IR-4(2)

Requirement

Include the following types of dynamic reconfiguration for [Assignment: organization-defined system components] as part of the incident response capability: [Assignment: organization-defined types of dynamic reconfiguration].

Discussion

Dynamic reconfiguration includes changes to router rules, access control lists, intrusion detection or prevention system parameters, and filter rules for guards or firewalls. Organizations may perform dynamic reconfiguration of systems to stop attacks, misdirect attackers, and isolate components of systems, thus limiting the extent of the damage from breaches or compromises. Organizations include specific time frames for achieving the reconfiguration of systems in the definition of the reconfiguration capability, considering the potential need for rapid response to effectively address cyber threats.

NIST 800-53A Assessment Guidance

Examine

[SELECT FROM: Incident response policy; procedures addressing incident handling; mechanisms supporting incident handling; list of system components to be dynamically reconfigured as part of incident response capability; system design documentation; system configuration settings and associated documentation; system audit records; incident response plan; system security plan; other relevant documents or records].

Interview

[SELECT FROM: Organizational personnel with incident handling responsibilities; organizational personnel with information security responsibilities].

Test

[SELECT FROM: Mechanisms that support and/or implement the dynamic reconfiguration of components as part of incident response].

ID	Assessment Objectives
IR-04(02)	<IR-04(02)_ODP[01] types of dynamic reconfiguration> for <IR-04(02)_ODP[02] system components> are included as part of the incident response capability.

Our CMMC Overview Course simplifies CMMC. Enroll so you can make informed decisions!