CCI-000850

Communicate incident response plan changes to organization-defined incident response personnel (identified by name and/or by role) and organizational elements.

Implementation Guidance

The organization being inspected/assessed communicates incident response plan changes to all stakeholders identified in the incident response plan, not later than 30 days after the change is made. DoD has defined the incident response personnel as all stakeholders identified in the incident response plan, not later than 30 days after the change is made.

Validation Procedures

The organization conducting the inspection/assessment examines the incident response plan via the inspected organization's information sharing capability (e.g. portal, intranet, email, etc) to ensure it has been communicated to all stakeholders identified in the incident response plan, not later than 30 days after the change is made. DoD has defined the incident response personnel as all stakeholders identified in the incident response plan, not later than 30 days after the change is made.

Compelling Evidence

1.) List of personnel the incident response plan is distributed to

The controls below (if any) were marked by NIST as being related to CCI-000850.