PCI DSS · Requirement 12: Support information security with organizational policies and programs
12.10.1
Incident response plan ready to activate
frameworkPCI DSS v4.0.1
sectionRequirement 12: Support information security with organizational policies and programs
csf 2.0DE.AE-06 DE.AE-08 GV.OC-04 GV.RM-04 GV.RM-05 GV.SC-02 GV.SC-08 GV.SC-10 ID.IM-04 ID.RA-06 PR.DS-11 PR.IR-02 PR.IR-03 RC.CO-03 RC.CO-04 RC.RP-01 RC.RP-02 RC.RP-03 RC.RP-04 RS.CO-02 RS.CO-03 RS.MA-01 RS.MA-02 RS.MA-03 RS.MA-04 RS.MA-05 RS.MI-01 RS.MI-02
topicsIncident Response, Mitigation, Reporting, Recovery Planning, Business Continuity, Disaster Recovery
frameworks7 5 1
Official text · not licensableSummary (ControlMapping's wording): Incident response plan ready to activate. The requirement text is PCI SSC's copyright; see PCI DSS v4.0.1.
Wrong or missing mapping? Report it
| Framework | Requirement | Title | Link | Source / reason |
|---|---|---|---|---|
| NIST CSF 2.0 | GV.OC-04ID.IM-04PR.IR-03RC.RP-01RC.RP-02RC.RP-04RC.RP-05RS.CO-02RS.MA-01RS.MA-02RS.MA-03RS.MA-04RS.MI-01RS.MI-02 | Critical objectives, capabilities, and services that external stakeholders depend on or expect from the organization are understood and communicated; Incident response plans and other cybersecurity plans that affect operations are established, communicated, maintained, and improved… | Crosswalk | Same topic: Business Continuity, Incident Response, Recovery Planning, Disaster Recovery, Reporting, Mitigation15 loosely related (not mappings)DE.AE-06 Information on adverse events is provided to authorized staff and tools Only shares CSF DE.AE-06: related, not a mapping DE.AE-08 Incidents are declared when adverse events meet the defined incident criteria Only shares CSF DE.AE-08: related, not a mapping GV.RM-04 Strategic direction that describes appropriate risk response options is established and communicated Only shares CSF GV.RM-04: related, not a mapping GV.RM-05 Lines of communication across the organization are established for cybersecurity risks, including risks from suppliers and other third parties Only shares CSF GV.RM-05: related, not a mapping GV.SC-02 Cybersecurity roles and responsibilities for suppliers, customers, and partners are established, communicated, and coordinated internally and externally Only shares CSF GV.SC-02: related, not a mapping GV.SC-08 Relevant suppliers and other third parties are included in incident planning, response, and recovery activities Only shares CSF GV.SC-08: related, not a mapping GV.SC-10 Cybersecurity supply chain risk management plans include provisions for activities that occur after the conclusion of a partnership or service agreement Only shares CSF GV.SC-10: related, not a mapping ID.RA-06 Risk responses are chosen, prioritized, planned, tracked, and communicated Only shares CSF ID.RA-06: related, not a mapping …and 7 more in the downloads |
| ISO 27001 | A.5.5A.5.24A.5.25A.5.26A.5.29A.5.30A.6.8A.8.14 | Contact with authorities; Information security incident management planning and preparation… | Crosswalk | Same topic: Reporting, Incident Response, Mitigation, Recovery Planning, Business Continuity, Disaster Recovery30 loosely related (not mappings)Clause 6.1.3 Information security risk treatment Only shares CSF GV.RM-04, GV.RM-05, GV.SC-10, ID.RA-06: related, not a mapping Clause 7.4 Communication Only shares CSF RC.CO-03, RC.CO-04, RS.CO-02, RS.CO-03: related, not a mapping A.5.27 Learning from information security incidents Only shares CSF ID.IM-04, RS.MA-01, RS.MA-02: related, not a mapping A.5.19 Information security in supplier relationships Only shares CSF GV.RM-05, GV.SC-10: related, not a mapping A.5.20 Addressing information security within supplier agreements Only shares CSF GV.OC-04, GV.SC-10: related, not a mapping …and 22 more in the downloads |
