03.06.05 — Incident Response Plan

Official NIST requirement content

Security requirement

a.Develop an incident response plan that:
1. 1.Provides the organization with a roadmap for implementing its incident response capability,
2. 2.Describes the structure and organization of the incident response capability,
3. 3.Provides a high-level approach for how the incident response capability fits into the overall organization,
4. 4.Defines reportable incidents,
5. 5.Addresses the sharing of incident information, and
6. 6.Designates responsibilities to organizational entities, personnel, or roles.
b.Distribute copies of the incident response plan to designated incident response personnel (identified by name and/or by role) and organizational elements.
c.Update the incident response plan to address system and organizational changes or problems encountered during plan implementation, execution, or testing.
d.Protect the incident response plan from unauthorized disclosure.

Official NIST discussion

Discussion

It is important that organizations develop and implement a coordinated approach to incident response. Organizational mission and business functions determine the structure of incident response capabilities. As part of the incident response capabilities, organizations consider the coordination and sharing of information with external organizations, including external service providers and other organizations involved in the supply chain.

Bare Metal Cyber interpretation

Implementation perspective

Treat Incident Response Plan as a CUI protection outcome that must be reflected in the system boundary, documented implementation, operational behavior, and assessment evidence. Pay particular attention to prepared detection, coordinated response, reporting, recovery, and lessons learned for incidents involving CUI.

Confirm the requirement is in scope for the CUI system components, services, users, and external connections being assessed.
Resolve every organization-defined parameter through an approved governance and tailoring process.
Map each clause of the requirement to an accountable owner, implementation mechanism, and evidence source.
Verify that inherited and shared implementations are supported by current provider evidence and responsibility boundaries.
Collect evidence during normal operation and review changes, exceptions, and deficiencies on a risk-based cadence.

Questions to ask

Which CUI assets, data flows, users, and services are protected by this requirement?
Which portions are implemented locally, inherited, shared, or not applicable, and what evidence supports that determination?
Do the system security plan, deployed configuration, operating process, and assessment evidence tell the same story?
What change, incident, or threshold should trigger reassessment?

Evidence and validation

incident response plans and playbooks
case records and timelines
exercise and tabletop results
lessons-learned and corrective-action tracking

Common failure patterns

plans that do not match the current architecture
unclear authority for containment decisions
evidence lost during response
lessons learned recorded but not implemented

Official NIST SP 800-171A content

Assessment objectives and methods

Assessment objectives (10)

a.1.
an incident response plan is developed that provides the organization with a roadmap for implementing its incident response capability.
a.2.
an incident response plan is developed that describes the structure and organization of the incident response capability.
a.3.
an incident response plan is developed that provides a high-level approach for how the incident response capability fits into the overall organization.
a.4.
an incident response plan is developed that defines reportable incidents.
a.5.
an incident response plan is developed that addresses the sharing of incident information.
a.6.
an incident response plan is developed that designates responsibilities to organizational entities, personnel, or roles.
b.
copies of the incident response plan are distributed to designated incident response personnel (identified by name or by role).
b.
copies of the incident response plan are distributed to organizational elements.
d.
the incident response plan is protected from unauthorized disclosure.
c.
the incident response plan is updated to address system and organizational changes or problems encountered during plan implementation, execution, or testing.

Examine

incident response policy
procedures addressing incident response planning
incident response plan
system security plan
records of incident response plan reviews and approvals
other relevant documents or records

Interview

personnel with incident response planning responsibilities
personnel with information security responsibilities

Test

incident response plan and related processes

Official source-control relationships

Source NIST SP 800-53 controls

These controls are referenced by the official SP 800-171 Rev. 3 OSCAL record. Open the corresponding control pages for complete control text, enhancements, D3FEND mappings, and related learning.

Source controlIR-8Open SP 800-53 control →

Source record

Authoritative sources

Bare Metal Cyber is an independent educational publisher and is not affiliated with or endorsed by NIST. The official publications, the responsible federal agency, and the governing contract or agreement determine applicability, tailoring, assessment depth, and required implementation.