IR-6 Incident Reporting: Same Procedure, Different Clock

Two agencies. Same checklist answer: incidents are reported in accordance with IR-6. Both had documented incident response procedures. Both rated themselves compliant.

The auditor asked what triggers the one-hour reporting clock.

Agency A explained that when an incident is confirmed, the LASO notifies the CSO and the SIB within one hour of confirmation. The procedure was written that way. Confirmation happened after the help desk investigated and escalated. In a recent incident, discovery happened at 8 a.m. when a user reported unusual account behavior. Investigation ran until 11 a.m. when IT confirmed a potential unauthorized access. The one-hour clock started at 11 a.m. The FBI CJIS ISO was notified at 11:45 a.m.

Agency B explained that when an incident is suspected, the notification chain is activated immediately. Their procedure: discovery triggers the clock. If an officer reports something unusual, that report is the discovery event, not the outcome of an investigation into the report. The LASO was notified at 8:05 a.m. The CSO and FBI CJIS ISO were notified at 8:47 a.m.

The auditor noted Agency A's finding: IR-6(a) requires reporting within one hour of discovery, not confirmation. Suspected incidents trigger the requirement. The three-hour gap between discovery and notification is a violation of the control regardless of when confirmation occurred.

What the control actually requires

IR-6(a) uses specific language: personnel shall report suspected incidents immediately but not to exceed one hour after discovery. Suspected. Discovery. Not confirmed. Not investigated. Not escalated.

IR-6(b) defines the notification chain: the CSO, SIB Chief or Interface Agency Official, and FBI CJIS ISO. All three. An internal-only notification that does not reach the FBI CJIS ISO does not satisfy IR-6(b).

IR-6(1) requires automated reporting mechanisms — not optional, not recommended. The Existing marking means this has applied since before v6.1.

What the auditor is looking for

A procedure that starts the clock at discovery. Named notification targets including the FBI CJIS ISO. An automated reporting mechanism. Records of past incidents showing when discovery occurred, when notification was sent, and to whom.

A procedure that requires investigation before notification is a procedure that does not satisfy IR-6 regardless of how quickly the investigation runs.

The common failure mode

The procedure was written by IT and modeled on general incident response practice, where investigation precedes escalation. CJIS inverts that. The CJIS clock starts at suspicion, not confirmation. Agencies that have not explicitly reviewed their IR procedure against IR-6's timing language frequently have this gap — not because they are careless, but because the CJIS requirement is different from standard IR practice and the difference is not obvious unless someone reads the control carefully.