Skip to main content
govconCyber — Federal Cybersecurity Law Reference
Back to results
NIST 800-171 R-3.6.3

Test Incident Response

Official citation: 3.6.3

Class: core · Severity: medium

Statement of the obligation — verify against source

3.6.3

What it means

Test your incident-response capability to confirm it works and to find weaknesses — using checklists, walk-through or tabletop exercises, simulations, or full exercises. Testing can also gauge the impact of incident response on your operations, assets, and people.

Educational reference only — not legal advice. Consult a qualified assessor or attorney for binding compliance determinations.