Independent DIB implementation resource — not affiliated with or endorsed by the U.S. Department of WarView the official DoW campaign ↗
Brilliant at the BasicsDIB Resource Center
3.6.3OFFICIAL STATEMENT BELOWDERIVED REQUIREMENTPENDING NIST SME REVIEW

3.6.3 — Incident response testing

3.6 Incident Response · NIST SP 800-171 Rev. 2 · The heading label is this site's navigational shorthand; the official language is the statement below.

Official requirement statement (verbatim)

Test the organizational incident response capability.

NIST SP 800-171 Rev. 2 — Protecting CUI in Nonfederal Systems ↗NIST SP 800-171A — Assessing Security Requirements for CUI ↗
Independent interpretation

What this requirement is after

The response capability is exercised before it is needed. A tabletop or functional exercise finds the broken contact list, the unclear authority, and the restore nobody has actually run — while the stakes are a conference room, not a production outage.

Mapped practices

Brilliant at the Basics practices that support this requirement

Partial implementation supportModerate confidence

Why: The practice's operating rhythm is exactly this requirement's substance for the plant: tabletops and joint exercises run on a cadence, measured against response and recovery expectations, with findings tracked to closure and fed back into the plan.

What this does not claim: Exercising the OT plan tests the OT plan — the organization's wider response capability, including the enterprise-side scenarios an assessor will ask about, needs its own testing. As with the rest of this family, the mapping applies only where OT systems fall within the CUI boundary.

Practice-side activities
  • Run the annual OT exercise with the plant manager, operations, and IT in the room together
  • Track exercise findings to closure and revise the plan from them
  • Include a recovery component — an actual configuration restore — in the exercise cycle
Evidence this produces
  • Dated exercise records with scenario, participants, and findings
  • Plan revisions traceable to specific exercises

Review status: Technical review complete · Reviewed by inDirectIT practitioner review — CUI security and NIST SP 800-171 engineering · updated 2026-08-06

Doing the work

Implementation considerations and evidence

Implementation considerationsIndependent guidance — tailor to your environment
  • A tabletop with the real decision-makers in the room beats an elaborate simulation run by stand-ins; the point is testing the people who will decide, not the scenario's realism.
  • Exercise the seams where response actually fails: joint IT and OT decisions, after-hours reachability, and drafting the external report against the clock.
  • Every exercise should change something. A plan that survives testing unedited was not tested hard enough.
What operating evidence looks likeRecords worth retaining, not a submission checklist
  • Dated exercise records with scenario, participants, and findings
  • After-action items tracked to closure
  • Plan revision history traceable to specific exercises

Suggested owners, derived from the mapped practices and artifacts: Plant / OT leader. Ownership is a named person in your organization, not a role on a website.

Artifacts

Templates and worksheets with a mapped relationship

No artifact in the library names this requirement yet. The library index groups everything by category and practice.

The other revision

Where this lands in Rev. 3

Provenance

Sources and review status

Primary sourcesNIST SP 800-171 Rev. 2 — Protecting CUI in Nonfederal Systems · NIST SP 800-171A — Assessing Security Requirements for CUI
Review statusPending NIST SME review
Content version1.0
Updated