NIST 800-171 Controls · Incident Response
IR.2.097 — Test organizational incident response capability
Test the organizational incident response capability.
What IR.2.097 means in plain English
Having a plan written down is not enough — you need to actually practice it. A "tabletop exercise" is exactly what it sounds like: your team sits around a table (or on a video call) and someone walks through a hypothetical scenario ("Our email system says 3,000 emails were sent from the CEO account at 3am — what do we do?"). You do not actually have to hack anything or shut systems down — just talk through the steps. For an 8-person company, a 90-minute annual tabletop exercise that you document is fully sufficient to satisfy this control.
The assessment question
“Has the organization conducted at least one documented test of the incident response plan (tabletop exercise, simulation, or live drill) within the past 12 months — with lessons learned captured and plan updates made as needed?”
How to implement IR.2.097
- Schedule a 90-minute annual tabletop exercise with all employees — put it on the calendar now for the same time every year (e.g., first Tuesday of March).
- Choose a realistic scenario relevant to defense contractors: ransomware attack, spear-phishing leading to CUI exfiltration, or a lost/stolen laptop containing CUI.
- Use the CISA Tabletop Exercise Package (free download from cisa.gov) as a structured agenda — they have pre-built scenarios for SMBs.
- During the exercise, have a designated note-taker record what steps were taken, what gaps were discovered, and what questions could not be answered.
- After the exercise, update your Incident Response Plan with any gaps found and document the exercise with: date, attendees, scenario used, key findings, and action items with owners and due dates.
Evidence your assessor will ask for
- Exercise After-Action Report (AAR) with date, attendees, scenario description, findings, and action items
- Calendar invitation or meeting record showing annual exercise is scheduled
- Updated Incident Response Plan with post-exercise revisions noted
- Sign-in sheet or attendance record for the exercise session
Does AI prompt monitoring help with this control? Honestly, no.
IR.2.097 is met through the remediation steps above, not through AI traffic controls — an AI prompt firewall neither satisfies nor substitutes for it. We map AI monitoring only to the controls it genuinely evidences (flow control, boundary protection, audit, and incident support); for the full picture of where it does help, see the mapping guide linked below.
Full mapping: which 800-171 controls AI prompt monitoring evidences →
More Incident Response controls
Score yourself against all 110 controls
The free ShieldReady assessment walks every NIST 800-171 requirement, computes your SPRS score, and shows exactly which gaps cost the most points.