800-53 · IR Incident Response
IR-7
Incident Response Assistance
frameworkNIST SP 800-53 Rev 5.2
sectionIR Incident Response
csf 2.0RS.CO-02 RS.CO-03 RS.MA-01 RS.MA-04
topicsCommunication
frameworks6 3 1
Official textProvide an incident response support resource, integral to the organizational incident response capability, that offers advice and assistance to users of the system for the handling and reporting of incidents.NIST SP 800-53 Rev 5.2 control statement (public domain)
Wrong or missing mapping? Report it
| Framework | Requirement | Title | Link | Source / reason |
|---|---|---|---|---|
| NIST CSF 2.0 | RS.CO-03 | Information is shared with designated internal and external stakeholders | Crosswalk | Same topic: Communication3 loosely related (not mappings)RS.CO-02 Internal and external stakeholders are notified of incidents Only shares CSF RS.CO-02: related, not a mapping RS.MA-01 The incident response plan is executed in coordination with relevant third parties once an incident is declared Only shares CSF RS.MA-01: related, not a mapping RS.MA-04 Incidents are escalated or elevated as needed Only shares CSF RS.MA-04: related, not a mapping |
| ISO 27001 | Clause 7.4A.5.6 | Communication; Contact with special interest groups | Crosswalk | Same topic: Communication |
| CIS v8.1 | CIS 17.2CIS 17.6 | Establish and Maintain Contact Information for Reporting Security Incidents; Define Mechanisms for Communicating During Incident Response | Crosswalk | Same topic: Communication6 loosely related (not mappings)CIS 17.4 Establish and Maintain an Incident Response Process Only shares CSF RS.MA-01: related, not a mapping CIS 17.1 Designate Personnel to Manage Incident Handling Only shares CSF RS.MA-01, RS.MA-04: related, not a mapping CIS 17.5 Assign Key Roles and Responsibilities Only shares CSF RS.MA-01, RS.MA-04: related, not a mapping CIS 17.7 Conduct Routine Incident Response Exercises Only shares CSF RS.MA-01, RS.MA-04: related, not a mapping CIS 17.9 Establish and Maintain Security Incident Thresholds Only shares CSF RS.MA-01, RS.MA-04: related, not a mapping CIS 17.3 Establish and Maintain an Enterprise Process for Reporting Incidents Only shares CSF RS.CO-02: related, not a mapping |
| SOC 2 | CC2.3 | Communication with external parties | Editorial | Same topic: Communication (editorial pick) |
| PCI DSS | 12.10.112.8.212.10.312.10.2 | Incident response plan ready to activate; Written agreements with service providers… | No mapping. Only shares CSF RS.CO-02, RS.CO-03, RS.MA-01, RS.MA-04: related, not a mapping+3 more loosely related (not mappings)12.8.4 Service provider compliance monitored annually Only shares CSF RS.CO-03: related, not a mapping 12.8.5 Responsibilities split with each provider documented Only shares CSF RS.CO-02: related, not a mapping 12.10.6 Plan updated from lessons learned and industry changes Only shares CSF RS.CO-03: related, not a mapping | |
| CMMC | IR.L2-3.6.2IR.L2-3.6.1 | Incident Reporting; Incident Handling | Crosswalk | Same topic: Communication NIST SP 800-171r2 Appendix D 1 loosely related (not mappings) |
| HIPAA | §164.308(a)(6)(ii) | Response and Reporting | Crosswalk | NIST HIPAA → SP 800-53 crosswalk5 loosely related (not mappings)§164.308(a)(1)(ii)(D) Information System Activity Review Only shares CSF RS.CO-02, RS.CO-03, RS.MA-01, RS.MA-04: related, not a mapping §164.314(a)(2)(i) Business Associate Contracts Only shares CSF RS.CO-02, RS.CO-03, RS.MA-01, RS.MA-04: related, not a mapping §164.314(a)(2)(iii) Business associate contracts with subcontractors Only shares CSF RS.CO-02, RS.CO-03, RS.MA-01, RS.MA-04: related, not a mapping §164.314(b)(2)(iv) Group Health Plan Implementation Specification Only shares CSF RS.CO-02, RS.CO-03, RS.MA-01, RS.MA-04: related, not a mapping §164.308(a)(6) Security Incident Procedures Only shares CSF RS.CO-02, RS.CO-03, RS.MA-04: related, not a mapping |
| GDPR | Art.33(1)Art.33(5)Art.34(1) | Notification of a personal data breach to the supervisory authority; Notification of a personal data breach to the supervisory authority… | No mapping. Only shares CSF RS.CO-02, RS.MA-01, RS.MA-04: related, not a mapping | |
| NIS2 | 4.3 | Crisis management | Crosswalk | Same topic: Communication4 loosely related (not mappings)3.5 Incident response Only shares CSF RS.CO-02, RS.CO-03, RS.MA-01, RS.MA-04: related, not a mapping |
| Essential Eight | ISM-1819ISM-0123ISM-0140 | Following the identification of a cyber security incident, the cyber security incident…; Cyber security incidents are reported to the chief information security officer, or one…… | No mapping. Only shares CSF RS.MA-01, RS.MA-04, RS.CO-02: related, not a mapping | |
| DORA | Art.14(1)Art.14(2)Art.17(3)(d) | Communication; Communication… | Editorial | Same topic: Communication (editorial pick)7 loosely related (not mappings)Art.18(1) Classification of ICT-related incidents and cyber threats Only shares CSF RS.CO-02, RS.MA-01, RS.MA-04: related, not a mapping Art.17(1) ICT-related incident management process Only shares CSF RS.MA-01, RS.MA-04: related, not a mapping Art.17(3) ICT-related incident management process Only shares CSF RS.MA-01, RS.MA-04: related, not a mapping Art.19(1) Reporting of major ICT-related incidents and voluntary notification of significant cyber threats Only shares CSF RS.CO-02: related, not a mapping Art.19(3) Reporting of major ICT-related incidents and voluntary notification of significant cyber threats Only shares CSF RS.CO-02: related, not a mapping Art.19(4) Reporting of major ICT-related incidents and voluntary notification of significant cyber threats Only shares CSF RS.CO-02: related, not a mapping |
| CPS 234 | Para 25 | Response plans cover all stages and escalation | Editorial | Same topic: Communication (editorial pick)5 loosely related (not mappings)Para 23 Detect and respond to incidents in a timely manner Only shares CSF RS.MA-01, RS.MA-04: related, not a mapping Para 24 Maintain information security response plans Only shares CSF RS.MA-01, RS.MA-04: related, not a mapping Para 26 Review and test response plans annually Only shares CSF RS.MA-01, RS.MA-04: related, not a mapping Para 35 Notify APRA of material incidents within 72 hours Only shares CSF RS.CO-02: related, not a mapping Para 36 Notify APRA of material control weaknesses within 10 business days Only shares CSF RS.CO-02: related, not a mapping |
| Cyber Essentials | — | No requirement | No mapping in our data | No mapping in our data (Cyber Essentials covers five technical controls only). |
Crosswalk a published crosswalk (NIST, ENISA, CIS, PCI SSC) makes the link · Editorial ControlMapping's judgement where no crosswalk exists; the reason is shown · only shares a CSF 2.0 outcome: worth checking, not a mapping · No mapping in our data nothing mapped in our data; often new work, but check the coverage notes. How links are sourced.