{"id":15435,"date":"2025-01-30T09:31:24","date_gmt":"2025-01-30T14:31:24","guid":{"rendered":"https:\/\/ndisac.org\/dibscc\/?p=15435"},"modified":"2025-03-31T07:22:17","modified_gmt":"2025-03-31T12:22:17","slug":"ir-l3-3-6-2e","status":"publish","type":"post","link":"https:\/\/ndisac.org\/dibscc\/cyberassist\/cybersecurity-maturity-model-certification\/level-3\/ir-l3-3-6-2e\/","title":{"rendered":"IR.L3-3.6.2E Cyber Incident Response Team"},"content":{"rendered":"<p>[et_pb_section fb_built=&#8221;1&#8243; _builder_version=&#8221;3.22&#8243;][et_pb_row _builder_version=&#8221;3.25&#8243; background_size=&#8221;initial&#8221; background_position=&#8221;top_left&#8221; background_repeat=&#8221;repeat&#8221;][et_pb_column type=&#8221;4_4&#8243; _builder_version=&#8221;3.0.47&#8243; custom_padding=&#8221;|||&#8221; custom_padding__hover=&#8221;|||&#8221;][et_pb_text _builder_version=&#8221;4.9.2&#8243; vertical_offset_tablet=&#8221;0&#8243; horizontal_offset_tablet=&#8221;0&#8243; z_index_tablet=&#8221;0&#8243; text_text_shadow_horizontal_length_tablet=&#8221;0px&#8221; text_text_shadow_vertical_length_tablet=&#8221;0px&#8221; text_text_shadow_blur_strength_tablet=&#8221;1px&#8221; link_text_shadow_horizontal_length_tablet=&#8221;0px&#8221; link_text_shadow_vertical_length_tablet=&#8221;0px&#8221; link_text_shadow_blur_strength_tablet=&#8221;1px&#8221; ul_text_shadow_horizontal_length_tablet=&#8221;0px&#8221; ul_text_shadow_vertical_length_tablet=&#8221;0px&#8221; ul_text_shadow_blur_strength_tablet=&#8221;1px&#8221; ol_text_shadow_horizontal_length_tablet=&#8221;0px&#8221; ol_text_shadow_vertical_length_tablet=&#8221;0px&#8221; ol_text_shadow_blur_strength_tablet=&#8221;1px&#8221; quote_text_shadow_horizontal_length_tablet=&#8221;0px&#8221; quote_text_shadow_vertical_length_tablet=&#8221;0px&#8221; quote_text_shadow_blur_strength_tablet=&#8221;1px&#8221; header_text_shadow_horizontal_length_tablet=&#8221;0px&#8221; header_text_shadow_vertical_length_tablet=&#8221;0px&#8221; header_text_shadow_blur_strength_tablet=&#8221;1px&#8221; header_2_text_shadow_horizontal_length_tablet=&#8221;0px&#8221; header_2_text_shadow_vertical_length_tablet=&#8221;0px&#8221; header_2_text_shadow_blur_strength_tablet=&#8221;1px&#8221; header_3_text_shadow_horizontal_length_tablet=&#8221;0px&#8221; header_3_text_shadow_vertical_length_tablet=&#8221;0px&#8221; header_3_text_shadow_blur_strength_tablet=&#8221;1px&#8221; header_4_text_shadow_horizontal_length_tablet=&#8221;0px&#8221; header_4_text_shadow_vertical_length_tablet=&#8221;0px&#8221; header_4_text_shadow_blur_strength_tablet=&#8221;1px&#8221; header_5_text_shadow_horizontal_length_tablet=&#8221;0px&#8221; header_5_text_shadow_vertical_length_tablet=&#8221;0px&#8221; header_5_text_shadow_blur_strength_tablet=&#8221;1px&#8221; header_6_text_shadow_horizontal_length_tablet=&#8221;0px&#8221; header_6_text_shadow_vertical_length_tablet=&#8221;0px&#8221; header_6_text_shadow_blur_strength_tablet=&#8221;1px&#8221; box_shadow_horizontal_tablet=&#8221;0px&#8221; box_shadow_vertical_tablet=&#8221;0px&#8221; box_shadow_blur_tablet=&#8221;40px&#8221; box_shadow_spread_tablet=&#8221;0px&#8221;]<\/p>\n<h2>CMMC Requirement IR.L3-3.6.2E \u2013 Cyber Incident Response Team: Establish and maintain a cyber incident response team that can be deployed by the organization within 24 hours.<\/h2>\n<p>[\/et_pb_text][et_pb_text _builder_version=&#8221;4.9.2&#8243; vertical_offset_tablet=&#8221;0&#8243; horizontal_offset_tablet=&#8221;0&#8243; custom_margin=&#8221;||||false|false&#8221; custom_padding=&#8221;20px|20px|20px|20px|false|false&#8221; hover_enabled=&#8221;0&#8243; z_index_tablet=&#8221;0&#8243; text_text_shadow_horizontal_length_tablet=&#8221;0px&#8221; text_text_shadow_vertical_length_tablet=&#8221;0px&#8221; text_text_shadow_blur_strength_tablet=&#8221;1px&#8221; link_text_shadow_horizontal_length_tablet=&#8221;0px&#8221; link_text_shadow_vertical_length_tablet=&#8221;0px&#8221; link_text_shadow_blur_strength_tablet=&#8221;1px&#8221; ul_text_shadow_horizontal_length_tablet=&#8221;0px&#8221; ul_text_shadow_vertical_length_tablet=&#8221;0px&#8221; ul_text_shadow_blur_strength_tablet=&#8221;1px&#8221; ol_text_shadow_horizontal_length_tablet=&#8221;0px&#8221; ol_text_shadow_vertical_length_tablet=&#8221;0px&#8221; ol_text_shadow_blur_strength_tablet=&#8221;1px&#8221; quote_text_shadow_horizontal_length_tablet=&#8221;0px&#8221; quote_text_shadow_vertical_length_tablet=&#8221;0px&#8221; quote_text_shadow_blur_strength_tablet=&#8221;1px&#8221; header_text_shadow_horizontal_length_tablet=&#8221;0px&#8221; header_text_shadow_vertical_length_tablet=&#8221;0px&#8221; header_text_shadow_blur_strength_tablet=&#8221;1px&#8221; header_2_text_shadow_horizontal_length_tablet=&#8221;0px&#8221; header_2_text_shadow_vertical_length_tablet=&#8221;0px&#8221; header_2_text_shadow_blur_strength_tablet=&#8221;1px&#8221; header_3_text_shadow_horizontal_length_tablet=&#8221;0px&#8221; header_3_text_shadow_vertical_length_tablet=&#8221;0px&#8221; header_3_text_shadow_blur_strength_tablet=&#8221;1px&#8221; header_4_text_shadow_horizontal_length_tablet=&#8221;0px&#8221; header_4_text_shadow_vertical_length_tablet=&#8221;0px&#8221; header_4_text_shadow_blur_strength_tablet=&#8221;1px&#8221; header_5_text_shadow_horizontal_length_tablet=&#8221;0px&#8221; header_5_text_shadow_vertical_length_tablet=&#8221;0px&#8221; header_5_text_shadow_blur_strength_tablet=&#8221;1px&#8221; header_6_text_shadow_horizontal_length_tablet=&#8221;0px&#8221; header_6_text_shadow_vertical_length_tablet=&#8221;0px&#8221; header_6_text_shadow_blur_strength_tablet=&#8221;1px&#8221; border_width_all=&#8221;1px&#8221; border_color_all=&#8221;#bcbcbc&#8221; box_shadow_style=&#8221;preset1&#8243; box_shadow_horizontal_tablet=&#8221;0px&#8221; box_shadow_vertical_tablet=&#8221;0px&#8221; box_shadow_blur_tablet=&#8221;40px&#8221; box_shadow_spread_tablet=&#8221;0px&#8221; sticky_enabled=&#8221;0&#8243;]<\/p>\n<p>\nLinks to Publicly Available Resources <\/p>\n<p class=\"p1\"><span class=\"s1\"><!