Incident Response
Incident response under 20x is KSI-INR: after-action reports with lessons learned, persistent review of IR procedures, and review of past incidents for patterns.
Educational resource only. scm.cc is not a FedRAMP Recognized Independent Assessor (3PAO) and is not FedRAMP-authorized; it grants no authorization, certification, or assessment outcome. FedRAMP.gov is the authoritative source. This is not legal advice.
Technical detail
Official related controls include IR-3, IR-4, IR-8 (from KSI-INR-AAR). A tabletop after-action note is not automatically KSI-INR-AAR evidence. Lessons learned in an OCR section are a report field, not a dual map onto AAR. Catalog family title: Incidents are reported, reviewed, and folded back into operations as lessons learned.. Indicators on this page: KSI-INR-AAR, KSI-INR-RIR, KSI-INR-RPI.
How to implement
Keep dated incident records, procedure-review dates, and after-action artifacts. Link the family page and each indicator. Do not map IR tabletop after_action onto KSI-INR-AAR in product verification.
Common mistakes
- A never-tested runbook as KSI-INR-RIR. - Dual-mapping one after-action document onto AAR and RPI.
Related Key Security Indicators
Primary family KSI-INR. Statements on the indicator pages are verbatim CR26 text.
Questions teams ask
- Which KSI family owns Incident Response?
- KSI-INR (Incident Response). Indicator statements are verbatim on the family and indicator pages.
- Are these pages a substitute for the catalog?
- No. FedRAMP.gov and the pinned CR26 KSI catalog are authoritative.
Related hub pages
Primary sources
- FedRAMP 20x Key Security Indicators (CR26) (retrieved 2026-09-27)
- FedRAMP 20x overview & Core Principles (retrieved 2026-09-27)
- NIST SP 800-53 Rev 5 (security & privacy controls) (retrieved 2026-09-27)
Last verified 2026-09-27. FedRAMP.gov is authoritative.