CPS 234 · Incident management
Para 25
Response plans cover all stages and escalation
frameworkAPRA CPS 234 Information Security
sectionIncident management
csf 2.0ID.IM-03 ID.IM-04 RC.RP-06 RS.CO-03 RS.MA-01 RS.MA-02 RS.MA-03 RS.MA-04
topicsIncident Response, Communication, Lessons Learned
frameworks0 12 1
Official textAn APRA-regulated entity's information security response plans must include the mechanisms in place for:
(a) managing all relevant stages of an incident, from detection to post-incident review; and
(b) escalation and reporting of information security incidents to the Board, other governing bodies and individuals responsible for information security incident management and oversight, as appropriate.APRA Prudential Standard CPS 234 Information Security. Based on content from the Federal Register of Legislation at 27 October 2026 (footnote markers removed and lines reflowed). For the latest information on Australian Government legislation please go to https://www.legislation.gov.au. Licensed under CC BY 4.0: https://creativecommons.org/licenses/by/4.0/
(a) managing all relevant stages of an incident, from detection to post-incident review; and
(b) escalation and reporting of information security incidents to the Board, other governing bodies and individuals responsible for information security incident management and oversight, as appropriate.APRA Prudential Standard CPS 234 Information Security. Based on content from the Federal Register of Legislation at 27 October 2026 (footnote markers removed and lines reflowed). For the latest information on Australian Government legislation please go to https://www.legislation.gov.au. Licensed under CC BY 4.0: https://creativecommons.org/licenses/by/4.0/
Wrong or missing mapping? Report it
| Framework | Requirement | Title | Link | Source / reason |
|---|---|---|---|---|
| NIST CSF 2.0 | ID.IM-03ID.IM-04RC.RP-06RS.CO-03RS.MA-01RS.MA-02RS.MA-03RS.MA-04 | Improvements are identified from execution of operational processes, procedures, and activities; Incident response plans and other cybersecurity plans that affect operations are established, communicated, maintained, and improved… | Editorial | Same topic: Lessons Learned, Incident Response, Communication (editorial pick) |
| ISO 27001 | A.5.6A.5.24A.5.25A.5.26A.5.27Clause 7.4Clause 10.1 | Contact with special interest groups; Information security incident management planning and preparation… | Editorial | Same topic: Communication, Incident Response, Lessons Learned (editorial pick) |
| CIS v8.1 | CIS 17.1CIS 17.2CIS 17.4CIS 17.5CIS 17.6CIS 17.7CIS 17.8CIS 17.9 | Designate Personnel to Manage Incident Handling; Establish and Maintain Contact Information for Reporting Security Incidents… | Editorial | Same topic: Incident Response, Communication, Lessons Learned (editorial pick) |
| SOC 2 | CC2.3CC7.3CC7.4CC7.5 | Communication with external parties; Evaluating security events to determine if they are incidents… | Editorial | Same topic: Communication, Incident Response, Lessons Learned (editorial pick) |
| PCI DSS | 12.10.112.10.212.10.312.10.412.10.6 | Incident response plan ready to activate; Incident response plan reviewed and tested annually… | Editorial | Same topic: Incident Response, Lessons Learned (editorial pick)5 loosely related (not mappings)10.4.1 Security event and critical logs reviewed daily Only shares CSF RS.MA-02, RS.MA-03: related, not a mapping 12.8.2 Written agreements with service providers Only shares CSF RS.CO-03, RS.MA-01: related, not a mapping 10.5.1 Audit logs retained 12 months, three immediately available Only shares CSF RC.RP-06: related, not a mapping 12.8.4 Service provider compliance monitored annually Only shares CSF RS.CO-03: related, not a mapping |
| CMMC | IR.L2-3.6.1IR.L2-3.6.2IR.L2-3.6.3 | Incident Handling; Incident Reporting… | Editorial | Same topic: Incident Response, Lessons Learned, Communication (editorial pick) |
| 800-53 | IR-2IR-3IR-4IR-7IR-8 | Incident Response Training; Incident Response Testing… | Editorial | Same topic: Incident Response, Lessons Learned, Communication (editorial pick)4 loosely related (not mappings)IR-6 Incident Reporting Only shares CSF RS.CO-03, RS.MA-01, RS.MA-02, RS.MA-03…: related, not a mapping |
| HIPAA | §164.308(a)(6)§164.308(a)(6)(ii) | Security Incident Procedures; Response and Reporting | Editorial | Same topic: Incident Response (editorial pick)4 loosely related (not mappings)§164.308(a)(1)(ii)(D) Information System Activity Review Only shares CSF ID.IM-03, RS.CO-03, RS.MA-01, RS.MA-02…: related, not a mapping §164.314(a)(2)(i) Business Associate Contracts Only shares CSF ID.IM-03, RS.CO-03, RS.MA-01, RS.MA-02…: related, not a mapping §164.314(a)(2)(iii) Business associate contracts with subcontractors Only shares CSF ID.IM-03, RS.CO-03, RS.MA-01, RS.MA-02…: related, not a mapping §164.314(b)(2)(iv) Group Health Plan Implementation Specification Only shares CSF RS.CO-03, RS.MA-01, RS.MA-02, RS.MA-03…: related, not a mapping |
| GDPR | Art.33(1)Art.33(5) | Notification of a personal data breach to the supervisory authority; Notification of a personal data breach to the supervisory authority | Editorial | Same topic: Incident Response (editorial pick) |
| NIS2 | 3.13.53.64.3 | Incident handling policy; Incident response… | Editorial | Same topic: Incident Response, Lessons Learned, Communication (editorial pick)1 loosely related (not mappings)3.4 Event assessment and classification Only shares CSF RS.MA-02, RS.MA-03, RS.MA-04: related, not a mapping |
| Essential Eight | ISM-1819 | Following the identification of a cyber security incident, the cyber security incident… | Editorial | Same topic: Incident Response (editorial pick) |
| DORA | Art.11(2)(b)Art.13(2)Art.13(3)Art.14(1)Art.14(2)Art.17(1)Art.17(3)Art.17(3)(d)Art.18(1) | Response and recovery; Learning and evolving… | Editorial | Same topic: Incident Response, Lessons Learned, Communication (editorial pick) |
| Cyber Essentials | — | No requirement | No mapping in our data | No mapping in our data (Cyber Essentials covers five technical controls only). |
Crosswalk a published crosswalk (NIST, ENISA, CIS, PCI SSC) makes the link · Editorial ControlMapping's judgement where no crosswalk exists; the reason is shown · only shares a CSF 2.0 outcome: worth checking, not a mapping · No mapping in our data nothing mapped in our data; often new work, but check the coverage notes. How links are sourced.