{"catalogRevision":"791ff2dd3a45707290badee660f185e514d15f1cf518908628f425c2f2c56ee4","download":{"releaseId":"sha256:5b3ffa8a2a8c0580c52dac577098bb32aa2279287aabe19d6d03befde2314c09","slug":"controls-incident-response-readiness-program","url":"/assets/agent_workflow-controls-incident-response-readiness-program-a8e458f4.0c976ba4ee334c57.json"},"kind":"record","record":{"attributes":{"department":"it","domain":"controls","lineOfDefense":"operate"},"canonicalUrl":"https://evidenceflows.com/workflows/all/?w=controls-incident-response-readiness-program","description":"Standing operator workflow that runs against the EXISTING incident-response Control item — UC-IR-01 (domains=incident_management_response, frequency=annual) — with the training-and-testing Control UC-IR-02 linked to the same instance; both carry framework=[nist-800-53, iso-27001], and those governing standards drive the plan's required elements. It maintains and approves the written IR plan (a Policy item, policy_type=procedure, framework=[nist-800-53, iso-27001], review_frequency=annual, whose governed redline attaches to the item), distributes and protects it to named responders, delivers role-based training, runs the scheduled capability test (an Audit item, audit_type=readiness, linked back to the two Controls), and feeds exercise and training gaps back into the plan and training program as corrective-action Issue items (source=self_assessment). Named deliverables: the redlined IR plan on its Policy item, the exercise after-action report, the IR readiness dashboard, and the routed corrective-action register (Issue items). In scope: the IR plan's required elements (mission and scope, incident definitions and severity structure, roles and responsibilities, communication paths, and business-continuity/third-party coordination), the named-responder and leadership training population, and the scheduled capability test. Out of scope: live incident handling itself — this workflow builds and tests readiness, it does not run the response to an active incident. It runs on an annual cadence and off-cycle whenever a significant incident or a material organizational/system change occurs; no upstream workflow feeds it and it hands off to no downstream workflow — identified gaps re-enter this same workflow as corrective-action Issues.","details":{"canonicalUrl":"https://evidenceflows.com/workflows/all/?w=controls-incident-response-readiness-program","capabilities":[],"controls":["UC-IR-01","UC-IR-02"],"domains":["controls"],"lineOfDefense":"operate","mappingStatus":"mapped","releaseId":"sha256:5b3ffa8a2a8c0580c52dac577098bb32aa2279287aabe19d6d03befde2314c09","roleIntegrity":{"activityCount":0,"ermPhases":[],"lineRoles":[],"serviceModes":[],"warnings":[]},"sourceTemplateId":"workflow-library:controls-incident-response-readiness-program","standards":["nist-800-53","iso-27001"],"teams":["it"]},"download":{"releaseId":"sha256:5b3ffa8a2a8c0580c52dac577098bb32aa2279287aabe19d6d03befde2314c09"},"history":{"digest":"4d9921441a5bc0fda084550f6ee173c78fc49bdd1f67129b03d15c915fb19d33","firstSeenAt":"2026-09-17T22:28:00Z","firstSeenRevision":"f368a6cce277037e4b1e1ff46004e3acd295f96c9ac63a411a0e45775a7f468e","updatedAt":"2026-10-04T21:48:26Z","updatedRevision":"791ff2dd3a45707290badee660f185e514d15f1cf518908628f425c2f2c56ee4"},"id":"wf:C57","mapUrl":"https://evidenceflows.com/?v=1&node=wf%3AC57","slug":"controls-incident-response-readiness-program","sourceIds":["iso-27001","nist-800-53"],"sourceUrl":null,"title":"Incident Response Readiness Program","type":"workflow"},"relationships":[{"expectedCatalogRevision":"791ff2dd3a45707290badee660f185e514d15f1cf518908628f425c2f2c56ee4","id":"rel:5d1da3bbabfdfb12ae952827d1eef946882f92760f56ed958b8c61fb6019953f","properties":{},"sourceDetailPath":"/data/v1/records/wf-c57-d3460b57.json","sourceId":"wf:C57","targetDetailPath":"/data/v1/records/uc-uc-ir-02-70e2bdb3.json","targetId":"uc:UC-IR-02","type":"operates"},{"expectedCatalogRevision":"791ff2dd3a45707290badee660f185e514d15f1cf518908628f425c2f2c56ee4","id":"rel:9cf2658fbf30d3fb1affa64301fe9cb19514879ebc6204bdb55c4c7280dfeb06","properties":{},"sourceDetailPath":"/data/v1/records/wf-c57-d3460b57.json","sourceId":"wf:C57","targetDetailPath":"/data/v1/records/uc-uc-ir-01-e7711d29.json","targetId":"uc:UC-IR-01","type":"operates"}],"schemaVersion":1}