INC-009 Incident Response Training and Testing
Description
Personnel with incident response roles receive training at onboarding and at a defined periodic frequency, drawn from the current plan and its runbooks. Personnel who may handle information that has spilled outside its authorised boundary receive training on the spillage procedure at a defined frequency, whether or not they hold an incident response role. The Incident Response Plan is tested through tabletop exercises or simulations at least annually, and each test is scheduled and run in coordination with the owners of the continuity and disaster recovery plans, with the exercise record naming the plans represented and the handover points tested. Test results are reviewed and used to update procedures. Metrics on incident response performance are tracked.
Rationale
Plans and training that are never exercised degrade and fail at the worst moment, and periodic testing is the only thing that shows whether procedures, tools and people are still current. Coordinating the exercise with the continuity and recovery plan owners tests the seam rather than the plan: a real incident invokes several plans at once and the handover between them is where they come apart. Spillage training reaches a wider population than the response team because the people who first see spilled information are usually the ones who received it, and what they do in the first minutes decides how far it travels.
Applicability (9 profiles)
Framework Mappings (16)
| SEF-04 | Incident Response Testing | full |
| SEF-05 | Incident Response Metrics | full |
| SEF-04 | Incident Response Testing | full |
| SEF-05 | Incident Response Metrics | full |
| HIPAA-164.308.a.7.ii.D | Testing and Revision Procedures | informative |
| NIS2-CIR-3.1 | Incident Handling Policy | informative |
| NIS2-CIR-3.5 | Incident Response | informative |
| CP-3 | Contingency Training | partial |
| IR-2 | Incident Response Training | full |
| IR-3 | Incident Response Testing | full |
| IR-3(2) | Incident Response Testing | Coordination with Related Plans | full |
| IR-9(2) | Information Spillage Response | Training | full |
| PM-14 | Testing, Training, and Monitoring | partial |
| GV-2.1-003 | AI Risk Roles and Responsibilities | GV-2.1-003 | full |
| GV-6.2-003 | Third-Party Failure Contingency Processes | GV-6.2-003 | informative |
| MG-4.2-002 | Continual Improvement Integration | MG-4.2-002 | informative |
Evidence (3)
Training completion records showing personnel with incident response roles completed required IR training at onboarding and at the defined periodic frequency.
Example: LMS (e.g., KnowBe4, Workday Learning, or equivalent) training completion report filtered to incident response roles, showing completion status, completion date, and training module name for the last training cycle
Test: Request the IR training completion report. Verify: (1) all personnel listed in the IRP with response roles appear in the training records; (2) training was completed within the required period (at onboarding and periodically); (3) any overdue completions have a documented remediation plan; (4) training content covers current procedures and tools.
IR tabletop exercise or simulation record showing the IRP was tested within the last 12 months and results were used to update procedures.
Example: IR tabletop exercise agenda and after-action report (dated within the last 12 months) showing scenario used, participant list, issues identified, IR performance metrics measured, and plan updates triggered by the exercise
Test: Request the most recent incident response exercise report. Verify: (1) the exercise was conducted within the last 12 months, (2) participants included personnel holding defined response roles, (3) performance metrics such as detection time, containment time and escalation accuracy were measured, (4) findings resulted in documented updates to the plan or its runbooks, (5) corrective actions were tracked to completion, (6) the exercise was scheduled with the owners of the continuity and disaster recovery plans and the record names the plans represented and the handover points tested.
Spillage response training records for the personnel groups that may handle spilled information, with completion dates and the material covered.
Example: Spillage training completion export, support and data teams, 2026 cycle
Test: Request the spillage training records. Verify: (1) the groups in scope are defined by the information those people may encounter rather than by job title alone, (2) completion within the defined frequency is recorded for each person in those groups, (3) the material covers recognising a spill, the reporting route and the handling limits that apply while systems are under corrective action, (4) the material matches the current version of the spillage procedure, (5) people who joined a group mid-cycle were trained rather than deferred to the next cycle.
Questions (3)
Do personnel with incident response roles receive training at onboarding and at a defined interval thereafter?
Training completion should be tracked in an LMS or equivalent system. Exercise results should be used to update IRP procedures. A plan that generates no updates after an exercise likely was not tested meaningfully.
How frequently is incident response training conducted for personnel with defined IR roles?
At onboarding plus annual refresher training is the minimum expectation. Six-monthly training is considered a strong practice for teams with active response responsibilities.
Which of the following apply to your incident response exercises and training?
Options run from the most commonly in place to the least. Coordinating the exercise tests the seam rather than the plan: a real incident invokes several plans at once and the handover between them is where they come apart. Spillage training reaches a wider group than the response team, because the people who first see spilled information are usually the ones who received it.