Introduction
Losing a DoD contract over a failed CMMC assessment is a real outcome - and incident response (IR) gaps are among the most scrutinized domains C3PAO assessors examine. For contractors handling Controlled Unclassified Information (CUI), a documented, tested, and practiced IR plan isn't a best practice. It's a compliance requirement.
The Verizon 2025 Data Breach Investigations Report analyzed 22,052 security incidents and 12,195 confirmed data breaches, confirming that threats targeting contractors and their supply chains show no signs of slowing. The pressure isn't just technical - it's contractual.
The CMMC Program final rule (32 CFR Part 170) took effect December 16, 2024, with phased enforcement now underway. This guide breaks down the three mandatory IR controls, how to build a compliant plan, and how managed services can close the gap for contractors without dedicated security teams.
Overview
- CMMC Level 2 mandates three IR controls: incident handling (IR.L2-3.6.1), incident reporting (IR.L2-3.6.2), and incident response testing (IR.L2-3.6.3)
- Qualifying cyber incidents must be reported to DoD within 72 hours under DFARS 252.204-7012 via the DC3 portal
- A compliant IR plan requires documented roles, detection procedures, containment steps, post-incident review, and regular testing
- Small businesses don't need a full SOC - clear documentation of your existing process is what assessors evaluate
- Managed security services with 24/7 monitoring deliver detection and response capabilities most small contractors can't build internally
What CMMC Requires for Incident Response - and Why It Matters
CMMC 2.0 establishes a three-level structure that governs how defense contractors protect sensitive information:
- Level 1 (Foundational): Covers basic cyber hygiene; no incident response domain requirements apply
- Level 2 (Advanced): All three IR controls become mandatory for any organization handling CUI, requiring full implementation of the 110 controls in NIST SP 800-171 Rev. 2
- Level 3 (Expert): Adds selected requirements from NIST SP 800-172, applying only to high-priority programs requiring Defense Contract Management Agency (DCMA) DIBCAC assessments
The CMMC incident response domain is based directly on NIST SP 800-171 Section 3.6, and assessors use the NIST SP 800-171A Assessment Guide to evaluate evidence. Documentation, personnel interviews, and testing records all count as proof of compliance. Assessors evaluate each control through three methods:
- Examine: Review policies, plans, and supporting documentation
- Interview: Question personnel to verify awareness and capability
- Test: Verify that controls actually function as described
The business risk here is direct. Organizations that cannot demonstrate incident response capability during a C3PAO assessment may receive a failing score on the IR domain, potentially blocking contract awards or renewals. Having incidents does not fail an assessment - failing to have a process for handling them does. The focus is on preparedness, not perfection.
To understand what assessors are actually measuring, it helps to distinguish the two frameworks. NIST SP 800-171 defines the security practices organizations must implement, while CMMC Level 2 is the certification process that verifies implementation through third-party assessment. CMMC adds the formal accountability mechanism, turning voluntary best practices into contractual requirements enforced through the DoD acquisition system.
The 3 CMMC Incident Response Controls Every Level 2 Contractor Must Implement
IR.L2-3.6.1 - Incident Handling
This control requires organizations to establish an operational incident-handling capability that covers preparation, detection, analysis, containment, recovery, and user response activities. The deliverable is a documented Incident Response Plan (IRP) that reflects how the organization actually operates - not a generic template downloaded from the internet.
Assessors specifically look for:
- A named incident response team or lead (even if it's a single person)
- Defined escalation paths showing who gets notified when incidents occur
- Documented containment and eradication procedures
- Evidence that the plan is actively maintained and updated
A single IT administrator can fulfill multiple roles in small organizations as long as responsibilities are explicitly documented. The key is clarity: assessors need to see that your organization has thought through the incident lifecycle and assigned accountability at each stage.
IR.L2-3.6.2 - Incident Reporting
Contractors must detect security events and route them to the right internal and external authorities. Two distinct reporting obligations apply:
- Internal: Employees need clear channels for escalating unusual activity, backed by awareness training
- External: Incidents affecting CUI must be reported to DoD within 72 hours via DoD-approved reporting channels
SIEM systems and intrusion detection systems (IDS) are the primary technical tools for satisfying this control. They aggregate logs, correlate events, and alert security teams to suspicious activity in real time.