-- Beginning of Link Library Output --><div id='linklist1' class='linklist'><!-- Div Linklist -->\n<div class=\"LinkLibraryCat LinkLibraryCat650 level0\"><!-- Div Category -->\n\t<ul>\n<li><a href=\"https:\/\/dodcio.defense.gov\/Portals\/0\/Documents\/CMMC\/AssessmentGuideL3v2.pdf\" id=\"link-14791\" class=\"track_this_link \" rel=\"noopener noreferrer\" target=\"_blank\">CMMC Level 3 Assessment Guide<\/a>\n<p>This document provides assessment guidance for conducting Cybersecurity Maturity Model Certification (CMMC) assessments for Level 3.<\/p><\/li>\n<li><a href=\"https:\/\/www.cisa.gov\/news-events\/bulletins\" id=\"link-16569\" class=\"track_this_link \" rel=\"noopener noreferrer\" target=\"_blank\">Cybersecurity and Infrastructure Security Agency &#8211; Bulletins<\/a>\n<p>Bulletins provide weekly summaries of new vulnerabilities. Patch information is provided when available. <\/p><\/li>\n<li><a href=\"https:\/\/www.cisa.gov\/resources-tools\/resources\/federal-government-cybersecurity-incident-and-vulnerability-response-playbooks\" id=\"link-16570\" class=\"track_this_link \" rel=\"noopener noreferrer\" target=\"_blank\">Cybersecurity and Infrastructure Security Agency &#8211; Federal Government Cybersecurity Incident and Vulnerability Response Playbooks<\/a>\n<p>Section 6 of Executive Order 14028 directed DHS, via CISA, to \u201cdevelop a standard set of operational procedures (playbook) to be used in planning and conducting cybersecurity vulnerability and incident response activity respecting Federal Civilian Executive Branch (FCEB) Information Systems.\u201d This document presents two playbooks: one for incident response and one for vulnerability response.<\/p><\/li>\n<li><a href=\"https:\/\/www.cisa.gov\/sites\/default\/files\/publications\/Incident-Response-Plan-Basics_508c.pdf\" id=\"link-16567\" class=\"track_this_link \" rel=\"noopener noreferrer\" target=\"_blank\">Cybersecurity and Infrastructure Security Agency &#8211; Incident Response Plan Basics<\/a>\n<p>This document developed by CISA shares key information to help create an Incident Response Plan for your organization.<\/p><\/li>\n<li><a href=\"https:\/\/www.cisa.gov\/resources-tools\/programs\/Incident-Response-Training\" id=\"link-1896\" class=\"track_this_link \" rel=\"noopener noreferrer\" target=\"_blank\">Cybersecurity and Infrastructure Security Agency &#8211; Incident Response Training<\/a>\n<p>This is a self-paced online training course regarding incident response offered by CISA.<\/p><\/li>\n<li><a href=\"https:\/\/www.cisa.gov\/stopransomware\/alerts\" id=\"link-16568\" class=\"track_this_link \" rel=\"noopener noreferrer\" target=\"_blank\">Cybersecurity and Infrastructure Security Agency &#8211; Stop Ransomware Alerts<\/a>\n<p>The #StopRansomware joint Cybersecurity Advisories are part of an ongoing effort to publish technical information on ransomware variants and ransomware threat actors for network defenders.<\/p><\/li>\n<li><a href=\"https:\/\/www.cisa.gov\/national-cyber-incident-response-plan-ncirp\" id=\"link-16571\" class=\"track_this_link \" rel=\"noopener noreferrer\" target=\"_blank\">Cybersecurity and Infrastructure Security Agency &#8211; The National Cyber Incident Response Plan (NCIRP)<\/a>\n<p>The NCIRP was first published in 2016 and serves as the nation\u2019s framework for coordinated response to significant cyber incidents. Since that time, the cybersecurity threat landscape and national response ecosystem have changed dramatically, resulting in a growing need to update this foundational document. Through the NCIRP 2024 planning effort, CISA will address many of these changes, while making the NCIRP more inclusive of non-federal stakeholders and establishing a foundation for continued evolution of the nation\u2019s capability to collectively respond to and manage significant cyber incidents.<\/p><\/li>\n<li><a href=\"https:\/\/nvlpubs.nist.gov\/nistpubs\/SpecialPublications\/NIST.SP.800-101r1.pdf\" id=\"link-15622\" class=\"track_this_link \" rel=\"noopener noreferrer\" target=\"_blank\">NIST SP 800-101 Rev. 1: Guidelines on Mobile Device Forensics<\/a>\n<p>Mobile device forensics is the science of recovering digital evidence from a mobile device under forensically sound conditions using accepted methods. Mobile device forensics is an evolving specialty in the field of digital forensics. This guide attempts to bridge the gap by providing an in-depth look into mobile devices and explaining the technologies involved and their relationship to forensic procedures. This document covers mobile devices with features beyond simple voice communication and text messaging capabilities. This guide also discusses procedures for the validation, preservation, acquisition, examination, analysis, and reporting of digital information.<\/p><\/li>\n<li><a href=\"https:\/\/nvlpubs.nist.gov\/nistpubs\/SpecialPublications\/NIST.SP.800-150.pdf\" id=\"link-15623\" class=\"track_this_link \" rel=\"noopener noreferrer\" target=\"_blank\">NIST SP 800-150: Guide to Cyber Threat Information Sharing<\/a>\n<p>This publication provides guidelines for establishing and participating in cyber threat information sharing relationships. This guidance helps organizations establish information sharing goals, identify cyber threat information sources, scope information sharing activities, develop rules that control the publication and distribution of threat information, engage with existing sharing communities, and make effective use of threat information in support of the organization\u2019s overall cybersecurity practices.<\/p><\/li>\n<li><a href=\"https:\/\/nvlpubs.nist.gov\/nistpubs\/SpecialPublications\/NIST.SP.800-184.pdf\" id=\"link-1891\" class=\"track_this_link \" rel=\"noopener noreferrer\" target=\"_blank\">NIST SP 800-184: Guide for Cybersecurity Event Recovery<\/a>\n<p>This NIST Special Publication focuses on providing plans and procedures to facilitate resuming normal business operations as quickly as possible during a cybersecurity event.