Réponse aux incidents
Établir et mettre en œuvre les processus de réponse aux incidents.
Réponse aux incidents est défini par les résultats NIST CSF 2.0 RS.MA-01 (The incident response plan is executed in coordination with relevant third parties once an incident is declared); RS.MA-02 (Incident reports are triaged and validated); RS.MA-03 (Incidents are categorized and prioritized); RS.MA-04 (Incidents are escalated or elevated as needed); ID.IM-04 (Incident response plans and other cybersecurity plans that affect operations are established, communicated, maintained, and improved). Correspondance Mis en correspondance par une correspondance publiée dans ISO 27001, CIS v8.1, PCI DSS, CMMC, 800-53, HIPAA et NIS2. Éditorial Mis en correspondance de manière éditoriale dans SOC 2, GDPR, Essential Eight, DORA et CPS 234. Aucune correspondance dans nos données Aucune correspondance dans nos données pour Cyber Essentials.
| Référentiel | Exigence | Titre | Lien | Source / motif |
|---|---|---|---|---|
| NIST CSF 2.0 | RS.MA-01RS.MA-02RS.MA-03RS.MA-04ID.IM-04 | The incident response plan is executed in coordination with relevant third parties once an incident is declared; Incident reports are triaged and validated; Incidents are categorized and prioritized… | Définition du sujet | RS.MA-01 RS.MA-02 RS.MA-03 RS.MA-04 ID.IM-04 |
| ISO 27001 | A.5.24A.5.25A.5.26 | Information security incident management planning and preparation; Assessment and decision on information security events; Response to information security incidents | Correspondance | A.5.24: via RS.MA-02; ID.IM-04; NIST 800-53 map: IR-8 A.5.25: via RS.MA-03; NIST 800-53 map: IR-4 A.5.26: via RS.MA-01; RS.MA-02; RS.MA-04; ID.IM-04; NIST 800-53 map: IR-4 |
| CIS v8.1 | CIS 17.1CIS 17.4CIS 17.5CIS 17.7CIS 17.9 | Designate Personnel to Manage Incident Handling; Establish and Maintain an Incident Response Process; Assign Key Roles and Responsibilities… | Correspondance | CIS 17.1: Designate personnel to manage incident handling; not in CIS's own crosswalk to CSF 2.0, which covers 49 of 153 safeguards. CIS 17.4: via RS.MA-01 CIS 17.5: Assign key roles and responsibilities for incident response, including legal, IT, security and communications. CIS 17.7: Routine incident response exercises and scenarios to test the plan and staff. CIS 17.9: Editorial (CIS's published crosswalk covers 49 of 153 safeguards): security incident thresholds that trigger the response process. |
| SOC 2 | CC7.4CC7.3 | Responding to identified security incidents; Evaluating security events to determine if they are incidents | Éditorial | AICPA's TSC mappings are not openly licensed; ControlMapping editorial mapping (criterion summaries are ours, not AICPA text). |
| PCI DSS | 12.10.112.10.312.10.212.10.4 | Incident response plan ready to activate; Incident response staff available around the clock; Incident response plan reviewed and tested annually… | Correspondance | 12.10.1: via RS.MA-01; RS.MA-02; RS.MA-03; RS.MA-04; ID.IM-04 12.10.3: via RS.MA-01; RS.MA-04; ID.IM-04 12.10.2: via RS.MA-01; RS.MA-03; RS.MA-04; ID.IM-04 12.10.4: via RS.MA-02 |
| CMMC | IR.L2-3.6.1IR.L2-3.6.3 | Incident Handling; Incident Response Testing | Correspondance | IR.L2-3.6.1: via 800-171r3 03.06.01 ↔ RS.MA-02, RS.MA-03, RS.MA-04 → IR-4; 800-171r2 Appendix D → IR-4 IR.L2-3.6.3: Test the organizational incident response capability. |
| 800-53 | IR-4IR-8IR-2IR-3 | Incident Handling; Incident Response Plan; Incident Response Training… | Correspondance | IR-4: via RS.MA-02; RS.MA-03; RS.MA-04 IR-8: via RS.MA-01; ID.IM-04 IR-2: Incident response training for the people who run the plan; NIST links IR-2 to PR.AT outcomes rather than RS.MA. IR-3: Testing incident response capability; NIST links IR-3 to ID.IM-02 (improvements from tests) rather than the RS.MA outcomes. |
