Incident Reporting

frameworkNIST SP 800-53 Rev 5.2 sectionIR Incident Response csf 2.0RC.CO-03 RS.AN-06 RS.AN-07 RS.CO-02 RS.CO-03 RS.MA-01 RS.MA-02 RS.MA-03 RS.MA-04 topicsReporting, Comms & Restore frameworks7 5 1

Official texta. Require personnel to report suspected incidents to the organizational incident response capability within [Assignment: organization-defined time period]; and
b. Report incident information to [Assignment: organization-defined authorities].NIST SP 800-53 Rev 5.2 control statement (public domain)

gap from 800-53 → gap to 800-53 →

Wrong or missing mapping? Report it

Equivalents of IR-6 in other frameworks
Framework	Requirement	Title	Link	Source / reason
NIST CSF 2.0	RC.CO-03 RC.CO-04 RC.RP-05 RS.CO-02	Recovery activities and progress in restoring operational capabilities are communicated to designated internal and external stakeholders; Public updates on incident recovery are shared using approved methods and messaging…	Crosswalk	Same topic: Comms & Restore, Reporting 7 loosely related (not mappings) RS.AN-06 Actions performed during an investigation are recorded, and the records' integrity and provenance are preserved Loosely related Only shares CSF RS.AN-06: related, not a mapping RS.AN-07 Incident data and metadata are collected, and their integrity and provenance are preserved Loosely related Only shares CSF RS.AN-07: related, not a mapping RS.CO-03 Information is shared with designated internal and external stakeholders Loosely related Only shares CSF RS.CO-03: related, not a mapping RS.MA-01 The incident response plan is executed in coordination with relevant third parties once an incident is declared Loosely related Only shares CSF RS.MA-01: related, not a mapping RS.MA-02 Incident reports are triaged and validated Loosely related Only shares CSF RS.MA-02: related, not a mapping RS.MA-03 Incidents are categorized and prioritized Loosely related Only shares CSF RS.MA-03: related, not a mapping RS.MA-04 Incidents are escalated or elevated as needed Loosely related Only shares CSF RS.MA-04: related, not a mapping
ISO 27001	A.5.5 A.5.26 A.6.8 Clause 7.4	Contact with authorities; Response to information security incidents…	Crosswalk	Same topic: Reporting, Comms & Restore 5 loosely related (not mappings) A.5.28 Collection of evidence Loosely related Only shares CSF RC.CO-03, RS.AN-06, RS.AN-07, RS.MA-01…: related, not a mapping A.5.27 Learning from information security incidents Loosely related Only shares CSF RS.MA-01, RS.MA-02: related, not a mapping A.5.24 Information security incident management planning and preparation Loosely related Only shares CSF RS.MA-02: related, not a mapping A.5.25 Assessment and decision on information security events Loosely related Only shares CSF RS.MA-03: related, not a mapping A.5.6 Contact with special interest groups Loosely related Only shares CSF RS.CO-03: related, not a mapping
CIS v8.1	CIS 17.6 CIS 17.3	Define Mechanisms for Communicating During Incident Response; Establish and Maintain an Enterprise Process for Reporting Incidents	Crosswalk	Same topic: Comms & Restore, Reporting 6 loosely related (not mappings) CIS 17.2 Establish and Maintain Contact Information for Reporting Security Incidents Loosely related Only shares CSF RS.CO-02, RS.CO-03: related, not a mapping CIS 17.4 Establish and Maintain an Incident Response Process Loosely related Only shares CSF RS.MA-01: related, not a mapping CIS 17.1 Designate Personnel to Manage Incident Handling Loosely related Only shares CSF RS.MA-01, RS.MA-02, RS.MA-03, RS.MA-04: related, not a mapping CIS 17.5 Assign Key Roles and Responsibilities Loosely related Only shares CSF RS.MA-01, RS.MA-02, RS.MA-03, RS.MA-04: related, not a mapping CIS 17.7 Conduct Routine Incident Response Exercises Loosely related Only shares CSF RS.MA-01, RS.MA-02, RS.MA-03, RS.MA-04: related, not a mapping CIS 17.9 Establish and Maintain Security Incident Thresholds Loosely related Only shares CSF RS.MA-01, RS.MA-02, RS.MA-03, RS.MA-04: related, not a mapping
