October 12, 2026
What Evidence Satisfies Incident Response Requirement 3.6.1?
An assessor asked you to prove your incident response capability, and you do not know which documents count.
NIST is the National Institute of Standards and Technology. IR means Incident Response. CUI means Controlled Unclassified Information.
What the requirement says
NIST SP 800-171 Rev 2 sets requirement 3.6.1 NIST SP 800-171 Rev 2. The requirement text is:
Build an operational incident-handling capability. It must cover six phases: preparation, detection, analysis, containment, recovery, and user response.
The word operational matters. A plan on a shelf is not enough. The capability must exist and be used.
NIST SP 800-171A is the assessment companion to 800-171. It tells assessors to examine policies, procedures, the incident response plan, and plan review records NIST SP 800-171A. It also directs interviews with the people who handle incidents, plus testing of the capability itself. The assessment procedure checks each phase separately: preparation, detection and analysis, containment, eradication, and recovery.
Evidence for each phase
Preparation. Keep an approved incident response plan with a review date. Keep an incident response policy that assigns responsibility. Keep a roster with names, roles, and contact details. Keep training records showing staff know how to report an incident.
Detection and analysis. Keep the tool or procedure that detects incidents, such as alerting from your monitoring. Keep procedures for triaging and analyzing alerts. Keep sample tickets showing alerts were reviewed and analyzed.
Containment. Keep procedures for isolating affected systems from the network. Keep records of past containment actions, with dates and who acted.
Eradication. Keep procedures for removing the cause, such as malware removal or credential resets. Keep records of what was removed and how you confirmed it.
Recovery. Keep procedures for restoring systems to normal operation. Keep records of systems restored, with verification that they were clean before going back online.
User response activities. Keep a documented way for users to report suspected incidents. A security inbox or a ticket form both work. Keep evidence that users know about it, such as awareness training records.
The folder a small company can maintain
/ir-evidence
incident-response-plan.pdf (approved, with review date)
ir-policy.pdf (who is responsible)
team-roster.xlsx (names, roles, contact details)
tickets/ (one ticket per incident, with dates and outcomes)
training-records/ (who trained, when, on what)
exercises/ (tabletop results, with action items)
plan-reviews/ (annual review sign-off)
Run a tabletop exercise at least once a year and file the results in exercises/. Review the plan once a year and file the sign-off in plan-reviews/. Log every incident, even small ones, in tickets/. An empty ticket folder invites questions about whether the capability is real.
Two related requirements sit nearby. Requirement 3.6.2 covers tracking, documenting, and reporting incidents to the right people. Requirement 3.6.3 covers testing the capability. If you hold DoD contracts, DFARS 252.204-7012 adds cyber incident reporting duties on top of 3.6.1 DFARS 252.204-7012.
PolicyCortex reads live Azure configuration and produces SSP, SAR, and POA&M output from the evidence it collects: PolicyCortex.