[{"data":1,"prerenderedAt":-1},["ShallowReactive",2],{"framework:nist-800-53\u002Fir-6":3},{"item":4,"lessons":18,"controls":69,"related":99},{"family":5,"item":6,"code":7,"title":8,"citations":9,"publisher":10,"summary_md":11,"official_text":12,"official_attribution":13,"official_url":14,"link_label":15,"note":16,"updated_at":17},"nist-800-53","ir-6","IR-6","Incident Reporting",210,"US National Institute of Standards and Technology (NIST)","**What it asks for.** Personnel must report suspected incidents to the internal incident response capability within a defined time, and incident information must be reported to defined authorities.\n\n**In practice.** Good practice is a simple, well-publicised reporting route such as a phishing report button, a hotline or a ticket form, plus clear criteria for when and how incidents are reported to regulators, customers and other external parties. Auditors expect reporting procedures, records of reports with timestamps and evidence of external notifications. European organisations should align this with NIS2, DORA and GDPR notification deadlines.\n\n**Common gaps.** Staff often do not know what counts as an incident or fear blame for reporting. External reporting duties are frequently not mapped to who decides and who sends the notification.","a. Require personnel to report suspected incidents to the organizational incident response capability within [Assignment: organization-defined time period] ; and\n  b. Report incident information to [Assignment: organization-defined authorities].\nDiscussion: The types of incidents reported, the content and timeliness of the reports, and the designated reporting authorities reflect applicable laws, executive orders, directives, regulations, policies, standards, and guidelines. Incident information can inform risk assessments, control effectiveness assessments, security requirements for acquisitions, and selection criteria for technology products.","From NIST SP 800-53 Rev. 5, a work of the US government in the public domain.","https:\u002F\u002Fcsrc.nist.gov\u002Fpubs\u002Fsp\u002F800\u002F53\u002Fr5\u002Fupd1\u002Ffinal","Open SP 800-53 at NIST",null,"2026-10-18T15:18:43.663+00:00",{"total":19,"list":20},215,[21,25,29,33,37,41,45,49,53,57,61,65],{"slug":22,"title":23,"published_at":24},"government-spyware-abuse-exposes-critical-gaps-in-accountability-and-victim-rights","Government Spyware Abuse Exposes Critical Gaps in Accountability and Victim Rights","2026-11-12T16:22:18.064+00:00",{"slug":26,"title":27,"published_at":28},"qilin-raas-admin-unmasked-through-reused-digital-identities","Qilin RaaS Admin Unmasked Through Reused Digital Identities","2026-11-12T14:21:18.908+00:00",{"slug":30,"title":31,"published_at":32},"iran-backed-operatives-used-facetime-to-direct-real-world-attacks-on-western-targets","Iran-Backed Operatives Used FaceTime to Direct Real-World Attacks on Western Targets","2026-11-11T18:21:18.327+00:00",{"slug":34,"title":35,"published_at":36},"eu-cyber-resilience-act-demands-247-incident-reporting-readiness","EU Cyber Resilience Act demands 24\u002F7 incident reporting readiness","2026-11-11T08:21:45.016+00:00",{"slug":38,"title":39,"published_at":40},"cisa-refines-incident-reporting-to-detect-coordinated-attack-campaigns","CISA Refines Incident Reporting to Detect Coordinated Attack Campaigns","2026-11-10T14:23:17.095+00:00",{"slug":42,"title":43,"published_at":44},"bae-systems-breach-cripples-us-bankruptcy-court-noticing-system","BAE Systems Breach Cripples US Bankruptcy Court Noticing System","2026-10-16T16:20:16.497+00:00",{"slug":46,"title":47,"published_at":48},"burger-king-japan-app-breach-exposes-11m-member-records","Burger King Japan App Breach Exposes 11M Member Records","2026-10-16T12:21:23.341+00:00",{"slug":50,"title":51,"published_at":52},"bae-systems-contractor-incident-cripples-us-bankruptcy-court-notifications","BAE Systems Contractor Incident Cripples US Bankruptcy Court Notifications","2026-10-16T12:20:16.174+00:00",{"slug":54,"title":55,"published_at":56},"bae-systems-breach-disrupts-federal-court-infrastructure-via-supply-chain-attack","BAE Systems Breach Disrupts Federal Court Infrastructure via Supply Chain Attack","2026-10-16T08:20:29.888+00:00",{"slug":58,"title":59,"published_at":60},"hard-coded-credentials-in-eseecloud-ip-cameras-leave-users-exposed","Hard-Coded Credentials in EseeCloud IP Cameras Leave Users Exposed","2026-10-15T18:21:38.566+00:00",{"slug":62,"title":63,"published_at":64},"international-csam-crackdown-highlights-platform-accountability-and-reporting-gaps","International CSAM Crackdown Highlights Platform Accountability and Reporting Gaps","2026-10-15T12:20:23.726+00:00",{"slug":66,"title":67,"published_at":68},"olvx-cybercrime-marketplace-operator-charged-after-500k-in-stolen-data-sales","OLVX Cybercrime Marketplace Operator Charged After $500K in Stolen Data Sales","2026-10-14T22:20:20.643+00:00",[70,75,80,85,90,95],{"slug":71,"name":72,"problem":73,"stories":74},"endpoint-detection-response","Endpoint detection and response (EDR and XDR)","Malware and hands-on-keyboard attackers on laptops and servers get spotted and stopped.",46,{"slug":76,"name":77,"problem":78,"stories":79},"identity-threat-detection","Identity threat detection and response (ITDR)","Attackers who log in with real, stolen credentials get noticed.",41,{"slug":81,"name":82,"problem":83,"stories":84},"patch-management","Automated patch management","Known holes get closed in days, not months.",37,{"slug":86,"name":87,"problem":88,"stories":89},"phishing-resistant-mfa","Phishing-resistant MFA","A stolen password, or a user who taps Approve on a push prompt, is no longer enough to log in.",35,{"slug":91,"name":92,"problem":93,"stories":94},"email-security","Email security","Phishing, malware and invoice fraud are filtered out before they reach inboxes.",31,{"slug":96,"name":97,"problem":98,"stories":94},"security-awareness-training","Security awareness training and phishing simulation","People recognise and report attacks instead of falling for them.",[100,105,111,116,122,127,132,137],{"family":101,"item":102,"code":103,"title":103,"together":104},"itil","overview","ITIL",120,{"family":106,"item":107,"code":108,"title":109,"together":110},"gdpr","33","Article 33","Notification of a personal data breach to the supervisory authority",96,{"family":106,"item":112,"code":113,"title":114,"together":115},"32","Article 32","Security of processing",95,{"family":117,"item":118,"code":119,"title":120,"together":121},"cis","6","Control 6","Access Control Management",82,{"family":5,"item":123,"code":124,"title":125,"together":126},"ac-2","AC-2","Account Management",72,{"family":117,"item":128,"code":129,"title":130,"together":131},"17","Control 17","Incident Response Management",69,{"family":117,"item":133,"code":134,"title":135,"together":136},"14","Control 14","Security Awareness and Skills Training",58,{"family":117,"item":138,"code":139,"title":140,"together":141},"3","Control 3","Data Protection",54]