controlIR-2

Incident Response Training (IR-2)

Provide incident response training to system users consistent with assigned roles and responsibilities: Review and update incident response training content [organization-defined] and following [organization-defined].

Security Baselines

LOWMODERATEHIGH

incident-responsedetectioncontainment

Why These Connect

Maps To2

These are equivalent or closely aligned requirements in other frameworks.

Baselined In3

This control is included in the linked security baseline (LOW, MODERATE, or HIGH).

Supports12

These related controls work together — a change to one may affect the others.

Enhances3

These enhancements add specific capabilities or refinements to the base control.

Related Controls(8)

AT-2Literacy Training and Awareness (AT-2)

LMH

AT-3Role-based Training (AT-3)

LMH

AT-4Training Records (AT-4)

LMH

CP-3Contingency Training (CP-3)

LMH

IR-3Incident Response Testing (IR-3)

IR-4Incident Handling (IR-4)

LMH

IR-8Incident Response Plan (IR-8)

LMH

IR-9Information Spillage Response (IR-9)

Cross-Framework Mappings(2)

ISO 27001ISO/IEC 27001:20221 mappingFinal

NIST OLIR informative reference — SP 800-53 Rev 5 to ISO/IEC 27001:2022

HIPAAHIPAA Security Rule1 mappingFinal

NIST OLIR informative reference — HIPAA Security Rule to SP 800-53 Rev 5

Organization-Defined Parameters(4)

Assignmentorganization-defined time period

Assignmentorganization-defined frequency

Assignmentorganization-defined events

Control Enhancements(3)

IR-2(1)Simulated Events (IR-2(1))

IR-2(2)Automated Training Environments (IR-2(2))

IR-2(3)Breach (IR-2(3))