“Usually applies to” lists what a typical moving company has in scope for each requirement; your own scope decides. See what's in scope.
“May wait on a POA&M” applies only if your overall score is at least 88 of 110, and the gap must then be closed within 180 days. See how Level 2 works.
3.6.1 Be ready to handle incidents
Be ready to handle a security problem, such as a hacked email account, a lost phone or ransomware. Have a written plan, and people who know it, covering how to prepare, spot the problem, work out what happened, contain it, recover and tell staff what to do.
Usually applies to: The whole company: a written plan and named people, your IT company included, covering everything in scope.
5 points if not met Cannot wait on a POA&M
Official wording: “Establish an operational incident-handling capability for organizational systems that includes preparation, detection, analysis, containment, recovery, and user response activities.”
3.6.2 Record and report incidents
Write down every incident and report it to the people who need to know, inside the company and outside, such as your TSP and the government, as your contracts require.
Usually applies to: Incidents involving anything in scope, such as a lost crew phone, an email with shipment details sent to the wrong person or paperwork left behind at a residence, and the reports your contracts require.
5 points if not met Cannot wait on a POA&M
Official wording: “Track, document, and report incidents to designated officials and/or authorities both internal and external to the organization.”
3.6.3 Practice the plan
Test the plan, for example with a short tabletop exercise: a dispatcher's email was hacked this morning; what do we do?
Usually applies to: The plan and the people named in it, your IT company included.
1 point if not met May wait on a POA&M
Official wording: “Test the organizational incident response capability.”
Sources: official wording, NIST SP 800-171 Rev 2; points, 32 CFR 170.24; plans of action, 32 CFR 170.21. The plain-English explanations are ours.
