3.6.3: Test the organizational incident response capability

Control Family:

Incident Response

Control Type:


CSF v1.1 References:


Organizations test incident response capabilities to determine the effectiveness of the capabilities and to identify potential weaknesses or deficiencies. Incident response testing includes the use of checklists, walk-through or tabletop exercises, simulations (both parallel and full interrupt), and comprehensive exercises. Incident response testing can also include a determination of the effects on organizational operations (e.g., reduction in mission capabilities), organizational assets, and individuals due to incident response.

[SP 800-84] provides guidance on testing programs for information technology capabilities.