CMMC Navigatorby Foxx Cyber Bedrock CMMC

↑↓ to move, Enter to open, Esc to close. Try 3.5.3, AC.L2-3.1.1, MFA or unmarked.

03.06.04Incident Response Training in Rev. 3

New in Revision 3 — no Revision 2 equivalent. Nothing in NIST SP 800-171 Rev. 2 maps onto this number, so it has no Rev. 2 page and no side-by-side; the Rev. 3 text is below in full. It carries organization-defined parameters.

Status as of 2026-09-08

Rev. 2 is what a contract requires today. DFARS 252.204-7012 and the CMMC rule at 32 CFR 170 point at NIST SP 800-171 Rev. 2, and a standing DoD class deviation keeps it there. NIST has published Rev. 3, but publishing a revision does not change an obligation. A move to Rev. 3 would arrive through the Department's reform process and formal rulemaking, a change to that deviation or an amendment to the rule, not through publication. The Department has published its organization-defined parameter values for Rev. 3 in preparation; that is groundwork, not adoption.

The requirement

Rev. 3 · not adopted 03.06.04 Incident Response Training

a. Provide incident response training to system users consistent with assigned roles and responsibilities:

01. Within [Assignment: organization-defined time period] of assuming an incident response role or responsibility or acquiring system access,

02. When required by system changes, and

03. [Assignment: organization-defined frequency] thereafter.

b. Review and update incident response training content [Assignment: organization-defined frequency] and following [Assignment: organization-defined events].

NIST SP 800-171 Rev. 3, verbatim, with organization-defined blanks highlighted. Rev. 2 has no counterpart to place beside it.

Determination statements

What an assessor would check under NIST SP 800-171A Rev. 3. 7 statements, each one answered yes or no.

  1. 03.06.04.a.01 incident response training for system users consistent with assigned roles and responsibilities is provided within <A.03.06.04.ODP[01]: time period> of assuming an incident response role or responsibility or acquiring system access.
  2. 03.06.04.a.02 incident response training for system users consistent with assigned roles and responsibilities is provided when required by system changes.
  3. 03.06.04.a.03 incident response training for system users consistent with assigned roles and responsibilities is provided <A.03.06.04.ODP[02]: frequency> thereafter.
  4. 03.06.04.b[01] incident response training content is reviewed <A.03.06.04.ODP[03]: frequency>.
  5. 03.06.04.b[02] incident response training content is updated <A.03.06.04.ODP[03]: frequency>.
  6. 03.06.04.b[03] incident response training content is reviewed following <A.03.06.04.ODP[04]: events>.
  7. 03.06.04.b[04] incident response training content is updated following <A.03.06.04.ODP[04]: events>.

NIST SP 800-171A Rev. 3, verbatim.

Organization-defined parameters

Blanks the organization fills in. Defining each value is itself a determination in 800-171A Rev. 3.

  • A.03.06.04.ODP[01] the time period within which incident response training is to be provided to system users is defined.
  • A.03.06.04.ODP[02] the frequency at which to provide incident response training to users after initial training is defined.
  • A.03.06.04.ODP[03] the frequency at which to review and update incident response training content is defined.
  • A.03.06.04.ODP[04] events that initiate a review of the incident response training content are defined.

What NIST says

  • New security requirement based on IR-02 (SP 800-53, Revision 5).
  • Added new ODP: time period to provide incident response training for new role/access
  • Added new ODP: frequency to provide incident response training after initial training
  • Added new ODP: frequency to review and update training content
  • Added new ODP: events that require an update to incident response training content

NIST, SP 800-171 Rev. 2 to Rev. 3 change analysis, class “New requirement”. At adoption, Bedrock files this under “New”.

NIST's Rev. 3 discussion for 03.06.04

Incident response training is associated with the assigned roles and responsibilities of organizational personnel to ensure that the appropriate content and level of detail are included in such training. For example, users may only need to know how to recognize an incident or whom to call; system administrators may require additional training on how to handle incidents; and incident responders may receive specific training on data collection techniques, forensics, reporting, system recovery, and system restoration. Incident response training includes user training in identifying and reporting suspicious activities from external and internal sources. Incident response training for users may be provided as part of 03.02.02. Events that may cause an update to incident response training content include incident response plan testing, response to an actual incident, audit or assessment findings, or changes in applicable laws, Executive Orders, policies, directives, regulations, standards, and guidelines.

Incident Response in Rev. 3

The active IR requirements in Rev. 3. Those with a Rev. 2 predecessor link to that comparison; those marked new have their own page.

All Incident Response requirements in Rev. 2

What this means for you now

Nothing. Until a class deviation or a published rule adopts Rev. 3, no assessor asks about 03.06.04 and SPRS has no score for it. If you already do what it describes, note where the evidence lives and what value you use for the parameters above; that costs nothing and answers the question later.

Bedrock CMMC carries the Rev. 3 catalog beside your Rev. 2 package, so the day adoption lands the new requirements are a to-do list, not a surprise.

Where this page's facts come from
Rev. 3 03.06.04 text, determination statements, parameters, class and note
bedrock-cmmc-api@89b8e8e:docs/reference/nist-800-171-rev3/normalized/rev3.json#requirements[]