the incident response plan (IR-8). Reporting be conducted IAW CJCSM 6510.01B. DoD has defined the authorities as the appropriate CIRT/CERT (such as US-CERT, DoD CERT, IC CERT). IR-6 IR-6 (b) CCI-002791 High Moderate Low High Moderate Low High Moderate Low The organization being inspected/assessed is automatically compliant with this CCI because they are covered at the DoD level. DoD has defined the authorities as the appropriate CIRT/CERT (such as US-CERT, DoD CERT, IC CERT). Automatically compliant with this CCI because they are covered at the DoD level IR-7 IR-7 CCI-000839 High Moderate Low High Moderate Low High Moderate Low The organization conducting the inspection/assessment will interview organizational users to determine awareness of incident response support services and quality of assistance of those services when used. If interviewing organizational users is not feasible, then review users manuals/documentation to ensures it identifies an incident response support service to contact. IR-7 (1) IR-7 (1) CCI-000840 High Moderate High Moderate High Moderate The organization conducting the inspection/assessment obtains and examines the incident response information sharing capability to validate the information sharing capability is available to organizational users. Internal Web Portal (external link)
lessons learned from past incidents). IR-8 IR-8 (c) CCI-000847 High Moderate Low High Moderate Low High Moderate Low The organization being inspected/assessed is automatically compliant with this CCI because they are covered at the DoD level. DoD has defined the frequency as at least annually (incorporating lessons learned from past incidents). Automatically compliant with this CCI because they are covered at the DoD level IR-8 IR-8 (d) CCI-000849 High Moderate Low High Moderate Low High Moderate Low The organization conducting the inspection/assessment obtains and examines documentation of the update actions for the incident response plan to ensure the organization is updating the incident response plan to address system/organizational changes or problems encountered during plan implementation, execution, or testing and incorporating lessons learned from past incidents (IR-4a). IR-8 IR-8 (e ) CCI-002803 High Moderate Low High Moderate Low High Moderate Low The organization being inspected/assessed is automatically compliant with this CCI because they are covered at the DoD level. DoD has defined the incident response personnel as all stakeholders identified in the incident response plan, not later than 30 days after the change is made. Automatically compliant with this CCI because they are covered at the DoD level