IR-3 Incident Response Testing

Guidance: draftPolicy clause: draftWhat these mean

Baselines	Implementation level	Enhancements
Moderate, High, Privacy	Organization	3 (1 in a baseline)

Related controls: CP-3, CP-4, IR-2, IR-4, IR-8, PM-14

Control statement

Test the effectiveness of the incident response capability for the system [Assignment: organization-defined frequency] using the following tests: [Assignment: organization-defined tests].

NIST discussion

Organizations test incident response capabilities to determine their effectiveness and identify potential weaknesses or deficiencies. Incident response testing includes the use of checklists, walk-through or tabletop exercises, and simulations (parallel or full interrupt). Incident response testing can include a determination of the effects on organizational operations and assets and individuals due to incident response. The use of qualitative and quantitative data aids in determining the effectiveness of incident response processes.

Control enhancements

IR-3(1) Automated Testing

Baselines: Not in a baseline

Test the incident response capability using [Assignment: organization-defined automated mechanisms].

Discussion and assessment objectives for IR-3(1)

Organizations use automated mechanisms to more thoroughly and effectively test incident response capabilities. This can be accomplished by providing more complete coverage of incident response issues, selecting realistic test scenarios and environments, and stressing the response capability.

Determine if the incident response capability is tested using [Assignment: organization-defined automated mechanisms].

Examine: Incident response policy; contingency planning policy; procedures addressing incident response testing; procedures addressing contingency plan testing; incident response testing documentation; incident response test results; incident response test plan; incident response plan; contingency plan; system security plan; automated mechanisms supporting incident response tests; other relevant documents or records.

Interview: Organizational personnel with incident response testing responsibilities; organizational personnel with information security responsibilities.

Test: Automated mechanisms that more thoroughly and effectively test the incident response capability.

IR-3(2) Coordination with Related Plans

Baselines: Moderate, High

Coordinate incident response testing with organizational elements responsible for related plans.

Discussion and assessment objectives for IR-3(2)

Organizational plans related to incident response testing include business continuity plans, disaster recovery plans, continuity of operations plans, contingency plans, crisis communications plans, critical infrastructure plans, and occupant emergency plans.

Determine if incident response testing is coordinated with organizational elements responsible for related plans.

Examine: Incident response policy; contingency planning policy; procedures addressing incident response testing; incident response testing documentation; incident response plan; business continuity plans; contingency plans; disaster recovery plans; continuity of operations plans; crisis communications plans; critical infrastructure plans; occupant emergency plans; system security plan; privacy plan; other relevant documents or records.

Interview: Organizational personnel with incident response testing responsibilities; organizational personnel with responsibilities for testing organizational plans related to incident response testing; organizational personnel with information security and privacy responsibilities.

IR-3(3) Continuous Improvement

Baselines: Not in a baseline

Use qualitative and quantitative data from testing to:

• (a) Determine the effectiveness of incident response processes;
• (b) Continuously improve incident response processes; and
• (c) Provide incident response measures and metrics that are accurate, consistent, and in a reproducible format.

Discussion and assessment objectives for IR-3(3)

To help incident response activities function as intended, organizations may use metrics and evaluation criteria to assess incident response programs as part of an effort to continually improve response performance. These efforts facilitate improvement in incident response efficacy and lessen the impact of incidents.

Determine if:

• IR-03(03)(a)
  • IR-03(03)(a)[01] qualitative data from testing are used to determine the effectiveness of incident response processes;
  • IR-03(03)(a)[02] quantitative data from testing are used to determine the effectiveness of incident response processes;
• IR-03(03)(b)
  • IR-03(03)(b)[01] qualitative data from testing are used to continuously improve incident response processes;
  • IR-03(03)(b)[02] quantitative data from testing are used to continuously improve incident response processes;
• IR-03(03)(c)
  • IR-03(03)(c)[01] qualitative data from testing are used to provide incident response measures and metrics that are accurate;
  • IR-03(03)(c)[02] quantitative data from testing are used to provide incident response measures and metrics that are accurate;
  • IR-03(03)(c)[03] qualitative data from testing are used to provide incident response measures and metrics that are consistent;
  • IR-03(03)(c)[04] quantitative data from testing are used to provide incident response measures and metrics that are consistent;
  • IR-03(03)(c)[05] qualitative data from testing are used to provide incident response measures and metrics in a reproducible format;
  • IR-03(03)(c)[06] quantitative data from testing are used to provide incident response measures and metrics in a reproducible format.

Examine: Incident response policy; contingency planning policy; procedures addressing incident response testing; incident response testing documentation; incident response plan; business continuity plans; contingency plans; disaster recovery plans; continuity of operations plans; crisis communications plans; critical infrastructure plans; occupant emergency plans; system security plan; privacy plan; other relevant documents or records.

Interview: Organizational personnel with incident response testing responsibilities; organizational personnel with responsibilities for testing organizational plans related to incident response testing; organizational personnel with information security and privacy responsibilities.

Assessment objectives (SP 800-53A)

Objectives and methods for IR-3

Determine if the effectiveness of the incident response capability for the system is tested [Assignment: organization-defined frequency] using [Assignment: organization-defined tests].

Examine: Incident response policy; contingency planning policy; procedures addressing incident response testing; procedures addressing contingency plan testing; incident response testing material; incident response test results; incident response test plan; incident response plan; contingency plan; system security plan; privacy plan; other relevant documents or records.

