03.06.05Incident Response Plan in Rev. 3

New in Revision 3 — no Revision 2 equivalent. Nothing in NIST SP 800-171 Rev. 2 maps onto this number, so it has no Rev. 2 page and no side-by-side; the Rev. 3 text is below in full.

New
Rev. 3 · not adopted
Incident Response

Status as of 2026-09-08

Rev. 2 is what a contract requires today. DFARS 252.204-7012 and the CMMC rule at 32 CFR 170 point at NIST SP 800-171 Rev. 2, and a standing DoD class deviation keeps it there. NIST has published Rev. 3, but publishing a revision does not change an obligation. A move to Rev. 3 would arrive through the Department's reform process and formal rulemaking, a change to that deviation or an amendment to the rule, not through publication. The Department has published its organization-defined parameter values for Rev. 3 in preparation; that is groundwork, not adoption.

The requirement

Rev. 3 · not adopted 03.06.05 Incident Response Plan

a. Develop an incident response plan that:

01. Provides the organization with a roadmap for implementing its incident response capability,

02. Describes the structure and organization of the incident response capability,

03. Provides a high-level approach for how the incident response capability fits into the overall organization,

04. Defines reportable incidents,

05. Addresses the sharing of incident information, and

06. Designates responsibilities to organizational entities, personnel, or roles.

b. Distribute copies of the incident response plan to designated incident response personnel (identified by name and/or by role) and organizational elements.

c. Update the incident response plan to address system and organizational changes or problems encountered during plan implementation, execution, or testing.

d. Protect the incident response plan from unauthorized disclosure.

NIST SP 800-171 Rev. 3, verbatim, with organization-defined blanks highlighted. Rev. 2 has no counterpart to place beside it.

Determination statements

What an assessor would check under NIST SP 800-171A Rev. 3. 10 statements, each one answered yes or no.

03.06.05.a.01 an incident response plan is developed that provides the organization with a roadmap for implementing its incident response capability.
03.06.05.a.02 an incident response plan is developed that describes the structure and organization of the incident response capability.
03.06.05.a.03 an incident response plan is developed that provides a high-level approach for how the incident response capability fits into the overall organization.
03.06.05.a.04 an incident response plan is developed that defines reportable incidents.
03.06.05.a.05 an incident response plan is developed that addresses the sharing of incident information.
03.06.05.a.06 an incident response plan is developed that designates responsibilities to organizational entities, personnel, or roles.
03.06.05.b[01] copies of the incident response plan are distributed to designated incident response personnel (identified by name or by role).
03.06.05.b[02] copies of the incident response plan are distributed to organizational elements.
03.06.05.c the incident response plan is updated to address system and organizational changes or problems encountered during plan implementation, execution, or testing.
03.06.05.d the incident response plan is protected from unauthorized disclosure.

NIST SP 800-171A Rev. 3, verbatim.

What NIST says

New security requirement based on IR-08 (SP 800-53, Revision 5)

NIST, SP 800-171 Rev. 2 to Rev. 3 change analysis, class “New requirement”. At adoption, Bedrock files this under “New”.

NIST's Rev. 3 discussion for 03.06.05

It is important that organizations develop and implement a coordinated approach to incident response. Organizational mission and business functions determine the structure of incident response capabilities. As part of the incident response capabilities, organizations consider the coordination and sharing of information with external organizations, including external service providers and other organizations involved in the supply chain.

Incident Response in Rev. 3

The active IR requirements in Rev. 3. Those with a Rev. 2 predecessor link to that comparison; those marked new have their own page.

All Incident Response requirements in Rev. 2

What this means for you now

Nothing. Until a class deviation or a published rule adopts Rev. 3, no assessor asks about 03.06.05 and SPRS has no score for it. If you already do what it describes, note where the evidence lives; that costs nothing and answers the question later.

Bedrock CMMC carries the Rev. 3 catalog beside your Rev. 2 package, so the day adoption lands the new requirements are a to-do list, not a surprise.

Where this page's facts come from

Rev. 3 03.06.05 text, determination statements, parameters, class and note: bedrock-cmmc-api@89b8e8e:docs/reference/nist-800-171-rev3/normalized/rev3.json#requirements[]