CMMC Identification Response Levels

CMMC Identification Response Levels for Cisco CyOps Associate

**Level 2**

Establish an incident response plan that follows the NIST process. Detect, report, and prioritize events. Respond to events by following predefined procedures. Analyze the cause of incidents in order to mitigate future issues.

**Level 3**

Document and report incidents to stakeholders that have been identified in the incident response plan. Test the incident response capability of the organization.

**Level 4**

Use knowledge of attacker tactics, techniques, and procedures (TTP) to refine incident response planning and execution. Establish a security operation center (SOC) that facilitates a 24/7 response capability.

**Level 5**

Utilize accepted and systematic computer forensic data gathering techniques including the secure handling and storage of forensic data. Develop and utilize manual and automated real-time responses to potential incidents that follow known patterns.