CMMC 2.0 - Incident Response

1. IR.L2-3.6.1 Establish an operational incident-handling capability for organizational systems that includes preparation, detection, analysis, containment, recovery, and user response activities.

1.1. "Determine if:

1.2. (a) an operational incident-handling capability is established"

1.3. (b) the operational incident-handling capability includes preparation"

1.4. (c) the operational incident-handling capability includes detection"

1.5. (d) the operational incident-handling capability includes analysis"

1.6. (e) the operational incident-handling capability includes containment"

1.7. (f) the operational incident-handling capability includes recovery"

1.8. (g) the operational incident-handling capability includes user response activities"

2. IR.L2-3.6.2 Track, document, and report incidents to designated officials and/or authorities both internal and external to the organization.

2.1. "Determine if:

2.2. (a) incidents are tracked"

2.3. (b) incidents are documented"

2.4. (c) authorities to whom incidents are to be reported are identified"

2.5. (d) organizational officials to whom incidents are to be reported are identified"

2.6. (e) identified authorities are notified of incidents"

2.7. (f) identified organizational officials are notified of incidents"

3. IR.L2-3.6.3 Test the organizational incident response capability.

3.1. "Determine if:

3.2. (a) the incident response capability is tested"