NIST 800-53 r5 · Controls catalogue · Family IR
IR-4Incident Handling
Implement an incident handling capability for incidents that is consistent with the incident response plan and includes preparation, detection and analysis, containment, eradication, and recovery; Coordinate incident handling activities with contingency planning activities; Incorporate lessons learned from ongoing incident handling activities into incident response procedures, training, and testing, and implement the resulting changes accordingly; and Ensure the rigor, intensity, scope, and results of incident handling activities are comparable and predictable across the organization.
Last updated: 09 May 2026 03:25 UTC
Implementations targeting this control (1)
- aws-config-cloudwatch-alarm-action-check Critical CloudWatch alarms have at least one action AWS::CloudWatch::Alarm partial
ATT&CK techniques this control mitigates (0)
- No ATT&CK techniques mapped to this control yet.
Weaknesses this control addresses (4)AI
CWEs ranked by how often they appear in real CVEs. The rationale describes how this control reduces exploitability of each weakness class.
| CWE | Name | CVEs | Why this control addresses it |
|---|---|---|---|
CWE-703 | Improper Check or Handling of Exceptional Conditions | 146 | Incident handling capability directly provides structured checking and response actions for security incidents as exceptional conditions. |
CWE-391 | Unchecked Error Condition | 23 | Formal incident handling procedures enforce checking and acting on error conditions that could indicate security incidents. |
CWE-778 | Insufficient Logging | 23 | Detection and analysis phases require sufficient logging to identify and investigate incidents, addressing insufficient logging. |
CWE-390 | Detection of Error Condition Without Action | 14 | The containment, eradication, and recovery steps ensure detected incidents trigger concrete actions rather than no response. |
Top CVEs where this control is the strongest mitigation
| CVE | Risk | CVSS | EPSS | Match |
|---|---|---|---|---|
| No CVEs annotated to this control yet — the per-CVE backfill is in progress. | ||||