NIST 800-171 R3 03.06.05 Incident Response Plan at a Glance
- Family: 03.06 Incident Response (IR)
- Requirement ID: 03.06.05 Incident Response Plan
- Assessment Objectives (AOs): Ten (10) determination statements
- Organization-Defined Parameters (ODPs): None (0). This requirement contains no organization-defined values
- Source NIST 800-53 R5 Control: IR-08
- NIST 800-171 R3 Kill Chain Phase: Phase 10, Incident Response (IR)
Incident Response Plan is the documented foundation the rest of the Incident Response (03.06) family points back to. Incident Handling (03.06.01) must be consistent with it, Incident Response Testing (03.06.03) exercises it, and Incident Response Training (03.06.04) teaches it. Incident Response Plan (03.06.05) is effectively new for R3, since the plan was an assumed control in R2 rather than a separately assessed one. It has four (4) parts: develop a plan that covers a defined set of elements, distribute it to the right people, update it as things change, and protect it from unauthorized disclosure. Per the NIST discussion, a coordinated approach is important, mission and business functions shape the structure of the capability, and the plan considers coordination and information sharing with external organizations and supply chain partners.
A common difficulty with this requirement is having a thin plan that names a few contacts but does not cover the required elements. R3 assesses each element separately: the roadmap, the structure, the high-level approach, the definition of reportable incidents, information sharing, and assigned responsibilities. It also assesses distribution, updates, and protection of the plan. A plan that exists but is never distributed, updated, or protected still leaves objectives open.
Where things stand for companies facing the transition from NIST 800-171 R2 to R3:
- The National Institute of Standards and Technology (NIST) withdrew R2 on May 14, 2024, the same day R3 was published. The withdrawal notice states that R2 "has been withdrawn (archived), and is provided solely for historical purposes," so it will never receive another correction or clarification from NIST.
- R2 remains the contractual standard for the Department of Defense (DoD) and the Defense Industrial Base (DIB). Cybersecurity Maturity Model Certification (CMMC) assessments reference it directly: per Title 32 of the Code of Federal Regulations (CFR), section 170.14(c)(3), "the security requirements in CMMC Level 2 are identical to the requirements in NIST SP 800-171 R2."
- The rulemaking points the other direction. The proposed Controlled Unclassified Information (CUI) rule for the Federal Acquisition Regulation (FAR), published June 23, 2026 as part of the Revolutionary FAR Overhaul, would apply CUI safeguarding requirements government wide rather than only to DoD contracts, and it sets the baseline at R3. That rule is not final, and DoD has separately signaled an interim rule to move CMMC to R3.
What Does NIST 800-171 R3 03.06.05 Actually Require?
The following is reproduced verbatim from NIST 800-171 R3, requirement 03.06.05 Incident Response Plan. Only the formatting has been adjusted for readability. This requirement has four (4) lettered parts, and part a has six numbered sub-parts:
- a. Develop an incident response plan that:
- Provides the organization with a roadmap for implementing its incident response capability,
- Describes the structure and organization of the incident response capability,
- Provides a high-level approach for how the incident response capability fits into the overall organization,
- Defines reportable incidents,
- Addresses the sharing of incident information, and
- Designates responsibilities to organizational entities, personnel, or roles.
- b. Distribute copies of the incident response plan to designated incident response personnel (identified by name and/or by role) and organizational elements.
- c. Update the incident response plan to address system and organizational changes or problems encountered during plan implementation, execution, or testing.
- d. Protect the incident response plan from unauthorized disclosure.
The source control is IR-08 from NIST 800-53. There are no Organization-Defined Parameters (ODPs). Per the NIST discussion, organizations develop and implement a coordinated approach to incident response, and they consider coordination and information sharing with external service providers and supply chain organizations. You can read the requirement directly at NIST 800-171 R3, 03.06.05 (p. 41).
What Are the Organization-Defined Parameters (ODPs) Associated with NIST 800-171 R3 03.06.05?
None (0). Requirement 03.06.05 contains no bracketed assignment, so there is no organization-defined value to select and nothing for the DoD to specify. The requirement applies as written.
Your System Security Plan (SSP) narrative for 03.06.05 therefore records how the requirement is implemented rather than a parameter you chose.
What Are the Assessment Objectives (AOs) For NIST 800-171 R3 03.06.05?
