Security requirement
Implement an incident-handling capability that is consistent with the incident response plan and includes preparation, detection and analysis, containment, eradication, and recovery.
Discussion
Incident-related information can be obtained from a variety of sources, including audit monitoring, network monitoring, physical access monitoring, user and administrator reports, and reported supply chain events. An effective incident handling capability involves coordination among many organizational entities, including mission and business owners, system owners, human resources offices, physical and personnel security offices, legal departments, operations personnel, and procurement offices.
Implementation perspective
Treat Incident Handling as a CUI protection outcome that must be reflected in the system boundary, documented implementation, operational behavior, and assessment evidence. Pay particular attention to prepared detection, coordinated response, reporting, recovery, and lessons learned for incidents involving CUI.
- Confirm the requirement is in scope for the CUI system components, services, users, and external connections being assessed.
- Resolve every organization-defined parameter through an approved governance and tailoring process.
- Map each clause of the requirement to an accountable owner, implementation mechanism, and evidence source.
- Verify that inherited and shared implementations are supported by current provider evidence and responsibility boundaries.
- Collect evidence during normal operation and review changes, exceptions, and deficiencies on a risk-based cadence.
Questions to ask
- Which CUI assets, data flows, users, and services are protected by this requirement?
- Which portions are implemented locally, inherited, shared, or not applicable, and what evidence supports that determination?
- Do the system security plan, deployed configuration, operating process, and assessment evidence tell the same story?
- What change, incident, or threshold should trigger reassessment?
Evidence and validation
- incident response plans and playbooks
- case records and timelines
- exercise and tabletop results
- lessons-learned and corrective-action tracking
Common failure patterns
- plans that do not match the current architecture
- unclear authority for containment decisions
- evidence lost during response
- lessons learned recorded but not implemented
Assessment objectives and methods
Assessment objectives (6)
- SR-03.6.1.
an incident-handling capability that is consistent with the incident response plan is implemented.
- SR-03.6.1.
the incident handling capability includes preparation.
- SR-03.6.1.
the incident handling capability includes detection and analysis.
- SR-03.6.1.
the incident handling capability includes containment.
- SR-03.6.1.
the incident handling capability includes eradication.
- SR-03.6.1.
the incident handling capability includes recovery.
Examine
- incident response policy and procedures
- contingency planning policy and procedures
- procedures for incident handling
- procedures for incident response planning
- incident response plan
- contingency plan
- records of incident response plan reviews and approvals
- system security plan
- other relevant documents or records
Interview
- personnel with incident handling responsibilities
- personnel with incident response planning responsibilities
- personnel with contingency planning responsibilities
- personnel with information security responsibilities
Test
- incident handling capability for the organization
- incident response plan
Source NIST SP 800-53 controls
These controls are referenced by the official SP 800-171 Rev. 3 OSCAL record. Open the corresponding control pages for complete control text, enhancements, D3FEND mappings, and related learning.
Authoritative sources
- NIST SP 800-171 Revision 3 official publication ↗
- NIST SP 800-171A Revision 3 official publication ↗
- NIST OSCAL Content release used for this import ↗
Bare Metal Cyber is an independent educational publisher and is not affiliated with or endorsed by NIST. The official publications, the responsible federal agency, and the governing contract or agreement determine applicability, tailoring, assessment depth, and required implementation.