Mobile Incident Management (END-003-R007) - END-003

Requirement Details & Guidance

END-003-R007 · END-003

Why This Requirement Exists

To ensure mobile incident management is consistently implemented and provides the intended security outcome for mobile device & application security.

Implementation Guidance

Define the required process, scope, roles, and control criteria for mobile incident management; implement through approved centralized tooling where practical; document evidence, monitor compliance, and establish remediation and escalation paths.

Practical Application & Audit Readiness

END-003-R007 · Field Guidance

Business Examples

Common Audit Findings

Common Mistakes

Best Practices & Ownership

END-003 · Recommended Approach

Recommended Practices

Typical Owner

Cross-Mapped Regulatory Frameworks

Harmonized Control Mappings

FRAMEWORK CODE	FRAMEWORK NAME & DETAILS	FAMILY / CATEGORY	VERSION	ACTION
CERT-IN	CERT-In Directions The CERT-In Directions issued under India’s Inform... Clause: Direction (ii) – Mandatory reporting of cyber security incidents to CERT-In within 6 hours Annexure I(xv) – Attacks through malicious mobile Apps Annexure I(xi) – Data Breach	India Direction	v2022	View →
COBIT2019	COBIT COBIT is an enterprise governance and management f... Clause: 4.4 – Deliver, Service and Support (DSS) > DSS05 – Managed Security Services > DSS05.03 – Manage endpoint security. 4.4 – Deliver, Service and Support (DSS) > DSS05 – Managed Security Services > DSS05.07 – Manage vulnerabilities and monitor the infrastructure for	COBIT Governance Framework	v2019	View →
DORA	Digital Operational Resilience Act The EU Digital Operational Resilience Act establis... Clause: Article 9(2) – ICT security policies, procedures, protocols and tools for resilience and data security Article 9(4)(c) – Logical/physical access limitation and access-rights administration	EU Regulation	vCurrent	View →
GDPR	General Data Protection Regulation (GDPR) The General Data Protection Regulation is a bindin... Clause: Article 32(1) – Security of processing; Article 33(1) – Notification of a personal data breach to the supervisory authority; Article 34(1) – Communication of a personal data breach to the data subject	EU Regulation	vCurrent	View →
IRDAI	IRDAI Information & Cyber Security Guidelines IRDAI information and cyber-security requirements... Clause: §2.6-3.7 – IT Service Management	India Guideline	vLatest	View →
ISO22301	ISO/IEC 22301 ISO 22301 specifies requirements for a Business Co... Clause: 8.4.2 – Response structure; 8.4.5 – Recovery	ISO Standard	v2019	View →
ISO27002	ISO/IEC 27002 ISO/IEC 27002 is a guidance standard containing a... Clause: 8.1 – User endpoint devices	ISO Standard	v2022	View →
NIS2	NIS2 Directive The NIS2 Directive establishes EU-wide cybersecuri... Clause: Article 21(2)(g) – Basic cyber hygiene practices and cybersecurity training	EU Directive	vCurrent	View →
NIST-CSF	NIST Cybersecurity Framework (CSF) The NIST Cybersecurity Framework provides high-lev... Clause: ID.AM – Asset Management \| ID.AM-08 – Systems, hardware, software, services, and data are managed throughout their life cycles PR.PS – Platform Security \| PR.PS-02 – Software is maintained, replaced, and removed commensurate with risk	NIST Framework	v2	View →
NIST80053	NIST SP 800-53 NIST SP 800-53 Rev. 5 presents control families, i... Clause: 3.1 – ACCESS CONTROL; AC-19 – ACCESS CONTROL FOR MOBILE DEVICES	NIST Control Catalog	vRev. 5	View →
PCI-DSS	PCI DSS PCI DSS is an industry security standard maintaine... Clause: 2.2.1 – Configuration standards are developed,; 2.2.6 – System security parameters are configured to; 8.3.8 – Authentication policies and procedures are	PCI Standard	v4	View →
RBI-CSF	RBI Cyber Security Framework / Master Directions RBI cyber-security requirements and directions set... Clause: 8) User Access Control / Management – 8.9 Remote management/wiping/locking of mobile devices/laptops; 6) Application Security Life Cycle (ASLC) – 6.8 Containerised/encrypted mobile business apps and remote wipe	India Regulation	vLatest	View →
SEBI-CSCRF	SEBI Cyber Security & Cyber Resilience Framework SEBI’s Cybersecurity and Cyber Resilience Framewor... Clause: 4.1 DE.CM: Security Continuous Monitoring	India Regulation	vLatest	View →
SOC2	SOC 2 Trust Services Criteria SOC 2 is an independent examination and reporting... Clause: CC6.1 – Logical and Physical Access Controls – The entity implements logical access security software, infrastructure, and architectures over protected information assets to protect them from security events to meet the entity's objectives. CC6.6 – Logical and Physical Access Controls – The entity implements logical access security measures to protect against threats from sources outside its system boundaries. CC7.4 – System Operations – The entity responds to identified security incidents by executing a defined incident-response program to understand, contain, remediate, and communicate security incidents, as appropriate.	AICPA Audit Framework	vLatest	View →

Parent Domain Context

Governance Domain Baseline

Domain Name:

Endpoint Security (END)

Purpose:

To protect endpoint devices (laptops, servers, mobile) from threats.

Scope:

Enterprise

View

Parent Control Context

Control Baseline

Control Name:

Mobile Device & Application Management (END-003)

Summary:

Establishes mobile device and application management including enrollment, configuration, application management, data protection, compliance monitoring, and incident management for mobile platforms.

Business Description:

Establish and maintain controls to securely manage mobile devices, mobile applications, and enterprise data on mobile platforms.

View