Notification Agreements

frameworkNIST SP 800-53 Rev 5.2 sectionSR Supply Chain Risk Management csf 2.0GV.OC-02 GV.SC-08 RC.CO-03 RS.CO-02 RS.CO-03 RS.MA-01 topics— frameworks0 0 1

Official textEstablish agreements and procedures with entities involved in the supply chain for the system, system component, or system service for the [Selection (one or more): notification of supply chain compromises; [Assignment: organization-defined results of assessments or audits] ].NIST SP 800-53 Rev 5.2 control statement (public domain)

gap from 800-53 → gap to 800-53 →

Wrong or missing mapping? Report it

Equivalents of SR-8 in other frameworks
Framework	Requirement	Title	Link	Source / reason
NIST CSF 2.0	GV.OC-02 GV.SC-08 RC.CO-03 RS.CO-02	Internal and external stakeholders are understood, and their needs and expectations regarding cybersecurity risk management are understood and considered; Relevant suppliers and other third parties are included in incident planning, response, and recovery activities…	Loosely related	No mapping. Only shares CSF GV.OC-02, GV.SC-08, RC.CO-03, RS.CO-02: related, not a mapping +2 more loosely related (not mappings) RS.CO-03 Information is shared with designated internal and external stakeholders Loosely related Only shares CSF RS.CO-03: related, not a mapping RS.MA-01 The incident response plan is executed in coordination with relevant third parties once an incident is declared Loosely related Only shares CSF RS.MA-01: related, not a mapping
ISO 27001	A.5.26 Clause 7.4 A.5.28 A.5.27	Response to information security incidents; Communication…	Loosely related	No mapping. Only shares CSF GV.SC-08, RS.CO-02, RS.CO-03, RS.MA-01…: related, not a mapping +8 more loosely related (not mappings) Clause 4.1 Understanding the organization and its context Loosely related Only shares CSF GV.OC-02: related, not a mapping Clause 4.2 Understanding the needs and expectations of interested parties Loosely related Only shares CSF GV.OC-02: related, not a mapping Clause 4.4 Information security management system Loosely related Only shares CSF GV.OC-02: related, not a mapping Clause 6.1 Actions to address risks and opportunities Loosely related Only shares CSF GV.OC-02: related, not a mapping …and 4 more in the downloads
CIS v8.1	CIS 17.2 CIS 15.4 CIS 17.4 CIS 17.1	Establish and Maintain Contact Information for Reporting Security Incidents; Ensure Service Provider Contracts Include Security Requirements…	Loosely related	No mapping. Only shares CSF RS.CO-02, RS.CO-03, GV.SC-08, RS.MA-01: related, not a mapping +5 more loosely related (not mappings) CIS 17.3 Establish and Maintain an Enterprise Process for Reporting Incidents Loosely related Only shares CSF RS.CO-02: related, not a mapping CIS 17.5 Assign Key Roles and Responsibilities Loosely related Only shares CSF RS.MA-01: related, not a mapping CIS 17.6 Define Mechanisms for Communicating During Incident Response Loosely related Only shares CSF RS.CO-03: related, not a mapping CIS 17.7 Conduct Routine Incident Response Exercises Loosely related Only shares CSF RS.MA-01: related, not a mapping …and 1 more in the downloads
SOC 2	CC2.3 CC7.3 CC7.4 CC7.5	Communication with external parties; Evaluating security events to determine if they are incidents…	Loosely related	No mapping. Only shares CSF RC.CO-03, RS.CO-02, RS.CO-03, RS.MA-01: related, not a mapping
PCI DSS	12.8.2 12.10.1 12.8.5 12.10.3	Written agreements with service providers; Incident response plan ready to activate…	Loosely related	No mapping. Only shares CSF GV.SC-08, RC.CO-03, RS.CO-02, RS.CO-03…: related, not a mapping +10 more loosely related (not mappings) 12.8.1 List of third-party service providers kept Loosely related Only shares CSF GV.OC-02, GV.SC-08: related, not a mapping 12.8.4 Service provider compliance monitored annually Loosely related Only shares CSF RC.CO-03, RS.CO-03: related, not a mapping 12.9.1 Service providers acknowledge responsibilities to customers Loosely related Only shares CSF GV.OC-02, GV.SC-08: related, not a mapping 12.10.2 Incident response plan reviewed and tested annually Loosely related Only shares CSF GV.SC-08, RS.MA-01: related, not a mapping …and 6 more in the downloads
