Incident Response Policy
Incident Response Domain (IR)
📖 What This Policy Covers
Incident Response is your organization's emergency playbook -- what happens when things go wrong. This policy covers your incident response plan and team structure, detection mechanisms and alert routing, the full incident lifecycle (preparation, detection, containment, eradication, recovery, lessons learned), severity classification, DoD DIBNET reporting requirements (72-hour rule for CUI incidents), incident documentation and metrics, and regular testing through tabletop exercises and technical drills.
Purpose
This policy ensures that security incidents are detected and responded to promptly, CUI is protected during and after incidents, incident response activities are coordinated and effective, lessons learned from incidents drive security improvements, and the organization meets CMMC Level 2 incident response requirements.
Scope
Applies to any event that threatens confidentiality, integrity, or availability of CUI or organizational systems. Covers all information systems, networks, applications, and devices. Includes all employees, contractors, vendors, and partners. Incident types covered: malware, ransomware, data breaches, unauthorized access, denial of service, insider threats, and physical security breaches.
🎯 Why It Matters
Every organization will face a security incident -- the question is when, not if. The average cost of a data breach is $4.45M (IBM 2023), but organizations with tested incident response plans save $2.66M on average. For defense contractors, CUI incidents must be reported to DoD DIBNET within 72 hours (DFARS 252.204-7012). A poorly handled incident can result in contract loss, legal liability, and reputational damage. Despite having only 3 CMMC practices, this domain is disproportionately important because it's tested through exercises and real incidents.
🔐 Key Requirements
1. Incident Response Capability
Establish and maintain a documented incident response plan, trained team, and detection capabilities.
- ✓ Written IR Plan covering: detection mechanisms, severity classification (Critical/High/Medium/Low), escalation procedures, response playbooks, communication protocols, recovery procedures, post-incident activities
- ✓ Incident Response Team (IRT) with defined roles: Team Lead, Security Analysts, IT Operations, Legal, HR, PR
- ✓ 24/7 on-call rotation with primary + backup
- ✓ Detection capabilities: automated (SIEM, IDS/IPS, EDR, DLP, AV) and manual (user reports, audit reviews, threat hunting)
- ✓ Forensic toolkit: air-gapped workstation, write-blockers, FTK/EnCase/Volatility/Autopsy
- ✓ Secure communication channel (Signal, encrypted email) for incident coordination
- ✓ Plan reviewed annually or after major incidents
2. Incident Handling (NIST Lifecycle)
Follow the NIST incident response lifecycle: preparation, detection/analysis, containment, eradication, recovery, and post-incident activity.
- ✓ Initial triage within 15 minutes: validate incident, gather IOCs, classify severity
- ✓ Severity levels: CRITICAL (CUI breach, ransomware), HIGH (malware on CUI system), MEDIUM (phishing clicked), LOW (caught by AV)
- ✓ CRITICAL/HIGH: page IRT Lead + CISO immediately; MEDIUM: notify within 1 hour; LOW: daily digest
- ✓ Containment: isolate affected systems, block malicious IPs/domains, disable compromised accounts, preserve evidence (memory dump before shutdown)
- ✓ Eradication: remove malware/backdoors, rebuild compromised systems from clean backups, verify eradication with IOC scans
- ✓ Recovery: restore from clean backups, phased service restoration with enhanced monitoring for 30 days
- ✓ Recovery timeframes: CRITICAL 4-8 hours, HIGH 24 hours, MEDIUM 72 hours
- ✓ Post-incident: lessons learned meeting within 7 days, written incident report, update IR plan/playbooks, track remediation via POA&M
3. Incident Tracking & Reporting
Document all incidents, track metrics, and fulfill external reporting obligations.
- ✓ Incident ticket with unique ID (INC-YYYY-####): classification, timeline, personnel, evidence, communications, outcome
- ✓ Real-time updates (hourly during active response), objective facts, chain of custody for evidence
- ✓ Monthly metrics: volume by severity/type, MTTD, MTTR, systems affected, root cause, estimated cost
- ✓ DoD DIBNET reporting: CUI incidents reported within 72 hours per DFARS 252.204-7012
- ✓ Other reporting: law enforcement (FBI), customer notifications per contract, state breach notification laws, cyber insurance
- ✓ Threat intelligence sharing: DOD DIBNET, ISACs, anonymized IOCs
4. Incident Response Testing
Regular testing through tabletop exercises and technical drills.
