Response and Reporting

frameworkHIPAA Security Rule section§164.308 Administrative safeguards statusRequired csf 2.0DE.AE-02 DE.AE-03 DE.AE-06 DE.AE-08 ID.IM-01 ID.IM-02 ID.IM-03 ID.IM-04 RC.CO-03 RC.CO-04 RC.RP-01 RC.RP-02 RC.RP-04 RC.RP-06 RS.AN-03 RS.AN-06 RS.AN-07 RS.AN-08 RS.CO-02 RS.CO-03 RS.MA-01 RS.MA-02 RS.MA-03 RS.MA-04 RS.MA-05 RS.MI-01 RS.MI-02 topicsIncident Response, Mitigation, Reporting frameworks7 5 1

Official textIdentify and respond to suspected or known security incidents; mitigate, to the extent practicable, harmful effects of security incidents that are known to the covered entity or business associate; and document security incidents and their outcomes.45 CFR Part 164 Subpart C, via NIST SP 800-66r2 (public domain)

gap from HIPAA → gap to HIPAA →

Wrong or missing mapping? Report it

Equivalents of §164.308(a)(6)(ii) in other frameworks
Framework	Requirement	Title	Link	Source / reason
NIST CSF 2.0	ID.IM-04 RS.CO-02 RS.MA-01 RS.MA-02 RS.MA-03 RS.MA-04 RS.MI-01 RS.MI-02	Incident response plans and other cybersecurity plans that affect operations are established, communicated, maintained, and improved; Internal and external stakeholders are notified of incidents…	Crosswalk	Same topic: Incident Response, Reporting, Mitigation 16 loosely related (not mappings) DE.AE-02 Potentially adverse events are analyzed to better understand associated activities Loosely related Only shares CSF DE.AE-02: related, not a mapping DE.AE-03 Information is correlated from multiple sources Loosely related Only shares CSF DE.AE-03: related, not a mapping DE.AE-06 Information on adverse events is provided to authorized staff and tools Loosely related Only shares CSF DE.AE-06: related, not a mapping DE.AE-08 Incidents are declared when adverse events meet the defined incident criteria Loosely related Only shares CSF DE.AE-08: related, not a mapping RC.CO-03 Recovery activities and progress in restoring operational capabilities are communicated to designated internal and external stakeholders Loosely related Only shares CSF RC.CO-03: related, not a mapping RC.CO-04 Public updates on incident recovery are shared using approved methods and messaging Loosely related Only shares CSF RC.CO-04: related, not a mapping RC.RP-01 The recovery portion of the incident response plan is executed once initiated from the incident response process Loosely related Only shares CSF RC.RP-01: related, not a mapping RC.RP-02 Recovery actions are selected, scoped, prioritized, and performed Loosely related Only shares CSF RC.RP-02: related, not a mapping …and 8 more in the downloads
ISO 27001	A.5.5 A.5.24 A.5.25 A.5.26 A.6.8	Contact with authorities; Information security incident management planning and preparation…	Crosswalk	Same topic: Reporting, Incident Response, Mitigation 11 loosely related (not mappings) A.5.27 Learning from information security incidents Loosely related Only shares CSF ID.IM-03, ID.IM-04, RC.RP-06, RS.AN-03…: related, not a mapping A.5.28 Collection of evidence Loosely related Only shares CSF RC.CO-03, RS.AN-06, RS.AN-07, RS.MA-01…: related, not a mapping Clause 7.4 Communication Loosely related Only shares CSF RC.CO-03, RC.CO-04, RS.CO-02, RS.CO-03: related, not a mapping Clause 10.1 Continual improvement Loosely related Only shares CSF ID.IM-01, ID.IM-02, ID.IM-03, RC.RP-06: related, not a mapping A.5.29 Information security during disruption Loosely related Only shares CSF RC.RP-01: related, not a mapping A.5.30 ICT readiness for business continuity Loosely related Only shares CSF RC.RP-02: related, not a mapping A.8.13 Information backup Loosely related Only shares CSF RC.RP-06: related, not a mapping A.8.15 Logging Loosely related Only shares CSF DE.AE-03: related, not a mapping …and 3 more in the downloads
