What this control covers
This control mandates providing incident response training to system users based on their assigned roles and responsibilities. Training should be provided within a defined time period of assuming a role or acquiring system access, and periodically thereafter. The content should be reviewed and updated regularly, or after significant events like system changes, incidents, or regulatory updates. This control supports the Incident Response Training System capability within the Incident Response (3.6) family.
Why it matters
How quickly and methodically you contain an incident determines the regulatory consequence — most fines are not for the breach itself but for the slow or absent response.
How to implement
AWS
Wire GuardDuty, Security Hub and Macie findings into your ticketing/SIEM via EventBridge. Maintain documented playbooks for IAM-key compromise, EC2 instance compromise, S3 data exposure, and run quarterly tabletop exercises.
Azure
Use Defender for Cloud + Microsoft Sentinel with playbooks (Logic Apps) for automated containment — disable user, isolate VM (NSG), revoke session tokens. Keep an on-call rotation in Teams with PagerDuty.
GCP
Org Policy Service for guardrails and Config Validator in CI to pre-check Terraform plans against policy as code (Rego).
GitHub
Subscribe to secret-scanning alerts and Dependabot security advisories; require triage SLAs by severity. For exposed secrets, rotate at the cloud provider FIRST then revoke at GitHub — order matters.
On-premises
Roll out role-based security awareness annually + phishing simulations quarterly. Track completion in your LMS and tie to performance review for repeat-fails.
Evidence to collect
ticketing_workflow— See the iCompaas Evidence library for the canonical source for this evidence type.
Workflow metrics (ServiceNow, Jira) show approvals and remediation. Focus: Incident Response Training.
Quick checklist
- Access — Management / Content
- Response — Management / Content
- Time — Management / Content
- System — Management / Content
- Incident — Management / Content
- Security — Management / Content
Related articles on this site
- NIST 800-171 3.14.3 Monitor system security alerts and advisories and take action in response.
- NIST 800-171 3.2.2 Ensure that personnel are trained to carry out their assigned information security-related duties and responsibilities.
- CMMC 2.0 AT.2.057 Ensure that personnel are trained to carry out their assigned information security-related duties and responsibilities.
- CMMC 2.0 SI.2.214 Monitor system security alerts and advisories and take action in response.