- ✓ Quarterly tabletop exercises with IRT members: ransomware, phishing, insider threat, DDoS scenarios
- ✓ Annual technical drills: red team exercise, forensic evidence collection drill, backup restoration drill
- ✓ Exercise outcomes documented: gaps identified, decisions tested, plan updates
- ✓ Post-exercise: action items assigned with owners and due dates
👥 Roles & Responsibilities
CISO
- • Overall accountability for incident response program
- • Declare major incidents and authorize response actions
- • Communicate with executive leadership and customers
- • Determine DoD DIBNET reporting requirements
Incident Response Team (IRT)
- • Team Lead: coordinate all response activities
- • Security Analysts: investigate incidents, analyze forensic data
- • IT Operations: contain threats, restore systems
- • Legal: advise on obligations, evidence handling
- • HR: coordinate personnel actions for insider threats
SOC / IT Security Operations
- • Monitor security alerts 24/7
- • Perform initial triage and classification
- • Escalate to IRT per severity thresholds
- • Execute containment actions per IRT guidance
All Employees
- • Report suspicious activity via incident hotline or email immediately
- • Do not attempt to investigate or remediate independently
- • Preserve evidence (don't delete emails, don't wipe devices)
- • Cooperate with investigations
🛠️ Implementation Roadmap (8 Weeks)
Plan Development
Weeks 1-2- → Week 1: Draft IR Plan using NIST SP 800-61 template: list CUI systems, define severity levels, document escalation paths, create contact list, develop playbooks (ransomware, phishing, data breach, insider threat)
- → Week 2: Review with stakeholders (IT, Legal, HR, executives), incorporate feedback, get CISO + CEO signatures, publish to intranet
Team Formation & Training
Weeks 3-4- → Week 3: Assign IRT roles, establish on-call rotation, set up communication channels (Slack #incident-response, Zoom bridge, encrypted email list)
- → Week 4: 8-hour IRT workshop (lifecycle, plan walkthrough, forensic tools, DIBNET reporting), company-wide 15-min training ('How to Report Security Incidents'), publish hotline number
Tool Deployment
Weeks 5-6- → Week 5: Deploy incident ticketing (Jira Service Desk / ServiceNow) with workflow, configure email notifications, create dashboard
- → Week 6: Procure forensic workstation (air-gapped + write-blockers + tools), deploy EDR with forensic features (CrowdStrike, Defender ATP), enable memory dump capability
Testing & Validation
Weeks 7-8- → Week 7: Conduct tabletop exercise -- ransomware encrypts 50 workstations including 10 with CUI. Document gaps and action items.
- → Week 8: Test hotline, test escalation paging (verify IRT paged within 5 minutes), test DIBNET access, CISO signs operational readiness certification
Recommended Tools
📊 CMMC Practice Mapping
| Practice ID | Requirement | Policy Section |
|---|---|---|
| IR.L1-3.6.1 | Establish incident handling capability | 1, 4 |
| IR.L2-3.6.2 | Detect, analyze, contain, eradicate, recover | 2 |
| IR.L2-3.6.3 | Track, document, report incidents | 3 |
📋 Evidence Requirements
These are the artifacts a C3PAO assessor will ask for. Start collecting early.
Incident Response Policy + Plan
IRT Roster
Tabletop Exercise Report
Sample Incident Report
Incident Metrics Dashboard
DoD DIBNET Submission Confirmation
Forensic Tool Inventory
Training Records
⚠️ Common Gaps (What Assessors Flag)
1. IR plan exists but has never been tested
2. No defined severity levels or escalation criteria
3. DIBNET reporting capability not established
4. No forensic evidence preservation procedures
📝 Template Customization Guide
When filling in the downloadable template for this policy, replace these placeholders with your organization's specifics:
[COMPANY NAME] Your organization's legal name
Example: Acme Defense Systems, LLC
[CISO Name] Name of your CISO or IT Director
Example: Jane Smith
[1-800-XXX-XXXX] Your incident reporting hotline number
Example: 1-800-555-0199
[[email protected]] Your incident reporting email
Example: [email protected]
[Incident Response Plan Appendix A] Location of your IRT contact list
Example: SharePoint: /sites/Security/IR-Plan/Appendix-A.pdf
Customization Tips
- 💡 The IR Plan is a separate, more detailed document from this policy -- create both
- 💡 Adjust recovery timeframes based on your actual RTO/RPO capabilities
- 💡 For small organizations, the IRT may be 3-4 people wearing multiple hats -- document who covers which role
- 💡 If you can't afford 24/7 SOC coverage, use automated alerting (PagerDuty) as your off-hours coverage and document this
- 💡 Create at least 3 playbooks (ransomware, phishing, data breach) -- these are the most common scenarios assessors ask about
- 💡 Practice DIBNET reporting with a test submission so the team knows the process