CMMC Navigatorby Foxx Cyber Bedrock CMMC

↑↓ to move, Enter to open, Esc to close. Try 3.5.3, AC.L2-3.1.1, MFA or unmarked.

3.6.1Have an incident response capability that works in Rev. 3

Reworded: 03.06.01 Incident Handling.

Status as of 2026-09-08

Rev. 2 is what a contract requires today. DFARS 252.204-7012 and the CMMC rule at 32 CFR 170 point at NIST SP 800-171 Rev. 2, and a standing DoD class deviation keeps it there. NIST has published Rev. 3, but publishing a revision does not change an obligation. A move to Rev. 3 would arrive through the Department's reform process and formal rulemaking, a change to that deviation or an amendment to the rule, not through publication. The Department has published its organization-defined parameter values for Rev. 3 in preparation; that is groundwork, not adoption.

Side by side

Rev. 2 · in force 3.6.1 Incident Handling

Establish an operational incident-handling capability for organizational systems that includes preparation, detection, analysis, containment, recovery, and user response activities.

Assessment objectives · 800-171A

  1. [a] an operational incident handling capability is established
  2. [b] the incident handling capability includes preparation
  3. [c] the incident handling capability includes detection
  4. [d] the incident handling capability includes analysis
  5. [e] the incident handling capability includes containment
  6. [f] the incident handling capability includes recovery
  7. [g] the incident handling capability includes user response activities

Rev. 3 · not adopted 03.06.01 Incident Handling

Implement an incident-handling capability that is consistent with the incident response plan and includes preparation, detection and analysis, containment, eradication, and recovery.

Determination statements · 800-171A Rev. 3

  1. 03.06.01[01] an incident-handling capability that is consistent with the incident response plan is implemented.
  2. 03.06.01[02] the incident handling capability includes preparation.
  3. 03.06.01[03] the incident handling capability includes detection and analysis.
  4. 03.06.01[04] the incident handling capability includes containment.
  5. 03.06.01[05] the incident handling capability includes eradication.
  6. 03.06.01[06] the incident handling capability includes recovery.

Draws on Rev. 2 3.6.1.

Left: NIST SP 800-171 Rev. 2 and 800-171A, verbatim. Right: NIST SP 800-171 Rev. 3 and 800-171A Rev. 3, verbatim, with organization-defined blanks highlighted.

Word by word

The Rev. 2 requirement compared with its Rev. 3 successor. A mechanical comparison of the two verbatim texts, not an interpretation.

removed in Rev. 3 added in Rev. 3

Rev. 2 3.6.1 → Rev. 3 03.06.01 Incident Handling

Establish Implement an operational incident-handling capability for organizational systems that is consistent with the incident response plan and includes preparation, detection and analysis, containment, recovery, eradication, and user response activities. recovery.

10 words kept, 9 removed, 12 added. Rev. 3 statement labels omitted for the comparison.

What NIST says changed

  • New security requirement title
  • Aligned with SP 800-53, Rev 5 to provide more comprehensive detail on and foundational tasks for an incident response plan and handling
  • Addresses implementation of incident handling capability and development/update of the incident response plan

NIST, SP 800-171 Rev. 2 to Rev. 3 change analysis, class “Significant change”. At adoption, Bedrock files this under “Rework”.

NIST's Rev. 3 discussion for 03.06.01

Incident-related information can be obtained from a variety of sources, including audit monitoring, network monitoring, physical access monitoring, user and administrator reports, and reported supply chain events. An effective incident handling capability involves coordination among many organizational entities, including mission and business owners, system owners, human resources offices, physical and personnel security offices, legal departments, operations personnel, and procurement offices.

What this means for you now

Nothing changes in what you are assessed against until a class deviation or a published rule adopts Rev. 3. Keep meeting 3.6.1 as written in Rev. 2.

Bedrock CMMC shows this same comparison against your own package, with your current status on the Rev. 2 side, so the day adoption lands the migration is a review, not a rewrite.

Back to the Rev. 2 vs Rev. 3 overview

Where this page's facts come from
Rev. 2 text and objectives
bedrock-cmmc-api@89b8e8e:migrations/004_reference_requirements.sql#Requirement.basicRequirement@rev2; bedrock-cmmc-api@89b8e8e:migrations/005_reference_objectives.sql#AssessmentObjective.description@rev2
Mapping and change class
bedrock-cmmc-api@89b8e8e:docs/reference/nist-800-171-rev3/normalized/r2_r3_transition_map.json#r2_to_r3
Rev. 3 03.06.01
bedrock-cmmc-api@89b8e8e:docs/reference/nist-800-171-rev3/normalized/rev3.json#requirements[]