Incident Response Training

frameworkNIST SP 800-53 Rev 5.2 sectionIR Incident Response csf 2.0ID.IM-04 RS.MA-01 RS.MA-02 RS.MA-03 RS.MA-04 topicsIncident Response frameworks2 10 1

Official texta. Provide incident response training to system users consistent with assigned roles and responsibilities:
1. Within [Assignment: organization-defined time period] of assuming an incident response role or responsibility or acquiring system access;
2. When required by system changes; and
3. [Assignment: organization-defined frequency] thereafter; and
b. Review and update incident response training content [Assignment: organization-defined frequency] and following [Assignment: organization-defined events].NIST SP 800-53 Rev 5.2 control statement (public domain)

gap from 800-53 → gap to 800-53 →

Wrong or missing mapping? Report it

Equivalents of IR-2 in other frameworks
Framework	Requirement	Title	Link	Source / reason
NIST CSF 2.0	ID.IM-04 RS.MA-01 RS.MA-02 RS.MA-03 RS.MA-04	Incident response plans and other cybersecurity plans that affect operations are established, communicated, maintained, and improved; The incident response plan is executed in coordination with relevant third parties once an incident is declared…	Editorial	Same topic: Incident Response (editorial pick)
ISO 27001	A.5.24 A.5.25 A.5.26 A.6.3	Information security incident management planning and preparation; Assessment and decision on information security events…	Crosswalk	Same topic: Incident Response (editorial pick) NIST SP 800-53 → ISO 27001 mapping 3 loosely related (not mappings) A.5.27 Learning from information security incidents Loosely related Only shares CSF ID.IM-04, RS.MA-01, RS.MA-02: related, not a mapping A.5.28 Collection of evidence Loosely related Only shares CSF RS.MA-01, RS.MA-02: related, not a mapping A.6.8 Information security event reporting Loosely related Only shares CSF RS.MA-02: related, not a mapping
CIS v8.1	CIS 17.1 CIS 17.4 CIS 17.5 CIS 17.7 CIS 17.9	Designate Personnel to Manage Incident Handling; Establish and Maintain an Incident Response Process…	Editorial	Same topic: Incident Response (editorial pick)
SOC 2	CC7.3 CC7.4	Evaluating security events to determine if they are incidents; Responding to identified security incidents	Editorial	Same topic: Incident Response (editorial pick)
PCI DSS	12.10.1 12.10.2 12.10.3 12.10.4	Incident response plan ready to activate; Incident response plan reviewed and tested annually…	Editorial	Same topic: Incident Response (editorial pick) 4 loosely related (not mappings) 10.4.1 Security event and critical logs reviewed daily Loosely related Only shares CSF RS.MA-02, RS.MA-03: related, not a mapping 12.10.6 Plan updated from lessons learned and industry changes Loosely related Only shares CSF ID.IM-04, RS.MA-03: related, not a mapping 10.2.1 Audit logs enabled and active Loosely related Only shares CSF RS.MA-02: related, not a mapping 12.8.2 Written agreements with service providers Loosely related Only shares CSF RS.MA-01: related, not a mapping
CMMC	IR.L2-3.6.1 IR.L2-3.6.3 IR.L2-3.6.2	Incident Handling; Incident Response Testing…	Crosswalk	Same topic: Incident Response (editorial pick) NIST SP 800-171r2 Appendix D
HIPAA	§164.308(a)(6)§164.308(a)(6)(ii)	Security Incident Procedures; Response and Reporting	Editorial	Same topic: Incident Response (editorial pick) 4 loosely related (not mappings) §164.308(a)(1)(ii)(D) Information System Activity Review Loosely related Only shares CSF RS.MA-01, RS.MA-02, RS.MA-03, RS.MA-04: related, not a mapping §164.314(a)(2)(i) Business Associate Contracts Loosely related Only shares CSF RS.MA-01, RS.MA-02, RS.MA-03, RS.MA-04: related, not a mapping §164.314(a)(2)(iii) Business associate contracts with subcontractors Loosely related Only shares CSF RS.MA-01, RS.MA-02, RS.MA-03, RS.MA-04: related, not a mapping §164.314(b)(2)(iv) Group Health Plan Implementation Specification Loosely related Only shares CSF RS.MA-01, RS.MA-02, RS.MA-03, RS.MA-04: related, not a mapping
GDPR	Art.33(1)Art.33(5)	Notification of a personal data breach to the supervisory authority; Notification of a personal data breach to the supervisory authority	Editorial	Same topic: Incident Response (editorial pick)
NIS2	3.1 3.5	Incident handling policy; Incident response	Editorial	Same topic: Incident Response (editorial pick) 1 loosely related (not mappings) 3.4 Event assessment and classification Loosely related Only shares CSF RS.MA-02, RS.MA-03, RS.MA-04: related, not a mapping
Essential Eight	ISM-1819	Following the identification of a cyber security incident, the cyber security incident…	Editorial	Same topic: Incident Response (editorial pick)
DORA	Art.11(2)(b)Art.17(1)Art.17(3)Art.18(1)	Response and recovery; ICT-related incident management process…	Editorial	Same topic: Incident Response (editorial pick)
CPS 234	Para 23 Para 24 Para 25 Para 26	Detect and respond to incidents in a timely manner; Maintain information security response plans…	Editorial	Same topic: Incident Response (editorial pick)
Cyber Essentials	—	No requirement	No mapping in our data	No mapping in our data (Cyber Essentials covers five technical controls only).

Crosswalk a published crosswalk (NIST, ENISA, CIS, PCI SSC) makes the link · Editorial ControlMapping's judgement where no crosswalk exists; the reason is shown · Loosely related only shares a CSF 2.0 outcome: worth checking, not a mapping · No mapping in our data nothing mapped in our data; often new work, but check the coverage notes. How links are sourced.