Cybriant's 24/7 Managed SIEM with live monitoring and analysis covers this function for contractors without in-house detection capabilities. Certified security analysts identify anomalies, assess threats, and provide remediation guidance - maintaining the continuous detection posture CMMC assessors expect.
IR.L2-3.6.3 - Incident Response Testing
Testing your incident response capability on a defined schedule is a hard requirement under this control. For small contractors, tabletop exercises are the most accessible method - no specialized tools required, annually conducted, with documented outputs: agenda, participant notes, lessons learned, and plan updates.
Assessors don't expect a flawless exercise. They look for evidence it happened, was documented, and produced improvements. The Cybersecurity and Infrastructure Security Agency (CISA) offers free tabletop exercise packages with ready-made scenarios, objectives, and discussion questions tailored to various threat types.
Testing validates that your team understands their roles and can execute the plan under pressure. Even a simple one-hour tabletop with five participants discussing a phishing scenario satisfies the requirement if properly documented.
How to Build a CMMC-Compliant Incident Response Plan
Step 1 - Define Your Incident Scope
The plan must specify what qualifies as a reportable incident in your organization's specific CUI environment. Common examples include:
- Phishing emails that result in credential compromise
- Unauthorized access attempts or successful logins
- Malware infections and ransomware attacks
- Suspicious data transfers or exfiltration alerts
- Data breaches affecting CUI or Federal Contract Information (FCI)
Be specific about thresholds: at what point does an event become an "incident" requiring formal response? This clarity helps staff recognize when to escalate and avoids confusion during high-pressure situations.
Step 2 - Assign and Document Roles
The plan must name the individuals or roles responsible for:
- Coordinating the overall response effort
- Performing forensic analysis and technical investigation
- Briefing executives on impact and risk
- Submitting DoD reports under DFARS 252.204-7012
- Maintaining the incident log and preserving evidence
Every employee shares one baseline responsibility: report anything suspicious immediately. Your IRP is only as effective as the staff trained to activate it.
Step 3 - Create a Step-by-Step Response Workflow
The workflow should align with NIST SP 800-171's four IR phases: preparation, detection and analysis, containment and eradication, and post-incident activity. Each phase should map to a named owner and a defined output so nothing stalls when things get chaotic.
Core workflow steps:
- Initial report - how the incident is reported (email, phone, ticketing system)
- Severity assessment - determine impact and classify urgency
- Containment actions - isolate affected systems to prevent spread
- Evidence preservation - collect logs and forensic data
- Investigation - analyze root cause and scope
- Eradication - remove malware, close vulnerabilities
- Recovery - restore systems and validate functionality
- Incident closure - document lessons learned and update the plan
Each step should include decision points and responsible parties.
Step 4 - Document Evidence Handling
DFARS 252.204-7012 requires preserving relevant forensic data - logs, endpoint detection and response (EDR) data, authentication records - for at least 90 days after a reportable incident. The plan should describe:
- How logs are collected from each affected system
- Where evidence is stored (and how that storage is secured)
- How chain of custody is documented and maintained
Even a simple manual process works - as long as you follow it consistently and document every step. For example: "IT administrator will collect logs from affected systems, store them on the encrypted backup server, and document collection timestamp and file hashes in the incident log."
Step 5 - Build in Testing and Continuous Improvement
The plan must include a testing schedule (annual at minimum), a mechanism for tracking lessons learned, and a process for updating the IRP after exercises or real incidents.
After each tabletop exercise or real incident, hold a structured debrief to capture what worked and what didn't. Document how changes are approved, then notify all stakeholders once the plan is updated. A plan that never changes is a plan that will eventually fail.
CMMC Incident Reporting Requirements: The 72-Hour Rule Explained
DFARS 252.204-7012 is the governing clause for cyber incident reporting in the DoD supply chain. Any incident affecting the confidentiality, integrity, or availability of CUI triggers the 72-hour reporting requirement. The clock starts when the organization becomes aware of the incident - not when the investigation is complete.
Submitting Reports: The DC3 ICF Portal
Contractors must use the DoD Cyber Crime Center (DC3) Incident Collection Format (ICF) portal at https://icf.dcise.cert.org/ to submit reports. The legacy DIBNet portal has been retired.
Access requires a DoD-Approved Medium Assurance Certificate, such as an External Certificate Authority (ECA) certificate. Obtain this before an incident occurs to avoid delays. Certificate details are available at http://public.cyber.mil/eca.
