NIST SP 800-171 Rev 2 · 3.6 Incident Response
3.6.2 Track, document and report incidents
Track, document, and report incidents to designated officials and/or authorities both internal and external to the organization.
- SPRS weight
- 5
- 5 points deducted from 110 when not implemented.
- CMMC level
- L2
- Level 2 only; not among the 17 Level 1 practices.
- Assessment objectives
- 6
- From NIST SP 800-171A, each one a “determine if” an assessor answers.
What an assessor checks
NIST SP 800-171A breaks 3.6.2 into 6 objectives. Every one has to be met for the requirement to be met; a partial answer scores as not implemented.
- [a]Determine if incidents are tracked.
- [b]Determine if incidents are documented.
- [c]Determine if authorities to whom incidents are to be reported are identified.
- [d]Determine if organizational officials to whom incidents are to be reported are identified.
- [e]Determine if identified authorities are notified of incidents.
- [f]Determine if identified organizational officials are notified of incidents.
- Examine
- [SELECT FROM: Incident response policy; procedures addressing incident monitoring; incident response records and documentation; procedures addressing incident reporting; incident reporting records and documentation; incident response plan; security plan; other relevant documents or records].
- Interview
- [SELECT FROM: Personnel with incident monitoring responsibilities; personnel with incident reporting responsibilities; personnel who have or should have reported incidents; personnel (authorities) to whom incident information is to be reported; personnel with information security responsibilities].
- Test
- [SELECT FROM: Incident monitoring capability for the organization; mechanisms supporting or implementing tracking and documenting of system security incidents; organizational processes for incident reporting; mechanisms supporting or implementing incident reporting].
If it is open: POA&M eligibility
Not POA&M-eligible: above the 1-point ceiling · 5 points deducted
Worth 5 points. No requirement over 1 point may appear on a Level 2 POA&M, so this has to be closed before the assessment.
A POA&M is only permitted at a score of 88 or above, and closes in one 180-day window. Check a full gap list or compute your score.
Where 3.6.2 maps
NIST SP 800-53 Rev 5
- IR-4 Incident Handling
- IR-5 Incident Monitoring
- IR-6 Incident Reporting
- IR-7 Incident Response Assistance
- IR-9 Information Spillage Response
NIST CSF 2.0
- Response processes and procedures are executed Response Planning
- Response activities are coordinated Response Communications
- Analysis is conducted Response Analysis
- Activities are performed to prevent expansion Incident Mitigation
- Restoration activities are coordinated Recovery Communications
SOC 2
No direct mapping.
Query it from your own tools
This page and the MacTech CMMC MCP server render the same dataset. Ask your assistant and it will answer from the methodology, not from memory.
lookup_control 3.6.2 get_assessment_objectives 3.6.2 generate_poam_entries ["3.6.2"]
Install the MCP server, free, no account.
From MacZine