CCI-000813

The organization provides incident response training to information system users consistent with assigned roles and responsibilities within an organization-defined time period of assuming an incident response role or responsibility.

Implementation Guidance

The organization being inspected/assessed documents and implement a process to provide incident response training to information system users consistent with assigned roles and responsibilities within 30 working days of assuming an incident response role or responsibility. The organization must maintain a record of training. DoD has defined the time period as 30 working days.

Validation Procedures

The organization conducting the inspection/assessment obtains and examines the documented process as well as training records for a sampling of information system users to ensure the organization being inspected/assessed provides incident response training to information system users consistent with assigned roles and responsibilities within 30 working days of assuming an incident response role or responsibility. DoD has defined the time period as 30 working days.

Compelling Evidence

1.) Signed and dated Incident Response Training documentation, referencing time frequency section

The controls below (if any) were marked by NIST as being related to CCI-000813.