IR.L2-3.6.1
Incident Handling
Source and approval
CMMC Assessment Guide — Level 2 · Revision 2.13
Publisher approved · Complete cited source edition 2026-10-31
Read the official guideSee IR.L2-3.6.1 in the reference catalog with its NIST cross-references
Official requirement
Establish an operational incident-handling capability for organizational systems that includes preparation, detection, analysis, containment, recovery, and user response activities.
Assessment objectives
a. an operational incident-handling capability is established;
b. the operational incident-handling capability includes preparation;
c. the operational incident-handling capability includes detection;
d. the operational incident-handling capability includes analysis;
e. the operational incident-handling capability includes containment;
f. the operational incident-handling capability includes recovery; and
g. the operational incident-handling capability includes user response activities.
Implementation guidance
Editorial examples to help you plan. Adapt them to your environment; the official requirement and objectives remain authoritative.
In plain language
Maintain an incident-handling capability covering preparation through recovery.
Implementation example
Example from the source assessment guide (not a mandatory implementation): Your manager asks you to set up your company’s incident-response capability [a]. First, you create an email address to collect information on possible incidents. Next, you draft a contact list of all the people who need to know when an incident occurs. You document a procedure for how to submit incidents that includes roles and responsibilities when a potential incident is detected or reported. The procedure also explains how to track incidents, from initial creation to closure [b].
Evidence examples
Examples suggested by the source guide (not an exhaustive or mandatory checklist): Incident response policy; contingency planning policy; procedures addressing incident handling; procedures addressing incident response assistance; incident response plan; contingency plan; system security plan; procedures addressing incident response training; incident response training curriculum; incident response training materials; incident response training records; other relevant documents or records
Common mistakes
Having an incident policy without assigned people, procedures, and operational capabilities.