{"catalogRevision":"24028ffcfc2b295fa1b08ee6caa84b765f0731b321496bf4f548c49ad2177028","kind":"record","record":{"attributes":{"category":"administrative","domain":"Incident Management & Response","type":"corrective"},"canonicalUrl":"https://controlsmap.com/?v=1&node=uc%3AUC-IR-07","description":"Track and document every incident from declaration to closure in a system of record covering status, actions performed, decisions, and timeline. Collect incident data and evidence using documented procedures that preserve integrity, provenance, and chain of custody so evidence remains suitable for disciplinary and legal proceedings, and record investigation actions as they are performed. Perform analysis, including root-cause analysis, to establish what took place and why, and record the conclusions.","details":{"control_category":"administrative","control_type":"corrective","domain":"Incident Management & Response","guidance":[],"members":[{"control_id":"IR-5","coverage":"full","framework":"nist-800-53","relationship":"superset_of"},{"control_id":"RS.AN-03","coverage":"full","framework":"nist-csf-2","relationship":"superset_of"},{"control_id":"RS.AN-06","coverage":"full","framework":"nist-csf-2","relationship":"superset_of"},{"control_id":"RS.AN-07","coverage":"full","framework":"nist-csf-2","relationship":"superset_of"},{"control_id":"A.5.28","coverage":"full","framework":"iso-27001","relationship":"superset_of"}],"statement":"Track and document every incident from declaration to closure in a system of record covering status, actions performed, decisions, and timeline. Collect incident data and evidence using documented procedures that preserve integrity, provenance, and chain of custody so evidence remains suitable for disciplinary and legal proceedings, and record investigation actions as they are performed. Perform analysis, including root-cause analysis, to establish what took place and why, and record the conclusions.","title":"Investigate incidents and preserve evidence and records","unified_id":"UC-IR-07"},"id":"uc:UC-IR-07","mapUrl":"https://controlsmap.com/?v=1&node=uc%3AUC-IR-07","sourceIds":["iso-27001","nist-800-53","nist-csf-2"],"sourceUrl":null,"title":"UC-IR-07 — Investigate incidents and preserve evidence and records","type":"unified"},"relationships":[{"expectedCatalogRevision":"24028ffcfc2b295fa1b08ee6caa84b765f0731b321496bf4f548c49ad2177028","id":"rel:1014cf6907ee24bbe99537fc7ce927f8d8ff672bf1ce05b8a1240b8ed9fc2f7c","properties":{"rationale":"Recording investigation actions and preserving evidence integrity, provenance, and chain of custody defends against unattributable and tampered records (mustKeep).","strength":"primary"},"sourceDetailPath":"/data/v1/records/uc-uc-ir-07-b4d61eff.json","sourceId":"uc:UC-IR-07","targetDetailPath":"/data/v1/records/risk-log-missing-audit-trail-37d1ba80.json","targetId":"risk:log-missing-audit-trail","type":"mitigates"},{"expectedCatalogRevision":"24028ffcfc2b295fa1b08ee6caa84b765f0731b321496bf4f548c49ad2177028","id":"rel:464d732549f0b141eb6c42247c0aebb78626d0ef47ff2224f67715f149847c02","properties":{},"sourceDetailPath":"/data/v1/records/wf-c3-4a88b225.json","sourceId":"wf:C3","targetDetailPath":"/data/v1/records/uc-uc-ir-07-b4d61eff.json","targetId":"uc:UC-IR-07","type":"operates"},{"expectedCatalogRevision":"24028ffcfc2b295fa1b08ee6caa84b765f0731b321496bf4f548c49ad2177028","id":"rel:74b049b6e5239ae0998a5aef47bb9c99828f89c587048f186af579fee9194276","properties":{},"sourceDetailPath":"/data/v1/records/wf-