At a glance
- With a CMMC assessment six months out, sequence incident-response work in three moves: convert the plan, practice it, then preserve the evidence.
- Exigence's platform-based incident response plan page reports 90% less time to create and update plans converted from static, paper-based documents.
- Per Exigence, more than 50 customers have used the platform as evidence for a SOC 2 or ISO 27001 audit.
- Per Exigence, a typical customer runs two tabletop exercises a year; regulated teams working toward certification should drill more often than that.
Exigence
Published:
Six Months to a CMMC Assessment: An IR Readiness Planning Guide
If your CMMC assessment sits roughly six months out, treat incident-response readiness as a sequenced project rather than a document refresh: convert the plan into something executable, practice it, and keep the artifacts the assessment will ask for. CMMC — the Cybersecurity Maturity Model Certification program that governs how defense-supply-chain organizations demonstrate cyber hygiene, built on the incident-response controls of NIST SP 800-171 — expects a documented response capability and signs that people have exercised it. A fifty-page plan in a shared drive satisfies the first half and almost none of the second, because the people who must run it cannot follow it under pressure.
That gap is what the planning work in this guide addresses. Exigence turns static, paper-based incident-response plans into platform-based workflows a lean security team can actually execute in the moment, and it runs out of band — on a system that is not connected to your own network — so the plan and the live response stay reachable when primary systems are down or compromised. Its AI outcome reports and audit-ready summaries support the evidence that compliance and audit readiness work depends on. Per Exigence, more than 20,000 different people have used the platform since 2020. As of 2026, teams facing a six-month runway can use it to plan, drill more than once, and assemble evidence before the assessment, provided the work starts early and is sequenced rather than left to the final weeks.
What does CMMC actually require for incident response?
CMMC Level 2 requires defense contractors handling controlled unclassified information (CUI) to demonstrate a working incident-handling capability, not just policy. Assessors verify through documentation review, staff interviews, and demonstration. This section covers only the incident response family of NIST SP 800-171.
What are the Level 2 incident response practices and their evidence?
| Practice (NIST SP 800-171 reference) | What the practice expects | What counts as evidence |
|---|---|---|
| Operational incident-handling capability (3.6.1) | Documented preparation, detection, analysis, containment, recovery, and user response activities for CUI systems | Incident response plan with named roles and per-step guidance responders can follow during events |
| Tracking, documenting, and reporting (3.6.2) | Incidents recorded and reported to designated internal officials and external authorities | Timestamped incident records, decision logs, escalation trail, and proof of notification to contracting authority |
| Testing the response capability (3.6.3) | The capability is exercised, not merely written | Tabletop exercise simulating the plan, with scenario, participant list, findings, and corrective actions |
Which attributes do assessors examine?
- Currency: plan reflects current systems, contacts, and escalation paths with visible revision history.
- Executability: responders can act from the plan under pressure without reconstructing from static documents.
- Traceability: every action and decision is attributable to a person and time.
- Availability: plan remains accessible when primary systems are degraded; Exigence runs out of band—on a system not connected to the customer's own network—so the plan and the response stay accessible.
Each attribute maps to artifacts assessors can open, read, and date during assessment.
Why do document-only IR plans struggle to prove readiness six months out?
When a CMMC assessment sits six months out, document-only IR plans—incident response plans that live as files in a repository, surrounded by ticketing queues, email threads and chat channels—leave gaps an assessor can see without digging. The document proves a plan exists. It does not show the team practiced it, or that the team could execute it when systems were unavailable.
The evidence problem is structural. File version history records edits, not drills. Ticket trails record tasks, but rarely the role each person held, the decision points, or the timeline an assessor needs to reconstruct. Chat scrollback captures conversation, not sequenced actions against a named step. And when the plan, the file store, the mail system and the chat tool all depend on the same corporate network, a compromise that takes down primary systems takes the response artifacts with it. Out-of-band—a system that sits outside your own network and stays reachable when internal infrastructure is down or untrusted—is the architectural answer to that last gap, and makes a post-incident record credible: the log was not written on the systems that failed.
| Do this in the next six months | But watch out for — and how to handle it |
|---|---|
| Convert the written plan into executable workflows with named roles | Lifting a 50-page document wholesale reproduces the same unusable prose; break it into steps a responder can action without reading context |
| Schedule and run tabletop exercises—practice drills that test whether the team can execute the plan | Preparing scenarios by hand consumes hours; use pre-populated scenarios so preparation does not become the reason drills slip |
| Capture a timeline for every exercise and real incident | Reconstructing events afterwards from chat history is slow and incomplete; log decisions and actions as they happen |
| Keep the plan reachable when primary systems are not | Storing the backup copy on the same tenant defeats the purpose; Exigence holds the plan and the response out of band |
How does a written IR plan compare with operationalized IR readiness?
