The updated FedRAMP Incident Communication Procedures take effect on July 4, 2026, for new certifications and January 1, 2027, for existing ones. If you're still drafting incident notifications manually or using outdated terminology, you're likely to fail your first post-RFC-0031 audit.
This template provides a framework that aligns with the new plain-language requirements and revised reporting timeframes. Customize it for your certification class and operational capabilities, but ensure it includes the mandatory elements FedRAMP now expects.
Purpose of the Template
This incident report template supports the three notification types required under the updated Incident Communication Procedures:
- Initial Incident Report (IIR): First notification when you've identified a FedRAMP reportable incident.
- Ongoing Incident Report (OIR): Status updates during active incidents.
- Final Incident Report (FIR): Post-incident summary after resolution.
The template uses new terminology: Potential Agency Impact N-rating (PAIN), Customer Effects classifications (Debilitating, Disruptive, Narrow, Minimal), and "FedRAMP reportable incidents" instead of "Federal reportable incidents."
Prerequisites
Before using this template effectively:
Establish a PAIN rating methodology. Under ICP-CSO-EFI, estimate the Potential Agency Impact N-rating unless using the default PAIN5 workflow (ICP-CSO-DPR). Defaulting to PAIN5 simplifies reporting but tightens timeframes.
Know your certification class. Reporting timeframes differ significantly:
- Class D (High): 15min IIR / 3hr OIR / 3hr FIR for N5, N4, N3
- Class C (Moderate): 1hr IIR / 6hr OIR / 6hr FIR for N5, N4, N3
- Class B (Low) and Class A (Pilot): 6hr IIR for N5, N4, N3
Maintain a list of affected customer agencies. The new rules require identifying likely affected agencies. If you can't produce this list within your notification timeframe, you're not tracking customer impact correctly.
Automate incident reporting. ICP-CSO-AIR strongly recommends automation. Hand-crafting notifications under a 15-minute clock isn't feasible for Class D services.
The Template
SUBJECT: [IIR/OIR/FIR] - [Incident ID] - [Brief Description]
INCIDENT CLASSIFICATION
Incident ID: [Your internal tracking number]
Report Type: [Initial / Ongoing / Final]
Detection Time: [UTC timestamp]
Evaluation Complete: [UTC timestamp when PAIN rating determined]
PAIN Rating: [N5 / N4 / N3 / N2 / N1 / Default PAIN5]
Customer Effect Classification: [Debilitating / Disruptive / Narrow / Minimal]
AFFECTED SCOPE
Certification Class: [Class D / C / B / A]
Affected Services: [List FedRAMP-certified offerings]
Likely Affected Agencies:
- [Agency name 1]
- [Agency name 2]
- [Add all identified agencies]
INCIDENT SUMMARY
[Describe what happened, what you know so far, and what's unknown.
If information isn't available yet, state that explicitly; the rules
require timely notification with available information, not complete
information.]
CURRENT STATUS
[For IIR: Initial assessment and immediate actions taken]
[For OIR: Progress since last report, current mitigation efforts]
[For FIR: Resolution summary and preventive measures]
CUSTOMER IMPACT
Data Confidentiality: [Confirmed / Suspected / No evidence of compromise]
Data Integrity: [Confirmed / Suspected / No evidence of compromise]
Service Availability: [Percentage of users affected, duration]
TIMELINE
[Key events with UTC timestamps - as available]
NEXT STEPS
[For IIR/OIR: What you're doing next, when you expect updates]
[For FIR: Lessons learned, control improvements planned]
CONTACT INFORMATION
Primary Contact: [Name, role, email, phone]
Incident Response Team: [Email/portal for questions]
Customization Tips
Adjust for your PAIN evaluation approach. If using ICP-CSO-DPR and defaulting to PAIN5, remove evaluation logic and streamline to a single workflow. This trades complexity for speed, which is effective if your incident management system can meet the tighter timeframes.
Build class-specific templates. A Class D provider needs a 15-minute IIR capability for N5/N4/N3 incidents. Pre-populate fields, use dropdown menus, and automate agency identification. Your Class B template can allow more manual input with a 6-hour window.
Integrate your customer registry. The "Likely Affected Agencies" requirement only works if you maintain an accurate mapping of which agencies use which services. If you're discovering this information during an incident, your response is already late.
Customize the Customer Effect definitions. Define Debilitating as interrupting most users or compromising most federal customer data. Disruptive affects many users for under 24 hours. Narrow affects some users for under 12 hours. Minimal is noticeable inconvenience. Map these to your service architecture for quick classification.
Remove CISA direct reporting. The updated procedures no longer require reporting to CISA directly for incidents affecting agency customers. Agencies will handle that based on their own impact assessment. If you have legacy contract language requiring CISA notification, note that in your template as an exception.
Validation Steps
Test your timeframe compliance. Run tabletop exercises to trigger the template workflow and measure time-to-notification. If you're a Class D provider and can't produce an IIR in 15 minutes, you need automation or must default to PAIN5, accepting that every incident gets reported at the highest urgency.
Verify your PAIN calculation. Walk through the Potential Agency Impact estimation process with your security and compliance teams. The calculation should consider cumulative effect across all agency customers, not just the worst-case single agency. If you're consistently rating everything N5, you might be miscalculating or your architecture has fundamental issues.
Confirm agency identification accuracy. Pull your current customer list and verify you can identify affected agencies for common incident scenarios. If this takes manual research, build the mapping now.
Review against Certification Data Sharing requirements. The availability reporting rules moved to CDS-CSO-AVR and now apply to Class B certifications. Ensure your incident template doesn't conflict with your availability data sharing obligations.
Check your automation triggers. If you're following ICP-CSO-AIR and automating incident communications, verify the system triggers correctly when incidents change status and sends updates to all affected parties without manual intervention.
The shift to plain language in RFC-0031 isn't just terminology cleanup. It's FedRAMP acknowledging that dual-use terms caused real compliance failures. Your incident reporting process must adapt to these clearer requirements, or you'll spend January 2027 explaining to your assessor why you're still using deprecated terminology and missing timeframes.