d06-c9616fb8.json","sourceId":"wf:D06","targetDetailPath":"/data/v1/records/uc-uc-ir-07-b4d61eff.json","targetId":"uc:UC-IR-07","type":"tests"},{"expectedCatalogRevision":"24028ffcfc2b295fa1b08ee6caa84b765f0731b321496bf4f548c49ad2177028","id":"rel:82e6f01251dcb45998c03678cffd7d30c45ad46a435b2eaaa068a9a4ec24f494","properties":{"control_id":"IR-5","coverage":"full","delta":null,"framework":"nist-800-53","provenance":{"defaultConfidence":"medium","defaultStatus":"active","direction":"canonical_to_source","mapper":"coworkcanvas-compliance-graph","note":"Each member is a documented relationship claim from the canonical unified control to a source control or guidance proposition. relationship: equal|superset_of (full) / intersects_with|subset_of (partial) / informs (guidance). confidence 'medium' = single-mapper, documented, not yet externally corroborated. source_version is the member framework's edition from the standard version register.","reviewDate":"2026-09-07"},"relationship":"superset_of","source_version":"Rev. 5"},"sourceDetailPath":"/data/v1/records/uc-uc-ir-07-b4d61eff.json","sourceId":"uc:UC-IR-07","targetDetailPath":"/data/v1/records/ctrl-nist-800-53-ir-5-dd4a5ff9.json","targetId":"ctrl:nist-800-53:IR-5","type":"maps_to"},{"expectedCatalogRevision":"24028ffcfc2b295fa1b08ee6caa84b765f0731b321496bf4f548c49ad2177028","id":"rel:93d0b97d6b9f00ad9e21c3bac40bab3ddb5654158bcaa0e3a06ef11e00592053","properties":{},"sourceDetailPath":"/data/v1/records/wf-a11-0924c009.json","sourceId":"wf:A11","targetDetailPath":"/data/v1/records/uc-uc-ir-07-b4d61eff.json","targetId":"uc:UC-IR-07","type":"operates"},{"expectedCatalogRevision":"24028ffcfc2b295fa1b08ee6caa84b765f0731b321496bf4f548c49ad2177028","id":"rel:c568c95ea582b081732f38851e7e052712cb91243d94998bb9f1d6eafac70730","properties":{"rationale":"Root-cause analysis establishes the full extent and method of a multi-stage intrusion so eradication can be made complete.","strength":"related"},"sourceDetailPath":"/data/v1/records/uc-uc-ir-07-b4d61eff.json","sourceId":"uc:UC-IR-07","targetDetailPath":"/data/v1/records/risk-cyber-coordinated-campaign-b5879769.json","targetId":"risk:cyber-coordinated-campaign","type":"mitigates"},{"expectedCatalogRevision":"24028ffcfc2b295fa1b08ee6caa84b765f0731b321496bf4f548c49ad2177028","id":"rel:d0ced64b425d387477584da8a61c2c2c516374df58427b000bf7f7805101676c","properties":{"control_id":"RS.AN-06","coverage":"full","delta":null,"framework":"nist-csf-2","provenance":{"defaultConfidence":"medium","defaultStatus":"active","direction":"canonical_to_source","mapper":"coworkcanvas-compliance-graph","note":"Each member is a documented relationship claim from the canonical unified control to a source control or guidance proposition. relationship: equal|superset_of (full) / intersects_with|subset_of (partial) / informs (guidance). confidence 'medium' = single-mapper, documented, not yet externally corroborated. source_version is the member framework's edition from the standard version register.","reviewDate":"2026-09-07"},"relationship":"superset_of","source_version":"2.0"},"sourceDetailPath":"/data/v1/records/uc-uc-ir-07-b4d61eff.json","sourceId":"uc:UC-IR-07","targetDetailPath":"/data/v1/records/ctrl-nist-csf-2-rs-an-06-4ff37775.json","targetId":"ctrl:nist-csf-2:RS.AN-06","type":"maps_to"},{"expectedCatalogRevision":"24028ffcfc2b295fa1b08ee6caa84b765f0731b321496bf4f548c49ad2177028","id":"rel:d18266cbbe65297c344262bec3d98cb93267dfa320ae533256df7772ef78f725","properties":{"control_id":"RS.AN-03","coverage":"full","delta":null,"framework":"nist-csf-2","provenance":{"defaultConfidence":"medium","defaultStatus":"active","direction":"canonical_to_source","mapper":"coworkcanvas-compliance-graph","note":"Each