Root Cause Analysis

frameworkNIST SP 800-53 Rev 5.2 sectionSI System and Information Integrity csf 2.0RS.AN-03 topicsForensics frameworks5 2 4

Official texta. Conduct root cause analysis to identify underlying causes of issues or failures.
b. Develop actions to address the root cause of the issue or failure.
c. Implement the actions and monitor the implementation for effectiveness.NIST SP 800-53 Rev 5.2 control statement (public domain)

gap from 800-53 → gap to 800-53 →

Wrong or missing mapping? Report it

Equivalents of SI-2(7) in other frameworks
Framework	Requirement	Title	Link	Source / reason
NIST CSF 2.0	RS.AN-03 RS.AN-06 RS.AN-07	Analysis is performed to establish what has taken place during an incident and the root cause of the incident; Actions performed during an investigation are recorded, and the records' integrity and provenance are preserved…	Crosswalk	Same topic: Forensics
ISO 27001	A.5.28	Collection of evidence	Crosswalk	Same topic: Forensics 2 loosely related (not mappings) A.5.25 Assessment and decision on information security events Loosely related Only shares CSF RS.AN-03: related, not a mapping A.5.27 Learning from information security incidents Loosely related Only shares CSF RS.AN-03: related, not a mapping
CIS v8.1	CIS 17.8	Conduct Post-Incident Reviews	Loosely related	No mapping. Only shares CSF RS.AN-03: related, not a mapping
SOC 2	CC7.4	Responding to identified security incidents	Editorial	Same topic: Forensics (editorial pick)
PCI DSS	10.3.2	Logs protected from modification	Crosswalk	Same topic: Forensics 4 loosely related (not mappings) 6.3.1 Vulnerabilities identified and risk-ranked Loosely related Only shares CSF RS.AN-03: related, not a mapping 10.2.1 Audit logs enabled and active Loosely related Only shares CSF RS.AN-03: related, not a mapping 10.2.2 Log entries record who, what, when, where and outcome Loosely related Only shares CSF RS.AN-03: related, not a mapping 10.4.1 Security event and critical logs reviewed daily Loosely related Only shares CSF RS.AN-03: related, not a mapping
CMMC	AU.L2-3.3.6	Reduction & Reporting	Crosswalk	Same topic: Forensics 1 loosely related (not mappings) IR.L2-3.6.1 Incident Handling Loosely related Only shares CSF RS.AN-03: related, not a mapping
HIPAA	§164.308(a)(1)(ii)(D)§164.308(a)(6)§164.308(a)(6)(ii)§164.312(b)	Information System Activity Review; Security Incident Procedures…	Loosely related	No mapping. Only shares CSF RS.AN-03: related, not a mapping
GDPR	—	No requirement	No mapping in our data	No mapping in our data (only GDPR's security articles are mapped, editorially).
NIS2	3.5	Incident response	Crosswalk	Same topic: Forensics
Essential Eight	—	No requirement	No mapping in our data	No mapping in our data (Essential Eight links are editorial only).
DORA	Art.13(2)Art.17(2)	Learning and evolving; ICT-related incident management process	Editorial	Same topic: Forensics (editorial pick)
CPS 234	—	No requirement	No mapping in our data	No mapping in our data (CPS 234 is principles-based and its links are editorial).
Cyber Essentials	—	No requirement	No mapping in our data	No mapping in our data (Cyber Essentials covers five technical controls only).

Crosswalk a published crosswalk (NIST, ENISA, CIS, PCI SSC) makes the link · Editorial ControlMapping's judgement where no crosswalk exists; the reason is shown · Loosely related only shares a CSF 2.0 outcome: worth checking, not a mapping · No mapping in our data nothing mapped in our data; often new work, but check the coverage notes. How links are sourced.