---
title: "NIST 800-171 3.6 Incident Response"
description: "The 3 NIST SP 800-171 Incident Response requirements (3.6, CMMC IR): text, SPRS points, POA&M rules and evidence."
url: https://policycortex.com/nist-800-171/incident-response
sealed: 2026-11-11
amended: 2026-11-11
register: nist-800-171/incident-response
records: 4
digest: sha3:dc4509e96cab6540f857abcba053e4d5d4aeef6be06d923542436a74bc8ab2c2
---

# NIST 800-171 3.6 Incident Response

NIST 800-171 / Incident Response

Incident Response requires a working capability to handle incidents from preparation to recovery, a record of every incident with reports to the right people, and regular tests of that capability.

3 requirements · up to 11 SPRS points · 1 can go on a CMMC POA&M

## The 3 Incident Response requirements

| Requirement | CMMC practice | SPRS points | Requirement text |
|---|---|---|---|
| [3.6.1 Incident Handling](https://policycortex.com/nist-800-171/incident-response/3.6.1) | IR.L2-3.6.1 | 5 points | Establish an operational incident-handling capability for organizational systems that includes preparation, detection, analysis, containment, recovery, and user response activities. |
| [3.6.2 Incident Reporting](https://policycortex.com/nist-800-171/incident-response/3.6.2) | IR.L2-3.6.2 | 5 points | Track, document, and report incidents to designated officials and/or authorities both internal and external to the organization. |
| [3.6.3 Incident Response Testing](https://policycortex.com/nist-800-171/incident-response/3.6.3) | IR.L2-3.6.3 | 1 point | Test the organizational incident response capability. |

## Incident Response: points and the CMMC POA&M

**Q: How many SPRS points can the Incident Response family cost?**
A: Up to 11 of the 313 points a score can lose: 2 worth 5 points and 1 worth 1.

**Q: Which Incident Response requirements can go on a CMMC POA&M?**
A: 1 of the 3: 3.6.3, worth 1 point. The others are worth more than 1 point, which 32 CFR 170.21(a)(2)(ii) does not admit. The score must also be at least 88.

## Related pages

- **Calculator**: [SPRS score calculator: mark the Incident Response requirements and see what they cost.](https://policycortex.com/sprs-score-calculator#family-IR)
- **Sample package**: [Sample package: an SSP, a POA&M and an evidence chain the product generated from demonstration data.](https://policycortex.com/sample-package)
- **Previous family**: [3.5 Identification and Authentication](https://policycortex.com/nist-800-171/identification-and-authentication)
- **Next family**: [3.7 Maintenance](https://policycortex.com/nist-800-171/maintenance)
- **All requirements**: [All 110 NIST SP 800-171 requirements, by family.](https://policycortex.com/nist-800-171)

Know the family. Keep the evidence for every requirement in it. [Request Access](https://app.policycortex.com/auth?mode=request-access) · [Book a call](https://policycortex.com/book)

## Register colophon

| Seq | Label | SHA3-256 | Prev |
|---|---|---|---|
| REC 0000 | FAMILY | 76998c18510a | 003ca26b2f1e |
| REC 0001 | REQUIREMENTS | 31588312bcab | 76998c18510a |
| REC 0002 | POINTS AND POA&M | 838705773cec | 31588312bcab |
| REC 0003 | RELATED | dc4509e96cab | 838705773cec |

Head sha3:dc4509e96cab6540f857abcba053e4d5d4aeef6be06d923542436a74bc8ab2c2. Each digest is SHA3-256 over the previous digest, the register key, the record label, and the record copy; a second party can recompute it from this document.