SOC 2	CC2.3 CC7.5	Communication with external parties; Recovering from identified security incidents	Editorial	Same topic: Reporting, Comms & Restore (editorial pick) 2 loosely related (not mappings) CC7.4 Responding to identified security incidents Loosely related Only shares CSF RS.AN-06, RS.AN-07, RS.MA-01, RS.MA-02…: related, not a mapping CC7.3 Evaluating security events to determine if they are incidents Loosely related Only shares CSF RS.MA-01, RS.MA-02, RS.MA-03, RS.MA-04: related, not a mapping
PCI DSS	12.10.1	Incident response plan ready to activate	Crosswalk	Same topic: Reporting 16 loosely related (not mappings) 12.8.2 Written agreements with service providers Loosely related Only shares CSF RC.CO-03, RS.CO-02, RS.CO-03, RS.MA-01: related, not a mapping 12.10.3 Incident response staff available around the clock Loosely related Only shares CSF RC.CO-03, RS.CO-02, RS.MA-01, RS.MA-04: related, not a mapping 12.10.2 Incident response plan reviewed and tested annually Loosely related Only shares CSF RS.MA-01, RS.MA-03, RS.MA-04: related, not a mapping 10.2.1 Audit logs enabled and active Loosely related Only shares CSF RS.AN-07, RS.MA-02: related, not a mapping 10.3.2 Logs protected from modification Loosely related Only shares CSF RS.AN-06, RS.AN-07: related, not a mapping 10.3.3 Logs promptly backed up to a central server Loosely related Only shares CSF RS.AN-06, RS.AN-07: related, not a mapping 10.4.1 Security event and critical logs reviewed daily Loosely related Only shares CSF RS.MA-02, RS.MA-03: related, not a mapping 10.6.1 System clocks synchronised Loosely related Only shares CSF RS.AN-06, RS.AN-07: related, not a mapping …and 8 more in the downloads
CMMC	IR.L2-3.6.2 IR.L2-3.6.1	Incident Reporting; Incident Handling	Crosswalk	Same topic: Reporting, Comms & Restore NIST SP 800-171r2 Appendix D 2 loosely related (not mappings) AU.L2-3.3.6 Reduction & Reporting Loosely related Only shares CSF RS.AN-06, RS.AN-07: related, not a mapping IR.L2-3.6.3 Incident Response Testing Loosely related Only shares CSF RS.MA-01, RS.MA-02, RS.MA-03, RS.MA-04: related, not a mapping
HIPAA	§164.308(a)(6)(ii)§164.308(a)(1)(ii)(D)§164.314(a)(2)(i)§164.314(a)(2)(iii)§164.314(b)(2)(iv)	Response and Reporting; Information System Activity Review…	Crosswalk	Same topic: Reporting NIST HIPAA → SP 800-53 crosswalk 2 loosely related (not mappings) §164.308(a)(6) Security Incident Procedures Loosely related Only shares CSF RC.CO-03, RS.AN-06, RS.AN-07, RS.CO-02…: related, not a mapping §164.312(b) Audit Controls Loosely related Only shares CSF RS.AN-06, RS.AN-07: related, not a mapping
GDPR	Art.33(1)Art.34(1)	Notification of a personal data breach to the supervisory authority; Communication of a personal data breach to the data subject	Editorial	Same topic: Reporting, Comms & Restore (editorial pick) 1 loosely related (not mappings) Art.33(5) Notification of a personal data breach to the supervisory authority Loosely related Only shares CSF RS.MA-01, RS.MA-02, RS.MA-03, RS.MA-04: related, not a mapping
