AC.L2-3.6.3[a] — Incident Response (Incident Reporting)
Domain: IR | Practice: IR.L2-3.6.3 | Source: NIST SP 800-171 Rev. 2 / CMMC 2.0 Level 2
Assessment Objective: Incidents are reported to the designated internal officials and external authorities.
Establish procedures and timelines for reporting confirmed security incidents to internal leadership, government agencies, and contracting officers as required by DFARS and DoD regulations.