Back
IR Audit
NIST SP 800-61 Rev 3
NIST SP 800-61 Rev 3DetectRespondRecover

Incident Response Auditor

IR plan maturity assessment across all four NIST 800-61 phases

IR-1 through IR-8CISA IR Guidelines

Overview

The Incident Response Auditor evaluates organizational IR plans against NIST SP 800-61 Rev 3 (Computer Security Incident Handling Guide) and CISA incident response guidelines. It assesses maturity across all four IR phases: Preparation, Detection & Analysis, Containment/Eradication/Recovery, and Post-Incident Activity. The auditor produces maturity scores, gap analysis, and actionable readiness checklists.

Prerequisites

Python 3.8+ standard library
IR plan document in Markdown or plain text format
Access to organizational incident response documentation
Understanding of NIST 800-61 IR lifecycle phases

Capabilities

Four-phase maturity assessment (Preparation, Detection, Containment, Post-Incident)
NIST 800-61 Rev 3 compliance scoring
CISA-specific requirement checking
Maturity scoring (0-100%) per phase and overall
Gap identification with specific missing procedures
Readiness checklist generation (standalone output)
Supply chain incident procedure verification
Communication plan and escalation path assessment

Usage Guide

1

Prepare the IR Plan Document

Ensure your incident response plan is in Markdown or text format. The auditor analyzes the document structure and content for completeness.

bash
# Verify the IR plan is accessible
cat /docs/incident_response_plan.md | head -20
2

Run the IR Audit

Execute the auditor against your IR plan. It will assess each of the four NIST 800-61 phases and produce a maturity report.

bash
python3 ir_audit.py \
  --ir-plan /docs/incident_response_plan.md \
  --output /reports/ir_audit.md
3

Generate Readiness Checklist

Produce a standalone checklist that can be used for tabletop exercises and IR drills.

bash
python3 ir_audit.py \
  --ir-plan /docs/incident_response_plan.md \
  --checklist-only \
  --output /reports/ir_checklist.md
4

Import Gaps into Risk Assessment

Feed critical IR gaps into the consolidated risk register.

bash
python3 risk_report.py add-risk \
  --project my-audit \
  --title 'IR Plan Missing Supply Chain Procedures' \
  --source ir-audit \
  --likelihood 3 --impact 4 \
  --control IR-4

CLI Commands

Perform a complete maturity assessment across all four NIST 800-61 phases.

bash
python3 ir_audit.py --ir-plan ir_plan.md --output ir_audit_report.md
Expected Output
Incident Response Readiness Audit
═══════════════════════════════════
Phase 1 - Preparation:        87.5% (7/8 requirements)
Phase 2 - Detection/Analysis: 83.3% (5/6 requirements)
Phase 3 - Containment/Eradication: 80.0% (4/5 requirements)
Phase 4 - Post-Incident:      66.7% (4/6 requirements)

Overall IR Maturity: 80.6%
CISA Compliance: 76.0%

Critical Gaps: 5 items requiring attention
Report saved to: ir_audit_report.md

Sample Outputs

IR Maturity Assessment

markdown
# Incident Response Readiness Audit
**Date:** 2026-03-01 | **Framework:** NIST SP 800-61 Rev 3

## Phase Maturity Scores
| Phase | Score | Status |
|-------|-------|--------|
| 1. Preparation | 87.5% | ✅ Strong |
| 2. Detection & Analysis | 83.3% | ✅ Strong |
| 3. Containment/Eradication/Recovery | 80.0% | ⚠️ Adequate |
| 4. Post-Incident Activity | 66.7% | ⚠️ Needs Improvement |
| **Overall** | **80.6%** | **⚠️ Adequate** |

## Critical Gaps
1. ❌ No supply chain incident procedures (CISA requirement)
2. ❌ No automated indicator sharing (NIST 800-61 §3.2.4)
3. ❌ Lessons learned process not formalized
4. ❌ No metrics/KPIs for IR effectiveness
5. ❌ Missing cross-functional communication templates

Readiness Checklist Excerpt

markdown
## Phase 1: Preparation Checklist
- [x] IR team roles and responsibilities defined
- [x] Contact information for IR team members
- [x] Escalation procedures documented
- [x] Communication templates prepared
- [x] IR tools and resources identified
- [x] Training program established
- [x] Legal/compliance notification requirements
- [ ] Supply chain incident procedures ← GAP

NIST Control Mappings

IR-1
Policy and Procedures
Incident Response

Develop, document, and disseminate incident response policy and procedures.

IR-2
Incident Response Training
Incident Response

Provide incident response training to system users.

IR-4
Incident Handling
Incident Response

Implement an incident handling capability for incidents.

IR-5
Incident Monitoring
Incident Response

Track and document incidents on an ongoing basis.

IR-6
Incident Reporting
Incident Response

Require personnel to report suspected incidents to the organizational incident response capability.

IR-8
Incident Response Plan
Incident Response

Develop an incident response plan that provides a roadmap for implementing the incident response capability.

Best Practices

Conduct tabletop exercises at least quarterly using the generated checklists
Update the IR plan after every real incident and after each tabletop exercise
Ensure supply chain incident procedures are included (CISA requirement)
Define clear metrics and KPIs for measuring IR effectiveness
Maintain current contact lists with multiple communication channels
Include legal, PR, and executive stakeholders in the IR communication plan

Limitations

Assesses plan documentation quality, not actual response capability
Cannot evaluate technical IR tooling or SIEM configuration
Maturity scoring is based on keyword and structure analysis
Does not simulate incident scenarios (use tabletop exercises for that)
Back to DashboardNIST SP 800-115 / 800-53 / CSF 2.0 / 800-61 / 800-37