3.6.3

Requirement

Test the effectiveness of the incident response capability [Assignment: organization-defined frequency].

Discussion

Organizations test incident response capabilities to determine their effectiveness and identify potential weaknesses or deficiencies. Incident response testing includes the use of checklists, walk-through or tabletop exercises, and simulations. Incident response testing can include a determination of the effects of incident response on organizational operations, organizational assets, and individuals. Qualitative and quantitative data can help determine the effectiveness of incident response processes.

NIST 800-171A r3 Assessment Guidance

Examine

[SELECT FROM: incident response policy and procedures; contingency planning policy and procedures; procedures for incident response testing; procedures for contingency plan testing; incident response testing material; incident response test results; incident response test plan; incident response plan; contingency plan; system security plan; other relevant documents or records]
Interview

[SELECT FROM: processes for incident reporting; incident monitoring capability; mechanisms for supporting or implementing the tracking and documenting of system security incidents; mechanisms for supporting or implementing incident reporting; mechanisms for supporting or implementing incident response assistance; processes for incident response assistance]
Test

[SELECT FROM: personnel with incident response testing responsibilities; personnel with information security responsibilities]

ID	Assessment Objectives
A.03.06.03	the effectiveness of the incident response capability is tested .
A.03.06.03.ODP[01]	the frequency at which to test the effectiveness of the incident response capability for the system is defined.

Our CMMC Overview Course simplifies CMMC. Enroll so you can make informed decisions!