member is a documented relationship claim from the canonical unified control to a source control or guidance proposition. relationship: equal|superset_of (full) / intersects_with|subset_of (partial) / informs (guidance). confidence 'medium' = single-mapper, documented, not yet externally corroborated. source_version is the member framework's edition from the standard version register.","reviewDate":"2026-09-07"},"relationship":"superset_of","source_version":"2.0"},"sourceDetailPath":"/data/v1/records/uc-uc-ir-07-b4d61eff.json","sourceId":"uc:UC-IR-07","targetDetailPath":"/data/v1/records/ctrl-nist-csf-2-rs-an-03-5c53f5f7.json","targetId":"ctrl:nist-csf-2:RS.AN-03","type":"maps_to"},{"expectedCatalogRevision":"24028ffcfc2b295fa1b08ee6caa84b765f0731b321496bf4f548c49ad2177028","id":"rel:f0c83635efeba62d090fe35f8b2986eb6385b02b17fd74179801aaf67ac7f465","properties":{"control_id":"A.5.28","coverage":"full","delta":null,"framework":"iso-27001","provenance":{"defaultConfidence":"medium","defaultStatus":"active","direction":"canonical_to_source","mapper":"coworkcanvas-compliance-graph","note":"Each member is a documented relationship claim from the canonical unified control to a source control or guidance proposition. relationship: equal|superset_of (full) / intersects_with|subset_of (partial) / informs (guidance). confidence 'medium' = single-mapper, documented, not yet externally corroborated. source_version is the member framework's edition from the standard version register.","reviewDate":"2026-09-07"},"relationship":"superset_of","source_version":"2022"},"sourceDetailPath":"/data/v1/records/uc-uc-ir-07-b4d61eff.json","sourceId":"uc:UC-IR-07","targetDetailPath":"/data/v1/records/ctrl-iso-27001-a-5-28-e9d04483.json","targetId":"ctrl:iso-27001:A.5.28","type":"maps_to"},{"expectedCatalogRevision":"24028ffcfc2b295fa1b08ee6caa84b765f0731b321496bf4f548c49ad2177028","id":"rel:f0f02444c8b5ce9ceb4cba399c979fd309ff981564a547e36c7e8e4efa777d0d","properties":{},"sourceDetailPath":"/data/v1/records/wf-g7-9762f11b.json","sourceId":"wf:G7","targetDetailPath":"/data/v1/records/uc-uc-ir-07-b4d61eff.json","targetId":"uc:UC-IR-07","type":"operates"},{"expectedCatalogRevision":"24028ffcfc2b295fa1b08ee6caa84b765f0731b321496bf4f548c49ad2177028","id":"rel:fc0aaa3a6ddd9965231b777a01d8b74b3bb88797504e8622637f5f505ab865fb","properties":{"control_id":"RS.AN-07","coverage":"full","delta":null,"framework":"nist-csf-2","provenance":{"defaultConfidence":"medium","defaultStatus":"active","direction":"canonical_to_source","mapper":"coworkcanvas-compliance-graph","note":"Each member is a documented relationship claim from the canonical unified control to a source control or guidance proposition. relationship: equal|superset_of (full) / intersects_with|subset_of (partial) / informs (guidance). confidence 'medium' = single-mapper, documented, not yet externally corroborated. source_version is the member framework's edition from the standard version register.","reviewDate":"2026-09-07"},"relationship":"superset_of","source_version":"2.0"},"sourceDetailPath":"/data/v1/records/uc-uc-ir-07-b4d61eff.json","sourceId":"uc:UC-IR-07","targetDetailPath":"/data/v1/records/ctrl-nist-csf-2-rs-an-07-885dcf6a.json","targetId":"ctrl:nist-csf-2:RS.AN-07","type":"maps_to"}],"schemaVersion":1}