| CIS v8.1 | CIS 17.4CIS 11.1CIS 17.1CIS 17.3CIS 17.5CIS 17.7CIS 17.9 | Establish and Maintain an Incident Response Process; Establish and Maintain a Data Recovery Process… | Crosswalk | Same topic: Incident Response, Recovery Planning, Disaster Recovery, Reporting11 loosely related (not mappings)CIS 17.2 Establish and Maintain Contact Information for Reporting Security Incidents Only shares CSF RC.CO-04, RS.CO-02, RS.CO-03: related, not a mapping CIS 15.4 Ensure Service Provider Contracts Include Security Requirements Only shares CSF GV.SC-02, GV.SC-08: related, not a mapping CIS 17.6 Define Mechanisms for Communicating During Incident Response Only shares CSF RC.CO-04, RS.CO-03: related, not a mapping …and 3 more in the downloads |
| SOC 2 | A1.1A1.2A1.3CC2.3CC7.3CC7.4CC7.5CC9.1 | Capacity management to meet availability commitments; Environmental protections, backups and recovery infrastructure… | Editorial | Same topic: Business Continuity, Disaster Recovery, Recovery Planning, Reporting, Incident Response, Mitigation (editorial pick) |
| CMMC | IR.L2-3.6.1IR.L2-3.6.2IR.L2-3.6.3 | Incident Handling; Incident Reporting… | Crosswalk | Same topic: Incident Response, Mitigation, Reporting6 loosely related (not mappings) |
| 800-53 | CP-2CP-2(8)CP-10IR-4IR-6IR-8CP-7IR-2IR-3 | Contingency Plan; Identify Critical Assets… | Crosswalk | Same topic: Recovery Planning, Business Continuity, Disaster Recovery, Incident Response, Mitigation, Reporting43 loosely related (not mappings)SR-3 Supply Chain Controls and Processes Only shares CSF GV.SC-02, GV.SC-08, GV.SC-10, RS.CO-02…: related, not a mapping SR-2 Supply Chain Risk Management Plan Only shares CSF GV.RM-04, GV.SC-02, GV.SC-08, GV.SC-10…: related, not a mapping SR-8 Notification Agreements Only shares CSF GV.SC-08, RC.CO-03, RS.CO-02, RS.CO-03…: related, not a mapping IR-7 Incident Response Assistance Only shares CSF RS.CO-02, RS.CO-03, RS.MA-01, RS.MA-04: related, not a mapping PM-9 Risk Management Strategy Only shares CSF GV.RM-04, GV.RM-05, ID.RA-06, RC.RP-04: related, not a mapping PM-30 Supply Chain Risk Management Strategy Only shares CSF GV.OC-04, GV.RM-04, GV.RM-05, ID.RA-06: related, not a mapping …and 35 more in the downloads |
| HIPAA | §164.308(a)(6)§164.308(a)(6)(ii)§164.308(a)(7)§164.308(a)(7)(ii)(B)§164.308(a)(7)(ii)(C)§164.308(a)(7)(ii)(D) | Security Incident Procedures; Response and Reporting… | Crosswalk | Same topic: Incident Response, Mitigation, Reporting, Recovery Planning, Disaster Recovery, Business Continuity22 loosely related (not mappings)§164.314(a)(2)(i) Business Associate Contracts Only shares CSF GV.SC-08, GV.SC-10, RC.CO-03, RS.CO-02…: related, not a mapping §164.314(a)(2)(iii) Business associate contracts with subcontractors Only shares CSF GV.SC-08, GV.SC-10, RC.CO-03, RS.CO-02…: related, not a mapping §164.308(a)(1)(ii)(D) Information System Activity Review Only shares CSF RC.CO-03, RS.CO-02, RS.CO-03, RS.MA-01…: related, not a mapping §164.314(b)(2)(iv) Group Health Plan Implementation Specification Only shares CSF RC.CO-03, RS.CO-02, RS.CO-03, RS.MA-01…: related, not a mapping §164.310(a)(2)(i) Contingency Operations Only shares CSF GV.OC-04, ID.IM-04, PR.DS-11, PR.IR-02…: related, not a mapping §164.308(a)(7)(ii)(E) Applications and Data Criticality Analysis Only shares CSF GV.OC-04, ID.IM-04, PR.IR-02, RC.CO-04…: related, not a mapping §164.312(a)(2)(ii) Emergency Access Procedure Only shares CSF GV.OC-04, ID.IM-04, PR.IR-02, RC.CO-04…: related, not a mapping …and 14 more in the downloads |