CIS v8.1	CIS 17.4 CIS 17.1 CIS 17.3 CIS 17.5 CIS 17.7 CIS 17.9	Establish and Maintain an Incident Response Process; Designate Personnel to Manage Incident Handling…	Crosswalk	Same topic: Incident Response, Reporting 21 loosely related (not mappings) CIS 17.2 Establish and Maintain Contact Information for Reporting Security Incidents Loosely related Only shares CSF RC.CO-04, RS.CO-02, RS.CO-03: related, not a mapping CIS 17.8 Conduct Post-Incident Reviews Loosely related Only shares CSF ID.IM-03, RC.RP-06, RS.AN-03: related, not a mapping CIS 17.6 Define Mechanisms for Communicating During Incident Response Loosely related Only shares CSF RC.CO-04, RS.CO-03: related, not a mapping CIS 8.11 Conduct Audit Log Reviews Loosely related Only shares CSF DE.AE-02: related, not a mapping CIS 8.9 Centralize Audit Logs Loosely related Only shares CSF DE.AE-03, DE.AE-06, DE.AE-08: related, not a mapping CIS 11.1 Establish and Maintain a Data Recovery Process Loosely related Only shares CSF ID.IM-04, RC.RP-01, RC.RP-02: related, not a mapping CIS 13.1 Centralize Security Event Alerting Loosely related Only shares CSF DE.AE-03, DE.AE-06, DE.AE-08: related, not a mapping CIS 13.11 Tune Security Event Alerting Thresholds Loosely related Only shares CSF DE.AE-03, DE.AE-06, DE.AE-08: related, not a mapping …and 13 more in the downloads
SOC 2	CC2.3 CC7.3 CC7.4	Communication with external parties; Evaluating security events to determine if they are incidents…	Editorial	Same topic: Reporting, Incident Response, Mitigation (editorial pick) 6 loosely related (not mappings) CC7.5 Recovering from identified security incidents Loosely related Only shares CSF ID.IM-03, ID.IM-04, RC.CO-03, RC.CO-04…: related, not a mapping A1.3 Testing recovery plan procedures Loosely related Only shares CSF ID.IM-04, RC.RP-01, RC.RP-02: related, not a mapping A1.2 Environmental protections, backups and recovery infrastructure Loosely related Only shares CSF RC.RP-02, RC.RP-04: related, not a mapping CC7.2 Monitoring system components for anomalies Loosely related Only shares CSF DE.AE-02, DE.AE-03: related, not a mapping A1.1 Capacity management to meet availability commitments Loosely related Only shares CSF RC.RP-04: related, not a mapping CC9.1 Mitigating risks from business disruptions Loosely related Only shares CSF RC.RP-04: related, not a mapping
PCI DSS	12.10.1 12.10.2 12.10.3 12.10.4	Incident response plan ready to activate; Incident response plan reviewed and tested annually…	Crosswalk	Same topic: Incident Response, Mitigation, Reporting 26 loosely related (not mappings) 12.10.6 Plan updated from lessons learned and industry changes Loosely related Only shares CSF ID.IM-02, ID.IM-04, RC.RP-02, RC.RP-06…: related, not a mapping 10.2.1 Audit logs enabled and active Loosely related Only shares CSF DE.AE-02, DE.AE-03, RC.RP-04, RS.AN-03…: related, not a mapping 10.4.1 Security event and critical logs reviewed daily Loosely related Only shares CSF DE.AE-02, DE.AE-03, RS.AN-03, RS.AN-08…: related, not a mapping 10.3.3 Logs promptly backed up to a central server Loosely related Only shares CSF DE.AE-02, DE.AE-03, DE.AE-06, RS.AN-06…: related, not a mapping 1.2.4 Accurate account-data flow diagram maintained Loosely related Only shares CSF DE.AE-03, RC.RP-02, RC.RP-04, RS.AN-08: related, not a mapping 12.8.2 Written agreements with service providers Loosely related Only shares CSF RC.CO-03, RS.CO-02, RS.CO-03, RS.MA-01: related, not a mapping 1.2.3 Accurate network diagram maintained Loosely related Only shares CSF RC.RP-02, RC.RP-04, RS.AN-08: related, not a mapping 10.5.1 Audit logs retained 12 months, three immediately available Loosely related Only shares CSF DE.AE-03, RC.RP-06, RS.AN-06: related, not a mapping …and 18 more in the downloads