The following incident types meet the reporting threshold under DFARS 252.204-7012:
- Phishing that results in compromise (not just the email itself)
- Unauthorized logins from unrecognized devices or locations
- Malware and ransomware infections on systems handling CUI
- Data exfiltration alerts indicating information left the network
- Compromised credentials (user accounts or service accounts)
- Denial-of-service attacks affecting CUI system availability
Even suspected incidents should be assessed against reporting thresholds. If you're uncertain whether an event qualifies, consult your incident response lead or legal counsel - it's better to over-report than miss a mandatory notification.
Designating an Authorized Submitter
Designate an authorized individual within your organization who holds the required certificate. Ensure backup personnel are trained and credentialed in case the primary contact is unavailable.
Contractors must also isolate and submit malicious software to DC3 via the Electronic Malware Submission (EMS) portal at https://ems.dc3on.gov.
How Managed Incident Response Services Support CMMC Readiness
Small and mid-sized DoD contractors face a significant challenge: building internal detection, response, and documentation capabilities from scratch is expensive and time-consuming. Many contractors lack a dedicated security team, leaving them reliant on part-time IT staff who may not have the expertise or capacity to maintain CMMC-level incident response capabilities.
A managed incident response service provides:
- Monitors network, endpoint, and cloud environments around the clock
- Alerts your team in real time when suspicious activity is detected
- Walks responders through containment and remediation step by step
- Captures incident logs and forensic data to support documentation requirements
- Delivers security expertise on demand, without the cost of full-time analysts
Cybriant - a SOC 2 Type 2 certified MSSP named to MSSP Alert's Top 250 MSSPs list - provides 24/7 Managed SIEM with live monitoring and analysis. This service directly supports the incident-handling and reporting capabilities required by NIST SP 800-171 controls 3.6.1 (incident handling) and 3.6.2 (incident tracking and reporting), the basis for CMMC practices IR.L2-3.6.1 and IR.L2-3.6.2, and helps contractors maintain the continuous monitoring posture expected under CMMC. Certified security analysts review logs in real time, assess alerts, and coordinate remediation with your IT team so incidents get addressed before they escalate.
One distinction matters here: managed services handle the technical layer, but they cannot substitute for contractor ownership. To pass a C3PAO assessment, your organization must still maintain:
- A documented IR plan with defined roles and escalation paths
- A scheduled testing program (tabletop exercises, at minimum)
- Governance records that demonstrate internal accountability
The division of responsibility is straightforward: the MSSP handles 24/7 monitoring, threat analysis, and technical response. The contractor owns the compliance documentation, internal roles, and testing schedule. Both sides working together is what satisfies assessor requirements - and what actually reduces risk.
Frequently Asked Questions
What are incident response services?
Incident response services cover the processes, tools, and support needed to detect, contain, investigate, and recover from cybersecurity incidents. In the CMMC context, they also include documentation and compliance support to meet the reporting standards required by C3PAO assessments.
What are CMMC Level 2 requirements?
CMMC Level 2 applies to organizations handling CUI and requires full implementation of the 110 controls in NIST SP 800-171 Rev. 2, verified through third-party assessment by a C3PAO. Incident response is one of 14 domains within this framework, covering incident handling, reporting, and testing capabilities.
What is the difference between NIST SP 800-171 and CMMC Level 2?
NIST SP 800-171 is the underlying control framework defining what security practices must be in place, while CMMC Level 2 is the certification program that formally verifies implementation through third-party assessment. CMMC adds the accountability layer to NIST compliance, turning self-attestation into verified certification.
Who is responsible for CMMC compliance?
The prime contractor is ultimately responsible for their own CMMC certification. Subcontractors handling CUI are also independently responsible for their own compliance. Responsibility does not flow down automatically through the supply chain.
How long does it take to get CMMC Level 2?
The timeline depends on an organization's starting security posture, but most contractors should expect 6-18 months to prepare for and complete a Level 2 C3PAO assessment. Much of that time goes toward documentation, gap remediation, policy development, and testing.
Who provides full service CMMC compliance support?
Registered Provider Organizations (RPOs) and MSSPs like Cybriant provide end-to-end CMMC support - from gap assessment and policy documentation to managed detection, monitoring, and incident response. This allows contractors to reach and maintain compliance without building every capability in-house.
