SA-15(10) Incident Response Plan
Control enhancement of SA-15 Development Process, Standards, and Tools
Control
Require the developer of the system, system component, or system service to provide, implement, and test an incident response plan.
Discussion
The incident response plan provided by developers may provide information not readily available to organizations and be incorporated into organizational incident response plans. Developer information may also be extremely helpful, such as when organizations respond to vulnerabilities in commercial off-the-shelf products.
Related controls
Need SA-15(10) implemented and evidenced?
We assess where you stand against this control, document the gap, and build the remediation plan your auditor and your board will both accept.
Control catalog and framework text on this page is reproduced from official NIST publications — a public-domain work of the U.S. Government (17 U.S.C. §105). Maverc commentary, groupings, and readiness guidance are our own and are not part of any NIST publication.