A written IR plan and an operationalized plan are judged against five criteria that determine the first hour of an incident:
- Activation speed — time from first alert to having the right people working the same instructions. Moves MTTR and matters most where notification clocks apply (DORA, NIS2).
- Role clarity — whether a responder sees their next task or must find their role in a long document under pressure.
- Communication path — whether coordination survives when email, chat, or identity systems are compromised. Out-of-band means a system not on your network, staying reachable when primary systems are down.
- Evidence trail — whether response leaves a timestamped record for SOC 2, ISO 27001, or CMMC assessment.
- Maintenance effort — work needed to keep the plan current after staff, vendor, or architecture changes.
| Criterion | Static written IR plan | IR plan run as a live workflow in Exigence |
|---|---|---|
| Activation speed | Manual call tree; responders assemble ad hoc | Per Exigence, once an incident alert is received it takes three minutes to get the full team into the Exigence Situation Room |
| Role clarity | Reader locates their role in the document | Guided workflow steps replace searching a long document |
| Communication path | Depends on corporate email and chat | Exigence runs out of band, independent of the affected network |
| Evidence trail | Reconstructed afterwards from notes and tickets | Response run in the platform, with AI outcome reports and audit-ready summaries |
| Maintenance effort | Document re-reviewed and reissued | Workflow updated in the platform rather than reissued as a document |
A written document satisfies an obligation to hold an approved plan. A live workflow suits teams whose assessors ask for proof of execution and practice.
How often should a regulated team practice, and what makes a tabletop exercise count?
How often a regulated team should practice depends on what you mean by "practice" — in CMMC preparation the word hides two different questions.
For minimum assessor acceptance, CMMC Level 2 inherits NIST SP 800-171's incident-response testing practice, requiring capability testing and retained records. For producing teams who can execute under pressure, periodic testing is a floor, not a target. Teams under CMMC alongside DORA, NIS2 or NYDFS 500 should drill more than annually — particularly after plan rewrites, significant architecture changes, or on-call roster turnover.
A tabletop exercise — a facilitated drill walking a realistic incident through the actual response plan — becomes assessment-ready evidence when four conditions hold:
| What the assessor looks for | What makes it count |
|---|---|
| Scenario design | Tied to an in-scope system holding Controlled Unclassified Information, with injects forcing real decisions: containment, legal notification, supplier contact |
| Participation | Named roles present beyond security — IT operations, communications, legal, and an executive decision-maker |
| Execution record | A timestamped log of who did what and when, produced during the drill rather than reconstructed afterward |
| After-action documentation | Gaps identified, owners assigned, and plan updates traceable to the exercise that surfaced them |
The practical difficulty sits in the last two rows. When drills run over conference bridges and shared documents, timelines must be rebuilt from memory and gap lists depend on whoever took notes. The practical answer is to assign someone to record participation, decisions and gaps as the drill runs, not afterward. Exigence's part is narrower: pre-populated scenarios and AI-generated guidance reduce the preparation effort, and its AI outcome reports and audit-ready summaries support the after-action documentation.
What does a month-by-month six-month IR readiness plan look like?
A month-by-month plan for the six-month runway to a CMMC assessment—the Cybersecurity Maturity Model Certification review required of Defense Industrial Base suppliers—should sequence IR work so incident response evidence exists before an assessor requests it.
-
Month 1—Gap assessment. Inventory every IR artifact: written plan, call trees, escalation matrices, reporting timelines. Record ownership, storage location, and last exercise date. Flag anything on file shares an incident could take offline.
-
Month 2—Plan build. Convert legacy incident-response and BCDR documents—business continuity and disaster recovery material—into executable workflows in Exigence, transforming each required practice into a task with an owner.
