This requirement exists to report availability status, performance against objectives, and trends and to ensure operational services are managed consistently, reliably, and with appropriate control.
Define and document the process for report availability status, performance against objectives, and trends. Establish accountable owners, inputs and outputs, approval or validation points, operating criteria, schedules or thresholds where applicable, exception handling, monitoring, reporting, review, and evidence requirements. Integrate the process with change, incident, risk, asset, security, and service-management processes where relevant.
| FRAMEWORK CODE | FRAMEWORK NAME & DETAILS | FAMILY / CATEGORY | VERSION | ACTION |
|---|---|---|---|---|
| CIS-V8 | CIS Controls CIS Controls are a prioritized set of cybersecurit... Clause: Control 11 – Data Recovery: 11.1 – Establish and Maintain a Data Recovery Process |
CIS
Best Practice
|
vv8 | View → |
| COBIT2019 | COBIT COBIT is an enterprise governance and management f... Clause: 4.3 – Build, Acquire and Implement (BAI) > BAI04 – Managed Availability and Capacity > BAI04.01 – Assess current availability, performance and capacity and 4.3 – Build, Acquire and Implement (BAI) > BAI04 – Managed Availability and Capacity > BAI04.05 – Investigate and address availability, performance and |
COBIT
Governance Framework
|
v2019 | View → |
| DORA | Digital Operational Resilience Act The EU Digital Operational Resilience Act establis... Clause: Article 11(1) – Comprehensive ICT business continuity policy Article 11(3) – ICT response and recovery plans |
EU
Regulation
|
vCurrent | View → |
| GDPR | General Data Protection Regulation (GDPR) The General Data Protection Regulation is a bindin... Clause: Article 32(1)(b) – Confidentiality, integrity, availability and access resilience; Article 32(1)(c) – Timely restoration of availability and access |
EU
Regulation
|
vCurrent | View → |
| IRDAI | IRDAI Information & Cyber Security Guidelines IRDAI information and cyber-security requirements... Clause: §2.5-3.1.3 – Availability standards; §2.13-3.1 – IT Availability |
India
Guideline
|
vLatest | View → |
| ISO22301 | ISO/IEC 22301 ISO 22301 specifies requirements for a Business Co... Clause: 8.3.4 – Resource requirements; 8.3.5 – Implementation of solutions; 9.1 – Monitoring, measurement, analysis and evaluation |
ISO
Standard
|
v2019 | View → |
| ISO27001 | ISO/IEC 27001 ISO/IEC 27001 specifies auditable requirements for... Clause: 7.4 – Communication |
ISO
Standard
|
v2022 | View → |
| NIS2 | NIS2 Directive The NIS2 Directive establishes EU-wide cybersecuri... Clause: Article 21(2)(c) – Business continuity, including backup management, disaster recovery and crisis management |
EU
Directive
|
vCurrent | View → |
| NIST-CSF | NIST Cybersecurity Framework (CSF) The NIST Cybersecurity Framework provides high-lev... Clause: PR.IR – Technology Infrastructure Resilience | PR.IR-04 – Adequate resource capacity to ensure availability is maintained DE.CM – Continuous Monitoring | DE.CM-09 – Computing hardware and software, runtime environments, and their data are monitored to find potentially adverse events |
NIST
Framework
|
v2 | View → |
| NIST80053 | NIST SP 800-53 NIST SP 800-53 Rev. 5 presents control families, i... Clause: 3.18 – SYSTEM AND COMMUNICATIONS PROTECTION, 3.6 – CONTINGENCY PLANNING; SC-6 – RESOURCE AVAILABILITY, CP-10 – SYSTEM RECOVERY AND RECONSTITUTION |
NIST
Control Catalog
|
vRev. 5 | View → |
| NPCI-ISR | NPCI Information Security Requirements NPCI information-security requirements define cont... Clause: Operational Review; Business Continuity Plan – High Availability |
India
Standard
|
vLatest | View → |
| PCI-DSS | PCI DSS PCI DSS is an industry security standard maintaine... Clause: 12.3.2 – A targeted risk analysis is performed for each; 12.3.4 – Hardware and software technologies in use |
PCI
Standard
|
v4 | View → |
| RBI-CSF | RBI Cyber Security Framework / Master Directions RBI cyber-security requirements and directions set... Clause: 19) Incident Response & Management – 19.4 BCP/DR supporting cyber resilience, rapid recovery and secure resumption aligned to RTOs |
India
Regulation
|
vLatest | View → |
| SEBI-CSCRF | SEBI Cyber Security & Cyber Resilience Framework SEBI’s Cybersecurity and Cyber Resilience Framewor... Clause: 3.4 PR.IP: Information Protection Processes and Procedures; 6.1 RC.RP: Incident Recovery Plan Execution |
India
Regulation
|
vLatest | View → |
| SOC2 | SOC 2 Trust Services Criteria SOC 2 is an independent examination and reporting... Clause: A1.1 – Availability – The entity maintains, monitors, and evaluates current processing capacity and use of system components (infrastructure, data, and software) to manage capacity demand and to enable the implementation of additional capacity to help meet its objectives. A1.2 – Availability – The entity authorizes, designs, develops or acquires, implements, operates, approves, maintains, and monitors environmental protections, software, data backup processes, and recovery infrastructure to meet its objectives. A1.3 – Availability – The entity tests recovery plan procedures supporting system recovery to meet its objectives. CC2.2 – Information and Communication – COSO Principle 14: The entity internally communicates information, including objectives and responsibilities for internal control, necessary to support the functioning of internal control. |
AICPA
Audit Framework
|
vLatest | View → |