Review and test response plans annually

frameworkAPRA CPS 234 Information Security sectionIncident management csf 2.0ID.IM-04 RS.MA-01 RS.MA-02 RS.MA-03 RS.MA-04 topicsIncident Response frameworks0 12 1

Official textAn APRA-regulated entity must annually review and test its information security response plans to ensure they remain effective and fit-for-purpose.APRA Prudential Standard CPS 234 Information Security. Based on content from the Federal Register of Legislation at 27 October 2026 (footnote markers removed and lines reflowed). For the latest information on Australian Government legislation please go to https://www.legislation.gov.au. Licensed under CC BY 4.0: https://creativecommons.org/licenses/by/4.0/

gap from CPS 234 → gap to CPS 234 →

Wrong or missing mapping? Report it

Equivalents of Para 26 in other frameworks
Framework	Requirement	Title	Link	Source / reason
NIST CSF 2.0	ID.IM-04 RS.MA-01 RS.MA-02 RS.MA-03 RS.MA-04	Incident response plans and other cybersecurity plans that affect operations are established, communicated, maintained, and improved; The incident response plan is executed in coordination with relevant third parties once an incident is declared…	Editorial	Same topic: Incident Response (editorial pick)
ISO 27001	A.5.24 A.5.25 A.5.26	Information security incident management planning and preparation; Assessment and decision on information security events…	Editorial	Same topic: Incident Response (editorial pick) 3 loosely related (not mappings) A.5.27 Learning from information security incidents Loosely related Only shares CSF ID.IM-04, RS.MA-01, RS.MA-02: related, not a mapping A.5.28 Collection of evidence Loosely related Only shares CSF RS.MA-01, RS.MA-02: related, not a mapping A.6.8 Information security event reporting Loosely related Only shares CSF RS.MA-02: related, not a mapping
CIS v8.1	CIS 17.1 CIS 17.4 CIS 17.5 CIS 17.7 CIS 17.9	Designate Personnel to Manage Incident Handling; Establish and Maintain an Incident Response Process…	Editorial	Same topic: Incident Response (editorial pick)
SOC 2	CC7.3 CC7.4	Evaluating security events to determine if they are incidents; Responding to identified security incidents	Editorial	Same topic: Incident Response (editorial pick)
PCI DSS	12.10.1 12.10.2 12.10.3 12.10.4	Incident response plan ready to activate; Incident response plan reviewed and tested annually…	Editorial	Same topic: Incident Response (editorial pick) 4 loosely related (not mappings) 10.4.1 Security event and critical logs reviewed daily Loosely related Only shares CSF RS.MA-02, RS.MA-03: related, not a mapping 12.10.6 Plan updated from lessons learned and industry changes Loosely related Only shares CSF ID.IM-04, RS.MA-03: related, not a mapping 10.2.1 Audit logs enabled and active Loosely related Only shares CSF RS.MA-02: related, not a mapping 12.8.2 Written agreements with service providers Loosely related Only shares CSF RS.MA-01: related, not a mapping
CMMC	IR.L2-3.6.1 IR.L2-3.6.3	Incident Handling; Incident Response Testing	Editorial	Same topic: Incident Response (editorial pick) 1 loosely related (not mappings) IR.L2-3.6.2 Incident Reporting Loosely related Only shares CSF RS.MA-01, RS.MA-02, RS.MA-03, RS.MA-04: related, not a mapping
800-53	IR-2 IR-3 IR-4 IR-8	Incident Response Training; Incident Response Testing…	Editorial	Same topic: Incident Response (editorial pick) 5 loosely related (not mappings) IR-6 Incident Reporting Loosely related Only shares CSF RS.MA-01, RS.MA-02, RS.MA-03, RS.MA-04: related, not a mapping IR-5 Incident Monitoring Loosely related Only shares CSF RS.MA-02, RS.MA-03, RS.MA-04: related, not a mapping IR-7 Incident Response Assistance Loosely related Only shares CSF RS.MA-01, RS.MA-04: related, not a mapping SR-3 Supply Chain Controls and Processes Loosely related Only shares CSF RS.MA-01: related, not a mapping SR-8 Notification Agreements Loosely related Only shares CSF RS.MA-01: related, not a mapping
HIPAA	§164.308(a)(6)§164.308(a)(6)(ii)	Security Incident Procedures; Response and Reporting	Editorial	Same topic: Incident Response (editorial pick) 4 loosely related (not mappings) §164.308(a)(1)(ii)(D) Information System Activity Review Loosely related Only shares CSF RS.MA-01, RS.MA-02, RS.MA-03, RS.MA-04: related, not a mapping §164.314(a)(2)(i) Business Associate Contracts Loosely related Only shares CSF RS.MA-01, RS.MA-02, RS.MA-03, RS.MA-04: related, not a mapping §164.314(a)(2)(iii) Business associate contracts with subcontractors Loosely related Only shares CSF RS.MA-01, RS.MA-02, RS.MA-03, RS.MA-04: related, not a mapping §164.314(b)(2)(iv) Group Health Plan Implementation Specification Loosely related Only shares CSF RS.MA-01, RS.MA-02, RS.MA-03, RS.MA-04: related, not a mapping
GDPR	Art.33(1)Art.33(5)	Notification of a personal data breach to the supervisory authority; Notification of a personal data breach to the supervisory authority	Editorial	Same topic: Incident Response (editorial pick)
NIS2	3.1 3.5	Incident handling policy; Incident response	Editorial	Same topic: Incident Response (editorial pick) 1 loosely related (not mappings) 3.4 Event assessment and classification Loosely related Only shares CSF RS.MA-02, RS.MA-03, RS.MA-04: related, not a mapping
Essential Eight	ISM-1819	Following the identification of a cyber security incident, the cyber security incident…	Editorial	Same topic: Incident Response (editorial pick)
DORA	Art.11(2)(b)Art.17(1)Art.17(3)Art.18(1)	Response and recovery; ICT-related incident management process…	Editorial	Same topic: Incident Response (editorial pick)
Cyber Essentials	—	No requirement	No mapping in our data	No mapping in our data (Cyber Essentials covers five technical controls only).

Crosswalk a published crosswalk (NIST, ENISA, CIS, PCI SSC) makes the link · Editorial ControlMapping's judgement where no crosswalk exists; the reason is shown · Loosely related only shares a CSF 2.0 outcome: worth checking, not a mapping · No mapping in our data nothing mapped in our data; often new work, but check the coverage notes. How links are sourced.