You exercise the IR plan so it works when it's real.
What it actually means
A plan you've never tested is a guess. Periodically exercise the incident-response capability — even a tabletop walkthrough counts — and capture lessons to improve it.
Pass or fail — an assessor needs a "yes" to each
- The IR capability is tested periodically (tabletop or live).
- Results/lessons are documented and feed improvements.
What to have ready
- Tabletop/exercise records
- After-action notes + plan updates
Where teams trip up
- A plan that's never been exercised
- Testing once and never again
See where this control puts your score
Run all 110 requirements free in about 10 minutes — or draft your SSP language for this control. No signup.
Calculate your SPRS score →Draft your SSP language →