IR.L2-3.6.1[g] – Determine if the organization responds to security incidents.

This objective verifies that your organization actually responds to security incidents when they occur. It ensures that the incident response process is more than just a documented plan — it’s something your team actively engages with when threats are detected or reported.

IR.L2-3.6.2[c] – Determine if incident types to be reported are defined.

This objective validates that your organization has clearly defined and communicated what constitutes a reportable incident. It is a confirmation step that looks at whether incident categories and examples are well-understood, consistent, and built into your IR process.

IR.L2-3.6.2[b] – Examine documentation to confirm that types of incidents to be reported are identified.

This objective ensures that the types of reportable security incidents—as identified in IR.L2-3.6.2[a]—are formally documented in your organization’s policies and procedures. The goal is to validate that users and response teams have clear written guidance on what qualifies as a reportable incident.

IR.L2-3.6.1[b] – Examine documentation to confirm the incident response process and procedures are defined.

This objective verifies that your organization has formally documented its incident response process and procedures, as identified in IR.L2-3.6.1[a]. It’s not enough to have a verbal or ad hoc plan—assessors must see evidence that a defined, actionable, and complete process exists in writing.

IR.L2-3.6.1[c] – Determine if the incident response process and procedures are implemented.

This objective verifies that your documented incident response process is not only written, but actively followed. It ensures that your team uses the procedures during actual incidents or exercises and that response activities are consistent with your plan.

IR.L2-3.6.2[a] – Identify types of security incidents to be reported.

This objective requires your organization to clearly define and categorize which types of security incidents must be reported, especially those that could impact the confidentiality, integrity, or availability of Controlled Unclassified Information (CUI).

IR.L2-3.6.1[e] – Determine if the incident response process and procedures are reviewed.

This objective confirms that your organization conducts formal reviews of its incident response process—independent of updates or real incidents. Regular review ensures the IR plan remains aligned with operational needs, current threats, and compliance obligations.

IR.L2-3.6.2[d] – Identify incident response personnel.

This objective ensures your organization designates specific personnel or roles responsible for handling incident response activities. It covers both technical responders (e.g., IT/security staff) and other stakeholders (e.g., legal, communications) who support the process.

IR.L2-3.6.1[f] – Determine if the incident response process and procedures are updated.

This objective ensures that your organization updates its incident response process and procedures in response to real-world changes—such as lessons learned from incidents, system upgrades, personnel changes, or evolving compliance requirements.

IR.L2-3.6.1[a] – Identify incident response process and procedures.

This objective requires your organization to identify and document the incident response (IR) process, including procedures for detecting, reporting, analyzing, and responding to cybersecurity incidents—especially those involving Controlled Unclassified Information (CUI).