NIS2 · 3. Incident handling

Event reporting

frameworkNIS2 Implementing Regulation (EU) 2024/2690 section3. Incident handling csf 2.0RS.CO-02 RS.MI-01 topicsReporting frameworks6 6 1

Official text · not licensableTitle from ENISA's guidance: Event reporting. See the Annex to Implementing Regulation (EU) 2024/2690 for the legal text.

gap from NIS2 → gap to NIS2 →

Wrong or missing mapping? Report it

Equivalents of 3.3 in other frameworks
Framework	Requirement	Title	Link	Source / reason
NIST CSF 2.0	RS.CO-02	Internal and external stakeholders are notified of incidents	Crosswalk	Same topic: Reporting 1 loosely related (not mappings) RS.MI-01 Incidents are contained Loosely related Only shares CSF RS.MI-01: related, not a mapping
ISO 27001	A.5.5 A.6.8	Contact with authorities; Information security event reporting	Crosswalk	Same topic: Reporting 2 loosely related (not mappings) A.5.26 Response to information security incidents Loosely related Only shares CSF RS.CO-02, RS.MI-01: related, not a mapping Clause 7.4 Communication Loosely related Only shares CSF RS.CO-02: related, not a mapping
CIS v8.1	CIS 17.3	Establish and Maintain an Enterprise Process for Reporting Incidents	Editorial	Same topic: Reporting (editorial pick) 1 loosely related (not mappings) CIS 17.2 Establish and Maintain Contact Information for Reporting Security Incidents Loosely related Only shares CSF RS.CO-02: related, not a mapping
SOC 2	CC2.3	Communication with external parties	Editorial	Same topic: Reporting (editorial pick) 1 loosely related (not mappings) CC7.4 Responding to identified security incidents Loosely related Only shares CSF RS.MI-01: related, not a mapping
PCI DSS	12.10.1	Incident response plan ready to activate	Crosswalk	Same topic: Reporting 6 loosely related (not mappings) 5.2.1 Anti-malware deployed on system components Loosely related Only shares CSF RS.MI-01: related, not a mapping 5.2.2 Anti-malware detects, removes or contains known malware Loosely related Only shares CSF RS.MI-01: related, not a mapping 5.3.2 Periodic scans or continuous behavioural analysis Loosely related Only shares CSF RS.MI-01: related, not a mapping 12.8.2 Written agreements with service providers Loosely related Only shares CSF RS.CO-02: related, not a mapping 12.8.5 Responsibilities split with each provider documented Loosely related Only shares CSF RS.CO-02: related, not a mapping 12.10.3 Incident response staff available around the clock Loosely related Only shares CSF RS.CO-02: related, not a mapping
CMMC	IR.L2-3.6.2	Incident Reporting	Crosswalk	Same topic: Reporting 1 loosely related (not mappings) IR.L2-3.6.1 Incident Handling Loosely related Only shares CSF RS.CO-02, RS.MI-01: related, not a mapping
800-53	IR-6	Incident Reporting	Crosswalk	Same topic: Reporting 4 loosely related (not mappings) IR-4 Incident Handling Loosely related Only shares CSF RS.CO-02, RS.MI-01: related, not a mapping IR-7 Incident Response Assistance Loosely related Only shares CSF RS.CO-02: related, not a mapping SR-3 Supply Chain Controls and Processes Loosely related Only shares CSF RS.CO-02: related, not a mapping SR-8 Notification Agreements Loosely related Only shares CSF RS.CO-02: related, not a mapping
HIPAA	§164.308(a)(6)(ii)	Response and Reporting	Crosswalk	Same topic: Reporting 5 loosely related (not mappings) §164.308(a)(6) Security Incident Procedures Loosely related Only shares CSF RS.CO-02, RS.MI-01: related, not a mapping §164.308(a)(1)(ii)(D) Information System Activity Review Loosely related Only shares CSF RS.CO-02: related, not a mapping §164.314(a)(2)(i) Business Associate Contracts Loosely related Only shares CSF RS.CO-02: related, not a mapping §164.314(a)(2)(iii) Business associate contracts with subcontractors Loosely related Only shares CSF RS.CO-02: related, not a mapping §164.314(b)(2)(iv) Group Health Plan Implementation Specification Loosely related Only shares CSF RS.CO-02: related, not a mapping
GDPR	Art.33(1)Art.34(1)	Notification of a personal data breach to the supervisory authority; Communication of a personal data breach to the data subject	Editorial	Same topic: Reporting (editorial pick)
Essential Eight	ISM-0123 ISM-0140	Cyber security incidents are reported to the chief information security officer, or one…; Cyber security incidents are reported to ASD as soon as possible after they occur or…	Editorial	Same topic: Reporting (editorial pick)
DORA	Art.18(1)Art.19(1)Art.19(3)Art.19(4)	Classification of ICT-related incidents and cyber threats; Reporting of major ICT-related incidents and voluntary notification of significant cyber threats…	Editorial	Same topic: Reporting (editorial pick) 2 loosely related (not mappings) Art.11(2)(c) Response and recovery Loosely related Only shares CSF RS.MI-01: related, not a mapping Art.17(3)(f) ICT-related incident management process Loosely related Only shares CSF RS.MI-01: related, not a mapping
CPS 234	Para 35 Para 36	Notify APRA of material incidents within 72 hours; Notify APRA of material control weaknesses within 10 business days	Editorial	Same topic: Reporting (editorial pick)
Cyber Essentials	—	No requirement	No mapping in our data	No mapping in our data (Cyber Essentials covers five technical controls only).

Crosswalk a published crosswalk (NIST, ENISA, CIS, PCI SSC) makes the link · Editorial ControlMapping's judgement where no crosswalk exists; the reason is shown · Loosely related only shares a CSF 2.0 outcome: worth checking, not a mapping · No mapping in our data nothing mapped in our data; often new work, but check the coverage notes. How links are sourced.