IR.L2-3.6.3 Incident Response Testing

CMMC Requirement IR.L2-3.6.3 – Incident Response Testing: Test the organizational incident response capability.

Links to Publicly Available Resources

• Amazon Web Services – Operational Best Practices for CMMC 2.0 Level 2
  The following provides a sample mapping between the Cybersecurity Maturity Model Certification (CMMC) 2.0 Level 2 and AWS managed Config rules. Each Config rule applies to a specific AWS resource, and relates to one or more CMMC 2.0 Level 2 controls. A CMMC 2.0 Level 2 control can be related to multiple Config rules.

• CMMC Level 2 Assessment Guide
  This document provides assessment guidance for conducting Cybersecurity Maturity Model Certification (CMMC) assessments for Level 2.

• Crowdstrike – Incident Response Plan: Frameworks and Steps
  This article outlines frameworks and steps a company can take to have an effective incident response plan.

• Cybersecurity and Infrastructure Security Agency – Incident Response Training
  This is a self-paced online training course regarding incident response offered by CISA.

• Fortinet – Five Cybersecurity Tabletop Exercise Myths Debunked
  In this blog post, Fortinet debunks some of the myths around tabletop exercises to assist organizations better prepare for a cyber incident.

• IRS – Incident Response Test and Exercise Guidance
  This document from the IRS provides guidance for testing and exercising incident response capabilities.

• NIST SP 800-53: IR–3 Incident Response Testing
  NIST resource that defines Incident Response testing requirements.

• NIST SP 800-84: Guide to Test, Training, and Exercise Programs for IT Plans and Capabilities
  This NIST Special Publication helps organizations in designing, developing, conducting, and evaluating test, training, and exercise events.

• YouTube – CMMC 2.0 Control IR.L2-3.6.3 – Test the organizational incident response capability
  In this video, Mike breaks down CMMC 2.0 Control IR.L2-3.6.3. Hot on the heels of the requirement to have an incident response plan or similar instrument that defines how information security incidents will be handled and responded to is this control which mandates that you actually test it!

Discussion [NIST SP 800-171 R2]

Organizations test incident response capabilities to determine the effectiveness of the capabilities and to identify potential weaknesses or deficiencies. Incident response testing includes the use of checklists, walk-through or tabletop exercises, simulations (both parallel and full interrupt), and comprehensive exercises. Incident response testing can also include a determination of the effects on organizational operations (e.g., reduction in mission capabilities), organizational assets, and individuals due to incident response.

NIST SP 800-84 provides guidance on testing programs for information technology capabilities.

Further Discussion

Testing incident response capability validates existing plans and highlights potential deficiencies. The test should address questions such as what happens during an incident; who is responsible for incident management; what tasks are assigned within the IT organization; what support is needed from legal, public affairs, or other business components; how resources are added if needed during the incident; and how law enforcement is involved. Any negative impacts to the normal day-to-day operations when responding to an incident should also be identified and documented.