A plan nobody has exercised is a guess. IR-3 requires you to test the effectiveness of your incident response capability for the system, using tests you define, at a frequency you define.
800-53 binds US federal systems and anyone held to it by contract. Others can use it as a reference. Auditors for other frameworks usually ask for the same artifact: a record of a tabletop.
What it means in practice
NIST lists the test types: checklists, walk through or tabletop exercises, and simulations, either parallel or full interrupt. Testing can also measure effects on operations, assets and people. Qualitative and quantitative data help judge whether the process worked.
For a small team, a two hour tabletop twice a year is a defensible start. Pick a scenario drawn from reality, such as a leaked credential or a compromised dependency, and walk it from detection to closure.
Evidence to collect
- The test plan: scenario, scope, participants, success criteria.
- The attendee list and the date.
- Notes on what happened and where the process stalled.
- Measurements such as time to declare an incident or time to reach the right owner.
- Action items with owners and due dates, then proof they closed.
Common gaps
Tests that never produce action items. The same three people in every exercise. No link between exercise findings and plan updates.
The enhancements point at maturity: IR-3.1 Automated Testing, IR-3.2 Coordination with Related Plans and IR-3.3 Continuous Improvement. IR-3.2 reminds you to test alongside business continuity and disaster recovery plans where they overlap.
How to implement it
Schedule exercises in advance. Rotate scenarios. Log findings in your tracker and review closure at the next test.
Quick check
Name two test formats listed in the IR-3 guidance.
Checklists and walk through or tabletop exercises, or simulations, which may be parallel or full interrupt.