<\/p><\/li>\n<li><a href=\"https:\/\/nvlpubs.nist.gov\/nistpubs\/SpecialPublications\/NIST.SP.800-61r3.pdf\" id=\"link-1887\" class=\"track_this_link \" rel=\"noopener noreferrer\" target=\"_blank\">NIST SP 800-61 Rev 3: Computer Security Incident Handling Guide<\/a>\n<p>This NIST Special Publication offers guidance for incident response by identifying best practices and other recommendations.<\/p><\/li>\n<li><a href=\"https:\/\/nvlpubs.nist.gov\/nistpubs\/Legacy\/SP\/nistspecialpublication800-86.pdf\" id=\"link-1889\" class=\"track_this_link \" rel=\"noopener noreferrer\" target=\"_blank\">NIST SP 800-86: Guide to Integrating Forensic Techniques into Incident Response<\/a>\n<p>This guide from NIST discusses how important forensics can be for an organization during a cyber incident.<\/p><\/li>\n\t<\/ul>\n<\/div><!-- Div End Category -->\n<script type='text\/javascript'>\njQuery(document).ready(function()\n{\njQuery('.arrow-up').hide();\njQuery('#linklist1 a.track_this_link').click(function() {\nlinkid = this.id;\nlinkid = linkid.substring(5);\npath = '';\njQuery.ajax( {    type: 'POST',    url: 'https:\/\/ndisac.org\/dibscc\/wp-admin\/admin-ajax.php',     data: { action: 'link_library_tracker',             _ajax_nonce: '89940d9abd',             id:linkid, xpath:path }     });\nreturn true;\n});\njQuery('#linklist1 .expandlinks').click(function() {\ntarget = '.' + jQuery(this).attr('id');\nsubcattarget = '.' + jQuery(this).attr('data-subcat');\nif ( jQuery( target ).is(':visible') ) {\njQuery(target).slideUp();\njQuery(subcattarget).slideToggle();\njQuery(this).children('img').attr('src', 'https:\/\/ndisac.org\/dibscc\/wp-content\/plugins\/link-library\/icons\/expand-32.png');\n} else {\njQuery(target).slideDown();\njQuery(subcattarget).slideToggle();\njQuery(this).children('img').attr('src', 'https:\/\/ndisac.org\/dibscc\/wp-content\/plugins\/link-library\/icons\/collapse-32.png');\n}\n});\njQuery('#linklist1 .linklistcatclass').click(function() {\njQuery(this).siblings('.expandlinks').click();\n});\njQuery('#linklist1 .linklistcatnamedesc').click(function() {\njQuery(this).siblings('.expandlinks').click();\n});\n});\n<\/script>\n<\/div><!-- Div Linklist -->\n<!-- End of Link Library Output -->\n\n<\/span><\/p>\n<\/p>\n<p>[\/et_pb_text][et_pb_divider _builder_version=&#8221;4.9.2&#8243; vertical_offset_tablet=&#8221;0&#8243; horizontal_offset_tablet=&#8221;0&#8243; z_index_tablet=&#8221;0&#8243; box_shadow_horizontal_tablet=&#8221;0px&#8221; box_shadow_vertical_tablet=&#8221;0px&#8221; box_shadow_blur_tablet=&#8221;40px&#8221; box_shadow_spread_tablet=&#8221;0px&#8221;][\/et_pb_divider][et_pb_testimonial quote_icon=&#8221;off&#8221; _builder_version=&#8221;4.9.2&#8243; vertical_offset_tablet=&#8221;0&#8243; horizontal_offset_tablet=&#8221;0&#8243; z_index_tablet=&#8221;0&#8243; author_text_shadow_horizontal_length_tablet=&#8221;0px&#8221; author_text_shadow_vertical_length_tablet=&#8221;0px&#8221; author_text_shadow_blur_strength_tablet=&#8221;1px&#8221; position_text_shadow_horizontal_length_tablet=&#8221;0px&#8221; position_text_shadow_vertical_length_tablet=&#8221;0px&#8221; position_text_shadow_blur_strength_tablet=&#8221;1px&#8221; company_text_shadow_horizontal_length_tablet=&#8221;0px&#8221; company_text_shadow_vertical_length_tablet=&#8221;0px&#8221; company_text_shadow_blur_strength_tablet=&#8221;1px&#8221; body_link_text_shadow_horizontal_length_tablet=&#8221;0px&#8221; body_link_text_shadow_vertical_length_tablet=&#8221;0px&#8221; body_link_text_shadow_blur_strength_tablet=&#8221;1px&#8221; body_ul_text_shadow_horizontal_length_tablet=&#8221;0px&#8221; body_ul_text_shadow_vertical_length_tablet=&#8221;0px&#8221; body_ul_text_shadow_blur_strength_tablet=&#8221;1px&#8221; body_ol_text_shadow_horizontal_length_tablet=&#8221;0px&#8221; body_ol_text_shadow_vertical_length_tablet=&#8221;0px&#8221; body_ol_text_shadow_blur_strength_tablet=&#8221;1px&#8221; body_quote_text_shadow_horizontal_length_tablet=&#8221;0px&#8221; body_quote_text_shadow_vertical_length_tablet=&#8221;0px&#8221; body_quote_text_shadow_blur_strength_tablet=&#8221;1px&#8221; box_shadow_horizontal_tablet=&#8221;0px&#8221; box_shadow_vertical_tablet=&#8221;0px&#8221; box_shadow_blur_tablet=&#8221;40px&#8221; box_shadow_spread_tablet=&#8221;0px&#8221; box_shadow_horizontal_image_tablet=&#8221;0px&#8221; box_shadow_vertical_image_tablet=&#8221;0px&#8221; box_shadow_blur_image_tablet=&#8221;40px&#8221; box_shadow_spread_image_tablet=&#8221;0px&#8221; text_shadow_horizontal_length_tablet=&#8221;0px&#8221; text_shadow_vertical_length_tablet=&#8221;0px&#8221; text_shadow_blur_strength_tablet=&#8221;1px&#8221;]Discussion [NIST SP 800-171 R2]<br \/>\nA cyber incident response team (CIRT) is a team of experts that assesses, documents, and responds to cyber incidents so that organizational systems can recover quickly and implement the necessary controls to avoid future incidents. CIRT personnel include, for example, forensic analysts, malicious code analysts, systems security engineers, and real-time operations personnel. The incident handling capability includes performing rapid forensic preservation of evidence and analysis of and response to intrusions. The team members may or may not be full-time but need to be available to respond in the time period required. The size and specialties of the team are based on known and anticipated threats. The team is typically pre-equipped with the software and hardware (e.g., forensic tools) necessary for rapid identification, quarantine, mitigation, and recovery and is familiar with how to preserve evidence and maintain chain of custody for law enforcement or counterintelligence uses. For some organizations, the CIRT can be implemented as a cross organizational entity or as part of the Security Operations Center (SOC).<br \/>\n[NIST SP 800-61] provides guidance on incident handling. [NIST SP 800-86] and [NIST SP 800-101] provide guidance on integrating forensic techniques into incident response. [NIST SP 800-150] provides guidance on cyber threat information sharing. [NIST SP 800-184] provides guidance on cybersecurity event recovery.