03.06 Incident Response

Statement

Implement an incident-handling capability that is consistent with the incident response plan and includes preparation, detection and analysis, containment, eradication, and recovery.

Guidance

Incident-related information can be obtained from a variety of sources, including audit monitoring, network monitoring, physical access monitoring, user and administrator reports, and reported supply chain events. An effective incident handling capability involves coordination among many organizational entities, including mission and business owners, system owners, human resources offices, physical and personnel security offices, legal departments, operations personnel, and procurement offices.

Assessment objective

an incident-handling capability that is consistent with the incident response plan is implemented.

Assessment objective

the incident handling capability includes preparation.

Assessment objective

the incident handling capability includes detection and analysis.

Assessment objective

the incident handling capability includes containment.

Assessment objective

the incident handling capability includes eradication.

Assessment objective

the incident handling capability includes recovery.

Assessment method

• incident response policy and procedures contingency planning policy and procedures procedures for incident handling procedures for incident response planning incident response plan contingency plan records of incident response plan reviews and approvals system security plan other relevant documents or records

Assessment method

• personnel with incident handling responsibilities personnel with incident response planning responsibilities personnel with contingency planning responsibilities personnel with information security responsibilities

Assessment method

• incident handling capability for the organization incident response plan

Statement

• a. Track and document system security incidents.

• b. Report suspected incidents to the organizational incident response capability within {{ insert: param, A.03.06.02.ODP.01 }}.

• c. Report incident information to {{ insert: param, A.03.06.02.ODP.02 }}.

• d. Provide an incident response support resource that offers advice and assistance to system users on handling and reporting incidents.

Guidance

Documenting incidents includes maintaining records about each incident, the status of the incident, and other pertinent information necessary for forensics as well as evaluating incident details, trends, and handling. Incident information can be obtained from many sources, including network monitoring, incident reports, incident response teams, user complaints, supply chain partners, audit monitoring, physical access monitoring, and user and administrator reports. [](#/cprt/framework/version/SP_800_171_3_0_0/home?element=03.06.01)03.06.01 provides information on the types of incidents that are appropriate for monitoring. The types of incidents reported, the content and timeliness of the reports, and the reporting authorities reflect applicable laws, Executive Orders, directives, regulations, policies, standards, and guidelines. Incident information informs risk assessments, the effectiveness of security assessments, the security requirements for acquisitions, and the selection criteria for technology products. Incident response support resources provided by organizations include help desks, assistance groups, automated ticketing systems to open and track incident response tickets, and access to forensic services or consumer redress services, when required.

Assessment objective

system security incidents are tracked.

Assessment objective

system security incidents are documented.

Assessment objective

suspected incidents are reported to the organizational incident response capability within {{ insert: param, A.03.06.02.ODP.01 }}.

Assessment objective

incident information is reported to {{ insert: param, A.03.06.02.ODP.02 }}.

Assessment objective

an incident response support resource that offers advice and assistance to system users on handling and reporting incidents is provided.

Assessment method

• incident response policy and procedures procedures for incident monitoring procedures for incident response assistance incident response records and documentation incident response plan system security plan other relevant documents or records

Assessment method

• personnel with incident monitoring responsibilities personnel with incident response assistance and support responsibilities personnel with information security responsibilities

Assessment method

• processes for incident reporting incident monitoring capability mechanisms for supporting or implementing the tracking and documenting of system security incidents mechanisms for supporting or implementing incident reporting mechanisms for supporting or implementing incident response assistance processes for incident response assistance

Statement

Test the effectiveness of the incident response capability {{ insert: param, A.03.06.03.ODP.01 }}.

Guidance

Organizations test incident response capabilities to determine their effectiveness and identify potential weaknesses or deficiencies. Incident response testing includes the use of checklists, walk-through or tabletop exercises, and simulations. Incident response testing can include a determination of the effects of incident response on organizational operations, organizational assets, and individuals. Qualitative and quantitative data can help determine the effectiveness of incident response processes.

Assessment objective

the effectiveness of the incident response capability is tested {{ insert: param, A.03.06.03.ODP.01 }}.

Assessment method

• incident response policy and procedures contingency planning policy and procedures procedures for incident response testing procedures for contingency plan testing incident response testing material incident response test results incident response test plan incident response plan contingency plan system security plan other relevant documents or records

Assessment method

• personnel with incident response testing responsibilities personnel with information security responsibilities

Statement

• a. Provide incident response training to system users consistent with assigned roles and responsibilities:

  • 01. Within {{ insert: param, A.03.06.04.ODP.01 }} of assuming an incident response role or responsibility or acquiring system access,

  • 02. When required by system changes, and

  • 03. {{ insert: param, A.03.06.04.ODP.02 }} thereafter.

