This requirement exists to prepare for, respond to, coordinate, recover from, test, review, and improve physical emergency preparedness and response, with specific focus on incident coordination, so that physical security controls are proportionate to risk and remain effective.
Establish and document the process for incident coordination. Define accountable owners, required inputs and outputs, authorization or validation criteria, review frequency, monitoring, reporting, exception handling, and evidence requirements. Apply controls according to facility, asset, media, personnel, and environmental risk, and integrate with asset management, incident response, business continuity, and facilities processes where applicable.
| FRAMEWORK CODE | FRAMEWORK NAME & DETAILS | FAMILY / CATEGORY | VERSION | ACTION |
|---|---|---|---|---|
| IRDAI | IRDAI Information & Cyber Security Guidelines IRDAI information and cyber-security requirements... Clause: §1.9-IV – Emergency exceptions |
India
Guideline
|
vLatest | View → |
| RBI-CSF | RBI Cyber Security Framework / Master Directions RBI cyber-security requirements and directions set... Clause: 3) Environmental Controls – 3.1 Environmental controls protecting critical-asset locations from natural/man-made threats; 3) Environmental Controls – 3.2 Monitoring environmental-control breaches and physical security |
India
Regulation
|
vLatest | View → |
| DORA | Digital Operational Resilience Act The EU Digital Operational Resilience Act establis... Clause: Article 6(2) – Protection of information assets, ICT assets and physical components/infrastructure |
EU
Regulation
|
vCurrent | View → |
| NIS2 | NIS2 Directive The NIS2 Directive establishes EU-wide cybersecuri... Clause: Article 21(1) – Cybersecurity risk-management measures – general obligation |
EU
Directive
|
vCurrent | View → |
| COBIT2019 | COBIT COBIT is an enterprise governance and management f... Clause: 4.4 – Deliver, Service and Support (DSS) > DSS05 – Managed Security Services > DSS05.05 – Manage physical access to I&T assets. 4.4 – Deliver, Service and Support (DSS) > DSS01 – Managed Operations > DSS01.05 – Manage facilities. |
COBIT
Governance Framework
|
v2019 | View → |
| NIST-CSF | NIST Cybersecurity Framework (CSF) The NIST Cybersecurity Framework provides high-lev... Clause: PR.AA – Identity Management, Authentication, and Access Control | PR.AA-06 – Physical access to assets is managed, monitored, and enforced commensurate with risk PR.IR – Technology Infrastructure Resilience | PR.IR-02 – The organization’s technology assets are protected from environmental threats DE.CM – Continuous Monitoring | DE.CM-02 – The physical environment is monitored to find potentially adverse events |
NIST
Framework
|
v2 | View → |
| NIST80053 | NIST SP 800-53 NIST SP 800-53 Rev. 5 presents control families, i... Clause: 3.8 – INCIDENT RESPONSE; IR-7 – INCIDENT RESPONSE ASSISTANCE |
NIST
Control Catalog
|
vRev. 5 | View → |
| SOC2 | SOC 2 Trust Services Criteria SOC 2 is an independent examination and reporting... Clause: A1.2 – Availability – The entity authorizes, designs, develops or acquires, implements, operates, approves, maintains, and monitors environmental protections, software, data backup processes, and recovery infrastructure to meet its objectives. A1.3 – Availability – The entity tests recovery plan procedures supporting system recovery to meet its objectives. CC7.4 – System Operations – The entity responds to identified security incidents by executing a defined incident-response program to understand, contain, remediate, and communicate security incidents, as appropriate. |
AICPA
Audit Framework
|
vLatest | View → |