Assign Key Roles and Responsibilities

frameworkCIS Controls v8.1 section17. Incident Response Management csf 2.0ID.IM-04 RS.MA-01 RS.MA-02 RS.MA-03 RS.MA-04 topicsIncident Response frameworks0 12 1

Official text · not licensableSafeguard title © CIS (CC BY-NC-ND 4.0). See CIS Controls v8.1 for details.

gap from CIS v8.1 → gap to CIS v8.1 →

Wrong or missing mapping? Report it

Equivalents of CIS 17.5 in other frameworks
Framework	Requirement	Title	Link	Source / reason
NIST CSF 2.0	ID.IM-04 RS.MA-01 RS.MA-02 RS.MA-03 RS.MA-04	Incident response plans and other cybersecurity plans that affect operations are established, communicated, maintained, and improved; The incident response plan is executed in coordination with relevant third parties once an incident is declared…	Editorial	Same topic: Incident Response (editorial pick)
ISO 27001	A.5.24 A.5.25 A.5.26	Information security incident management planning and preparation; Assessment and decision on information security events…	Editorial	Same topic: Incident Response (editorial pick) 3 loosely related (not mappings) A.5.27 Learning from information security incidents Loosely related Only shares CSF ID.IM-04, RS.MA-01, RS.MA-02: related, not a mapping A.5.28 Collection of evidence Loosely related Only shares CSF RS.MA-01, RS.MA-02: related, not a mapping A.6.8 Information security event reporting Loosely related Only shares CSF RS.MA-02: related, not a mapping
SOC 2	CC7.3 CC7.4	Evaluating security events to determine if they are incidents; Responding to identified security incidents	Editorial	Same topic: Incident Response (editorial pick)
PCI DSS	12.10.1 12.10.2 12.10.3 12.10.4	Incident response plan ready to activate; Incident response plan reviewed and tested annually…	Editorial	Same topic: Incident Response (editorial pick) 4 loosely related (not mappings) 10.4.1 Security event and critical logs reviewed daily Loosely related Only shares CSF RS.MA-02, RS.MA-03: related, not a mapping 12.10.6 Plan updated from lessons learned and industry changes Loosely related Only shares CSF ID.IM-04, RS.MA-03: related, not a mapping 10.2.1 Audit logs enabled and active Loosely related Only shares CSF RS.MA-02: related, not a mapping 12.8.2 Written agreements with service providers Loosely related Only shares CSF RS.MA-01: related, not a mapping
CMMC	IR.L2-3.6.1 IR.L2-3.6.3	Incident Handling; Incident Response Testing	Editorial	Same topic: Incident Response (editorial pick) 1 loosely related (not mappings) IR.L2-3.6.2 Incident Reporting Loosely related Only shares CSF RS.MA-01, RS.MA-02, RS.MA-03, RS.MA-04: related, not a mapping
800-53	IR-2 IR-3 IR-4 IR-8	Incident Response Training; Incident Response Testing…	Editorial	Same topic: Incident Response (editorial pick) 5 loosely related (not mappings) IR-6 Incident Reporting Loosely related Only shares CSF RS.MA-01, RS.MA-02, RS.MA-03, RS.MA-04: related, not a mapping IR-5 Incident Monitoring Loosely related Only shares CSF RS.MA-02, RS.MA-03, RS.MA-04: related, not a mapping IR-7 Incident Response Assistance Loosely related Only shares CSF RS.MA-01, RS.MA-04: related, not a mapping SR-3 Supply Chain Controls and Processes Loosely related Only shares CSF RS.MA-01: related, not a mapping SR-8 Notification Agreements Loosely related Only shares CSF RS.MA-01: related, not a mapping
HIPAA	§164.308(a)(6)§164.308(a)(6)(ii)	Security Incident Procedures; Response and Reporting	Editorial	Same topic: Incident Response (editorial pick) 4 loosely related (not mappings) §164.308(a)(1)(ii)(D) Information System Activity Review Loosely related Only shares CSF RS.MA-01, RS.MA-02, RS.MA-03, RS.MA-04: related, not a mapping §164.314(a)(2)(i) Business Associate Contracts Loosely related Only shares CSF RS.MA-01, RS.MA-02, RS.MA-03, RS.MA-04: related, not a mapping §164.314(a)(2)(iii) Business associate contracts with subcontractors Loosely related Only shares CSF RS.MA-01, RS.MA-02, RS.MA-03, RS.MA-04: related, not a mapping §164.314(b)(2)(iv) Group Health Plan Implementation Specification Loosely related Only shares CSF RS.MA-01, RS.MA-02, RS.MA-03, RS.MA-04: related, not a mapping
GDPR	Art.33(1)Art.33(5)	Notification of a personal data breach to the supervisory authority; Notification of a personal data breach to the supervisory authority	Editorial	Same topic: Incident Response (editorial pick)
NIS2	3.1 3.5	Incident handling policy; Incident response	Editorial	Same topic: Incident Response (editorial pick) 1 loosely related (not mappings) 3.4 Event assessment and classification Loosely related Only shares CSF RS.MA-02, RS.MA-03, RS.MA-04: related, not a mapping
Essential Eight	ISM-1819	Following the identification of a cyber security incident, the cyber security incident…	Editorial	Same topic: Incident Response (editorial pick)
DORA	Art.11(2)(b)Art.17(1)Art.17(3)Art.18(1)	Response and recovery; ICT-related incident management process…	Editorial	Same topic: Incident Response (editorial pick)
CPS 234	Para 23 Para 24 Para 25 Para 26	Detect and respond to incidents in a timely manner; Maintain information security response plans…	Editorial	Same topic: Incident Response (editorial pick)
Cyber Essentials	—	No requirement	No mapping in our data	No mapping in our data (Cyber Essentials covers five technical controls only).

Crosswalk a published crosswalk (NIST, ENISA, CIS, PCI SSC) makes the link · Editorial ControlMapping's judgement where no crosswalk exists; the reason is shown · Loosely related only shares a CSF 2.0 outcome: worth checking, not a mapping · No mapping in our data nothing mapped in our data; often new work, but check the coverage notes. How links are sourced.