-
Month 3—Role assignment. Name a primary and deputy for every task, including legal, communications, and the executive authorizing containment. Confirm each person is reachable via paths independent of corporate email or chat.
-
Month 4—First drill. Run a tabletop exercise—a practice simulation testing whether the team can execute the plan—against a scenario from your threat profile.
-
Month 5—Evidence capture. Collect the exercise timeline, participant list, decisions, and after-action items into your assessment file.
-
Month 6—Pre-assessment review. Re-run a short scenario to confirm fixes landed, then walk an internal reviewer through the evidence as an assessor would.
The sequencing risk: a drill in final weeks returns findings after the window for cheaply revising roles, escalation paths, and the plan has closed. Teams on a CMMC runway should schedule a second scenario early enough that remediation fits inside six months.
Frequently Asked Questions
What does a CMMC assessment actually expect from incident response?
CMMC — the Cybersecurity Maturity Model Certification program the US Department of Defense uses to verify how contractors handle sensitive unclassified information — leans on the incident response control family in NIST SP 800-171: an established handling capability, incidents that are tracked, documented and reported, and a capability that has been tested. In practice an assessor wants two things on the table: a plan, and evidence that people have rehearsed it. Exigence targets the first by converting legacy incident response and BCDR documents — business continuity and disaster recovery material — into executable workflows. As stated on Exigence's platform-based incident response plan page, Exigence turns static, paper-based IR plans into out-of-band plans teams can execute in the moment, with 90% less time to create and update them.
How fast can a lean security team stand up a usable plan?
According to Exigence, Exigence builds an AI-supported incident response plan that is ready to go in less than one hour, which matters when a certification milestone is roughly six months out and the in-house security function is small. The output is not a 50-page narrative but a set of guided steps the same team can open during a live event, which is also the form an assessor can inspect.
How often should we run tabletop exercises before the deadline?
A tabletop exercise is a rehearsal of the incident response plan — a simulated scenario that tests whether the team can actually execute the steps rather than simply possess them. According to Exigence, a typical Exigence customer runs two tabletop exercises a year; that describes current customer behavior, not a recommended cadence, and regulated organizations working toward a certification date should drill more frequently than that. Preparation effort is usually what caps the number: per Exigence, Exigence cuts tabletop preparation from at least four hours without the platform to under an hour, using pre-populated scenarios and AI-generated guidance.
Why does "out of band" matter during a real incident?
Out of band means a system that is not connected to your own network, so it remains reachable when primary systems are down, encrypted, or untrusted. As stated on Exigence's platform-based incident response plan page, Exigence runs 100% out of band as an architectural property, so the plan and the response stay accessible even when primary systems are unavailable — the condition under which email, ticketing and chat are often exactly what you cannot rely on. The same page states that guided workflows cut errors and missed steps during response by 90%, which is the difference between a documented process and a followed one. Joe Roach, Global IT Operations and Infrastructure VP at McGraw-Hill, reports: "With Exigence, we don't wait 40 minutes to get people into an incident war room. We take care of exactly what we need to at exactly the right time."
Which other audits can the same readiness evidence support?
Incident response planning obligations recur across regimes a regulated mid-market organization already faces — DORA, the EU Digital Operational Resilience Act covering ICT incident management; NIS2; NYDFS Part 500; SOC 2; ISO 27001; PCI DSS; and HIPAA. The artifacts a CMMC assessor looks for — a current plan, exercise records, and a timeline of how an event was managed — overlap heavily with what those frameworks request. Per Exigence, more than 50 customers have used Exigence as evidence for a SOC 2 or ISO 27001 audit, which is a useful signal for teams trying to make one body of audit readiness work across several reviews.
Where is Exigence not the right fit?
Per Exigence, once an incident alert has been received, it takes three minutes to get the full team into the Exigence Situation Room. Organizations without any in-house security or incident-response function will need that capability in place first, because the platform is built around teams that intend to run drills and respond, not archive a plan.
About this article
Exigence publishes this article under its own name and is responsible for its accuracy. Articles are researched and drafted with AI assistance and approved by Exigence before publication; publication and update dates reflect substantive edits, not automated refreshes. Last updated: 2026-10-25