NIST 800-171A R3 breaks 03.06.05 into ten (10) determination statements, and it has no Organization-Defined Parameters (ODPs). These AOs are:
- A.03.06.05.a.01: an incident response plan is developed that provides the organization with a roadmap for implementing its incident response capability.
- A.03.06.05.a.02: an incident response plan is developed that describes the structure and organization of the incident response capability.
- A.03.06.05.a.03: an incident response plan is developed that provides a high-level approach for how the incident response capability fits into the overall organization.
- A.03.06.05.a.04: an incident response plan is developed that defines reportable incidents.
- A.03.06.05.a.05: an incident response plan is developed that addresses the sharing of incident information.
- A.03.06.05.a.06: an incident response plan is developed that designates responsibilities to organizational entities, personnel, or roles.
- A.03.06.05.b[01]: copies of the incident response plan are distributed to designated incident response personnel (identified by name or by role).
- A.03.06.05.b[02]: copies of the incident response plan are distributed to organizational elements.
- A.03.06.05.c: the incident response plan is updated to address system and organizational changes or problems encountered during plan implementation, execution, or testing.
- A.03.06.05.d: the incident response plan is protected from unauthorized disclosure.
Part a becomes six (6) objectives, one for each required element of the plan, and parts b through d cover distribution, updating, and protection. An assessor checks all ten. The full guidance on assessment methods and objects, is in NIST 800-171A R3, 03.06.05 (p. 53).
Assessment Methods and Objects for NIST 800-171 R3 03.06.05
Examine: incident response policy; procedures addressing incident response planning; incident response plan; system security plan; records of incident response plan reviews and approvals.
Interview: personnel with incident response planning responsibilities; personnel with information security responsibilities.
Test: incident response plan and related processes.
How Does NIST 800-171 R3 03.06.05 Map From NIST 800-171 R2?
03.06.05 is effectively new for R3. All ten (10) assessment objectives are net new, and the requirement has no corresponding assessed requirement in NIST 800-171 R2:
- A.03.06.05.a.01 through a.06, A.03.06.05.b[01] and b[02], A.03.06.05.c, and A.03.06.05.d are all net new for R3.
Mapped against the ten (10) AOs, all ten (10) are net new (significant effort), with none direct, indirect, or unmapped. The base incident response plan control, IR-08, was an assumed control in R2 rather than one that R2 separately assessed, so R3 turns it into explicit, testable objectives. Even organizations that had an incident response plan under R2 should confirm it covers all six required elements and that distribution, updates, and protection are demonstrable.
How Does NIST 800-171 R3 03.06.05 Map to NIST 800-53 R5 and the SCF?
Source Control in NIST 800-53 R5:
Secure Controls Framework (SCF) Crosswalk
Organizations running a single control set across multiple frameworks can satisfy 03.06.05 through the following SCF controls:
- DCH-06.1 Defining Access Authorizations for Sensitive / Regulated Data
- DCH-07 Sensitive / Regulated Data Protection
- HRS-04 Defined Roles & Responsibilities
- IAC-06 Role-Based Access Control (RBAC)
- IAC-25.1 Access To Sensitive / Regulated Data
- IRO-06 Incident Handling
- IRO-08 Incident Response Plan (IRP)
- IRO-08.1 Incident Response Plan (IRP) Update
The crosswalks from NIST 800-171 R3 and NIST 800-171A R3 to the SCF are available at no cost through the SCF Set Theory Relationship Mapping (STRM): https://securecontrolsframework.com/start-here/set-theory-relationship-mapping-strm. The STRM also carries the relationship type for each mapping (Equal, Subset Of, Intersects With), which tells you whether an SCF control fully satisfies the requirement or only part of it. Mapping above taken from SCF 2026.3.
Common Pitfalls with NIST 800-171 R3 03.06.05
The pitfalls for this effectively new requirement are about plan completeness and lifecycle, each of which needs documented evidence of due diligence and due care such as policies, standards, procedures, and configuration screenshots:
- Cover all six elements. A.03.06.05.a.01 through a.06 each require a specific element: roadmap, structure, high-level approach, reportable incidents, information sharing, and assigned responsibilities. A plan missing any one leaves an objective open.
- Distribute the plan. A.03.06.05.b[01] and b[02] require distribution to designated personnel and organizational elements. A plan that sits unshared in a folder does not meet these objectives.
