IR.L2-3.6.3
Incident Response Testing
Source and approval
CMMC Assessment Guide — Level 2 · Revision 2.13
Publisher approved · Complete cited source edition 2026-10-31
Read the official guideSee IR.L2-3.6.3 in the reference catalog with its NIST cross-references
Official requirement
Test the organizational incident response capability.
Assessment objectives
a. the incident response capability is tested.
Implementation guidance
Editorial examples to help you plan. Adapt them to your environment; the official requirement and objectives remain authoritative.
In plain language
Test the effectiveness of incident-response capabilities.
Implementation example
Example from the source assessment guide (not a mandatory implementation): You decide to conduct an incident response table top exercise that simulates an attacker gaining access to the network through a compromised server. You include relevant IT staff such as security, database, network, and system administrators as par ticipants. You also request representatives from legal, human resources, and communications. You provide a scenario to the group and have prepared key questions aligned with the response plans to guide the exercise. During the exercise, you focus on how the team executes the incident response plan. Afterward, you conduct a debrief with everyone that was involved to provide feedback and develop improvements to the incident response plan [a].
Evidence examples
Examples suggested by the source guide (not an exhaustive or mandatory checklist): Incident response policy; contingency planning policy; procedures addressing incident response testing; procedures addressing contingency plan testing; incident response testing material; incident response test results; incident response test plan; incident response plan; contingency plan; system security plan; other relevant documents or records
Common mistakes
Treating policy publication as evidence that the response process works.