CMMC	IR.L2-3.6.1 IR.L2-3.6.2 IR.L2-3.6.3	Incident Handling; Incident Reporting…	Crosswalk	Same topic: Incident Response, Mitigation, Reporting 8 loosely related (not mappings) CA.L2-3.12.3 Security Control Monitoring Loosely related Only shares CSF DE.AE-02, DE.AE-03, ID.IM-01, ID.IM-02…: related, not a mapping CM.L2-3.4.9 User-Installed Software Loosely related Only shares CSF DE.AE-02, DE.AE-03, ID.IM-01, ID.IM-02…: related, not a mapping SI.L2-3.14.6 Monitor Communications for Attacks Loosely related Only shares CSF DE.AE-02, DE.AE-03, ID.IM-01, ID.IM-02…: related, not a mapping SI.L2-3.14.7 Identify Unauthorized Use Loosely related Only shares CSF DE.AE-02, DE.AE-03, ID.IM-01, ID.IM-02…: related, not a mapping RA.L2-3.11.1 Risk Assessments Loosely related Only shares CSF ID.IM-01, ID.IM-02, ID.IM-03, RS.AN-08: related, not a mapping AU.L2-3.3.6 Reduction & Reporting Loosely related Only shares CSF RS.AN-03, RS.AN-06, RS.AN-07: related, not a mapping AU.L2-3.3.5 Audit Correlation Loosely related Only shares CSF DE.AE-02, DE.AE-03: related, not a mapping AU.L2-3.3.7 Authoritative Time Source Loosely related Only shares CSF DE.AE-03: related, not a mapping
800-53	IR-4 IR-6 IR-8 IR-2 IR-3 IR-5 IR-7 IR-9	Incident Handling; Incident Reporting…	Crosswalk	Same topic: Incident Response, Mitigation, Reporting NIST HIPAA → SP 800-53 crosswalk 19 loosely related (not mappings) CA-7 Continuous Monitoring Loosely related Only shares CSF DE.AE-02, DE.AE-03, ID.IM-01, ID.IM-02…: related, not a mapping CP-2 Contingency Plan Loosely related Only shares CSF ID.IM-01, ID.IM-02, ID.IM-03, ID.IM-04…: related, not a mapping SI-4 System Monitoring Loosely related Only shares CSF DE.AE-02, DE.AE-03, ID.IM-01, ID.IM-02…: related, not a mapping RA-3 Risk Assessment Loosely related Only shares CSF ID.IM-01, ID.IM-02, ID.IM-03, RS.AN-08: related, not a mapping RA-7 Risk Response Loosely related Only shares CSF ID.IM-01, ID.IM-02, ID.IM-03, RS.AN-08: related, not a mapping SR-8 Notification Agreements Loosely related Only shares CSF RC.CO-03, RS.CO-02, RS.CO-03, RS.MA-01: related, not a mapping AU-7 Audit Record Reduction and Report Generation Loosely related Only shares CSF RS.AN-03, RS.AN-06, RS.AN-07: related, not a mapping SR-3 Supply Chain Controls and Processes Loosely related Only shares CSF RS.CO-02, RS.CO-03, RS.MA-01: related, not a mapping …and 11 more in the downloads
GDPR	Art.33(1)Art.33(5)Art.34(1)	Notification of a personal data breach to the supervisory authority; Notification of a personal data breach to the supervisory authority…	Editorial	Same topic: Incident Response, Reporting (editorial pick) 2 loosely related (not mappings) Art.32(1)(c) Security of processing Loosely related Only shares CSF ID.IM-04, RC.RP-01, RC.RP-02: related, not a mapping Art.32(1)(b) Security of processing Loosely related Only shares CSF RC.RP-04: related, not a mapping
NIS2	3.1 3.3 3.5	Incident handling policy; Event reporting…	Crosswalk	Same topic: Incident Response, Reporting, Mitigation 6 loosely related (not mappings) 4.3 Crisis management Loosely related Only shares CSF DE.AE-02, DE.AE-03, DE.AE-06, DE.AE-08…: related, not a mapping 3.4 Event assessment and classification Loosely related Only shares CSF RS.MA-02, RS.MA-03, RS.MA-04: related, not a mapping 3.2 Monitoring and logging Loosely related Only shares CSF RS.AN-06, RS.AN-07: related, not a mapping 4.1 Business continuity and disaster recovery plan Loosely related Only shares CSF RC.RP-01, RC.RP-02: related, not a mapping 4.2 Backup management Loosely related Only shares CSF RC.RP-01, RC.RP-02: related, not a mapping 3.6 Post-incident reviews Loosely related Only shares CSF RS.AN-08: related, not a mapping
