NIST 800-171, a cybersecurity framework by the National Institute of Standards and Technology, outlines controls for protecting controlled unclassified information (CUI). Section 3.6 focuses on incident response (IR), which is the process of handling security incidents. An effective IR capability is crucial for minimizing damage and restoring normal operations after a security breach.

NIST 800-171 requires organizations to establish a operational IR program that covers several key areas. First, it mandates the creation of a documented IR plan. This plan should detail the steps for identifying, reporting, containing, eradicating, and recovering from incidents. It should also clearly define roles and responsibilities for IR activities.

---

Next, NIST 800-171 requires the establishment of an IR team. This team should consist of individuals with the knowledge and expertise to effectively respond to security incidents. The team is responsible for implementing the IR plan and coordinating all IR activities. Regular testing of the IR plan and team ensures their effectiveness and identifies areas for improvement.