Skip to main content
MuonPartners
Services
Architecture

Solution design and technology roadmapping

Solution AssessmentTechnology RoadmapsIntegration DesignSolution ArchitectureTechnical Design
Cyber Security

Security assessments, IAM, and compliance

AssessmentsIAMComplianceSecurity BaselineCyber Innovation
Network and Platform

Network architecture and cloud platforms

Network DesignCloud StrategyModernisation
Enterprise Architecture

Business-technology alignment

Business AlignmentPortfolio AnalysisGovernance
View all services
ProjectsCase StudiesInsightsToolsAbout
Contact Us

Services

Architecture
Solution AssessmentTechnology RoadmapsIntegration DesignSolution ArchitectureTechnical Design
Cyber Security
AssessmentsIAMComplianceSecurity BaselineCyber Innovation
Network and Platform
Network DesignCloud StrategyModernisation
Enterprise Architecture
Business AlignmentPortfolio AnalysisGovernance
ProjectsCase StudiesInsightsToolsAboutContact
Get in Touch
MuonPartners

Strategic technology consulting for Australian organisations navigating complexity.

Services

  • Architecture
  • Cyber Security
  • Network and Platform
  • Enterprise Architecture

Company

  • About
  • Products
  • Frameworks
  • Cross-Framework Mapping
  • Projects
  • Case Studies
  • Insights
  • Contact

Contact

  • [email protected]
  • Australia
  • LinkedIn

© 2026 Muon Partners. All rights reserved.

ABN 50 669 022 315 · A Muon Group company.

Privacy PolicyTerms of Service
  1. Frameworks
  2. >C2M2
  3. >Event And Incident Response, Continuity Of Operations
  4. >Event And Incident Response, Continuity Of Operations - Objective 3
  5. >C2M2-RESPONSE-3K
C2M2-RESPONSE-3KActive

Cybersecurity incident response personnel participate in joint cybersecurity exercises with other organizations

Statement

Cybersecurity incident response personnel participate in joint cybersecurity exercises with other organizations

Location

Domain
Event and Incident Response, Continuity of Operations
Objective
Event and Incident Response, Continuity of Operations - Objective 3

Practice Details

Identifier
C2M2-RESPONSE-3K
Domain
Event and Incident Response, Continuity of Operations
Objective
Objective 3
Maturity Level
MIL-3

Help Text

If possible, incident response personnel should participate in joint cybersecurity exercises to become familiar with the entities and individuals they would need to work with in a real-world incident, gain experience in response activities, possibly identify deficiencies in internal response plans, and share their knowledge and experience with others in the community. One example of a joint exercise in the Electric Sector is the Grid Security Exercise (GridEx), the Department of Energy’s annual two-day exercise.

Related Practices · Progression: This practice is part of a practice progression. Practice progressions are groups of related practices that represent increasingly complete or more advanced implementations of an activity. The practices in this progression include: RESPONSE-3g, RESPONSE-3k.

AESCSF
AESCSF-RESPONSE-3kequivalentvia derived-shared-practice-structure
View in graphReport an issue
← Back to Event and Incident Response, Continuity of Operations - Objective 3
Event and Incident Response, Continuity of Operations - Objective 312 controls
C2M2-RESPONSE-3ACybersecurity incident response personnel are identified, and roles are assigned, at least in an ad hoc mannerC2M2-RESPONSE-3BResponses to cybersecurity incidents are executed, at least in an ad hoc manner, to limit impact to the function and restore normal operationsC2M2-RESPONSE-3CReporting of incidents is performed (for example, internal reporting, ICS-CERT, relevant ISACs), at least in an ad hoc mannerC2M2-RESPONSE-3DCybersecurity incident response plans that address all phases of the incident lifecycle are established and maintainedC2M2-RESPONSE-3ECybersecurity incident response is executed according to defined plans and proceduresC2M2-RESPONSE-3FCybersecurity incident response plans include a communications plan for internal and external stakeholdersC2M2-RESPONSE-3GCybersecurity incident response plan exercises are conducted periodically and according to defined triggers, such as system changes and external eventsC2M2-RESPONSE-3HCybersecurity incident lessons-learned activities are performed and corrective actions are taken, including updates to the incident response planC2M2-RESPONSE-3ICybersecurity incident root-cause analysis is performed and corrective actions are taken, including updates to the incident response planC2M2-RESPONSE-3JCybersecurity incident responses are coordinated with vendors, law enforcement, and other external entities as appropriate, including support for evidence collection and preservationC2M2-RESPONSE-3KCybersecurity incident response personnel participate in joint cybersecurity exercises with other organizationsC2M2-RESPONSE-3LCybersecurity incident responses leverage and trigger predefined states of operation (SITUATION-3g)