ICT-related incident management process

frameworkDORA (Regulation (EU) 2022/2554) sectionChapter III: ICT-related incidents csf 2.0RS.MI-01 RS.MI-02 topicsMitigation frameworks0 8 5

Official textestablish ICT-related incident response procedures to mitigate impacts and ensure that services become operational and secure in a timely manner.Regulation (EU) 2022/2554 (DORA), Official Journal of the European Union. © European Union, https://eur-lex.europa.eu (reuse authorised with acknowledgement; only the Official Journal text is authentic)

gap from DORA → gap to DORA →

Wrong or missing mapping? Report it

Equivalents of Art.17(3)(f) in other frameworks
Framework	Requirement	Title	Link	Source / reason
NIST CSF 2.0	RS.MI-01 RS.MI-02	Incidents are contained; Incidents are eradicated	Editorial	Same topic: Mitigation (editorial pick)
ISO 27001	A.5.26	Response to information security incidents	Editorial	Same topic: Mitigation (editorial pick)
CIS v8.1	—	No requirement	No mapping in our data	No mapping in our data (most CIS links are editorial: CIS's published crosswalk covers 49 of 153 safeguards).
SOC 2	CC7.4	Responding to identified security incidents	Editorial	Same topic: Mitigation (editorial pick)
PCI DSS	12.10.1	Incident response plan ready to activate	Editorial	Same topic: Mitigation (editorial pick) 6 loosely related (not mappings) 5.2.2 Anti-malware detects, removes or contains known malware Loosely related Only shares CSF RS.MI-01, RS.MI-02: related, not a mapping 2.2.1 System configuration standards developed and maintained Loosely related Only shares CSF RS.MI-02: related, not a mapping 5.2.1 Anti-malware deployed on system components Loosely related Only shares CSF RS.MI-01: related, not a mapping 5.3.2 Periodic scans or continuous behavioural analysis Loosely related Only shares CSF RS.MI-01: related, not a mapping 6.2.3 Custom code reviewed before release Loosely related Only shares CSF RS.MI-02: related, not a mapping 6.3.3 Security patches installed promptly Loosely related Only shares CSF RS.MI-02: related, not a mapping
CMMC	IR.L2-3.6.1	Incident Handling	Editorial	Same topic: Mitigation (editorial pick)
800-53	IR-4	Incident Handling	Editorial	Same topic: Mitigation (editorial pick)
HIPAA	§164.308(a)(6)(ii)	Response and Reporting	Editorial	Same topic: Mitigation (editorial pick) 1 loosely related (not mappings) §164.308(a)(6) Security Incident Procedures Loosely related Only shares CSF RS.MI-01, RS.MI-02: related, not a mapping
GDPR	—	No requirement	No mapping in our data	No mapping in our data (only GDPR's security articles are mapped, editorially).
NIS2	3.5	Incident response	Editorial	Same topic: Mitigation (editorial pick) 2 loosely related (not mappings) 3.1 Incident handling policy Loosely related Only shares CSF RS.MI-01, RS.MI-02: related, not a mapping 3.3 Event reporting Loosely related Only shares CSF RS.MI-01: related, not a mapping
Essential Eight	—	No requirement	No mapping in our data	No mapping in our data (Essential Eight links are editorial only).
CPS 234	—	No requirement	No mapping in our data	No mapping in our data (CPS 234 is principles-based and its links are editorial).
Cyber Essentials	—	No requirement	No mapping in our data	No mapping in our data (Cyber Essentials covers five technical controls only).

Crosswalk a published crosswalk (NIST, ENISA, CIS, PCI SSC) makes the link · Editorial ControlMapping's judgement where no crosswalk exists; the reason is shown · Loosely related only shares a CSF 2.0 outcome: worth checking, not a mapping · No mapping in our data nothing mapped in our data; often new work, but check the coverage notes. How links are sourced.