The three CMMC Level 2 incident response requirements: an operational incident handling capability, tracking and reporting incidents, and testing the response capability.
Establishing an operational incident-handling capability that covers preparation, detection, analysis, containment, recovery and user response. Covers the incident response plan, team roles, training and the evidence assessors test.
Tracking and documenting incidents and reporting them to designated internal officials and external authorities. Covers incident records, reporting chains and how this links to the 72-hour DoD reporting duty in DFARS 252.204-7012.
Testing the organization's incident response capability to validate plans and expose gaps, for example through exercises that cover roles, escalation, legal and law enforcement involvement and business impact.
Tell us what you're working on, whether it's a deployment, an audit, a security test or a cyber range. You'll speak with an engineer who can help you scope it.