CMMC	IR.L2-3.6.2 IR.L2-3.6.1 RA.L2-3.11.1 IR.L2-3.6.3	Incident Reporting; Incident Handling…	Loosely related	No mapping. Only shares CSF GV.SC-08, RC.CO-03, RS.CO-02, RS.CO-03…: related, not a mapping
HIPAA	§164.314(a)(2)(i)§164.314(a)(2)(iii)§164.308(a)(1)(ii)(D)§164.308(a)(6)	Business Associate Contracts; Business associate contracts with subcontractors…	Loosely related	No mapping. Only shares CSF GV.SC-08, RC.CO-03, RS.CO-02, RS.CO-03…: related, not a mapping +10 more loosely related (not mappings) §164.308(a)(6)(ii) Response and Reporting Loosely related Only shares CSF RC.CO-03, RS.CO-02, RS.CO-03, RS.MA-01: related, not a mapping §164.314(b)(2)(iv) Group Health Plan Implementation Specification Loosely related Only shares CSF RC.CO-03, RS.CO-02, RS.CO-03, RS.MA-01: related, not a mapping §164.308(a)(7) Contingency Plan Loosely related Only shares CSF GV.SC-08: related, not a mapping §164.308(b)(1) Business Associate Contracts and Other Arrangements Loosely related Only shares CSF GV.SC-08: related, not a mapping …and 6 more in the downloads
GDPR	Art.33(1)Art.34(1)Art.33(5)	Notification of a personal data breach to the supervisory authority; Communication of a personal data breach to the data subject…	Loosely related	No mapping. Only shares CSF RS.CO-02, RS.MA-01, RC.CO-03: related, not a mapping
NIS2	3.5 3.1 4.3 1.1	Incident response; Incident handling policy…	Loosely related	No mapping. Only shares CSF RC.CO-03, RS.CO-02, RS.CO-03, RS.MA-01…: related, not a mapping +2 more loosely related (not mappings) 3.3 Event reporting Loosely related Only shares CSF RS.CO-02: related, not a mapping 4.1 Business continuity and disaster recovery plan Loosely related Only shares CSF GV.SC-08: related, not a mapping
Essential Eight	ISM-0123 ISM-0140 ISM-1819	Cyber security incidents are reported to the chief information security officer, or one…; Cyber security incidents are reported to ASD as soon as possible after they occur or……	Loosely related	No mapping. Only shares CSF RS.CO-02, RS.MA-01: related, not a mapping
DORA	Art.18(1)Art.11(2)(b)Art.11(2)(e)Art.11(7)	Classification of ICT-related incidents and cyber threats; Response and recovery…	Loosely related	No mapping. Only shares CSF RS.CO-02, RS.MA-01, RC.CO-03: related, not a mapping +8 more loosely related (not mappings) Art.14(1) Communication Loosely related Only shares CSF RS.CO-03: related, not a mapping Art.14(2) Communication Loosely related Only shares CSF RS.CO-03: related, not a mapping Art.17(1) ICT-related incident management process Loosely related Only shares CSF RS.MA-01: related, not a mapping Art.17(3) ICT-related incident management process Loosely related Only shares CSF RS.MA-01: related, not a mapping …and 4 more in the downloads
CPS 234	Para 25 Para 23 Para 24 Para 26	Response plans cover all stages and escalation; Detect and respond to incidents in a timely manner…	Loosely related	No mapping. Only shares CSF RS.CO-03, RS.MA-01: related, not a mapping +2 more loosely related (not mappings) Para 35 Notify APRA of material incidents within 72 hours Loosely related Only shares CSF RS.CO-02: related, not a mapping Para 36 Notify APRA of material control weaknesses within 10 business days Loosely related Only shares CSF RS.CO-02: related, not a mapping
Cyber Essentials	—	No requirement	No mapping in our data	No mapping in our data (Cyber Essentials covers five technical controls only).

Crosswalk a published crosswalk (NIST, ENISA, CIS, PCI SSC) makes the link · Editorial ControlMapping's judgement where no crosswalk exists; the reason is shown · Loosely related only shares a CSF 2.0 outcome: worth checking, not a mapping · No mapping in our data nothing mapped in our data; often new work, but check the coverage notes. How links are sourced.