| name | Incident Response Training (03.06.04)_incident-response-training |
| description | Provide incident response training to system users consistent with assigned roles and responsibilities: Within [organization-defined] of assuming an i |
| category | configuration |
| version | 3.0 |
| author | cyberstrike-official |
| tags | ["nist","sp800-171","rev3","incident response training (03-06-04)","family-03.06","cui-protection","cmmc"] |
| tech_stack | ["any"] |
| cwe_ids | [] |
| chains_with | [] |
| prerequisites | [] |
| severity_boost | {} |
Incident Response Training (03.06.04) Incident Response Training
High-Level Description
Family: Incident Response
Framework: NIST SP 800-171 Rev 3
Applicability: Systems processing, storing, or transmitting CUI
Provide incident response training to system users consistent with assigned roles and responsibilities:
Within [organization-defined] of assuming an incident response role or responsibility or acquiring system access,
When required by system changes, and
[organization-defined] thereafter.
Review and update incident response training content [organization-defined] and following [organization-defined].
What to Check
How to Test
Step 1: Review System Security Plan
Examine the SSP for Incident Response Training (03.06.04) implementation description and responsible parties.
Step 2: Assess Implementation
# Verify security controls protecting CUI
# Check access controls, encryption, monitoring as applicable
# For Linux systems:
ls -la /etc/security/ 2>/dev/null
grep -r "CUI\|controlled" /etc/security/ 2>/dev/null
# For cloud:
# Use cloud-audit-mcp tools to assess posture
Step 3: CMMC Assessment Validation
Verify this requirement passes CMMC Level 2 assessment methodology per SP 800-171A Rev 3.
Tools
| Tool | Purpose | Usage |
|---|
| cloud-audit-mcp | Assess cloud CUI environment | cloud_audit_* tools |
| Manual Review | SSP and POA&M review | Documentation analysis |
Remediation Guide
Requirement Statement
Provide incident response training to system users consistent with assigned roles and responsibilities:
Within [organization-defined] of assuming an incident response role or responsibility or acquiring system access,
When required by system changes, and
[organization-defined] thereafter.
Review and update incident response training content [organization-defined] and following [organization-defined].
