What this requirement asks
Establish an operational incident-handling capability for organizational systems that includes preparation, detection, analysis, containment, recovery, and user response activities.
This is a CMMC Level 2 requirement in the Incident Response family, drawn from NIST SP 800-171 Rev. 2. An assessor evaluates it objective by objective — every objective below must be supported by evidence, not just described in a policy.
Assessment objectives (7)
- 3.6.1[a] — an operational incident-handling capability is established
- 3.6.1[b] — the operational incident-handling capability includes preparation
- 3.6.1[c] — the operational incident-handling capability includes detection
- 3.6.1[d] — the operational incident-handling capability includes analysis
- 3.6.1[e] — the operational incident-handling capability includes containment
- 3.6.1[f] — the operational incident-handling capability includes recovery
- 3.6.1[g] — the operational incident-handling capability includes user response activities
What an assessor examines
Examine:
- Incident response policy
- contingency planning policy
- procedures addressing incident handling
- procedures addressing incident response assistance
- incident response plan
- contingency plan
- system security plan
- procedures addressing incident response training
- incident response training curriculum
- incident response training materials
- incident response training records
- other relevant documents or records
Interview:
- Personnel with incident handling responsibilities
- personnel with contingency planning responsibilities
- personnel with incident response training and operational responsibilities
- personnel with incident response assistance and support responsibilities
- personnel with access to incident response support and assistance capability
- personnel with information security responsibilities
Test:
- Incident-handling capability for the organization
- organizational processes for incident response assistance
- mechanisms supporting or implementing incident response assistance
Evidence that defends it
Upload IR plan and roles
Check your readiness
Score this requirement against your own environment with the Level 2 self-assessment checklist, or estimate your SPRS score with the free CMMC compliance tool. Self-reported answers are planning signals only — they do not establish a verified or assessor-accepted result.