Assessment NOTES: A CMMC assessor may want to review, observe, or test the following

·  Organizational policy and Incident Response Plan on handling of incidents involving Federal Contract Information to determine if plan addresses preparation, detection and analysis, containment, eradication, and recovery.

·  Processes for incident response activities.

Ensure that adequate procedures/processes guide the implementation of each area covered in the Incident Response Plan. 

Assessment NOTES: A CMMC assessor may want to review, observe, or test the following

·  Company policy for incident response and reporting that includes the documentation, tracking, and reporting of incidents involving CUI or non-public Federal Contract Information.  

·  Incident reporting records and documentation, incident response plans, and procedures addressing incident reporting to ensure that specific actions are identified for any incident involving CUI or non-public Federal Contract Information.