{"catalogRevision":"24028ffcfc2b295fa1b08ee6caa84b765f0731b321496bf4f548c49ad2177028","kind":"record","record":{"attributes":{"category":"administrative","domain":"Incident Management & Response","type":"detective"},"canonicalUrl":"https://controlsmap.com/?v=1&node=uc%3AUC-IR-03","description":"Operate well-known channels — such as a monitored mailbox, hotline, or service portal — through which all personnel can and are directed to report observed or suspected security events as quickly as possible. Provide an incident response support resource, integral to the response capability, that offers advice and assistance to users on reporting and on handling suspected events. Acknowledge every report and route it into triage.","details":{"control_category":"administrative","control_type":"detective","domain":"Incident Management & Response","guidance":[],"members":[{"control_id":"A.6.8","coverage":"full","framework":"iso-27001","relationship":"superset_of"},{"control_id":"IR-7","coverage":"full","framework":"nist-800-53","relationship":"superset_of"}],"statement":"Operate well-known channels — such as a monitored mailbox, hotline, or service portal — through which all personnel can and are directed to report observed or suspected security events as quickly as possible. Provide an incident response support resource, integral to the response capability, that offers advice and assistance to users on reporting and on handling suspected events. Acknowledge every report and route it into triage.","title":"Provide channels to report events and obtain response help","unified_id":"UC-IR-03"},"id":"uc:UC-IR-03","mapUrl":"https://controlsmap.com/?v=1&node=uc%3AUC-IR-03","sourceIds":["iso-27001","nist-800-53"],"sourceUrl":null,"title":"UC-IR-03 — Provide channels to report events and obtain response help","type":"unified"},"relationships":[{"expectedCatalogRevision":"24028ffcfc2b295fa1b08ee6caa84b765f0731b321496bf4f548c49ad2177028","id":"rel:04b40b037e51c3fd146d1a2c69b51720dad73989915420d0806b29a0ab3f3a1f","properties":{"rationale":"Prompt all-personnel event reporting enables timely detection, a prerequisite for meeting statutory breach-notification deadlines.","strength":"related"},"sourceDetailPath":"/data/v1/records/uc-uc-ir-03-477c1ef0.json","sourceId":"uc:UC-IR-03","targetDetailPath":"/data/v1/records/risk-ir-breach-notification-failure-1f01c218.json","targetId":"risk:ir-breach-notification-failure","type":"mitigates"},{"expectedCatalogRevision":"24028ffcfc2b295fa1b08ee6caa84b765f0731b321496bf4f548c49ad2177028","id":"rel:050cbc2c4a7c9df6cabc85aa31f2211884307c8c66eaa72bef781431e8e21ea5","properties":{"rationale":"All-personnel reporting of suspected events provides a human detection channel that partially compensates for absent monitoring of suspicious activity.","strength":"related"},"sourceDetailPath":"/data/v1/records/uc-uc-ir-03-477c1ef0.json","sourceId":"uc:UC-IR-03","targetDetailPath":"/data/v1/records/risk-log-no-monitoring-supervision-712fe573.json","targetId":"risk:log-no-monitoring-supervision","type":"mitigates"},{"expectedCatalogRevision":"24028ffcfc2b295fa1b08ee6caa84b765f0731b321496bf4f548c49ad2177028","id":"rel:2279683b6e719a1c1cd30a634133e41a40c59ecfa65daceeec8bae95cef18662","properties":{},"sourceDetailPath":"/data/v1/records/wf-d06-c9616fb8.json","sourceId":"wf:D06","targetDetailPath":"/data/v1/records/uc-uc-ir-03-477c1ef0.json","targetId":"uc:UC-IR-03","type":"tests"},{"expectedCatalogRevision":"24028ffcfc2b295fa1b08ee6caa84b765f0731b321496bf4f548c49ad2177028","id":"rel:241e3ed1ff8130607909052d7a1a4961af0c9fa568fdacf408d7b8d9d359cb20","properties":{"control_id":"A.6.8","coverage":"full","delta":null,"framework":"iso-27001","provenance":{"defaultConfidence":"medium","defaultStatus":"active","direction":"canonical_to_source","mapper":"coworkcanvas-compliance-graph","note":"Each member is a documented relationship claim from the canonical unified control to a source control or guidance proposition. relationship: equal|superset_of (full) / intersects_with|subset_of (partial) / informs (guidance). confidence 'medium' = single-mapper, documented, not yet externally corroborated. source_version is the member framework's edition from the standard version register.","reviewDate":"2026-09-07"},"relationship":"superset_of","source_version":"2022"},"sourceDetailPath":"/data/v1/records/uc-uc-ir-03-477c1ef0.json","sourceId":"uc:UC-IR-03","targetDetailPath":"/data/v1/records/ctrl-iso-27001-a-6-8-87f56c6a.json","targetId":"ctrl:iso-27001:A.6.8","type":"maps_to"},{"expectedCatalogRevision":"24028ffcfc2b295fa1b08ee6caa84b765f0731b321496bf4f548c49ad2177028","id":"rel:53c400d05fefaa8205385e76e7d91863d805eb1ea636cf29218a30b0a7acae83","properties":{"rationale":"Operating monitored reporting channels and support routes events promptly into triage, directly reducing slow/inconsistent incident handling at intake.","strength":"primary"},"sourceDetailPath":"/data/v1/records/uc-uc-ir-03-477c1ef0.json","sourceId":"uc:UC-IR-03","targetDetailPath":"/data/v1/records/risk-ir-no-response-procedures-90eb7ba1.json","targetId":"risk:ir-no-response-procedures","type":"mitigates"},{"expectedCatalogRevision":"24028ffcfc2b295fa1b08ee6caa84b765f0731b321496bf4f548c49ad2177028","id":"rel:58e0ff48243f302248e65d1afc93091cd050265a7637f573bad13272c3f257ba","properties":{},"sourceDetailPath":"/data/v1/records/wf-c23-d6d82467.json","sourceId":"wf:C23","targetDetailPath":"/data/v1/records/uc-uc-ir-03-477c1ef0.json","targetId":"uc:UC-IR-03","type":"operates"},{"expectedCatalogRevision":"24028ffcfc2b295fa1b08ee6caa84b765f0731b321496bf4f548c49ad2177028","id":"rel:d70dc108dd4282d375a47b570686e06ef0aeb8f34cb4f8610902ad16e277e0b0","properties":{"control_id":"IR-7","coverage":"full","delta":null,"framework":"nist-800-53","provenance":{"defaultConfidence":"medium","defaultStatus":"active","direction":"canonical_to_source","mapper":"coworkcanvas-compliance-graph","note":"Each member is a documented relationship claim from the canonical unified control to a source control or guidance proposition. relationship: equal|superset_of (full) / intersects_with|subset_of (partial) / informs (guidance). confidence 'medium' = single-mapper, documented, not yet externally corroborated. source_version is the member framework's edition from the standard version register.","reviewDate":"2026-09-07"},"relationship":"superset_of","source_version":"Rev. 5"},"sourceDetailPath":"/data/v1/records/uc-uc-ir-03-477c1ef0.json","sourceId":"uc:UC-IR-03","targetDetailPath":"/data/v1/records/ctrl-nist-800-53-ir-7-45251b92.json","targetId":"ctrl:nist-800-53:IR-7","type":"maps_to"}],"schemaVersion":1}