CMMC Level 2: Incident Response & Security Training

Incident Response and Security Awareness Training round out the CMMC Level 2 requirements. These 8 practices ensure your organization can detect, respond to, and recover from security incidents while maintaining a security-aware workforce.

Incident Response (IR) - 5 Practices

Incident Response from NIST SP 800-171 section 3.6 ensures you can effectively handle security incidents. No security program prevents all breaches. What matters is how quickly you detect, contain, and recover from them.

Incident Response Capability (3.6.1)

3.6.1: Establish an operational incident-handling capability for organizational systems that includes preparation, detection, analysis, containment, recovery, and user response activities.

Building your incident response capability:

• Preparation: Document procedures, train staff, prepare tools
• Detection: Monitor for indicators of compromise (IoCs)
• Analysis: Determine scope, impact, and root cause
• Containment: Limit damage and prevent spread
• Eradication: Remove the threat from your environment
• Recovery: Restore systems to normal operation
• Lessons learned: Improve defenses based on incidents

Incident Tracking and Reporting (3.6.2)

3.6.2: Track, document, and report incidents to designated officials and/or authorities both internal and external to the organization.

Implementation guidance:

• Use a ticketing system to track all security incidents
• Document incident timeline, actions taken, and outcomes
• Establish escalation procedures based on severity
• Know your reporting obligations:
  • DFARS 252.204-7012: Report cyber incidents involving CUI to DoD within 72 hours
  • Report to DIBNet portal at dibnet.dod.mil
  • Preserve images of affected systems for 90 days
• Maintain incident records for post-incident analysis

Incident Response Testing (3.6.3)

3.6.3: Test the organizational incident response capability.

Testing methods:

• Tabletop exercises: Walk through scenarios with key personnel discussing responses (recommended annually)
• Functional exercises: Actually execute portions of the plan in a simulated environment
• Full-scale exercises: Complete simulation of a major incident
• Red team exercises: Authorized penetration testing to test detection and response

After testing:

• Document lessons learned
• Update the incident response plan based on findings
• Address identified gaps in procedures or capabilities
• Retrain staff on updated procedures

Incident Response Plan Example Structure

Your Incident Response Plan should include:

1. Purpose and scope: What the plan covers
2. Incident response team: Roles, responsibilities, contact info
3. Incident classification: How to categorize incidents by severity
4. Detection procedures: How incidents are identified
5. Response procedures: Step-by-step actions for common incident types
6. Containment strategies: How to limit damage
7. Evidence preservation: How to maintain forensic integrity
8. Communication procedures: Who to notify, when, and how
9. Recovery procedures: How to restore normal operations
10. Post-incident activities: Lessons learned, report writing
11. External reporting requirements: DoD, law enforcement, customers

Awareness and Training (AT) - 3 Practices

Awareness and Training from NIST 800-171 section 3.2 recognizes that people are both the greatest security risk and the strongest defense. Well-trained employees are your first line of defense against social engineering, phishing, and other human-targeted attacks.

Security Awareness Training (3.2.1)

3.2.1: Ensure that managers, systems administrators, and users of organizational systems are made aware of the security risks associated with their activities and of the applicable policies, standards, and procedures related to the security of those systems.

Training content should cover:

• What is CUI and why it must be protected
• Recognizing phishing emails and social engineering
• Password security and multi-factor authentication
• Safe web browsing practices
• Physical security (tailgating, clean desk policy)
• Removable media risks
• Mobile device security
• Incident reporting procedures
• Acceptable use policy requirements
• Consequences of security violations

Training delivery:

• Provide training during onboarding for new employees
• Conduct annual refresher training for all staff
• Use varied formats: videos, interactive modules, in-person sessions
• Send periodic security awareness reminders (newsletters, tips)
• Conduct simulated phishing exercises to reinforce training

Role-Based Training (3.2.2)

3.2.2: Ensure that personnel are trained to carry out their assigned information security-related duties and responsibilities.

Role-specific training examples:

• System administrators: Secure configuration, patch management, log review
• Developers: Secure coding practices, OWASP Top 10
• Help desk: Social engineering awareness, password reset procedures
• Executives: Business email compromise, wire fraud awareness
• HR: Personnel security, insider threat indicators
• Incident responders: Forensics, evidence handling, containment procedures
• Security staff: Threat intelligence, vulnerability management, compliance requirements

Insider Threat Awareness (3.2.3)

3.2.3: Provide security awareness training on recognizing and reporting potential indicators of insider threat.

Insider threat indicators to train on:

• Unexplained affluence or financial difficulties
• Disgruntlement, conflicts with management
• Unusual interest in sensitive information outside job scope
• Working unusual hours without explanation
• Attempting to bypass security controls
• Unauthorized copying of large amounts of data
• Discussing resignation while increasing data access
• Unwillingness to take vacations (hiding ongoing activity)

Establish reporting mechanisms:

• Clear procedures for reporting concerns
• Anonymous reporting options
• Non-retaliation policy for good-faith reports
• Management training on handling reports appropriately

Evidence for Assessment

Prepare the following for your C3PAO assessment:

• Incident Response Plan (current, approved)
• Incident response team roster with contact information
• Incident tracking system and sample tickets
• Tabletop exercise documentation and after-action reports
• Evidence of incident response testing (dates, participants, findings)
• Security awareness training materials
• Training completion records for all employees
• Role-based training curriculum
• Insider threat training materials
• Phishing simulation results
• Training policy and procedures

Key Takeaways

• Have a written, tested Incident Response Plan ready before you need it
• Know your DoD reporting obligations: 72 hours for CUI incidents
• Test your incident response capability at least annually
• Train all employees on security awareness during onboarding and annually
• Provide role-specific training for technical staff
• Build a culture where employees feel comfortable reporting security concerns

Series Complete: Your CMMC Journey

You've completed the full CMMC series. You now have a solid understanding of all 110 Level 2 practices across 14 domains. Here's what we covered:

Next Steps for Your Organization

1. Determine your required level: Do you handle FCI (Level 1) or CUI (Level 2)?
2. Conduct a gap assessment: Compare your current practices against requirements
3. Build your SSP: Document how you implement each practice
4. Create your POA&M: Track remediation of identified gaps
5. Implement missing controls: Prioritize based on risk and timeline
6. Prepare evidence: Gather documentation for each practice
7. Schedule assessment: When ready, engage a C3PAO for Level 2 certification

Get Started with Pretorin

CMMC compliance is complex, but you don't have to do it alone. Pretorin's AI-powered platform helps defense contractors:

• Automate gap assessments across all 110 practices
• Generate assessment-ready SSP and POA&M documentation
• Track implementation progress with visual dashboards
• Map existing controls to CMMC requirements
• Prepare evidence packages for C3PAO assessments
• Maintain continuous compliance monitoring

Ready to simplify your CMMC journey? Get early access to Pretorin and transform how you approach defense contractor cybersecurity compliance.