# IR-5 — Incident Monitoring

- **Control ID:** IR-5
- **Family:** [IR](/md/families/IR.md)
- **Baselines:** low, moderate, high
- **Enhancement of:** No content available.

## Description

Track and document incidents.

## Discussion

Documenting incidents includes maintaining records about each incident, the status of the incident, and other pertinent information necessary for forensics as well as evaluating incident details, trends, and handling. Incident information can be obtained from a variety of sources, including network monitoring, incident reports, incident response teams, user complaints, supply chain partners, audit monitoring, physical access monitoring, and user and administrator reports. \[IR-4\](\#ir-4) provides information on the types of incidents that are appropriate for monitoring.

## Implementation guidance

No content available.

## CSF 2.0 subcategories

- [DE.AE-03](/md/csf/DE.AE-03.md) — Information is correlated from multiple sources
- [RS.MA-02](/md/csf/RS.MA-02.md) — Incident reports are triaged and validated
- [RS.MA-03](/md/csf/RS.MA-03.md) — Incidents are categorized and prioritized
- [RS.MA-04](/md/csf/RS.MA-04.md) — Incidents are escalated or elevated as needed

## Related controls

- [AU-6](/md/controls/AU-6.md)
- [AU-7](/md/controls/AU-7.md)
- [IR-4](/md/controls/IR-4.md)
- [IR-6](/md/controls/IR-6.md)
- [IR-8](/md/controls/IR-8.md)
- [PE-6](/md/controls/PE-6.md)
- [PM-5](/md/controls/PM-5.md)
- [SC-5](/md/controls/SC-5.md)
- [SC-7](/md/controls/SC-7.md)
- [SI-3](/md/controls/SI-3.md)
- [SI-4](/md/controls/SI-4.md)
- [SI-7](/md/controls/SI-7.md)

---

Derived from official NIST publications (NIST SP 800-53 Rev 5 and NIST CSF 2.0). nistcontrols.com is not affiliated with NIST.