| GDPR | Art.32(1)(b)Art.32(1)(c)Art.33(1)Art.33(5)Art.34(1) | Security of processing; Security of processing… | Editorial | Same topic: Business Continuity, Recovery Planning, Disaster Recovery, Incident Response, Reporting (editorial pick) |
| NIS2 | 3.13.33.54.14.24.3 | Incident handling policy; Event reporting… | Crosswalk | Same topic: Incident Response, Reporting, Mitigation, Recovery Planning, Business Continuity, Disaster Recovery |
| Essential Eight | ISM-0123ISM-0140ISM-1515ISM-1819 | Cyber security incidents are reported to the chief information security officer, or one…; Cyber security incidents are reported to ASD as soon as possible after they occur or…… | Editorial | Same topic: Reporting, Disaster Recovery, Incident Response (editorial pick)12 loosely related (not mappings)ISM-1228 Cyber security events are analysed in a timely manner to identify cyber security incidents Only shares CSF DE.AE-06, DE.AE-08: related, not a mapping ISM-1511 Backups of data, applications and settings are performed and retained in accordance… Only shares CSF PR.DS-11, RC.RP-03: related, not a mapping ISM-1705 Privileged user accounts (excluding backup administrator accounts) cannot access… Only shares CSF PR.DS-11, RC.RP-03: related, not a mapping ISM-1706 Privileged user accounts (excluding backup administrator accounts) cannot access their… Only shares CSF PR.DS-11, RC.RP-03: related, not a mapping ISM-1707 Privileged user accounts (excluding backup administrator accounts) are prevented from… Only shares CSF PR.DS-11, RC.RP-03: related, not a mapping ISM-1708 Backup administrator accounts are prevented from modifying and deleting backups during… Only shares CSF PR.DS-11, RC.RP-03: related, not a mapping ISM-1810 Backups of data, applications and settings are synchronised to enable restoration to a… Only shares CSF PR.DS-11, RC.RP-03: related, not a mapping ISM-1811 Backups of data, applications and settings are retained in a secure and resilient manner Only shares CSF PR.DS-11, RC.RP-03: related, not a mapping …and 4 more in the downloads |
| DORA | Art.11(1)Art.11(2)(b)Art.11(2)(c)Art.11(3)Art.11(4)Art.11(6)Art.12(4)Art.12(6)Art.17(1)Art.17(3)Art.17(3)(f)Art.18(1)Art.19(1)Art.19(3)Art.19(4) | Response and recovery; Response and recovery… | Editorial | Same topic: Business Continuity, Incident Response, Mitigation, Recovery Planning, Disaster Recovery, Reporting (editorial pick)17 loosely related (not mappings)Art.12(1) Backup policies and procedures, restoration and recovery procedures and methods Only shares CSF PR.DS-11, RC.RP-03: related, not a mapping Art.12(2) Backup policies and procedures, restoration and recovery procedures and methods Only shares CSF PR.DS-11, RC.RP-03: related, not a mapping Art.12(3) Backup policies and procedures, restoration and recovery procedures and methods Only shares CSF PR.DS-11, RC.RP-03: related, not a mapping …and 9 more in the downloads |
| CPS 234 | Para 23Para 24Para 25Para 26Para 35Para 36 | Detect and respond to incidents in a timely manner; Maintain information security response plans… | Editorial | Same topic: Incident Response, Reporting (editorial pick) |
| Cyber Essentials | — | No requirement | No mapping in our data | No mapping in our data (Cyber Essentials covers five technical controls only). |
Crosswalk a published crosswalk (NIST, ENISA, CIS, PCI SSC) makes the link · Editorial ControlMapping's judgement where no crosswalk exists; the reason is shown · only shares a CSF 2.0 outcome: worth checking, not a mapping · No mapping in our data nothing mapped in our data; often new work, but check the coverage notes. How links are sourced.