This was originally posted on LinkedIn. Check the original post and community discussion here!
On to the next requirement! 3.6.3 ๐๐๐ฌ๐ญ ๐ญ๐ก๐ ๐จ๐ซ๐ ๐๐ง๐ข๐ณ๐๐ญ๐ข๐จ๐ง๐๐ฅ ๐ข๐ง๐๐ข๐๐๐ง๐ญ ๐ซ๐๐ฌ๐ฉ๐จ๐ง๐ฌ๐ ๐๐๐ฉ๐๐๐ข๐ฅ๐ข๐ญ๐ฒ.
This is post #5 in my series analyzing the top ten failed / misunderstood NIST SP 800-171 and #CMMC requirements according to DIBCAC. Incident response testing is the 9th most “other than satisfied” requirement.
The assessor expectation for 3.6.3 is that the organization has performed a drill or a test of their incident response procedures and capabilities.
โ๏ธ It is important to note that there is no actual minimum frequency or schedule in the requirement, however, most assessors will say that the minimum is one test per year. One test per quarter is a best practice for both compliance and security.
Why do companies fail ? My guess is that they either
โฐ 1) think that real incidents count as tests *๐ต๐ฉ๐ฆ๐บ ๐ฅ๐ฐ๐ฏ’๐ต*,
๐ณ 2) get intimidated by the idea of an incident response test and never do one, or
๐ด 3) fail to show improvement from lessons learned.
This is NOT technical. You do not need special solutions. You do not need whiz-bang incident commandos. ๐ฎ
Your regular system administration team can perform an incident response test. Because guess what – they are the ones that WILL respond to a real incident, at least at the beginning stages.
If in doubt, start with these steps.
1) Devise a scenario that would force you to go through all of your incident plans and procedures.
Where possible, make it realistic. “Tom clicked on phishing malware which compromised his cloud account credentials using ‘pass-the-hash’. Any data on Tom’s computer, or anything that could be accessed with his active cloud sessions, is being exfiltrated.”
2) Talk through how this incident would be handled. How is it discovered? Who discovers it? How would they document it? Who would they escalate to? How do they contain the damage?
As you talk through these steps, transcribe notes of what was discussed.
3) Check your policies and procedures as they become relevant. Do you have an incident response form? Try to fill it out. What was helpful? What didn’t work?
4) Test your ability to get help. Do you have a retained incident response firm? Do they answer the phone? Do you have cyber insurance? Would cyber insurance cover this scenario? Can you reach the CISO, President, Public Relations?
5) Test your ability to contact stakeholders. Can you submit this incident to dibnet? Do you know which customer is affected by the exfiltrated data?
6) Test your ability to investigate and gather forensics. Would your existing logs identify this malicious activity?
7) Identify lessons learned. Write down things you want to improve. Start change requests, or modify log settings, as appropriate.
8) Pack all these notes, filled-out forms, and lessons learned together as evidence. ๐
Shameless plug: The Kieri Compliance Documentation (Google it) includes all this.
Amira Armond is the President of Kieri Solutions, an Authorized C3PAO. She is a CMMC Provisional Assessor, Provisional Instructor, and has passed the examinations for both CCP and CCA. Amira is the chief editor for CMMCAudit.org and is the vice-chair of the C3PAO Stakeholder Forum.