- Keep it updated and protected. A.03.06.05.c requires updates after changes or problems found in testing, and d requires protecting the plan from unauthorized disclosure.
- Align the family. The plan is the anchor for Incident Handling (03.06.01), Testing (03.06.03), and Training (03.06.04), so keep them consistent with it.
What Is Reasonable Evidence For NIST 800-171 R3 03.06.05?
Reasonable objective evidence for an assessment is often subjective. The following examples of evidence to address NIST 800-171 R3 03.06.05 are sourced from the SCF Evidence Request List (ERL), available at https://securecontrolsframework.com/free-content/scf-download. These ERL artifacts are mapped to NIST 800-171 R3 03.06.05 through SCF controls. They establish a starting point for discussions on what an organization needs to have for evidence of due diligence and due care to withstand external scrutiny by an assessor or regulator.
- E-DCH-02 Data Handling Practices. An organization-specific data handling practices (e.g., guidance specific the data classification scheme).
- E-DCH-08 Authorization Documentation. That identifies authorized users and processes acting on behalf of authorized users.
- E-HRS-02 Assigned Roles - Application Developers. List of employed or contract personnel assigned to application development roles.
- E-HRS-03 Assigned Roles - Cybersecurity Staff. List of employed or contract personnel assigned to cybersecurity roles.
- E-HRS-04 Assigned Roles - Data Privacy Staff. List of employed or contract personnel assigned to data privacy roles.
- E-HRS-13 Defined Cybersecurity & Data Privacy Responsibilities. A role-based cybersecurity & data privacy responsibilities to ensure personnel are both educated on the role and are responsible for the associated control execution.
- E-HRS-14 Responsibilities Review. A formal review process to ensure assigned responsibilities currently reflect business needs for the assigned role.
- E-IAC-02 Defined Roles & Authorizations (RBAC). Defined access control-specific roles (e.g., role based access control (rbac)) that affect both logical and physical access authorizations.
- E-IRO-01 Incident Response Plan (IRP). A incident response plan (irp). this is program-level documentation in the form of a runbook, playbook or a similar format provides guidance on organizational practices that support existing policies and standards.
- E-IRO-07 IRP Updates. A periodic review process for the organization's incident response plan (irp) to identify necessary updates.
Alongside these, keep the System Security Plan (SSP) narrative for 03.06.05.
Timeline Considerations for NIST 800-171 R3 03.06.05
With all ten (10) AOs net new, 03.06.05 is a significant lift, though much of it is documentation. A realistic sequence:
- Develop the incident response plan covering all six required elements (A.03.06.05.a.01 through a.06).
- Distribute the plan to designated incident response personnel and organizational elements (A.03.06.05.b[01] and b[02]).
- Establish a process to update the plan after changes or testing findings (A.03.06.05.c).
- Protect the plan from unauthorized disclosure (A.03.06.05.d).
- Collect evidence for all ten (10) AOs, including the plan, distribution records, update history, and access controls.
Frequently Asked Questions About NIST 800-171 R3 03.06.05
How many assessment objectives does NIST 800-171 R3 03.06.05 have? NIST 800-171A R3 breaks 03.06.05 into ten (10) assessment objectives. An assessor works through each one separately, so each needs its own evidence.
Which NIST 800-53 R5 control does NIST 800-171 R3 03.06.05 come from? IR-08.
How many Organization-Defined Parameters (ODPs) does NIST 800-171 R3 03.06.05 have? None (0). The requirement contains no bracketed assignment, so there is no organization-defined value and nothing for the DoD to specify.
Where does NIST 800-171 R3 03.06.05 sit in the NIST 800-171 R3 Kill Chain? Phase 10, Incident Response (IR). The Kill Chain is a phased model for sequencing R3 implementation, and it assigns this requirement to that phase.
Bottom Line on NIST 800-171 R3 03.06.05
03.06.05 Incident Response Plan develops a plan covering six required elements, distributes it, updates it, and protects it. It is effectively new for R3, with all ten (10) assessment objectives net new. The recurring problem is a thin plan that is never distributed, updated, or protected. Build a complete plan, distribute it to the right people, keep it current after changes and testing, and protect it, keeping the rest of the incident response family aligned to it.
Authoritative sources:
Authoritative sources:
This guide reproduces U.S. Government text from NIST 800-171 R3 and NIST 800-171A R3. It is educational, not legal or assessment advice. Last reviewed: 2026-09-22.
