CCI-000849

The organization updates the incident response plan to address system/organizational changes or problems encountered during plan implementation, execution, or testing.

Implementation Guidance

The organization being inspected/assessed must update the incident response plan to address system/organizational changes or problems encountered during plan implementation, execution, or testing and incorporate lessons learned from past incidents (IR-4a). The organization must document the update actions as an audit trail.

Validation Procedures

The organization conducting the inspection/assessment obtains and examines documentation of the update actions for the incident response plan to ensure the organization is updating the incident response plan to address system/organizational changes or problems encountered during plan implementation, execution, or testing and incorporating lessons learned from past incidents (IR-4a).

Compelling Evidence

1.) Signed and dated Incident Response Plan, referencing change log and/or version section 2.) After action reports

The controls below (if any) were marked by NIST as being related to CCI-000849.