Essential Eight	ISM-0123 ISM-0140 ISM-1819	Cyber security incidents are reported to the chief information security officer, or one…; Cyber security incidents are reported to ASD as soon as possible after they occur or……	Editorial	Same topic: Reporting, Incident Response (editorial pick) 10 loosely related (not mappings) ISM-1228 Cyber security events are analysed in a timely manner to identify cyber security incidents Loosely related Only shares CSF DE.AE-02, DE.AE-03, DE.AE-06, DE.AE-08: related, not a mapping ISM-1906 Event logs from internet-facing servers are analysed in a timely manner to detect cyber… Loosely related Only shares CSF DE.AE-02, DE.AE-03, DE.AE-06, DE.AE-08: related, not a mapping ISM-0109 Event logs from workstations are analysed in a timely manner to detect cyber security… Loosely related Only shares CSF DE.AE-02, DE.AE-03: related, not a mapping ISM-1907 Event logs from non-internet-facing servers are analysed in a timely manner to detect… Loosely related Only shares CSF DE.AE-02, DE.AE-03: related, not a mapping ISM-1509 Privileged access events are centrally logged Loosely related Only shares CSF DE.AE-03: related, not a mapping ISM-1515 Restoration of data, applications and settings from backups to a common point in time… Loosely related Only shares CSF RC.RP-02: related, not a mapping ISM-1623 PowerShell module logging, script block logging and transcription events are centrally… Loosely related Only shares CSF DE.AE-03: related, not a mapping ISM-1660 Allowed and blocked application control events are centrally logged Loosely related Only shares CSF DE.AE-03: related, not a mapping …and 2 more in the downloads
DORA	Art.11(2)(b)Art.11(2)(c)Art.17(1)Art.17(3)Art.17(3)(f)Art.18(1)Art.19(1)Art.19(3)Art.19(4)	Response and recovery; Response and recovery…	Editorial	Same topic: Incident Response, Mitigation, Reporting (editorial pick) 17 loosely related (not mappings) Art.13(2) Learning and evolving Loosely related Only shares CSF ID.IM-03, RC.RP-06, RS.AN-03, RS.AN-06…: related, not a mapping Art.10(2) Detection Loosely related Only shares CSF DE.AE-02, DE.AE-03, DE.AE-06, DE.AE-08: related, not a mapping Art.10(3) Detection Loosely related Only shares CSF DE.AE-03, DE.AE-06, DE.AE-08: related, not a mapping Art.11(3) Response and recovery Loosely related Only shares CSF ID.IM-04, RC.RP-01, RC.RP-02: related, not a mapping Art.12(6) Backup policies and procedures, restoration and recovery procedures and methods Loosely related Only shares CSF ID.IM-04, RC.RP-01, RC.RP-02: related, not a mapping Art.17(2) ICT-related incident management process Loosely related Only shares CSF RS.AN-03, RS.AN-06, RS.AN-07: related, not a mapping Art.11(2)(e) Response and recovery Loosely related Only shares CSF RC.CO-03, RC.CO-04: related, not a mapping Art.11(6) Response and recovery Loosely related Only shares CSF RC.RP-02, RC.RP-04: related, not a mapping …and 9 more in the downloads
CPS 234	Para 23 Para 24 Para 25 Para 26 Para 35 Para 36	Detect and respond to incidents in a timely manner; Maintain information security response plans…	Editorial	Same topic: Incident Response, Reporting (editorial pick)
Cyber Essentials	—	No requirement	No mapping in our data	No mapping in our data (Cyber Essentials covers five technical controls only).

Crosswalk a published crosswalk (NIST, ENISA, CIS, PCI SSC) makes the link · Editorial ControlMapping's judgement where no crosswalk exists; the reason is shown · Loosely related only shares a CSF 2.0 outcome: worth checking, not a mapping · No mapping in our data nothing mapped in our data; often new work, but check the coverage notes. How links are sourced.