NIS2	3.3 4.3	Event reporting; Crisis management	Crosswalk	Same topic: Reporting, Comms & Restore 4 loosely related (not mappings) 3.5 Incident response Loosely related Only shares CSF RC.CO-03, RS.CO-02, RS.CO-03, RS.MA-01…: related, not a mapping 3.4 Event assessment and classification Loosely related Only shares CSF RS.MA-02, RS.MA-03, RS.MA-04: related, not a mapping 3.2 Monitoring and logging Loosely related Only shares CSF RS.AN-06, RS.AN-07: related, not a mapping 3.1 Incident handling policy Loosely related Only shares CSF RS.MA-01: related, not a mapping
Essential Eight	ISM-0123 ISM-0140	Cyber security incidents are reported to the chief information security officer, or one…; Cyber security incidents are reported to ASD as soon as possible after they occur or…	Editorial	Same topic: Reporting (editorial pick) 1 loosely related (not mappings) ISM-1819 Following the identification of a cyber security incident, the cyber security incident… Loosely related Only shares CSF RS.MA-01, RS.MA-02, RS.MA-03, RS.MA-04: related, not a mapping
DORA	Art.11(2)(e)Art.11(7)Art.18(1)Art.19(1)Art.19(3)Art.19(4)	Response and recovery; Response and recovery…	Editorial	Same topic: Comms & Restore, Reporting (editorial pick) 8 loosely related (not mappings) Art.11(2)(b) Response and recovery Loosely related Only shares CSF RS.MA-01, RS.MA-02, RS.MA-03, RS.MA-04: related, not a mapping Art.17(1) ICT-related incident management process Loosely related Only shares CSF RS.MA-01, RS.MA-02, RS.MA-03, RS.MA-04: related, not a mapping Art.17(3) ICT-related incident management process Loosely related Only shares CSF RS.MA-01, RS.MA-02, RS.MA-03, RS.MA-04: related, not a mapping Art.13(2) Learning and evolving Loosely related Only shares CSF RS.AN-06, RS.AN-07: related, not a mapping Art.17(2) ICT-related incident management process Loosely related Only shares CSF RS.AN-06, RS.AN-07: related, not a mapping Art.14(1) Communication Loosely related Only shares CSF RS.CO-03: related, not a mapping Art.14(2) Communication Loosely related Only shares CSF RS.CO-03: related, not a mapping Art.17(3)(d) ICT-related incident management process Loosely related Only shares CSF RS.CO-03: related, not a mapping
CPS 234	Para 35 Para 36	Notify APRA of material incidents within 72 hours; Notify APRA of material control weaknesses within 10 business days	Editorial	Same topic: Reporting (editorial pick) 4 loosely related (not mappings) Para 25 Response plans cover all stages and escalation Loosely related Only shares CSF RS.CO-03, RS.MA-01, RS.MA-02, RS.MA-03…: related, not a mapping Para 23 Detect and respond to incidents in a timely manner Loosely related Only shares CSF RS.MA-01, RS.MA-02, RS.MA-03, RS.MA-04: related, not a mapping Para 24 Maintain information security response plans Loosely related Only shares CSF RS.MA-01, RS.MA-02, RS.MA-03, RS.MA-04: related, not a mapping Para 26 Review and test response plans annually Loosely related Only shares CSF RS.MA-01, RS.MA-02, RS.MA-03, RS.MA-04: related, not a mapping
Cyber Essentials	—	No requirement	No mapping in our data	No mapping in our data (Cyber Essentials covers five technical controls only).

Crosswalk a published crosswalk (NIST, ENISA, CIS, PCI SSC) makes the link · Editorial ControlMapping's judgement where no crosswalk exists; the reason is shown · Loosely related only shares a CSF 2.0 outcome: worth checking, not a mapping · No mapping in our data nothing mapped in our data; often new work, but check the coverage notes. How links are sourced.