NIS2 · 3. Incident handling

Post-incident reviews

frameworkNIS2 Implementing Regulation (EU) 2024/2690 section3. Incident handling csf 2.0RS.AN-08 topicsLessons Learned frameworks5 4 3

Official text · not licensableTitle from ENISA's guidance: Post-incident reviews. See the Annex to Implementing Regulation (EU) 2024/2690 for the legal text.

gap from NIS2 → gap to NIS2 →

Wrong or missing mapping? Report it

Equivalents of 3.6 in other frameworks
Framework	Requirement	Title	Link	Source / reason
NIST CSF 2.0	ID.IM-03 RC.RP-06	Improvements are identified from execution of operational processes, procedures, and activities; The end of incident recovery is declared based on criteria, and incident-related documentation is completed	Crosswalk	Same topic: Lessons Learned 1 loosely related (not mappings) RS.AN-08 An incident's magnitude is estimated and validated Loosely related Only shares CSF RS.AN-08: related, not a mapping
ISO 27001	A.5.27 Clause 10.1	Learning from information security incidents; Continual improvement	Crosswalk	Same topic: Lessons Learned 1 loosely related (not mappings) A.5.25 Assessment and decision on information security events Loosely related Only shares CSF RS.AN-08: related, not a mapping
CIS v8.1	CIS 17.8	Conduct Post-Incident Reviews	Editorial	Same topic: Lessons Learned (editorial pick)
SOC 2	CC7.5	Recovering from identified security incidents	Editorial	Same topic: Lessons Learned (editorial pick)
PCI DSS	12.10.6	Plan updated from lessons learned and industry changes	Crosswalk	Same topic: Lessons Learned 4 loosely related (not mappings) 1.2.3 Accurate network diagram maintained Loosely related Only shares CSF RS.AN-08: related, not a mapping 1.2.4 Accurate account-data flow diagram maintained Loosely related Only shares CSF RS.AN-08: related, not a mapping 10.4.1 Security event and critical logs reviewed daily Loosely related Only shares CSF RS.AN-08: related, not a mapping 12.5.1 Inventory of in-scope system components Loosely related Only shares CSF RS.AN-08: related, not a mapping
CMMC	IR.L2-3.6.1	Incident Handling	Crosswalk	Same topic: Lessons Learned 1 loosely related (not mappings) RA.L2-3.11.1 Risk Assessments Loosely related Only shares CSF RS.AN-08: related, not a mapping
800-53	IR-4	Incident Handling	Crosswalk	Same topic: Lessons Learned 3 loosely related (not mappings) IR-8 Incident Response Plan Loosely related Only shares CSF RS.AN-08: related, not a mapping RA-3 Risk Assessment Loosely related Only shares CSF RS.AN-08: related, not a mapping RA-7 Risk Response Loosely related Only shares CSF RS.AN-08: related, not a mapping
HIPAA	§164.308(a)(1)(ii)(A)§164.308(a)(1)(ii)(B)§164.308(a)(6)§164.308(a)(6)(ii)	Risk Analysis; Risk Management…	Loosely related	No mapping. Only shares CSF RS.AN-08: related, not a mapping +1 more loosely related (not mappings) §164.316(a) Policies and Procedures Loosely related Only shares CSF RS.AN-08: related, not a mapping
GDPR	—	No requirement	No mapping in our data	No mapping in our data (only GDPR's security articles are mapped, editorially).
Essential Eight	—	No requirement	No mapping in our data	No mapping in our data (Essential Eight links are editorial only).
DORA	Art.13(2)Art.13(3)	Learning and evolving; Learning and evolving	Editorial	Same topic: Lessons Learned (editorial pick)
CPS 234	Para 25	Response plans cover all stages and escalation	Editorial	Same topic: Lessons Learned (editorial pick)
Cyber Essentials	—	No requirement	No mapping in our data	No mapping in our data (Cyber Essentials covers five technical controls only).

Crosswalk a published crosswalk (NIST, ENISA, CIS, PCI SSC) makes the link · Editorial ControlMapping's judgement where no crosswalk exists; the reason is shown · Loosely related only shares a CSF 2.0 outcome: worth checking, not a mapping · No mapping in our data nothing mapped in our data; often new work, but check the coverage notes. How links are sourced.