Does CMMC Level 1 require an incident response plan?

CMMC Level 1 does not have a specific practice mandating a formal, documented incident response plan. However, practices like malicious code protection (SI domain) imply a need to react to security events. A basic plan is a good idea, even if not explicitly required at Level 1.