CCI-000818

The organization tests the incident response capability for the information system on an organization-defined frequency using organization-defined tests to determine the incident response effectiveness.

Implementation Guidance

The organization being inspected/assessed documents and implements a process to test its incident response capability for the information system at least every six months for high availability and at least annually for low/med availability using tests and as defined in the incident response plan. The organization must maintain a record of test results. DoD has defined the frequency as at least every six months for high availability and at least annually for low/med availability. DoD has defined the tests as tests as defined in the incident response plan.

Validation Procedures

The organization conducting the inspection/assessment obtains and examines the documented process as well as the record of test results to ensure the organization being inspected/assessed tests its incident response capability for the information system at least every six months for high availability and at least annually for low/med availability using tests and as defined in the incident response plan. DoD has defined the frequency as at least every six months for high availability and at least annually for low/med availability. DoD has defined the tests as tests as defined in the incident response plan.

Compelling Evidence

1.) Signed and dated Incident Response Test and/or after action reports

The controls below (if any) were marked by NIST as being related to CCI-000818.