CCI-000818

Test the effectiveness of the incident response capability for the system on an organization-defined frequency using organization-defined tests.

Implementation Guidance

Determine if the effectiveness of the incident response capability for the system is tested [IR-03_ODP[01]; frequency at which to test the effectiveness of the incident response capability for the system is defined] using [IR-03_ODP[02]; tests used to test the effectiveness of the incident response capability for the system are defined].

Validation Procedures

Examine: [SELECT FROM: Incident response policy; contingency planning policy; procedures addressing incident response testing; procedures addressing contingency plan testing; incident response testing material; incident response test results; incident response test plan; incident response plan; contingency plan; system security plan; privacy plan; other relevant documents or records]. Interview: [SELECT FROM: Organizational personnel with incident response testing responsibilities; organizational personnel with information security and privacy responsibilities].

The controls below (if any) were marked by NIST as being related to CCI-000818.