Incident Response has three requirements: be able to handle incidents, report them, and test that you can. For defense contractors the second one carries a contractual deadline. DFARS 252.204-7012 requires cyber incidents affecting covered defense information to be reported to DoD within 72 hours of discovery.
The family's most common failure is the third requirement. Plenty of organizations have an incident response plan; far fewer have ever exercised it.
What the Incident Response family covers
Incident Response contains 3 requirements, numbered 3.6.1 to 3.6.3 in NIST SP 800-171 Revision 2. In CMMC Level 2 they carry the practice prefix IR.L2, so 3.6.1 appears as IR.L2-3.6.1.
3.6.1 requires an operational incident-handling capability spanning preparation, detection, analysis, containment, recovery and user response. 3.6.2 requires tracking, documenting and reporting incidents internally and externally. 3.6.3 requires testing the capability. The DFARS reporting process is described in the DFARS 252.204-7012 guide.
| Requirement | What it requires | SPRS points | POA&M |
|---|---|---|---|
| 3.6.1 | Establish an operational incident-handling capability: preparation, detection, analysis, containment, recovery and user response | 5 | No |
| 3.6.2 | Track, document and report incidents to designated officials and authorities, internal and external | 5 | No |
| 3.6.3 | Test the organizational incident response capability | 1 | Eligible |
Point values from the DoD Assessment Methodology v1.2.1. POA&M eligibility under 32 CFR 170.21.
What it costs you in SPRS points
The family puts 11 of the 313 deductible points in the SPRS score at risk. The five-point requirements are 3.6.1 and 3.6.2. The remaining 1 is worth one point each.
With two five-point requirements among three, the family averages 3.67 points per requirement. An organization without any incident capability loses 11 points and cannot defer either five-pointer.
Why testing fails
3.6.3 is ninth on DIBCAC's list. The plan exists on paper, but there is no record that anyone has walked through it. Assessors ask for evidence of a test: a tabletop exercise with attendees, a scenario, decisions made and lessons recorded, or a technical simulation.
A good test also exposes the DFARS-specific steps people forget: who holds the medium assurance certificate needed to report through DIBNet, who preserves images of affected systems for 90 days, and who tells the prime contractor. Subcontractors must report directly to DoD and provide the report number to their prime — see subcontractor requirements.
Running a tabletop exercise
A tabletop exercise needs a realistic scenario — ransomware on an engineering workstation that holds CUI is a good one — the people named in the plan, and a facilitator who walks through detection, containment, the DoD report, image preservation, customer notification and recovery. Record who attended, the decisions made, the gaps found and the actions assigned. That record is the evidence for 3.6.3, and the actions usually improve 3.6.1 and 3.6.2 at the same time.
What you can and cannot defer
Under 32 CFR 170.21 only one-point requirements may be placed on a POA&M, with the single exception of 3.13.11 when encryption exists but is not FIPS-validated. In this family that makes 3.6.3 eligible for deferral.
Only 3.6.3 is deferrable, but a tabletop exercise takes an afternoon. It is one of the cheapest points in the standard to close.
Evidence assessors expect
Assessors work at the level of the objectives in NIST SP 800-171A and use examine, interview and test. For this family, have the following ready — the full evidence package checklist covers all 14 families:
- An incident response plan covering all six phases named in 3.6.1.
- Contact lists and escalation paths, including DoD reporting through DIBNet.
- Proof of a medium assurance certificate for DoD reporting.
- Incident tickets or records showing tracking and documentation.
- Records of at least one exercised test with lessons learned.
Frequently asked questions
What counts as a reportable incident under DFARS 7012?
A cyber incident that affects a covered contractor information system or the covered defense information on it, or that affects the ability to perform operationally critical support. When in doubt, consult the definitions in the clause.
How often should we test incident response?
NIST SP 800-171 does not set a frequency. Annually is common and defensible, with additional tests after significant changes.
Can an outsourced provider handle incident response?
Yes, but you remain responsible for reporting. The provider's role and the reporting steps must be in your plan.
Who should be on the incident response team?
At minimum an incident lead, someone with technical authority over the affected systems, the person who holds the DoD reporting certificate, a senior decision-maker and whoever manages customer communication. Small companies often combine roles but should name a backup for each.
What is a medium assurance certificate?
A DoD-approved digital certificate required to submit cyber incident reports through the DIBNet portal. Obtain one before you need it; it cannot be issued in the 72 hours after an incident.