Information Spillage Response

frameworkNIST SP 800-53 Rev 5.2 sectionIR Incident Response csf 2.0— topics— frameworks1 0 12

Official textRespond to information spills by:
a. Assigning [Assignment: organization-defined personnel or roles] with responsibility for responding to information spills;
b. Identifying the specific information involved in the system contamination;
c. Alerting [Assignment: organization-defined personnel or roles] of the information spill using a method of communication not associated with the spill;
d. Isolating the contaminated system or system component;
e. Eradicating the information from the contaminated system or component;
f. Identifying other systems or system components that may have been subsequently contaminated; and
g. Performing the following additional actions: [Assignment: organization-defined actions].NIST SP 800-53 Rev 5.2 control statement (public domain)

gap from 800-53 → gap to 800-53 →

Wrong or missing mapping? Report it

Equivalents of IR-9 in other frameworks
Framework	Requirement	Title	Link	Source / reason
NIST CSF 2.0	—	No requirement	No mapping in our data	No mapping in our data.
ISO 27001	—	No requirement	No mapping in our data	No mapping in our data.
CIS v8.1	—	No requirement	No mapping in our data	No mapping in our data (most CIS links are editorial: CIS's published crosswalk covers 49 of 153 safeguards).
SOC 2	—	No requirement	No mapping in our data	No mapping in our data (SOC 2 links are editorial only).
PCI DSS	—	No requirement	No mapping in our data	No mapping in our data.
CMMC	—	No requirement	No mapping in our data	No mapping in our data.
HIPAA	§164.308(a)(6)(ii)	Response and Reporting	Crosswalk	NIST HIPAA → SP 800-53 crosswalk
GDPR	—	No requirement	No mapping in our data	No mapping in our data (only GDPR's security articles are mapped, editorially).
NIS2	—	No requirement	No mapping in our data	No mapping in our data.
Essential Eight	—	No requirement	No mapping in our data	No mapping in our data (Essential Eight links are editorial only).
DORA	—	No requirement	No mapping in our data	No mapping in our data (DORA links are editorial, and its technical standards are not mapped).
CPS 234	—	No requirement	No mapping in our data	No mapping in our data (CPS 234 is principles-based and its links are editorial).
Cyber Essentials	—	No requirement	No mapping in our data	No mapping in our data (Cyber Essentials covers five technical controls only).

Crosswalk a published crosswalk (NIST, ENISA, CIS, PCI SSC) makes the link · Editorial ControlMapping's judgement where no crosswalk exists; the reason is shown · Loosely related only shares a CSF 2.0 outcome: worth checking, not a mapping · No mapping in our data nothing mapped in our data; often new work, but check the coverage notes. How links are sourced.