documentation_complete: true

title: 'Perform Periodic Incident Response Exercises'

description: |-
    Production environments should exercise incident
    response procedures at least annually. Environments requiring
    higher assurances of security should test incident response
    procedures more often, possibly quarterly or even monthly.
    Incident response procedures should cover all anomalous events.

rationale: |-
    Planning for incidents and practicing procedures to be followed
    prior to real-life scenario improves response time and mitigates
    damages/losses that occur with incidents.

severity: medium

identifiers:
    cce: ""

references:
    cis: ""
    disa: ""
    nist: IR-3

ocil_clause: 'incident response exercises have not been conducted'
