CPS 234 · Incident management
Para 23
Detect and respond to incidents in a timely manner
frameworkAPRA CPS 234 Information Security
sectionIncident management
csf 2.0DE.AE-02 DE.CM-01 ID.IM-04 RS.MA-01 RS.MA-02 RS.MA-03 RS.MA-04
topicsIntrusion Detection, Incident Response
frameworks0 12 1
Official textAn APRA-regulated entity must have robust mechanisms in place to detect and respond to information security incidents in a timely manner.APRA Prudential Standard CPS 234 Information Security. Based on content from the Federal Register of Legislation at 27 October 2026 (footnote markers removed and lines reflowed). For the latest information on Australian Government legislation please go to https://www.legislation.gov.au. Licensed under CC BY 4.0: https://creativecommons.org/licenses/by/4.0/
Wrong or missing mapping? Report it
| Framework | Requirement | Title | Link | Source / reason |
|---|---|---|---|---|
| NIST CSF 2.0 | DE.AE-02DE.CM-01ID.IM-04RS.MA-01RS.MA-02RS.MA-03RS.MA-04 | Potentially adverse events are analyzed to better understand associated activities; Networks and network services are monitored to find potentially adverse events… | Editorial | Same topic: Intrusion Detection, Incident Response (editorial pick) |
| ISO 27001 | A.5.24A.5.25A.5.26A.8.16 | Information security incident management planning and preparation; Assessment and decision on information security events… | Editorial | Same topic: Incident Response, Intrusion Detection (editorial pick)4 loosely related (not mappings)A.5.27 Learning from information security incidents Only shares CSF ID.IM-04, RS.MA-01, RS.MA-02: related, not a mapping |
| CIS v8.1 | CIS 13.2CIS 13.3CIS 13.7CIS 13.8CIS 17.1CIS 17.4CIS 17.5CIS 17.7CIS 17.9 | Deploy a Host-Based Intrusion Detection Solution; Deploy a Network Intrusion Detection Solution… | Editorial | Same topic: Intrusion Detection, Incident Response (editorial pick)7 loosely related (not mappings)CIS 4.9 Configure Trusted DNS Servers on Enterprise Assets Only shares CSF DE.CM-01: related, not a mapping |
| SOC 2 | CC7.2CC7.3CC7.4 | Monitoring system components for anomalies; Evaluating security events to determine if they are incidents… | Editorial | Same topic: Intrusion Detection, Incident Response (editorial pick)1 loosely related (not mappings)CC6.6 Protection against threats from outside system boundaries Only shares CSF DE.CM-01: related, not a mapping |
| PCI DSS | 11.5.112.10.112.10.212.10.312.10.4 | Intrusion detection or prevention on network traffic; Incident response plan ready to activate… | Editorial | Same topic: Intrusion Detection, Incident Response (editorial pick)12 loosely related (not mappings)10.4.1 Security event and critical logs reviewed daily Only shares CSF DE.AE-02, DE.CM-01, RS.MA-02, RS.MA-03: related, not a mapping 10.2.1 Audit logs enabled and active Only shares CSF DE.AE-02, DE.CM-01, RS.MA-02: related, not a mapping 12.10.6 Plan updated from lessons learned and industry changes Only shares CSF ID.IM-04, RS.MA-03: related, not a mapping 1.2.4 Accurate account-data flow diagram maintained Only shares CSF DE.CM-01: related, not a mapping 6.4.2 Automated solution blocks attacks on public web apps Only shares CSF DE.CM-01: related, not a mapping …and 4 more in the downloads |
| CMMC | IR.L2-3.6.1IR.L2-3.6.3SI.L2-3.14.6 | Incident Handling; Incident Response Testing… | Editorial | Same topic: Incident Response, Intrusion Detection (editorial pick)13 loosely related (not mappings)IR.L2-3.6.2 Incident Reporting Only shares CSF RS.MA-01, RS.MA-02, RS.MA-03, RS.MA-04: related, not a mapping …and 5 more in the downloads |
| 800-53 | IR-2IR-3IR-4IR-8SI-4 | Incident Response Training; Incident Response Testing… | Editorial | Same topic: Incident Response, Intrusion Detection (editorial pick)15 loosely related (not mappings)IR-6 Incident Reporting Only shares CSF RS.MA-01, RS.MA-02, RS.MA-03, RS.MA-04: related, not a mapping …and 7 more in the downloads |
| HIPAA | §164.308(a)(6)§164.308(a)(6)(ii) | Security Incident Procedures; Response and Reporting | Editorial | Same topic: Incident Response (editorial pick)15 loosely related (not mappings)§164.308(a)(1)(ii)(D) Information System Activity Review Only shares CSF DE.AE-02, DE.CM-01, RS.MA-01, RS.MA-02…: related, not a mapping §164.314(a)(2)(i) Business Associate Contracts Only shares CSF RS.MA-01, RS.MA-02, RS.MA-03, RS.MA-04: related, not a mapping §164.314(a)(2)(iii) Business associate contracts with subcontractors Only shares CSF RS.MA-01, RS.MA-02, RS.MA-03, RS.MA-04: related, not a mapping §164.314(b)(2)(iv) Group Health Plan Implementation Specification Only shares CSF RS.MA-01, RS.MA-02, RS.MA-03, RS.MA-04: related, not a mapping §164.312(a)(2)(ii) Emergency Access Procedure Only shares CSF DE.CM-01, ID.IM-04: related, not a mapping §164.308(a)(3)(ii)(A) Authorization and/or Supervision Only shares CSF DE.CM-01: related, not a mapping …and 7 more in the downloads |
| GDPR | Art.33(1)Art.33(5) | Notification of a personal data breach to the supervisory authority; Notification of a personal data breach to the supervisory authority | Editorial | Same topic: Incident Response (editorial pick) |
| NIS2 | 3.13.23.5 | Incident handling policy; Monitoring and logging… | Editorial | Same topic: Incident Response, Intrusion Detection (editorial pick) |
| Essential Eight | ISM-1819 | Following the identification of a cyber security incident, the cyber security incident… | Editorial | Same topic: Incident Response (editorial pick)4 loosely related (not mappings)ISM-0109 Event logs from workstations are analysed in a timely manner to detect cyber security… Only shares CSF DE.AE-02, DE.CM-01: related, not a mapping ISM-1906 Event logs from internet-facing servers are analysed in a timely manner to detect cyber… Only shares CSF DE.AE-02, DE.CM-01: related, not a mapping ISM-1907 Event logs from non-internet-facing servers are analysed in a timely manner to detect… Only shares CSF DE.AE-02, DE.CM-01: related, not a mapping ISM-1228 Cyber security events are analysed in a timely manner to identify cyber security incidents Only shares CSF DE.AE-02: related, not a mapping |
| DORA | Art.10(1)Art.10(2)Art.11(2)(b)Art.17(1)Art.17(3)Art.18(1) | Detection; Detection… | Editorial | Same topic: Intrusion Detection, Incident Response (editorial pick) |
| Cyber Essentials | — | No requirement | No mapping in our data | No mapping in our data (Cyber Essentials covers five technical controls only). |
Crosswalk a published crosswalk (NIST, ENISA, CIS, PCI SSC) makes the link · Editorial ControlMapping's judgement where no crosswalk exists; the reason is shown · only shares a CSF 2.0 outcome: worth checking, not a mapping · No mapping in our data nothing mapped in our data; often new work, but check the coverage notes. How links are sourced.