This requirement exists to analyze incident trends, frequencies, response times, containment times, and recovery times to identify improvement needs and to ensure security incidents are handled consistently, promptly, and with clear accountability.
Establish a documented process for analyze incident trends, frequencies, response times, containment times, and recovery times to identify improvement needs. Define accountable roles, inputs and outputs, decision criteria, approval or escalation points, timeframes where applicable, evidence requirements, monitoring, reporting, review, and exception handling. Integrate the process with security operations, risk management, business continuity, legal, compliance, communications, and technology operations as appropriate.
| FRAMEWORK CODE | FRAMEWORK NAME & DETAILS | FAMILY / CATEGORY | VERSION | ACTION |
|---|---|---|---|---|
| CIS-V8 | CIS Controls CIS Controls are a prioritized set of cybersecurit... Clause: Control 17 – Incident Response Management: 17.6 – Define Mechanisms for Communicating During Incident Response |
CIS
Best Practice
|
vv8 | View → |
| COBIT2019 | COBIT COBIT is an enterprise governance and management f... Clause: 4.4 – Deliver, Service and Support (DSS) > DSS02 – Managed Service Requests and Incidents > DSS02.07 – Track status and produce reports. 4.4 – Deliver, Service and Support (DSS) > DSS04 – Managed Continuity > DSS04.03 – Develop and implement a business continuity response. |
COBIT
Governance Framework
|
v2019 | View → |
| DORA | Digital Operational Resilience Act The EU Digital Operational Resilience Act establis... Clause: Article 13(2) – Post-ICT-incident reviews and identification of improvements Article 13(3) – Incorporation of testing/incident lessons into ICT risk assessment and framework |
EU
Regulation
|
vCurrent | View → |
| IRDAI | IRDAI Information & Cyber Security Guidelines IRDAI information and cyber-security requirements... Clause: §2.10-3.4 – Management of IS Incidents and Improvement; §2.10-3.6 – Knowledge Management |
India
Guideline
|
vLatest | View → |
| ISO22301 | ISO/IEC 22301 ISO 22301 specifies requirements for a Business Co... Clause: 8.4.1 – General; 8.4.2 – Response structure; 8.4.5 – Recovery |
ISO
Standard
|
v2019 | View → |
| ISO27001 | ISO/IEC 27001 ISO/IEC 27001 specifies auditable requirements for... Clause: 9.1 – Monitoring, measurement, analysis and evaluation |
ISO
Standard
|
v2022 | View → |
| ISO27002 | ISO/IEC 27002 ISO/IEC 27002 is a guidance standard containing a... Clause: 5.26 – Response to information security incidents |
ISO
Standard
|
v2022 | View → |
| NIS2 | NIS2 Directive The NIS2 Directive establishes EU-wide cybersecuri... Clause: Article 21(2)(b) – Incident handling |
EU
Directive
|
vCurrent | View → |
| NIST-CSF | NIST Cybersecurity Framework (CSF) The NIST Cybersecurity Framework provides high-lev... Clause: RS.MA – Incident Management | RS.MA-01 – The incident response plan is executed in coordination with relevant third parties once an incident is declared RS.AN – Incident Analysis | RS.AN-03 – Analysis is performed to establish what has taken place during an incident and the root cause of the incident RS.CO – Incident Response Reporting and Communication | RS.CO-03 – Information is shared with designated internal and external stakeholders |
NIST
Framework
|
v2 | View → |
| NIST80053 | NIST SP 800-53 NIST SP 800-53 Rev. 5 presents control families, i... Clause: 3.8 – INCIDENT RESPONSE; IR-4 – INCIDENT HANDLING |
NIST
Control Catalog
|
vRev. 5 | View → |
| NPCI-ISR | NPCI Information Security Requirements NPCI information-security requirements define cont... Clause: Security Measures / Controls; Incident Management – Investigating |
India
Standard
|
vLatest | View → |
| PCI-DSS | PCI DSS PCI DSS is an industry security standard maintaine... Clause: 12.10.1 – An incident response plan exists and is; 12.10.2 – At least once every 12 months, the security; 12.10.3 – Specific personnel are designated to be; 12.10.4 – Personnel responsible for responding to; 12.10.5 – The security incident response plan; 12.10.6 – The security incident response plan is; 12.10.7 – Incident response procedures are in place, |
PCI
Standard
|
v4 | View → |
| RBI-CSF | RBI Cyber Security Framework / Master Directions RBI cyber-security requirements and directions set... Clause: 19) Incident Response & Management – 19.3 Lessons learned incorporated to improve response strategies; 7) Patch/Vulnerability & Change Management – 7.6 Root-cause identification and patching to plug vulnerabilities |
India
Regulation
|
vLatest | View → |
| SEBI-CSCRF | SEBI Cyber Security & Cyber Resilience Framework SEBI’s Cybersecurity and Cyber Resilience Framewor... Clause: 5.3 RS.AN: Incident Analysis; 5.4 RS.IM: Improvements |
India
Regulation
|
vLatest | View → |
| SOC2 | SOC 2 Trust Services Criteria SOC 2 is an independent examination and reporting... Clause: CC4.2 – Monitoring of Controls – COSO Principle 17: The entity evaluates and communicates internal control deficiencies in a timely manner to those parties responsible for taking corrective action, including senior management and the board of directors, as appropriate. CC7.5 – System Operations – The entity identifies, develops, and implements activities to recover from identified security incidents. |
AICPA
Audit Framework
|
vLatest | View → |