<\/p>\n<p>Further Discussion<br \/>\nThe CIRT\u2019s primary function is to handle information security incident management and response for the environments the SOC oversees. The primary goals of the CIRT are triage and initial response to an incident. They also communicate with all the proper people to ensure understanding of an incident and the response actions, including collection of forensic evidence, have been conveyed.<br \/>\nIf and when an incident is detected by the organization\u2019s SOC, the IR team is responsible for handling the incident and communicating what has happened to the appropriate people within the organization, as well to the authorities (as needed).<br \/>\nThe deployment of a team does not necessarily mean they are \u201cphysically deployed.\u201d Deployment may simply mean connecting to a remote system in a manner that is equivalent to being on the system\u2019s keyboard. Remote access can provide just as much capability as local access in many cases.<br \/>\nSome situations require physical access. For instance, if the company has a physically isolated environment located at a remote location, a team must be physically present at the remote facility to perform the duties required.[\/et_pb_testimonial][\/et_pb_column][\/et_pb_row][\/et_pb_section]<\/p>\n","protected":false},"excerpt":{"rendered":"<p>[et_pb_section fb_built=&#8221;1&#8243; _builder_version=&#8221;3.22&#8243;][et_pb_row _builder_version=&#8221;3.25&#8243; background_size=&#8221;initial&#8221; background_position=&#8221;top_left&#8221; background_repeat=&#8221;repeat&#8221;][et_pb_column type=&#8221;4_4&#8243; _builder_version=&#8221;3.0.47&#8243; custom_padding=&#8221;|||&#8221; custom_padding__hover=&#8221;|||&#8221;][et_pb_text _builder_version=&#8221;4.9.2&#8243; vertical_offset_tablet=&#8221;0&#8243; horizontal_offset_tablet=&#8221;0&#8243; z_index_tablet=&#8221;0&#8243; text_text_shadow_horizontal_length_tablet=&#8221;0px&#8221; text_text_shadow_vertical_length_tablet=&#8221;0px&#8221; text_text_shadow_blur_strength_tablet=&#8221;1px&#8221; link_text_shadow_horizontal_length_tablet=&#8221;0px&#8221; link_text_shadow_vertical_length_tablet=&#8221;0px&#8221; link_text_shadow_blur_strength_tablet=&#8221;1px&#8221; ul_text_shadow_horizontal_length_tablet=&#8221;0px&#8221; ul_text_shadow_vertical_length_tablet=&#8221;0px&#8221; ul_text_shadow_blur_strength_tablet=&#8221;1px&#8221; ol_text_shadow_horizontal_length_tablet=&#8221;0px&#8221; ol_text_shadow_vertical_length_tablet=&#8221;0px&#8221; ol_text_shadow_blur_strength_tablet=&#8221;1px&#8221; quote_text_shadow_horizontal_length_tablet=&#8221;0px&#8221; quote_text_shadow_vertical_length_tablet=&#8221;0px&#8221; quote_text_shadow_blur_strength_tablet=&#8221;1px&#8221; [&hellip;]<\/p>\n","protected":false},"author":8,"featured_media":0,"comment_status":"closed","ping_status":"closed","sticky":false,"template":"","format":"standard","meta":{"_et_pb_use_builder":"on","_et_pb_old_content":"[et_pb_section bb_built=\"1\"][et_pb_row][et_pb_column type=\"4_4\"][et_pb_text _builder_version=\"4.2.2\" text_text_shadow_horizontal_length=\"text_text_shadow_style,%91object Object%93\" text_text_shadow_horizontal_length_tablet=\"0px\" text_text_shadow_vertical_length=\"text_text_shadow_style,%91object Object%93\" text_text_shadow_vertical_length_tablet=\"0px\" text_text_shadow_blur_strength=\"text_text_shadow_style,%91object Object%93\" text_text_shadow_blur_strength_tablet=\"1px\" link_text_shadow_horizontal_length=\"link_text_shadow_style,%91object Object%93\" link_text_shadow_horizontal_length_tablet=\"0px\" link_text_shadow_vertical_length=\"link_text_shadow_style,%91object Object%93\" link_text_shadow_vertical_length_tablet=\"0px\" link_text_shadow_blur_strength=\"link_text_shadow_style,%91object Object%93\" link_text_shadow_blur_strength_tablet=\"1px\" ul_text_shadow_horizontal_length=\"ul_text_shadow_style,%91object Object%93\" ul_text_shadow_horizontal_length_tablet=\"0px\" ul_text_shadow_vertical_length=\"ul_text_shadow_style,%91object Object%93\" ul_text_shadow_vertical_length_tablet=\"0px\" ul_text_shadow_blur_strength=\"ul_text_shadow_style,%91object Object%93\" ul_text_shadow_blur_strength_tablet=\"1px\" ol_text_shadow_horizontal_length=\"ol_text_shadow_style,%91object Object%93\" ol_text_shadow_horizontal_length_tablet=\"0px\" ol_text_shadow_vertical_length=\"ol_text_shadow_style,%91object Object%93\" ol_text_shadow_vertical_length_tablet=\"0px\" ol_text_shadow_blur_strength=\"ol_text_shadow_style,%91object Object%93\" ol_text_shadow_blur_strength_tablet=\"1px\" quote_text_shadow_horizontal_length=\"quote_text_shadow_style,%91object Object%93\" quote_text_shadow_horizontal_length_tablet=\"0px\" quote_text_shadow_vertical_length=\"quote_text_shadow_style,%91object Object%93\" quote_text_shadow_vertical_length_tablet=\"0px\" quote_text_shadow_blur_strength=\"quote_text_shadow_style,%91object Object%93\" quote_text_shadow_blur_strength_tablet=\"1px\" header_text_shadow_horizontal_length=\"header_text_shadow_style,%91object Object%93\" header_text_shadow_horizontal_length_tablet=\"0px\" header_text_shadow_vertical_length=\"header_text_shadow_style,%91object Object%93\" header_text_shadow_vertical_length_tablet=\"0px\" header_text_shadow_blur_strength=\"header_text_shadow_style,%91object Object%93\" header_text_shadow_blur_strength_tablet=\"1px\" header_2_text_shadow_horizontal_length=\"header_2_text_shadow_style,%91object Object%93\" header_2_text_shadow_horizontal_length_tablet=\"0px\" header_2_text_shadow_vertical_length=\"header_2_text_shadow_style,%91object Object%93\" header_2_text_shadow_vertical_length_tablet=\"0px\" header_2_text_shadow_blur_strength=\"header_2_text_shadow_style,%91object Object%93\" header_2_text_shadow_blur_strength_tablet=\"1px\" header_3_text_shadow_horizontal_length=\"header_3_text_shadow_style,%91object Object%93\" header_3_text_shadow_horizontal_length_tablet=\"0px\" header_3_text_shadow_vertical_length=\"header_3_text_shadow_style,%91object Object%93\" header_3_text_shadow_vertical_length_tablet=\"0px\" header_3_text_shadow_blur_strength=\"header_3_text_shadow_style,%91object