IR-9 IR · Incident Response

Information Spillage Response

LOW MODERATE HIGH
3 Enhancements 0 Overlays 8 Related Controls
Graph
Export ▾

Requirements NIST SOURCE

Respond to information spills by:

Discussion (NIST Supplemental Guidance)

Information spillage refers to instances where information is placed on systems that are not authorized to process such information. Information spills occur when information that is thought to be a certain classification or impact level is transmitted to a system and subsequently is determined to be of a higher classification or impact level. At that point, corrective action is required. The nature of the response is based on the classification or impact level of the spilled information, the security capabilities of the system, the specific nature of the contaminated storage media, and the access authorizations of individuals with authorized access to the contaminated system. The methods used to communicate information about the spill after the fact do not involve methods directly associated with the actual spill to minimize the risk of further spreading the contamination before such contamination is isolated and eradicated.

Enhancements NIST SOURCE

IR-9(1) Responsible Personnel WITHDRAWN

Withdrawn. Incorporated into IR-9.

IR-9(2) Training LOW MODERATE HIGH

Provide information spillage response training [frequency].

Discussion

Organizations establish requirements for responding to information spillage incidents in incident response plans. Incident response training on a regular basis helps to ensure that organizational personnel understand their individual responsibilities and what specific actions to take when spillage incidents occur.

Open full page for IR-9(2) →
IR-9(3) Post-spill Operations LOW MODERATE HIGH

Implement the following procedures to ensure that organizational personnel impacted by information spills can continue to carry out assigned tasks while contaminated systems are undergoing corrective actions: [procedures].

Discussion

Corrective actions for systems contaminated due to information spillages may be time-consuming. Personnel may not have access to the contaminated systems while corrective actions are being taken, which may potentially affect their ability to conduct organizational business.

Open full page for IR-9(3) →
IR-9(4) Exposure to Unauthorized Personnel LOW MODERATE HIGH

Employ the following controls for personnel exposed to information not within assigned access authorizations: [controls].

Discussion

Controls include ensuring that personnel who are exposed to spilled information are made aware of the laws, executive orders, directives, regulations, policies, standards, and guidelines regarding the information and the restrictions imposed based on exposure to such information.

Open full page for IR-9(4) →

Implementation Guidance

Engineering Interpretation

Original engineering commentary written for this explorer — not NIST source text and not authoritative guidance.

No engineering interpretation has been authored for IR-9 yet. This section is architected to receive it — see the Requirements and Assessment sections above for the authoritative NIST source content in the meantime.

Assessment

NIST SP 800-53A REV 5.2.0

Assessment Objectives

  1. personnel or roles assigned the responsibility for responding to information spills is/are defined;
  2. personnel or roles to be alerted of the information spill using a method of communication not associated with the spill is/are defined;
  3. actions to be performed are defined;
  4. <IR-09_ODP[01] personnel or roles> is/are assigned the responsibility to respond to information spills;
  5. the specific information involved in the system contamination is identified in response to information spills;
  6. <IR-09_ODP[02] personnel or roles> is/are alerted of the information spill using a method of communication not associated with the spill;
  7. the contaminated system or system component is isolated in response to information spills;
  8. the information is eradicated from the contaminated system or component in response to information spills;
  9. other systems or system components that may have been subsequently contaminated are identified in response to information spills;
  10. <IR-09_ODP[03] actions> are performed in response to information spills.

Examine

[SELECT FROM: Incident response policy; procedures addressing information spillage; incident response plan; system security plan; records of information spillage alerts/notifications; list of personnel who should receive alerts of information spillage; list of actions to be performed regarding information spillage; other relevant documents or records].

Interview

[SELECT FROM: Organizational personnel with incident response responsibilities; organizational personnel with information security responsibilities].

Test

[SELECT FROM: Organizational processes for information spillage response; mechanisms supporting and/or implementing information spillage response actions and related communications].

STIGs & CCIs

No STIG checks or CCI mappings are currently loaded for IR-9. This section is architected to display, per product: STIG ID, Finding ID, Severity, Title, Description, Check, Fix, CCI, and NIST control mapping — but nothing is populated here until a real DISA STIG/CCI dataset is ingested.

Learn more about STIG/CCI integration →

Evidence

Potential Evidence — Derived

Categorized from the SP 800-53A "Examine"/"Test" artifact list above by keyword — not an authoritative NIST evidence list.

Policy

  • Incident response policy
  • incident response plan
  • system security plan

Testing

  • Organizational processes for information spillage response
  • mechanisms supporting and/or implementing information spillage response actions and related communications

Other Records

  • procedures addressing information spillage
  • records of information spillage alerts/notifications
  • list of personnel who should receive alerts of information spillage
  • list of actions to be performed regarding information spillage
  • other relevant documents or records