NIST 800-53 REV 5 • INCIDENT RESPONSE
IR-3(1) — Automated Testing
Test the incident response capability using {{ insert: param, ir-03.01_odp }}.
CMMC Practice Mapping
No direct CMMC mapping
NIST 800-171 Mapping
No direct NIST 800-171 mapping
Related Controls
No related controls listed
Supplemental Guidance
Organizations use automated mechanisms to more thoroughly and effectively test incident response capabilities. This can be accomplished by providing more complete coverage of incident response issues, selecting realistic test scenarios and environments, and stressing the response capability.
Practitioner Notes
This enhancement requires automated mechanisms to support your incident response testing. Instead of purely manual tabletop exercises, you use tools that automatically generate test scenarios or simulate attacks.
Example 1: Deploy a breach and attack simulation (BAS) tool like AttackIQ, SafeBreach, or Picus Security. Schedule automated attack simulations monthly that test your SIEM detection rules and endpoint response capabilities.
Example 2: Use Atomic Red Team scripts to automatically execute MITRE ATT&CK techniques on test systems. Compare the alerts generated in your SIEM (Splunk, Sentinel, or Elastic) against what should have been detected. Track detection coverage percentage over time.