Object%93\" header_3_text_shadow_blur_strength_tablet=\"1px\" header_4_text_shadow_horizontal_length=\"header_4_text_shadow_style,%91object Object%93\" header_4_text_shadow_horizontal_length_tablet=\"0px\" header_4_text_shadow_vertical_length=\"header_4_text_shadow_style,%91object Object%93\" header_4_text_shadow_vertical_length_tablet=\"0px\" header_4_text_shadow_blur_strength=\"header_4_text_shadow_style,%91object Object%93\" header_4_text_shadow_blur_strength_tablet=\"1px\" header_5_text_shadow_horizontal_length=\"header_5_text_shadow_style,%91object Object%93\" header_5_text_shadow_horizontal_length_tablet=\"0px\" header_5_text_shadow_vertical_length=\"header_5_text_shadow_style,%91object Object%93\" header_5_text_shadow_vertical_length_tablet=\"0px\" header_5_text_shadow_blur_strength=\"header_5_text_shadow_style,%91object Object%93\" header_5_text_shadow_blur_strength_tablet=\"1px\" header_6_text_shadow_horizontal_length=\"header_6_text_shadow_style,%91object Object%93\" header_6_text_shadow_horizontal_length_tablet=\"0px\" header_6_text_shadow_vertical_length=\"header_6_text_shadow_style,%91object Object%93\" header_6_text_shadow_vertical_length_tablet=\"0px\" header_6_text_shadow_blur_strength=\"header_6_text_shadow_style,%91object Object%93\" header_6_text_shadow_blur_strength_tablet=\"1px\" box_shadow_horizontal_tablet=\"0px\" box_shadow_vertical_tablet=\"0px\" box_shadow_blur_tablet=\"40px\" box_shadow_spread_tablet=\"0px\" vertical_offset_tablet=\"0\" horizontal_offset_tablet=\"0\" z_index_tablet=\"0\"]\r\n\r\nAC.2.005: Provide privacy and security notices consistent with applicable CUI rules.\r\n\r\n[\/et_pb_text][et_pb_text _builder_version=\"4.2.2\" text_text_shadow_horizontal_length=\"text_text_shadow_style,%91object Object%93\" text_text_shadow_horizontal_length_tablet=\"0px\" text_text_shadow_vertical_length=\"text_text_shadow_style,%91object Object%93\" text_text_shadow_vertical_length_tablet=\"0px\" text_text_shadow_blur_strength=\"text_text_shadow_style,%91object Object%93\" text_text_shadow_blur_strength_tablet=\"1px\" link_text_shadow_horizontal_length=\"link_text_shadow_style,%91object Object%93\" link_text_shadow_horizontal_length_tablet=\"0px\" link_text_shadow_vertical_length=\"link_text_shadow_style,%91object Object%93\" link_text_shadow_vertical_length_tablet=\"0px\" link_text_shadow_blur_strength=\"link_text_shadow_style,%91object Object%93\" link_text_shadow_blur_strength_tablet=\"1px\" ul_text_shadow_horizontal_length=\"ul_text_shadow_style,%91object Object%93\" ul_text_shadow_horizontal_length_tablet=\"0px\" ul_text_shadow_vertical_length=\"ul_text_shadow_style,%91object Object%93\" ul_text_shadow_vertical_length_tablet=\"0px\" ul_text_shadow_blur_strength=\"ul_text_shadow_style,%91object Object%93\" ul_text_shadow_blur_strength_tablet=\"1px\" ol_text_shadow_horizontal_length=\"ol_text_shadow_style,%91object Object%93\" ol_text_shadow_horizontal_length_tablet=\"0px\" ol_text_shadow_vertical_length=\"ol_text_shadow_style,%91object Object%93\" ol_text_shadow_vertical_length_tablet=\"0px\" ol_text_shadow_blur_strength=\"ol_text_shadow_style,%91object Object%93\" ol_text_shadow_blur_strength_tablet=\"1px\" quote_text_shadow_horizontal_length=\"quote_text_shadow_style,%91object Object%93\" quote_text_shadow_horizontal_length_tablet=\"0px\" quote_text_shadow_vertical_length=\"quote_text_shadow_style,%91object Object%93\" quote_text_shadow_vertical_length_tablet=\"0px\" quote_text_shadow_blur_strength=\"quote_text_shadow_style,%91object Object%93\" quote_text_shadow_blur_strength_tablet=\"1px\" header_text_shadow_horizontal_length=\"header_text_shadow_style,%91object Object%93\" header_text_shadow_horizontal_length_tablet=\"0px\" header_text_shadow_vertical_length=\"header_text_shadow_style,%91object Object%93\" header_text_shadow_vertical_length_tablet=\"0px\" header_text_shadow_blur_strength=\"header_text_shadow_style,%91object Object%93\" header_text_shadow_blur_strength_tablet=\"1px\" header_2_text_shadow_horizontal_length=\"header_2_text_shadow_style,%91object Object%93\" header_2_text_shadow_horizontal_length_tablet=\"0px\" header_2_text_shadow_vertical_length=\"header_2_text_shadow_style,%91object Object%93\" header_2_text_shadow_vertical_length_tablet=\"0px\" header_2_text_shadow_blur_strength=\"header_2_text_shadow_style,%91object Object%93\" header_2_text_shadow_blur_strength_tablet=\"1px\" header_3_text_shadow_horizontal_length=\"header_3_text_shadow_style,%91object Object%93\" header_3_text_shadow_horizontal_length_tablet=\"0px\" header_3_text_shadow_vertical_length=\"header_3_text_shadow_style,%91object Object%93\" header_3_text_shadow_vertical_length_tablet=\"0px\" header_3_text_shadow_blur_strength=\"header_3_text_shadow_style,%91object Object%93\" header_3_text_shadow_blur_strength_tablet=\"1px\" header_4_text_shadow_horizontal_length=\"header_4_text_shadow_style,%91object Object%93\" header_4_text_shadow_horizontal_length_tablet=\"0px\" header_4_text_shadow_vertical_length=\"header_4_text_shadow_style,%91object Object%93\" header_4_text_shadow_vertical_length_tablet=\"0px\" header_4_text_shadow_blur_strength=\"header_4_text_shadow_style,%91object Object%93\" header_4_text_shadow_blur_strength_tablet=\"1px\" header_5_text_shadow_horizontal_length=\"header_5_text_shadow_style,%91object Object%93\" header_5_text_shadow_horizontal_length_tablet=\"0px\" header_5_text_shadow_vertical_length=\"header_5_text_shadow_style,%91object Object%93\" header_5_text_shadow_vertical_length_tablet=\"0px\" header_5_text_shadow_blur_strength=\"header_5_text_shadow_style,%91object Object%93\" header_5_text_shadow_blur_strength_tablet=\"1px\" header_6_text_shadow_horizontal_length=\"header_6_text_shadow_style,%91object Object%93\" header_6_text_shadow_horizontal_length_tablet=\"0px\" header_6_text_shadow_vertical_length=\"header_6_text_shadow_style,%91object Object%93\" header_6_text_shadow_vertical_length_tablet=\"0px\" header_6_text_shadow_blur_strength=\"header_6_text_shadow_style,%91object