Interview: Organizational personnel with incident response testing responsibilities; organizational personnel with information security and privacy responsibilities.

Policy statement

• The Incident response team shall test the effectiveness of the incident response capability for the system Fill in: frequency at which to test the effectiveness of the incident response capability for the system Typical: annually using Fill in: tests used to test the effectiveness of the incident response capability for the system Typical: a tabletop exercise based on a realistic scenario, and a functional test of notification and escalation. (IR-3)

IR-3(2) Coordination with related plans

• The Incident response team shall coordinate incident response testing with the organizational elements responsible for related plans, such as contingency, continuity and crisis communications plans. (IR-3(2))

From the Incident Response Policy template (draft). Highlighted fields are values your organization sets.

How to apply it

IR-3 asks you to test how well the incident response capability works, at a set frequency and with tests you name. NIST’s IR-3 discussion lists checklists, walk-through or tabletop exercises, and simulations, and says qualitative and quantitative data help show whether the processes work. IR-3 is in the Moderate, High and Privacy baselines, not in Low.

NIST SP 800-84, Guide to Test, Training, and Exercise Programs for IT Plans and Capabilities (September 2006; current as of October 2026), describes the two kinds of exercise most programs use. A tabletop exercise is discussion-based: a facilitator presents a scenario and asks questions about roles, coordination and decisions. A functional exercise has personnel perform their duties in a simulated environment, for example communications or emergency notifications. NIST SP 800-61 Rev. 3 (April 2025; current as of October 2026) treats exercises as a source of improvements (CSF subcategory ID.IM-02, including exercises done with suppliers and other third parties) and points to SP 800-84 for how to run them.

Common implementations. Each year, a tabletop exercise built on a scenario the organization is likely to face, such as ransomware, a compromised administrator account or a cloud service outage caused by an attack. A functional test of notification and escalation checks the path from report to declaration: a test report goes in through the normal channel, and the team times each call, page and message against the plan. Results are written up in an after-action report, and each action goes to an owner with a due date.

SP 800-84 (section 4.2.2) has senior-level and operational teams exercise separately at first, then together to check coordination between them. Section 4.5 puts the debrief comments and lessons learned in an after-action report, with recommendations for updating the plan. Section 4.3 lists the documents a tabletop exercise usually needs: a briefing, a facilitator guide, a participant guide and an after-action report. The tabletop exercise kit holds all four in one template, with objectives and evaluation criteria set in advance, three incident scenarios with injects and facilitator questions (ransomware, a compromised administrator account, and a breach of personally identifiable information), and an after-action report whose actions feed the plan, the incident handling playbook and training. For ready-made scenarios and materials, CISA’s free Tabletop Exercise Packages (more than 100 as of October 2026) each include objectives, a scenario, discussion questions, a participant feedback form and an after-action report template. Their cyber scenarios include ransomware, insider threat, phishing and industrial control system compromise, with sector sets. Use one as the scenario in the kit, and keep the kit’s objectives and after-action report so the results connect back to the plan. For the functional test of notification and escalation, send a test report through the incident report form and time each step against the plan.

Organization-defined parameters. Typical values, from the Incident Response policy, which your organization may set differently:

Parameter	Typical value
Test frequency	Annually
Tests used	A tabletop exercise based on a realistic scenario, and a functional test of notification and escalation

IR-3(2) has no parameters. In the policy, the incident response team runs the tests. The annual frequency matches the contingency plan test in the Contingency Planning policy (CP-4), which makes a joint exercise easy to schedule.

Evidence assessors ask for.

• The test plan or exercise materials for the last test: scenario, objectives, participants and injects
• The after-action report, with what worked, what did not, and the recommended changes
• The action items from the report, tracked to closure, and the plan, playbook or training changes they produced
• Records showing the test met the stated frequency
• For IR-3(2), evidence that the owners of related plans took part or reviewed the scenario, such as attendance lists or a joint after-action report

Inheritance. Testing is usually a common control, run by the incident response team for the organization’s capability as a whole. The system owner makes sure the system’s own playbook steps and contacts are exercised from time to time, for example by choosing the system for a scenario. Record the split in the system security plan.

Common findings.

• A tabletop exercise held, but no after-action report or no action taken on its findings.
• The same scenario every year, or one that never reaches a decision about notifying outside parties.
• Contact lists and escalation paths never tested, so the first real incident finds wrong phone numbers.
• Incident response tests and contingency plan tests run by different teams that never involve each other.

Enhancements in the Moderate baseline. IR-3(2) coordination with related plans: coordinate incident response testing with the people responsible for related plans. NIST’s discussion lists business continuity, disaster recovery, continuity of operations, contingency, crisis communications, critical infrastructure and occupant emergency plans. The policy names contingency, continuity and crisis communications plans as examples. SP 800-61 Rev. 3 recommends synchronizing business continuity plans with incident response plans (ID.IM-04). A practical way to meet IR-3(2) is to run the incident response tabletop and the contingency plan test (CP-4) as one exercise, with a scenario that moves from containment into recovery under the contingency plan. The tabletop exercise kit’s ransomware scenario does this, and its section A.1 records the related plans and their teams.

High adds nothing beyond IR-3(2). IR-3(1) automated testing and IR-3(3) continuous improvement are in no baseline.

Artifacts

• Incident Response Decision Worksheet
• Incident Response Plan
• Incident Response Policy
• Tabletop Exercise Kit