IR.L2-3.6.2
Incident Reporting
Source and approval
CMMC Assessment Guide — Level 2 · Revision 2.13
Publisher approved · Complete cited source edition 2026-10-31
Read the official guideSee IR.L2-3.6.2 in the reference catalog with its NIST cross-references
Official requirement
Track, document, and report incidents to designated officials and/or authorities both internal and external to the organization.
Assessment objectives
a. incidents are tracked;
b. incidents are documented;
c. authorities to whom incidents are to be reported are identified;
d. organizational officials to whom incidents are to be reported are identified;
e. identified authorities are notified of incidents; and
f. identified organizational officials are notified of incidents.
Implementation guidance
Editorial examples to help you plan. Adapt them to your environment; the official requirement and objectives remain authoritative.
In plain language
Track, document, and report incidents to designated officials and authorities.
Implementation example
Example from the source assessment guide (not a mandatory implementation): You notice unusual activity on a server and determine a potential security incident has occurred. You open a tracking ticket with the Security Operations Center (SOC) , which assigns an incident handler to work the ticket [a]. The handler investigates and documents initial findings, which lead to a determination that unauthorized access occurred on the server [b]. The SOC establishes an incident management team consis ting of se curity, database, network, and system administrators. The team meets daily to update progress and plan courses of action to contain the incident [a]. At the end of the day , the team provides a status report to IT executives [d,f]. Two days later, the team declares the incident contained. The team produces a final report as the database system is rebuilt and placed back into operation.
Evidence examples
Examples suggested by the source guide (not an exhaustive or mandatory checklist): Incident response policy; procedures addressing incident monitoring; incident response records and documentation; procedures addressing incident reportin g; incident reporting records and documentation; incident response plan; system security plan; other relevant documents or records
Common mistakes
Resolving an incident without maintaining its record or making required reports.