Object%93\" header_6_text_shadow_blur_strength_tablet=\"1px\" box_shadow_horizontal_tablet=\"0px\" box_shadow_vertical_tablet=\"0px\" box_shadow_blur_tablet=\"40px\" box_shadow_spread_tablet=\"0px\" vertical_offset_tablet=\"0\" horizontal_offset_tablet=\"0\" z_index_tablet=\"0\"]\r\n\r\n<a href=\"https:\/\/ndisac.org\/dibscc\/links\/cloudfaq19\/microsoft-azure-security-fundamentals\/\">Microsoft \u2013 Azure Security Fundamentals<\/a><a href=\"https:\/\/ndisac.org\/dibscc\/links\/regulations\/uk-ministry-of-defences-mod-defcon-658-cyber\/\">UK Ministry of Defence\u2019s (MOD) DEFCON 658 (Cyber)<\/a><a href=\"https:\/\/ndisac.org\/dibscc\/links\/ir-exercises-implementation\/mitre-cyber-exercise-playbook\/\">MITRE \u2013 Cyber Exercise Playbook<\/a>\r\n\r\n[\/et_pb_text][et_pb_divider _builder_version=\"4.2.2\" box_shadow_horizontal_tablet=\"0px\" box_shadow_vertical_tablet=\"0px\" box_shadow_blur_tablet=\"40px\" box_shadow_spread_tablet=\"0px\" vertical_offset_tablet=\"0\" horizontal_offset_tablet=\"0\" z_index_tablet=\"0\" \/][et_pb_testimonial _builder_version=\"4.2.2\" quote_icon_background_color=\"#f5f5f5\" box_shadow_horizontal_image_tablet=\"0px\" box_shadow_vertical_image_tablet=\"0px\" box_shadow_blur_image_tablet=\"40px\" box_shadow_spread_image_tablet=\"0px\" text_shadow_horizontal_length=\"text_shadow_style,%91object Object%93\" text_shadow_horizontal_length_tablet=\"0px\" text_shadow_vertical_length=\"text_shadow_style,%91object Object%93\" text_shadow_vertical_length_tablet=\"0px\" text_shadow_blur_strength=\"text_shadow_style,%91object Object%93\" text_shadow_blur_strength_tablet=\"1px\" body_link_text_shadow_horizontal_length=\"body_link_text_shadow_style,%91object Object%93\" body_link_text_shadow_horizontal_length_tablet=\"0px\" body_link_text_shadow_vertical_length=\"body_link_text_shadow_style,%91object Object%93\" body_link_text_shadow_vertical_length_tablet=\"0px\" body_link_text_shadow_blur_strength=\"body_link_text_shadow_style,%91object Object%93\" body_link_text_shadow_blur_strength_tablet=\"1px\" body_ul_text_shadow_horizontal_length=\"body_ul_text_shadow_style,%91object Object%93\" body_ul_text_shadow_horizontal_length_tablet=\"0px\" body_ul_text_shadow_vertical_length=\"body_ul_text_shadow_style,%91object Object%93\" body_ul_text_shadow_vertical_length_tablet=\"0px\" body_ul_text_shadow_blur_strength=\"body_ul_text_shadow_style,%91object Object%93\" body_ul_text_shadow_blur_strength_tablet=\"1px\" body_ol_text_shadow_horizontal_length=\"body_ol_text_shadow_style,%91object Object%93\" body_ol_text_shadow_horizontal_length_tablet=\"0px\" body_ol_text_shadow_vertical_length=\"body_ol_text_shadow_style,%91object Object%93\" body_ol_text_shadow_vertical_length_tablet=\"0px\" body_ol_text_shadow_blur_strength=\"body_ol_text_shadow_style,%91object Object%93\" body_ol_text_shadow_blur_strength_tablet=\"1px\" body_quote_text_shadow_horizontal_length=\"body_quote_text_shadow_style,%91object Object%93\" body_quote_text_shadow_horizontal_length_tablet=\"0px\" body_quote_text_shadow_vertical_length=\"body_quote_text_shadow_style,%91object Object%93\" body_quote_text_shadow_vertical_length_tablet=\"0px\" body_quote_text_shadow_blur_strength=\"body_quote_text_shadow_style,%91object Object%93\" body_quote_text_shadow_blur_strength_tablet=\"1px\" author_text_shadow_horizontal_length=\"author_text_shadow_style,%91object Object%93\" author_text_shadow_horizontal_length_tablet=\"0px\" author_text_shadow_vertical_length=\"author_text_shadow_style,%91object Object%93\" author_text_shadow_vertical_length_tablet=\"0px\" author_text_shadow_blur_strength=\"author_text_shadow_style,%91object Object%93\" author_text_shadow_blur_strength_tablet=\"1px\" position_text_shadow_horizontal_length=\"position_text_shadow_style,%91object Object%93\" position_text_shadow_horizontal_length_tablet=\"0px\" position_text_shadow_vertical_length=\"position_text_shadow_style,%91object Object%93\" position_text_shadow_vertical_length_tablet=\"0px\" position_text_shadow_blur_strength=\"position_text_shadow_style,%91object Object%93\" position_text_shadow_blur_strength_tablet=\"1px\" company_text_shadow_horizontal_length=\"company_text_shadow_style,%91object Object%93\" company_text_shadow_horizontal_length_tablet=\"0px\" company_text_shadow_vertical_length=\"company_text_shadow_style,%91object Object%93\" company_text_shadow_vertical_length_tablet=\"0px\" company_text_shadow_blur_strength=\"company_text_shadow_style,%91object Object%93\" company_text_shadow_blur_strength_tablet=\"1px\" box_shadow_horizontal_tablet=\"0px\" box_shadow_vertical_tablet=\"0px\" box_shadow_blur_tablet=\"40px\" box_shadow_spread_tablet=\"0px\" vertical_offset_tablet=\"0\" horizontal_offset_tablet=\"0\" z_index_tablet=\"0\" quote_icon=\"off\"]\r\n\r\nCMMC CLARIFICATION\r\nEvery   system   has   legal   information   about   user   privacy   and   security. A system-use notification banner displays the legal requirements of using the systems.  Users are required to click to agree to the displayed requirements of using the system each time they logon to the machine.  You can use this implicit agreement in the civil and\/or criminal prosecution of an attacker that violates the terms.\r\nDiscuss  legal  notification  requirements  with  your  organization\u2019s  legal  counsel.    This  will  ensure that they meet all applicable requirements.  You should inform the user that:\r\n\u2022 you may monitor, record, and subject to audit any information system usage;\r\n\u2022 you prohibit unauthorized use of the information system;\r\n\u2022 you may subject unauthorized use to criminal and civil penalties; and\r\n\u2022 use of the information system indicates consent to monitoring and recording.\r\n\r\n[\/et_pb_testimonial][\/et_pb_column][\/et_pb_row][\/et_pb_section]","_et_gb_content_width":"","footnotes":""},"categories":[461],"tags":[],"class_list":["post-15435","post","type-post","status-publish","format-standard","hentry","category-level-3"],"yoast_head":"<!