This post gives pragmatic, step-by-step guidance and ready-to-use templates for building incident response (IR) workflows that meet the intent of NIST SP 800-171 Rev.2 / CMMC 2.0 Level 2 control SI.L2-3.14.3, helping small businesses detect, report, contain, and recover from incidents that could affect Controlled Unclassified Information (CUI).
Understanding SI.L2-3.14.3 and compliance objectives
SI.L2-3.14.3 is a CMMC 2.0 Level 2 control that maps to the NIST SP 800-171 system and information integrity family; its objective is to ensure organizations can promptly detect, analyze, report, and respond to security incidents affecting confidentiality, integrity, or availability of CUI. For a small business this means formalizing roles, escalation criteria, timelines, evidence preservation, and reporting paths so you can demonstrate an auditable, repeatable response capability during assessments or contract reviews.
Core elements your workflow must include
A compliant IR workflow should include: (1) defined roles and authority (Incident Commander, Technical Lead, Communications, Legal/Compliance); (2) phases mapped to NIST-style steps (Prepare, Detect & Analyze, Contain, Eradicate & Recover, Post-Incident Review); (3) notification and reporting triggers and timeboxes (e.g., initial acknowledgement within 30 minutes, executive notification within 2 hours for CUI-impacting events); (4) evidence handling and chain-of-custody; and (5) retention and reporting artifacts (logs, timelines, remediation tickets) to prove compliance.
Practical implementation steps for small businesses
Start with a risk-based scope: identify systems that store or process CUI and prioritize monitoring on those assets. Implement lightweight logging (Windows Event Forwarding or Sysmon + Winlogbeat, Linux rsyslog + auditd, cloud provider audit logs) and a central collector (open-source SIEM like Wazuh/Elastic or a managed logging service). Create a simple escalation matrix (phone + e-mail + Slack) and codify triage criteria: e.g., confirmed CUI exfiltration, ransomware encryption, privileged credential compromise. Document these in your incident response playbook and run quarterly tabletop exercises to validate times and handoffs.
Technical details and tools to operationalize the workflow
Log sources and detection: monitor Windows Security event IDs (4624/4625 logon, 4688 process creation with Sysmon), Sysmon event 3 (network connection), Linux auth/audit logs, firewall and proxy logs, EDR telemetry, and cloud Trail/CloudWatch events. Use SIEM correlation rules for spikes in outbound traffic, large file transfers, new account creation, or unusual process chains (PowerShell spawning cmd.exe). For evidence collection use FTK Imager or dd for disk images, tcpdump/pcap for network captures, and preserve hashes (SHA256) and timestamps. Maintain an evidence log with who collected what, when, and where it's stored (encrypted, access-controlled). Automate containment for common cases: isolate an endpoint via EDR (Quarantine/Network isolation API), block IPs on firewalls, disable compromised accounts in AD/Azure AD.
Templates: incident workflow, triage checklist, notification & post-incident report
Below are compact templates you can copy into your incident response plan and ticketing system.
Incident Workflow (timeboxed) - 0-15 min: Detection & Triage - Alert generated -> Triage checklist run by on-call analyst - Record initial facts: who, what, when, where, CUI impact yes/no - 15-60 min: Escalation & Containment Decision - If CUI impacted or ransomware suspected -> Incident Commander assigned - Perform containment actions (isolate host via EDR, block IPs, revoke creds) - 1-8 hours: Investigation & Eradication - Collect volatile evidence (memory, running processes), image disk - Identify root cause, remove persistence, revoke compromised keys - 8-72 hours: Recovery & Validation - Restore systems from known-good backups, validate checksums, rejoin network - 3-10 days: Post-Incident Review & Reporting - Prepare report, update playbooks, remediate control gaps Triage Checklist (yes/no + evidence) - Is the alert validated (false positive)? -> artifact: alert ID, screenshots - Is there evidence of data exfiltration? -> logs (proxy, firewall), pcap - Is ransomware detected? -> file extensions, process names, EDR indicator - Are privileged accounts involved? -> AD logs, session data Notification Email Template Subject: [INCIDENT]— — Body: - Summary: what happened, when (UTC), initial impact (CUI yes/no) - Actions taken: containment steps - Next steps: investigation lead, expected ETA for update - Required recipients: Incident Commander, CISO/owner, Contracting Officer (if applicable) Post-Incident Report Template - Executive summary - Timeline of events (with UTC timestamps) - Affected systems & data types (list CUI categories) - Root cause & indicators of compromise (IOCs) - Actions taken & mitigations - Lessons learned & plan (who will implement changes, due dates) - Evidence inventory (hashes, locations) </pre> Real-world scenarios and how the workflow applies
Scenario A — Ransomware: EDR alert flags mass file modification and abnormal process chain (powershell->ransomware.exe). Triage confirms encryption behavior; Incident Commander isolates endpoint via EDR, blocks relevant IPs on firewall, and begins forensic imaging. Notify customers and contracting officer per contractual timeline. Restore from backups after ensuring backups are uncompromised. Post-incident review adds detection rule for the malware's initial access pattern.
Scenario B — Compromised credentials with suspected exfiltration: SIEM detects large outbound data transfers to an unfamiliar cloud storage. Triage checks proxy logs and SSO logs, disables the compromised account, and obtains pcaps and FTP/s3 logs as evidence. If CUI left the controlled environment, follow contractual notification requirements and prepare full incident report with forensic artifacts and a mitigation plan (MFA enforcement, credential rotation).
Compliance tips, best practices, and the risk of non-implementation
Best practices: codify IR in written playbooks and evidence artifacts so assessors can follow the chain; run tabletop exercises at least twice a year; instrument critical systems with EDR and centralized logging; enforce least privilege and MFA to reduce blast radius; automate containment for common, high-impact events. Maintain retention of logs per contract (commonly 1 year) and keep incident artifacts in an encrypted, access-controlled repository. Failure to implement these controls risks loss of CUI, contract sanctions, loss of DoD eligibility, reputational damage, and higher recovery costs—the worst outcome for a small business is contract termination or a mandatory remediation that disrupts operations.
In summary, meeting SI.L2-3.14.3 is achievable for small businesses by formalizing roles, timeboxed workflows, evidence preservation, and simple technical controls (EDR, centralized logs, playbooks). Use the templates above as a starting point, tailor timelines and escalation paths to your size, and validate the plan through regular exercises and continuous improvement so the organization can demonstrate an auditable, effective incident response capability.
