Incident Communications Procedures¶

Providers MUST responsibly report incidents to FedRAMP within 1 hour of identification by sending an email to fedramp_security@fedramp.gov or fedramp_security@gsa.gov.

---

Terms: Incident

Providers MUST responsibly report incidents to all agency customers within 1 hour of identification using the incident communications points of contact provided by each agency customer.

---

Terms: Agency, Incident

Providers MUST responsibly report incidents to CISA within 1 hour of identification if the incident is confirmed or suspected to be the result of an attack vector listed at https://www.cisa.gov/federal-incident-notification-guidelines#attack-vectors-taxonomy, following the CISA Federal Incident Notification Guidelines at https://www.cisa.gov/federal-incident-notification-guidelines, by using the CISA Incident Reporting System at https://myservices.cisa.gov/irf.

Reference: CISA IRF Incident Reporting System

---

Terms: Incident

Providers MUST update all necessary parties, including at least FedRAMP, CISA (if applicable), and all agency customers, at least once per calendar day until the incident is resolved and recovery is complete.

---

Terms: Agency, All Necessary Parties, Incident

Providers MUST make incident report information available in their secure FedRAMP repository (such as USDA Connect) or trust center.

---

Terms: Incident, Trust Center

Providers MUST provide a final report once the incident is resolved and recovery is complete that describes at least:

1. What occurred

2. Root cause

3. Response

4. Lessons learned

5. Changes needed

---

Terms: Incident, Vulnerability Response

Providers MUST NOT irresponsibly disclose specific sensitive information about incidents that would likely increase the impact of the incident, but MUST disclose sufficient information for informed risk-based decision-making to all necessary parties.

---

Terms: All Necessary Parties, Incident, Likely

Providers SHOULD use automated mechanisms for reporting incidents and providing updates to all necessary parties (including CISA).

---

Terms: All Necessary Parties, Incident

Providers SHOULD make incident report information available in consistent human-readable and machine-readable formats.

---

Terms: Incident, Machine-Readable