-- This site is optimized with the Yoast SEO plugin v24.5 - https:\/\/yoast.com\/wordpress\/plugins\/seo\/ -->\n<title>IR.L3-3.6.2E Cyber Incident Response Team - DIB SCC CyberAssist<\/title>\n<meta name=\"robots\" content=\"index, follow, max-snippet:-1, max-image-preview:large, max-video-preview:-1\" \/>\n<link rel=\"canonical\" href=\"https:\/\/ndisac.org\/dibscc\/cyberassist\/cybersecurity-maturity-model-certification\/level-3\/ir-l3-3-6-2e\/\" \/>\n<meta property=\"og:locale\" content=\"en_US\" \/>\n<meta property=\"og:type\" content=\"article\" \/>\n<meta property=\"og:title\" content=\"IR.L3-3.6.2E Cyber Incident Response Team - DIB SCC CyberAssist\" \/>\n<meta property=\"og:description\" content=\"[et_pb_section fb_built=&#8221;1&#8243; _builder_version=&#8221;3.22&#8243;][et_pb_row _builder_version=&#8221;3.25&#8243; background_size=&#8221;initial&#8221; background_position=&#8221;top_left&#8221; background_repeat=&#8221;repeat&#8221;][et_pb_column type=&#8221;4_4&#8243; _builder_version=&#8221;3.0.47&#8243; custom_padding=&#8221;|||&#8221; custom_padding__hover=&#8221;|||&#8221;][et_pb_text _builder_version=&#8221;4.9.2&#8243; vertical_offset_tablet=&#8221;0&#8243; horizontal_offset_tablet=&#8221;0&#8243; z_index_tablet=&#8221;0&#8243; text_text_shadow_horizontal_length_tablet=&#8221;0px&#8221; text_text_shadow_vertical_length_tablet=&#8221;0px&#8221; text_text_shadow_blur_strength_tablet=&#8221;1px&#8221; link_text_shadow_horizontal_length_tablet=&#8221;0px&#8221; link_text_shadow_vertical_length_tablet=&#8221;0px&#8221; link_text_shadow_blur_strength_tablet=&#8221;1px&#8221; ul_text_shadow_horizontal_length_tablet=&#8221;0px&#8221; ul_text_shadow_vertical_length_tablet=&#8221;0px&#8221; ul_text_shadow_blur_strength_tablet=&#8221;1px&#8221; ol_text_shadow_horizontal_length_tablet=&#8221;0px&#8221; ol_text_shadow_vertical_length_tablet=&#8221;0px&#8221; ol_text_shadow_blur_strength_tablet=&#8221;1px&#8221; quote_text_shadow_horizontal_length_tablet=&#8221;0px&#8221; quote_text_shadow_vertical_length_tablet=&#8221;0px&#8221; quote_text_shadow_blur_strength_tablet=&#8221;1px&#8221; [&hellip;]\" \/>\n<meta property=\"og:url\" content=\"https:\/\/ndisac.org\/dibscc\/cyberassist\/cybersecurity-maturity-model-certification\/level-3\/ir-l3-3-6-2e\/\" \/>\n<meta property=\"og:site_name\" content=\"DIB SCC CyberAssist\" \/>\n<meta property=\"article:published_time\" content=\"2025-01-30T14:31:24+00:00\" \/>\n<meta property=\"article:modified_time\" content=\"2025-03-31T12:22:17+00:00\" \/>\n<meta name=\"author\" content=\"markcarr\" \/>\n<meta name=\"twitter:card\" content=\"summary_large_image\" \/>\n<meta name=\"twitter:label1\" content=\"Written by\" \/>\n\t<meta name=\"twitter:data1\" content=\"markcarr\" \/>\n\t<meta name=\"twitter:label2\" content=\"Est. reading time\" \/>\n\t<meta name=\"twitter:data2\" content=\"5 minutes\" \/>\n<script type=\"application\/ld+json\" class=\"yoast-schema-graph\">{\"@context\":\"https:\/\/schema.org\",\"@graph\":[{\"@type\":\"WebPage\",\"@id\":\"https:\/\/ndisac.org\/dibscc\/cyberassist\/cybersecurity-maturity-model-certification\/level-3\/ir-l3-3-6-2e\/\",\"url\":\"https:\/\/ndisac.org\/dibscc\/cyberassist\/cybersecurity-maturity-model-certification\/level-3\/ir-l3-3-6-2e\/\",\"name\":\"IR.L3-3.6.2E Cyber Incident Response Team - DIB SCC CyberAssist\",\"isPartOf\":{\"@id\":\"https:\/\/ndisac.org\/dibscc\/#website\"},\"datePublished\":\"2025-01-30T14:31:24+00:00\",\"dateModified\":\"2025-03-31T12:22:17+00:00\",\"author\":{\"@id\":\"https:\/\/ndisac.org\/dibscc\/#\/schema\/person\/930af72cb910c130c27675e47ba8e9a0\"},\"breadcrumb\":{\"@id\":\"https:\/\/ndisac.org\/dibscc\/cyberassist\/cybersecurity-maturity-model-certification\/level-3\/ir-l3-3-6-2e\/#breadcrumb\"},\"inLanguage\":\"en-US\",\"potentialAction\":[{\"@type\":\"ReadAction\",\"target\":[\"https:\/\/ndisac.org\/dibscc\/cyberassist\/cybersecurity-maturity-model-certification\/level-3\/ir-l3-3-6-2e\/\"]}]},{\"@type\":\"BreadcrumbList\",\"@id\":\"https:\/\/ndisac.org\/dibscc\/cyberassist\/cybersecurity-maturity-model-certification\/level-3\/ir-l3-3-6-2e\/#breadcrumb\",\"itemListElement\":[{\"@type\":\"ListItem\",\"position\":1,\"name\":\"Home\",\"item\":\"https:\/\/ndisac.org\/dibscc\/\"},{\"@type\":\"ListItem\",\"position\":2,\"name\":\"IR.L3-3.6.2E Cyber Incident Response Team\"}]},{\"@type\":\"WebSite\",\"@id\":\"https:\/\/ndisac.org\/dibscc\/#website\",\"url\":\"https:\/\/ndisac.org\/dibscc\/\",\"name\":\"DIB SCC CyberAssist\",\"description\":\"Cybersecurity Resources for DIB companies and suppliers\",\"potentialAction\":[{\"@type\":\"SearchAction\",\"target\":{\"@type\":\"EntryPoint\",\"urlTemplate\":\"https:\/\/ndisac.org\/dibscc\/?s={search_term_string}\"},\"query-input\":{\"@type\":\"PropertyValueSpecification\",\"valueRequired\":true,\"valueName\":\"search_term_string\"}}],\"inLanguage\":\"en-US\"},{\"@type\":\"Person\",\"@id\":\"https:\/\/ndisac.org\/dibscc\/#\/schema\/person\/930af72cb910c130c27675e47ba8e9a0\",\"name\":\"markcarr\",\"url\":\"https:\/\/ndisac.org\/dibscc\/author\/markcarr\/\"}]}<\/script>\n<!-- \/ Yoast SEO plugin. -->","yoast_head_json":{"title":"IR.L3-3.6.2E Cyber Incident Response Team - DIB SCC CyberAssist","robots":{"index":"index","follow":"follow","max-snippet":"max-snippet:-1","max-image-preview":"max-image-preview:large","max-video-preview":"max-video-preview:-1"},"canonical":"https:\/\/ndisac.org\/dibscc\/cyberassist\/cybersecurity-maturity-model-certification\/level-3\/ir-l3-3-6-2e\/","og_locale":"en_US","og_type":"article","og_title":"IR.L3-3.6.2E Cyber Incident Response Team - DIB SCC CyberAssist","og_description":"[et_pb_section fb_built=&#8221;1&#8243; _builder_version=&#8221;3.22&#8243;][et_pb_row _builder_version=&#8221;3.25&#8243; background_size=&#8221;initial&#8221; background_position=&#8221;top_left&#8221; background_repeat=&#8221;repeat&#8221;][et_pb_column type=&#8221;4_4&#8243; _builder_version=&#8221;3.0.47&#8243; custom_padding=&#8221;|||&#8221; custom_padding__hover=&#8221;|||&#8221;][et_pb_text _builder_version=&#8221;4.9.2&#8243; vertical_offset_tablet=&#8221;0&#8243; horizontal_offset_tablet=&#8221;0&#8243; z_index_tablet=&#8221;0&#8243; text_text_shadow_horizontal_length_tablet=&#8221;0px&#8221; text_text_shadow_vertical_length_tablet=&#8221;0px&#8221; text_text_shadow_blur_strength_tablet=&#8221;1px&#8221; link_text_shadow_horizontal_length_tablet=&#8221;0px&#8221; link_text_shadow_vertical_length_tablet=&#8221;0px&#8221; link_text_shadow_blur_strength_tablet=&#8221;1px&#8221; ul_text_shadow_horizontal_length_tablet=&#8221;0px&#8221; ul_text_shadow_vertical_length_tablet=&#8221;0px&#8221; ul_text_shadow_blur_strength_tablet=&#8221;1px&#8221; ol_text_shadow_horizontal_length_tablet=&#8221;0px&#8221; ol_text_shadow_vertical_length_tablet=&#8221;0px&#8221; ol_text_shadow_blur_strength_tablet=&#8221;1px&#8221; quote_text_shadow_horizontal_length_tablet=&#8221;0px&#8221; quote_text_shadow_vertical_length_tablet=&#8221;0px&#8221; quote_text_shadow_blur_strength_tablet=&#8221;1px&#8221; [&hellip;]","og_url":"https:\/\/ndisac.org\/dibscc\/cyberassist\/cybersecurity-maturity-model-certification\/level-3\/ir-l3-3-6-2e\/","og_site_name":"DIB SCC CyberAssist","article_published_time":"2025-01-30T14:31:24+00:00","article_modified_time":"2025-03-31T12:22:17+00:00","author":"markcarr","twitter_card":"summary_large_image","twitter_misc":{"Written by":"markcarr","Est. reading time":"5 minutes"},"schema":{"@context":"https:\/\/schema.org","@graph":[{"@type":"WebPage","@id":"https:\/\/ndisac.org\/dibscc\/cyberassist\/cybersecurity-maturity-model-certification\/level-3\/ir-l3-3-6-2e\/","url":"https:\/\/ndisac.org\/dibscc\/cyberassist\/cybersecurity-maturity-model-certification\/level-3\/ir-l3-3-6-2e\/","name":"IR.L3-3.6.2E Cyber Incident Response Team - DIB SCC CyberAssist","isPartOf":{"@id":"https:\/\/ndisac.org\/dibscc\/#website"},"datePublished":"2025-01-30T14:31:24+00:00","dateModified":"2025-03-31T12:22:17+00:00","author":{"@id":"https:\/\/ndisac.org\/dibscc\/#\/schema\/person\/930af72cb910c130c27675e47ba8e9a0"},"breadcrumb":{"@id":"https:\/\/ndisac.org\/dibscc\/cyberassist\/cybersecurity-maturity-model-certification\/level-3\/ir-l3-3-6-2e\/#breadcrumb"},"inLanguage":"en-US","potentialAction":[{"@type":"ReadAction","target":["https:\/\/ndisac.org\/dibscc\/cyberassist\/cybersecurity-maturity-model-certification\/level-3\/ir-l3-3-6-2e\/"]}]},{"@type":"BreadcrumbList","@id":"https:\/\/ndisac.org\/dibscc\/cyberassist\/cybersecurity-maturity-model-certification\/level-3\/ir-l3-3-6-2e\/#breadcrumb","itemListElement":[{"@type":"ListItem","position":1,"name":"Home","item":"https:\/\/ndisac.org\/dibscc\/"},{"@type":"ListItem","position":2,"name":"IR.L3-3.6.2E Cyber Incident Response Team"}]},{"@type":"WebSite","@id":"https:\/\/ndisac.org\/dibscc\/#website","url":"https:\/\/ndisac.org\/dibscc\/","name":"DIB SCC CyberAssist","description":"Cybersecurity Resources for DIB companies and suppliers","potentialAction":[{"@type":"SearchAction","target":{"@type":"EntryPoint","urlTemplate":"https:\/\/ndisac.org\/dibscc\/?s={search_term_string}"},"query-input":{"@type":"PropertyValueSpecification","valueRequired":true,"valueName":"search_term_string"}}],"inLanguage":"en-US"},{"@type":"Person","@id":"https:\/\/ndisac.org\/dibscc\/#\/schema\/person\/930af72cb910c130c27675e47ba8e9a0","name":"markcarr","url":"https:\/\/ndisac.org\/dibscc\/author\/markcarr\/"}]}},"rttpg_featured_image_url":null,"rttpg_author":{"display_name":"markcarr","author_link":"https:\/\/ndisac.org\/dibscc\/author\/markcarr\/"},"rttpg_comment":0,"rttpg_category":" <a href=\"https:\/\/ndisac.org\/dibscc\/category\/cyberassist\/cybersecurity-maturity-model-certification\/level-3\/\" rel=\"tag\">Level 3<\/a>","rttpg_excerpt":"[et_pb_section fb_built=&#8221;1&#8243; _builder_version=&#8221;3.22&#8243;][et_pb_row _builder_version=&#8221;3.25&#8243; background_size=&#8221;initial&#8221; background_position=&#8221;top_left&#8221; background_repeat=&#8221;repeat&#8221;][et_pb_column type=&#8221;4_4&#8243; _builder_version=&#8221;3.0.47&#8243; custom_padding=&#8221;|||&#8221; custom_padding__hover=&#8221;|||&#8221;][et_pb_text _builder_version=&#8221;4.9.2&#8243; vertical_offset_tablet=&#8221;0&#8243; horizontal_offset_tablet=&#8221;0&#8243; z_index_tablet=&#8221;0&#8243; text_text_shadow_horizontal_length_tablet=&#8221;0px&#8221; text_text_shadow_vertical_length_tablet=&#8221;0px&#8221; text_text_shadow_blur_strength_tablet=&#8221;1px&#8221; link_text_shadow_horizontal_length_tablet=&#8221;0px&#8221; link_text_shadow_vertical_length_tablet=&#8221;0px&#8221; link_text_shadow_blur_strength_tablet=&#8221;1px&#8221; ul_text_shadow_horizontal_length_tablet=&#8221;0px&#8221; ul_text_shadow_vertical_length_tablet=&#8221;0px&#8221; ul_text_shadow_blur_strength_tablet=&#8221;1px&#8221; ol_text_shadow_horizontal_length_tablet=&#8221;0px&#8221; ol_text_shadow_vertical_length_tablet=&#8221;0px&#8221; ol_text_shadow_blur_strength_tablet=&#8221;1px&#8221; quote_text_shadow_horizontal_length_tablet=&#8221;0px&#8221; quote_text_shadow_vertical_length_tablet=&#8221;0px&#8221; quote_text_shadow_blur_strength_tablet=&#8221;1px&#8221; [&hellip;]","_links":{"self":[{"href":"https:\/\/ndisac.org\/dibscc\/wp-json\/wp\/v2\/posts\/15435"}],"collection":[{"href":"https:\/\/ndisac.org\/dibscc\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/ndisac.org\/dibscc\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/ndisac.org\/dibscc\/wp-json\/wp\/v2\/users\/8"}],"replies":[{"embeddable":true,"href":"https:\/\/ndisac.org\/dibscc\/wp-json\/wp\/v2\/comments?post=15435"}],"version-history":[{"count":5,"href":"https:\/\/ndisac.org\/dibscc\/wp-json\/wp\/v2\/posts\/15435\/revisions"}],"predecessor-version":[{"id":16593,"href":"https:\/\/ndisac.org\/dibscc\/wp-json\/wp\/v2\/posts\/15435\/revisions\/16593"}],"wp:attachment":[{"href":"https:\/\/ndisac.org\/dibscc\/wp-json\/wp\/v2\/media?parent=15435"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/ndisac.org\/dibscc\/wp-json\/wp\/v2\/categories?post=15435"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/ndisac.org\/dibscc\/wp-json\/wp\/v2\/tags?post=15435"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}