Independent DIB implementation resource — not affiliated with or endorsed by the U.S. Department of WarView the official DoW campaign ↗
Brilliant at the BasicsDIB Resource Center
03.06.03OFFICIAL TITLEPENDING NIST SME REVIEW

03.06.03 — Incident Response Testing

03.06 Incident Response · NIST SP 800-171 Rev. 3

Independent summary of the official requirement

Requires testing the effectiveness of the incident response capability at an organization-defined frequency.

Rev. 3 requirement text is multi-part and parameterized with organization-defined values, so this site summarizes rather than reproduces it. The summary is independent — read the official publication for the binding wording.

NIST SP 800-171 Rev. 3 — Protecting CUI in Nonfederal Systems ↗NIST SP 800-171A Rev. 3 — Assessing Security Requirements for CUI ↗
Independent interpretation

What this requirement is after

An untested response capability is a hypothesis. Exercises at the defined frequency — tabletop, simulation, or live drill — exist to find the broken contact list, the missing access, and the unowned decision while they are cheap to fix instead of during a real incident.

Across revisions

Carried from Rev. 2's 3.6.3 with the frequency now an organization-defined parameter and the object of testing named as effectiveness, not mere execution.

Mapped practices

Brilliant at the Basics practices that support this requirement

Partial implementation supportModerate confidence

Why: The practice calls for exercising the OT plan — tabletops with operations, drills against realistic plant scenarios — which is incident response testing for the part of most environments that is hardest to test any other way.

What this does not claim: Testing the OT scenario does not test the rest of the capability: enterprise scenarios, cross-boundary incidents, and the organization-defined testing frequency all sit outside this practice's scope. An assessor evaluates whether the capability as a whole is tested at the defined frequency, and OT tabletop records cover only part of that picture.

Practice-side activities
  • Run OT tabletop exercises with operators, engineering, and plant leadership on a recurring schedule
  • Track exercise findings to closure and fold them back into the OT plan
Evidence this produces
  • Dated OT exercise records with scenarios and participants
  • Corrective actions from exercises tracked to closure

Review status: Pending NIST SME review · Reviewed by Brilliant at the Basics editorial — practitioner-authored; NIST SME review pending · updated 2026-08-06

Doing the work

Implementation considerations and evidence

Implementation considerationsIndependent guidance — tailor to your environment
  • Pick a format the organization will sustain: an annual tabletop that happens beats an elaborate simulation that never runs twice.
  • Script scenarios against the real environment, including at least one touching production or OT systems, where containment decisions are hardest.
  • Capture findings as tracked corrective actions — a test that changes nothing was a rehearsal of the status quo.
What operating evidence looks likeRecords worth retaining, not a submission checklist
  • Dated exercise records with scenario, participants, and findings
  • Corrective actions from tests tracked to closure

Suggested owners, derived from the mapped practices and artifacts: Plant / OT leader. Ownership is a named person in your organization, not a role on a website.

Artifacts

Templates and worksheets with a mapped relationship

No artifact in the library names this requirement yet. The library index groups everything by category and practice.

The other revision

Where this came from in Rev. 2

Provenance

Sources and review status

Primary sourcesNIST SP 800-171 Rev. 3 — Protecting CUI in Nonfederal Systems · NIST SP 800-171A Rev. 3 — Assessing Security Requirements for CUI
Review statusPending NIST SME review
Content version1.0
Updated