3.6.2Track and report incidents

Incidents are documented and reported to the right people, including DoD within 72 hours where the clause applies.

IR
Level 2
5 pt
Rev. 3: Reworded

The requirement, verbatim

NIST SP 800-171 Rev. 2 · 3.6.2
Track, document, and report incidents to designated officials and/or authorities both internal and external to the organization.

Requirement 3.6.2, practice name in the CMMC assessment guide: Incident Reporting.

NIST's discussion

Tracking and documenting system security incidents includes maintaining records about each incident, the status of the incident, and other pertinent information necessary for forensics, evaluating incident details, trends, and handling. Incident information can be obtained from a variety of sources including incident reports, incident response teams, audit monitoring, network monitoring, physical access monitoring, and user/administrator reports. Reporting incidents addresses specific incident reporting requirements within an organization and the formal incident reporting requirements for the organization. Suspected security incidents may also be reported and include the receipt of suspicious email communications that can potentially contain malicious code. The types of security incidents reported, the content and timeliness of the reports, and the designated reporting authorities reflect applicable laws, Executive Orders, directives, regulations, and policies.

NIST SP 800-61 provides guidance on incident handling.

NIST SP 800-171 Rev. 2, discussion under 3.6.2. Whitespace normalised; wording unchanged.

Assessment objectives

An assessor decides each of these separately. The requirement is met only when every objective is.

[a] incidents are tracked
[b] incidents are documented
[c] authorities to whom incidents are to be reported are identified
[d] organizational officials to whom incidents are to be reported are identified
[e] incidents are reported to identified authorities
[f] incidents are reported to identified organizational officials

NIST SP 800-171A, determination statements for 3.6.2.

For assessors: examine, interview, test

NIST SP 800-171A names what an assessor may examine, whom they may interview, and what they may test for this requirement. Assessors select from these lists; they are not a checklist of everything you must produce.

Examine

Incident response policy
procedures addressing incident monitoring
incident response records and documentation
procedures addressing incident reporting
incident reporting records and documentation
incident response plan
system security plan
other relevant documents or records

Interview

Personnel with incident monitoring responsibilities
personnel with incident reporting responsibilities
personnel who have or should have reported incidents
personnel (authorities) to whom incident information is to be reported
personnel with information security responsibilities

Test

Incident monitoring capability for the organization
mechanisms supporting or implementing tracking and documenting of system security incidents
organizational processes for incident reporting
mechanisms supporting or implementing incident reporting

NIST SP 800-171A, potential assessment methods and objects for 3.6.2.

Evidence

No evidence examples are published for this requirement yet. The objectives above are what an assessor checks; evidence is whatever shows each one is true in your environment, dated and kept with your system security plan.

Scoring weight

Worth 5 points. Not meeting this requirement subtracts 5 from your 110-point SPRS score. These are the requirements with the largest effect on your posture.

DoD NIST SP 800-171 Assessment Methodology v1.2.1 weighting, as carried in the Bedrock scoring table. The score starts at 110 and subtracts the weight of every requirement not met.

In Rev. 3

Rev. 2 is what your contract requires today. A standing DoD class deviation keeps Rev. 2 in force; NIST has published Rev. 3, but it is not adopted for contracts. In Rev. 3 this requirement is reworded: 03.06.02 Incident Monitoring, Reporting, and Response Assistance. It gains organization-defined parameters.

See the Rev. 2 and Rev. 3 wording word by word, or start with the status page.

Where this page's facts come from

Requirement text: bedrock-cmmc-api@89b8e8e:migrations/004_reference_requirements.sql#Requirement.basicRequirement@rev2
Discussion: bedrock-cmmc-api@89b8e8e:migrations/004_reference_requirements.sql#Requirement.discussion@rev2
Practice name: bedrock-cmmc-api@89b8e8e:migrations/004_reference_requirements.sql#Requirement.title@rev2 (CMMC Assessment Guide practice name)
Objectives: bedrock-cmmc-api@89b8e8e:migrations/005_reference_objectives.sql#AssessmentObjective.description@rev2
Examine, interview, test: bedrock-cmmc-api@89b8e8e:migrations/005_reference_objectives.sql#AssessmentObjective.description@rev2 ({examineGuidance, interviewGuidance, testGuidance})
Level: bedrock-cmmc-api@89b8e8e:migrations/021_fix_level1_requirements.sql#Requirement.cmmcLevel@rev2
Weight: bedrock-cmmc-api@89b8e8e:internal/cmmc/requirement_values.go#requirementValues (DoD AM v1.2.1 / eMASS L2 template v3.8)
Rev. 3 mapping: bedrock-cmmc-api@89b8e8e:docs/reference/nist-800-171-rev3/normalized/r2_r3_transition_map.json#r2_to_r3
Plain-language title and summary: editorial/CMMC Navigator.dc.html#RAW (Foxx Cyber editorial)