Incident Response Testing IR-3

Incident Response · Moderate baseline ✗ Not implemented

Status — program-wide

What references this control

No risks name this control in their Framework field yet.

No policies reference it yet.

Link a risk or policy to this control

Attaching adds IR-3 to the item's Framework field; the ✨ AI button suggests the best match. You can also edit the Framework field on a risk / policy directly.

Source: NIST SP 800-53 Rev.5, Incident Response family NIST SP 800-53 Rev.5. The baseline shows the lowest SP 800-53B baseline (Low / Moderate / High) this control appears in NIST SP 800-53B.

Control guide — plain-English, per NIST SP 800-53

IR-3 (Incident Response Testing) checks that the incident response capability actually works before a real incident puts it to the test. You run planned tests on a set schedule (a tabletop walkthrough, a functional drill, or a simulated event) and then use what you learn to fix the gaps. It is a Moderate-baseline control, so it comes in as the program matures past the basics.

What good looks like

Test on a set schedule (for example, once a year) rather than only after something goes wrong.
Pick a test type that fits — a tabletop discussion, a functional drill, or a simulated incident against the server.
Test the whole chain: detecting the event, reporting it, deciding what to do, and recovering.
Write down what worked and what did not — the point is to find gaps, not to score a pass.
Feed the findings back into your procedures and training so the next test goes better.

Framework mapping

NIST CSF 2.0 — ID.IM-02 — Improvements are identified from security tests and exercises
CIS Controls v8 — Control 17 — Incident Response Management

How to move it toward Implemented

Run a simulated incident on the server — for example, trip a burst of failed logins and confirm it shows up in /var/log/auth.log and journalctl.
Walk the responders through detect, report, decide, recover and time how long each step takes.
Write a short after-action note: what was found, what broke, and the fixes with owners and dates.
Attach the after-action note as hardening evidence on the asset, naming IR-3 in the Requirement field — that moves it from ‘To assess’ toward ‘Completed’.