IR-3

IR-3 INCIDENT RESPONSE TESTING

Overview

Number	Title	Impact	Priority	Subject Area
IR-3	Incident Response Testing	MODERATE	P2	Incident Response

Instructions
The organization tests the incident response capability for the information system Assignment: organization-defined frequency using Assignment: organization-defined tests to determine the incident response effectiveness and documents the results.

Guidance
Organizations test incident response capabilities to determine the overall effectiveness of the capabilities and to identify potential weaknesses or deficiencies. Incident response testing includes, for example, the use of checklists, walk-through or tabletop exercises, simulations (parallel/full interrupt), and comprehensive exercises. Incident response testing can also include a determination of the effects on organizational operations (e.g., reduction in mission capabilities), organizational assets, and individuals due to incident response.

Guidance

Organizations test incident response capabilities to determine the overall effectiveness of the capabilities and to identify potential weaknesses or deficiencies. Incident response testing includes, for example, the use of checklists, walk-through or tabletop exercises, simulations (parallel/full interrupt), and comprehensive exercises. Incident response testing can also include a determination of the effects on organizational operations (e.g., reduction in mission capabilities), organizational assets, and individuals due to incident response.

Enhancements

IR-3 (1) Automated Testing

Organizations use automated mechanisms to more thoroughly and effectively test incident response capabilities, for example: (i) by providing more complete coverage of incident response issues; (ii) by selecting more realistic test scenarios and test environments; and (iii) by stressing the response capability.

The organization employs automated mechanisms to more thoroughly and effectively test the incident response capability.

IR-3 (2) Coordination With Related Plans

MODERATE

Organizational plans related to incident response testing include, for example, Business Continuity Plans, Contingency Plans, Disaster Recovery Plans, Continuity of Operations Plans, Crisis Communications Plans, Critical Infrastructure Plans, and Occupant Emergency Plans.

The organization coordinates incident response testing with organizational elements responsible for related plans.