Requirements 3.6
3.6 Incident Response: the NIST SP 800-171 requirements
The 3 requirements of family 3.6, Incident Response, in NIST SP 800-171 Rev 2, worth 11 points of a SPRS score under 32 CFR 170.24. For each: NIST's text, what it costs when not met, the objectives an assessor determines under NIST SP 800-171A, and how to meet it. To mark each one and work out your score, use the free calculator.
3.6.1 Incident Handling
Establish an operational incident-handling capability for organizational systems that includes preparation, detection, analysis, containment, recovery, and user response activities.
Points: 5 points.
Assessment objectives (NIST SP 800-171A)
- [a]an operational incident-handling capability is established.
- [b]the operational incident-handling capability includes preparation.
- [c]the operational incident-handling capability includes detection.
- [d]the operational incident-handling capability includes analysis.
- [e]the operational incident-handling capability includes containment.
- [f]the operational incident-handling capability includes recovery.
- [g]the operational incident-handling capability includes user response activities.
How to meet it
Write an incident response plan covering the six phases (preparation, detection, analysis, containment, recovery, and user response) with named roles, contact numbers, and simple playbooks for your likely scenarios (phishing compromise, ransomware, lost laptop). Keep it to a usable length; a 10-page plan that people follow beats a 60-page binder. Train the response team on it. Evidence: the approved plan, role assignments, and training/distribution records.
3.6.2 Incident Reporting
Track, document, and report incidents to designated officials and/or authorities both internal and external to the organization.
Points: 5 points.
Assessment objectives (NIST SP 800-171A)
- [a]incidents are tracked.
- [b]incidents are documented.
- [c]authorities to whom incidents are to be reported are identified.
- [d]organizational officials to whom incidents are to be reported are identified.
- [e]identified authorities are notified of incidents.
- [f]identified organizational officials are notified of incidents.
How to meet it
Stand up an incident log (ticketing category or register) that tracks each incident's timeline, actions, and status, and document your external reporting obligations: for defense contractors, DFARS 252.204-7012 requires reporting cyber incidents to DIBNet within 72 hours, which requires a DoD-approved Medium Assurance Certificate obtained in advance. Get that certificate now, before you need it. Evidence: the incident register, the reporting procedure naming DIBNet and the 72-hour clock, and the certificate acquisition record.
3.6.3 Incident Response Testing
Test the organizational incident response capability.
Points: 1 point.
Assessment objectives (NIST SP 800-171A)
- [a]the incident response capability is tested.
How to meet it
Run at least an annual tabletop exercise walking the team through a realistic scenario (ransomware on a CUI file server is a good default), capture what worked and what did not, and update the IR plan from the findings. A two-hour facilitated tabletop satisfies this without expensive red teams. Evidence: the exercise scenario, attendance list, after-action report, and the resulting plan revisions.