CCI-000818

Test the effectiveness of the incident response capability for the system on an organization-defined frequency using organization-defined tests.

Implementation Guidance

The organization being inspected/assessed documents and implements a process to test its incident response capability for the information system at least every six months for high availability and at least annually for low/med availability using tests and as defined in the incident response plan. The organization must maintain a record of test results. DoD has defined the frequency as at least every six months for high availability and at least annually for low/med availability. DoD has defined the tests as tests as defined in the incident response plan.

Validation Procedures

The organization conducting the inspection/assessment obtains and examines the documented process as well as the record of test results to ensure the organization being inspected/assessed tests its incident response capability for the information system at least every six months for high availability and at least annually for low/med availability using tests and as defined in the incident response plan. DoD has defined the frequency as at least every six months for high availability and at least annually for low/med availability. DoD has defined the tests as tests as defined in the incident response plan.

Compelling Evidence

1.) Signed and dated Incident Response Test and/or after action reports

The controls below (if any) were marked by NIST as being related to CCI-000818.