03.06.05 Incident Response Plan

This policy establishes the framework for the organization's incident response capability, ensuring the timely and effective handling of security incidents that may impact the confidentiality, integrity, and availability of Controlled Unclassified Information (CUI). This policy outlines the incident response plan's development, distribution, maintenance, and protection.

• A.03.06.05.a.01: an incident response plan is developed that provides the organization with a roadmap for implementing its incident response capability.
• A.03.06.05.a.02: an incident response plan is developed that describes the structure and organization of the incident response capability.
• A.03.06.05.a.03: an incident response plan is developed that provides a high-level approach for how the incident response capability fits into the overall organization.
• A.03.06.05.a.04: an incident response plan is developed that defines reportable incidents.
• A.03.06.05.a.05: an incident response plan is developed that addresses the sharing of incident information.
• A.03.06.05.a.06: an incident response plan is developed that designates responsibilities to organizational entities, personnel, or roles.
• A.03.06.05.b[01]: copies of the incident response plan are distributed to designated incident response personnel (identified by name or by role).
• A.03.06.05.b[02]: copies of the incident response plan are distributed to organizational elements.
• A.03.06.05.c: the incident response plan is updated to address system and organizational changes or problems encountered during plan implementation, execution, or testing.
• A.03.06.05.d: the incident response plan is protected from unauthorized disclosure.