| HIPAA | §164.308(a)(6)§164.308(a)(6)(ii) | Security Incident Procedures; Response and Reporting | Correspondance | §164.308(a)(6): via NIST HIPAA map: IR-4 §164.308(a)(6)(ii): via NIST HIPAA map: IR-4, IR-8 |
| GDPR | Art.33(1)Art.33(5) | Notification of a personal data breach to the supervisory authority; Notification of a personal data breach to the supervisory authority | Éditorial | No official crosswalk exists for GDPR; ControlMapping editorial mapping. |
| NIS2 | 3.13.5 | Incident handling policy; Incident response | Correspondance | 3.1: via RS.MA-01; ENISA ISO map: A.5.24 3.5: via RS.MA-01; RS.MA-02; RS.MA-03; RS.MA-04; ENISA ISO map: A.5.26 |
| Essential Eight | ISM-1819 | Following the identification of a cyber security incident, the cyber security incident… | Éditorial | ISM-1819: ASD assigns these ISM controls to the Essential Eight; ASD publishes no crosswalk to NIST or ISO, so linking them to topics is ControlMapping editorial. |
| DORA | Art.17(1)Art.17(3)Art.11(2)(b)Art.18(1) | ICT-related incident management process; ICT-related incident management process; Response and recovery… | Éditorial | Art.17(1): An ICT-related incident management process to detect, manage and notify incidents. Art.17(3): Early warning indicators, classification, roles, communication, escalation and response procedures. Art.11(2)(b): Respond to and resolve ICT-related incidents quickly, limiting damage. Art.18(1): Classify ICT-related incidents and determine their impact using the regulation's criteria: clients affected, duration, geographical spread, data losses, criticality and economic impact. |
| CPS 234 | Para 23Para 24Para 25Para 26 | Detect and respond to incidents in a timely manner; Maintain information security response plans; Response plans cover all stages and escalation… | Éditorial | Para 23: Robust mechanisms to respond to information security incidents in a timely manner. Para 24: Response plans for incidents that could plausibly occur. Para 25: Plans cover every stage from detection to post-incident review, and escalation. Para 26: Review and test response plans annually. |
| Cyber Essentials | — | Aucune exigence | Aucune correspondance dans nos données | Aucune exigence Cyber Essentials n'est mise en correspondance avec ce thème dans nos données. |
Définition du sujet Résultats CSF 2.0 qui définissent ce thème · Correspondance au moins un choix appuyé par une table de correspondance publiée · Éditorial Jugement de ControlMapping, avec le motif · non mappé, partage seulement les résultats CSF de ce thème · Aucune correspondance dans nos données rien de mappé dans nos données ; souvent un travail nouveau, mais consultez les notes de couverture. Méthodologie.
Les identifiants et intitulés des exigences sont présentés tels que chaque référentiel les publie, en anglais.
Correspondance erronée ou manquante ? Signaler
À propos de Réponse aux incidents
Un programme de réponse aux incidents définit les processus et procédures structurés qu'une organisation suit pour détecter, contenir, éradiquer les incidents de cybersécurité et s'en remettre. Le plan de réponse aux incidents doit définir les niveaux de gravité, les rôles et responsabilités, les protocoles de communication, les procédures d'escalade, ainsi que l'intégration avec les équipes juridique, communication et de direction. Des exercices de simulation sur table réguliers et des exercices d'incident simulés permettent de tester l'efficacité du plan, d'identifier les écarts et de s'assurer que les membres de l'équipe peuvent exécuter leurs responsabilités sous pression lorsqu'un incident réel survient.