Got questions? Contact our team today for a free CMMC Consultation
3.6.1
Establish and maintain an operational incident-handling capability that includes preparation, detection, analysis, containment, recovery, and user response activities. Include documented processes and assigned personnel for effective response.
More details Less details
+ —
Relevant NIST SP 800-53 R5
IR-2: Incident response training to personnel responsible for incident handling
IR-4: Implement incident handling process to respond to security incidents
IR-5: Track, document, and report security incidents
IR-6: Report security incidents to internal and external stakeholders as required
IR-7: Provide specialized incident response support when needed
Recommended Microsoft Licensing
Microsoft 365 E5 (or GCC High E5 for CUI) and Microsoft Sentinel
(includes Microsoft Defender XDR for detection, Sentinel for SIEM/log correlation, and incident case management)
3.6.2
Track, document, and report cybersecurity incidents to internal security officials and designated external authorities in accordance with policy or contractual obligations. This includes maintaining incident records, timelines, resolution status, and audit trails.
More details Less details
+ —
Relevant NIST SP 800-53 R5
IR-2: Incident response training to personnel responsible for incident handling
IR-4: Implement incident handing process to respond to security incidents
IR-5: Track, document, and report security incidents
IR-6: Report security incidents to internal and external stakeholders are required
IR-7: Provide specialized incident response support when needed
Recommended Microsoft Licensing
Microsoft 365 E5 (or GCC High E5 for CUI)
- Microsoft Sentinel for SIEM and log correlation
(Includes integration with Microsoft 365 Defender for alert management, incident timelines, automated incident response, and exportable reporting.)
3.6.3
Periodically test the organizational incident response capability through exercises, simulations, or tabletop scenarios to evaluate preparedness, identify gaps, and ensure timely and effective responses.
More details Less details
+ —
Relevant NIST SP 800-53 R5
IR-3: Test incident response capabilities to ensure effectiveness & readiness
Recommended Microsoft Licensing
Microsoft 365 E5 (or GCC High E5 for CUI)
- Microsoft Sentinel for SIEM/log correlation
(Enables simulation of security incidents, automated attack simulation tools, and audit reporting for IR testing exercises.)
Contact our team today
See how Agile IT's MSP for CMMC can strengthen your data security and allow your team to focus on your business's objectives and success.
Schedule a FREEconsultation