• b. Review and update incident response training content {{ insert: param, A.03.06.04.ODP.03 }} and following {{ insert: param, A.03.06.04.ODP.04 }}.

Guidance

Incident response training is associated with the assigned roles and responsibilities of organizational personnel to ensure that the appropriate content and level of detail are included in such training. For example, users may only need to know how to recognize an incident or whom to call; system administrators may require additional training on how to handle incidents; and incident responders may receive specific training on data collection techniques, forensics, reporting, system recovery, and system restoration. Incident response training includes user training in identifying and reporting suspicious activities from external and internal sources. Incident response training for users may be provided as part of [](#/cprt/framework/version/SP_800_171_3_0_0/home?element=03.02.02)03.02.02. Events that may cause an update to incident response training content include incident response plan testing, response to an actual incident, audit or assessment findings, or changes in applicable laws, Executive Orders, policies, directives, regulations, standards, and guidelines.

Assessment objective

incident response training for system users consistent with assigned roles and responsibilities is provided within {{ insert: param, A.03.06.04.ODP.01 }} of assuming an incident response role or responsibility or acquiring system access.

Assessment objective

incident response training for system users consistent with assigned roles and responsibilities is provided when required by system changes.

Assessment objective

incident response training for system users consistent with assigned roles and responsibilities is provided {{ insert: param, A.03.06.04.ODP.02 }} thereafter.

Assessment objective

incident response training content is updated following {{ insert: param, A.03.06.04.ODP.04 }}.

Assessment objective

incident response training content is updated {{ insert: param, A.03.06.04.ODP.03 }}.

Assessment objective

incident response training content is reviewed following {{ insert: param, A.03.06.04.ODP.04 }}.

Assessment objective

incident response training content is reviewed {{ insert: param, A.03.06.04.ODP.03 }}.

Assessment method

• incident response policy and procedures procedures for incident response training incident response training curriculum incident response training materials incident response plan incident response training records system security plan other relevant documents or records

Assessment method

• personnel with incident response training and operational responsibilities personnel with information security responsibilities

Statement

• a. Develop an incident response plan that:

  • 01. Provides the organization with a roadmap for implementing its incident response capability,

  • 02. Describes the structure and organization of the incident response capability,

  • 03. Provides a high-level approach for how the incident response capability fits into the overall organization,

  • 04. Defines reportable incidents,

  • 05. Addresses the sharing of incident information, and

  • 06. Designates responsibilities to organizational entities, personnel, or roles.

• b. Distribute copies of the incident response plan to designated incident response personnel (identified by name and/or by role) and organizational elements.

• c. Update the incident response plan to address system and organizational changes or problems encountered during plan implementation, execution, or testing.

• d. Protect the incident response plan from unauthorized disclosure.

Guidance

It is important that organizations develop and implement a coordinated approach to incident response. Organizational mission and business functions determine the structure of incident response capabilities. As part of the incident response capabilities, organizations consider the coordination and sharing of information with external organizations, including external service providers and other organizations involved in the supply chain.

Assessment objective

an incident response plan is developed that provides the organization with a roadmap for implementing its incident response capability.

Assessment objective

an incident response plan is developed that describes the structure and organization of the incident response capability.

Assessment objective

an incident response plan is developed that provides a high-level approach for how the incident response capability fits into the overall organization.

Assessment objective

an incident response plan is developed that defines reportable incidents.

Assessment objective

an incident response plan is developed that addresses the sharing of incident information.

Assessment objective

an incident response plan is developed that designates responsibilities to organizational entities, personnel, or roles.

Assessment objective

copies of the incident response plan are distributed to designated incident response personnel (identified by name or by role).

Assessment objective

copies of the incident response plan are distributed to organizational elements.

Assessment objective

the incident response plan is protected from unauthorized disclosure.

Assessment objective

the incident response plan is updated to address system and organizational changes or problems encountered during plan implementation, execution, or testing.

Assessment method

• incident response policy procedures addressing incident response planning incident response plan system security plan records of incident response plan reviews and approvals other relevant documents or records

Assessment method

• personnel with incident response planning responsibilities personnel with information security responsibilities

Assessment method

• incident response plan and related processes