Incident Response Plans: The CMMC Requirement Everyone Underestimates

An incident response plan isn't a document — it's a rehearsed capability. Assessors look for defined roles, communication trees, detection and analysis procedures, and evidence of tabletop exercises. Most small contractors fail here on evidence, not intent. Have you run a tabletop exercise this year? What broke?