NIST 800 171 Incident Response Plan Template

INSTITUTIONAL INCIDENT RESPONSE PLAN (IRP)

NIST SP 800-171 Rev. 2 Compliance Standard

---

1. PURPOSE & REGULATORY SCOPE

1.1 Purpose

This Incident Response Plan (IRP) establishes the formal operational, technical, and legal protocols for detecting, containing, eradicating, recovering from, and reporting security incidents affecting [Organization Name] systems. This document specifically satisfies the mandates of NIST SP 800-171 Revision 2 (Incident Response Family: 3.6.1, 3.6.2, 3.6.3) and ensures compliance with DFARS 252.204-7012 regarding the handling of Covered Defense Information (CDI) and Controlled Unclassified Information (CUI).

1.2 Scope

This plan applies to:

• All internal and external networks, endpoints, cloud environments, and physical facilities owned, leased, or operated by [Organization Name].
• All employees, contractors, third-party vendors, and managed service providers with access to systems processing, storing, or transmitting CUI.
• Any suspected or confirmed compromise of organizational infrastructure, regardless of classification.

---

2. INCIDENT RESPONSE TEAM (IRT) & ESCALATION MATRIX

2.1 Roles and Responsibilities

The Incident Response Team (IRT) operates on a 24/7/365 readiness model.

2.2 External Reporting Contacts

• DOD Cyber Crime Center (DC3) / DCISE: Via DibNet Portal within 72 hours of discovery.
• Federal Bureau of Investigation (FBI) Cyber Division: Local Field Office: [Location / Phone].
• Cybersecurity and Infrastructure Security Agency (CISA): Report via Central Reporting Portal or 1-888-282-0870.

---

3. NIST SP 800-171 CONTROL MAPPING

This IRP directly implements the requirements set forth in NIST SP 800-171 Rev. 2:

• 3.6.1 (Preparation & Testing): Operationalized via Section 4 (Lifecycle Phases) and Section 7 (Testing & Training).
• 3.6.2 (Handling & Tracking): Operationalized via Section 5 (Ticketing, Chain of Custody, and Evidence Handling).
• 3.6.3 (Reporting): Operationalized via Section 6 (Mandatory Regulatory and Customer Notification Timelines).

---

4. INCIDENT RESPONSE LIFECYCLE (NIST SP 800-61 / 800-171 ALIGNED)

[ Preparation ] ---> [ Detection & Analysis ] ---> [ Containment, Eradication, Recovery ] ---> [ Post-Incident Activity ]

Phase 1: Preparation (NIST 3.6.1)

• Maintain continuous log monitoring, SIEM integration, and Endpoint Detection & Response (EDR) agents across all assets housing CUI.
• Conduct semi-annual table-top exercises and full-scale operational simulations.
• Maintain up-to-date asset inventories and network topology diagrams.

Phase 2: Detection & Analysis

• Triage: Security Operations Center (SOC) identifies anomalous indicators of compromise (IoCs) or behavioral alerts.
• Validation: Determine if the alert represents a legitimate security incident or a false positive.
• Scoring: Classify severity using the following matrix:

Phase 3: Containment, Eradication, and Recovery

• Containment (Short & Long-term): Isolate affected hosts from the network (network cable disconnect, software-defined quarantine via EDR) to prevent lateral spread without destroying volatile evidence (RAM).
• Eradication: Remove malware binaries, close exploited vulnerability vectors, reset compromised credentials, and patch software flaws.
• Recovery: Restore systems from verified, clean, offline backups. Validate system integrity through vulnerability scanning and behavioral monitoring before returning assets to production.

Phase 4: Post-Incident Activity (Lessons Learned)

• Conduct a mandatory Post-Incident Review (PIR) meeting within five (5) business days of incident closure.
• Complete the Incident Root Cause Analysis (RCA) report.
• Update control baselines, firewall rules, and detection signatures to prevent recurrence.

---

5. EVIDENCE HANDLING & CHAIN OF CUSTODY

To ensure admissibility in legal proceedings and compliance with regulatory audits, all digital evidence must be handled meticulously.

5.1 Chain of Custody Protocol

1. Collection: Only authorized forensic investigators shall capture volatile memory (RAM), disk images, and system logs.
2. Hashing: Cryptographic hashes (SHA-256) must be generated immediately upon acquisition of digital media to verify data integrity.
3. Documentation: Every transfer of physical or digital evidence must be logged in the Evidence Tracking Log:

---

6. MANDATORY REPORTING & COMPLIANCE TIMELINES

6.1 DFARS 252.204-7012 Compliance

If an incident involves a cyber incident that affects a DoD network, system, or CUI residing on contractor systems:

1. 72-Hour Rule: Discover and report the incident to the DoD via https://dibnet.dod.mil within 72 hours of discovery.
2. Medium/High Attribution: Provide the DCN (Defense Cyber Crime Center) access to affected systems if requested.
3. Prime Contractor Notification: If operating as a subcontractor, immediately notify the prime contractor per contractual flow-down obligations.

6.2 Customer & Data Owner Notification

• Notify internal stakeholders, Legal Counsel, and impacted external clients/government program managers in accordance with contract-specific SLAs (typically not to exceed 24 to 48 hours).

---

7. PLAN MAINTENANCE, TESTING, AND TRAINING

7.1 Testing Schedule

• Tabletop Exercises: Conducted semi-annually with executive leadership, IT, legal, and operational staff.
• Technical Red Team / Penetration Testing: Conducted annually by an independent third party to validate detection and response capabilities.

7.2 Plan Review

This IRP must be reviewed, updated, and re-approved by the CISO and Executive Leadership at least annually, or immediately following any major infrastructure overhaul, organizational restructure, or significant security incident.

---

8. DOCUMENT REVISION HISTORY