This requirement exists to define the governance and process for assessing, approving, and conducting regulatory and external incident notifications and to ensure security incidents are handled consistently, promptly, and with clear accountability.
Establish a documented process for define the governance and process for assessing, approving, and conducting regulatory and external incident notifications. Define accountable roles, inputs and outputs, decision criteria, approval or escalation points, timeframes where applicable, evidence requirements, monitoring, reporting, review, and exception handling. Integrate the process with security operations, risk management, business continuity, legal, compliance, communications, and technology operations as appropriate.
| FRAMEWORK CODE | FRAMEWORK NAME & DETAILS | FAMILY / CATEGORY | VERSION | ACTION |
|---|---|---|---|---|
| CERT-IN | CERT-In Directions The CERT-In Directions issued under India’s Inform... Clause: Direction (ii) – Mandatory reporting of cyber security incidents to CERT-In within 6 hours |
India
Direction
|
v2022 | View → |
| COBIT2019 | COBIT COBIT is an enterprise governance and management f... Clause: 4.4 – Deliver, Service and Support (DSS) > DSS02 – Managed Service Requests and Incidents > DSS02.01 – Define classification schemes for incidents and 4.4 – Deliver, Service and Support (DSS) > DSS05 – Managed Security Services > DSS05.07 – Manage vulnerabilities and monitor the infrastructure for |
COBIT
Governance Framework
|
v2019 | View → |
| DORA | Digital Operational Resilience Act The EU Digital Operational Resilience Act establis... Clause: Article 19(1) – Reporting major ICT-related incidents to the relevant competent authority Article 19(4) – Initial, intermediate and final incident reports |
EU
Regulation
|
vCurrent | View → |
| GDPR | General Data Protection Regulation (GDPR) The General Data Protection Regulation is a bindin... Clause: Article 33(1) – Notification of a personal data breach to the supervisory authority; Article 34(1) – Communication of a personal data breach to the data subject |
EU
Regulation
|
vCurrent | View → |
| IRDAI | IRDAI Information & Cyber Security Guidelines IRDAI information and cyber-security requirements... Clause: §2.10-3.5 – Notification to regulatory authorities; §2.17-3.2 – Adherence to IRDAI guidelines |
India
Guideline
|
vLatest | View → |
| ISO22301 | ISO/IEC 22301 ISO 22301 specifies requirements for a Business Co... Clause: 8.4.3 – Warning and communication; 7.4 – Communication |
ISO
Standard
|
v2019 | View → |
| ISO27001 | ISO/IEC 27001 ISO/IEC 27001 specifies auditable requirements for... Clause: 7.4 – Communication |
ISO
Standard
|
v2022 | View → |
| NIS2 | NIS2 Directive The NIS2 Directive establishes EU-wide cybersecuri... Clause: Article 23(1) – Significant incident notification and cross-border impact information |
EU
Directive
|
vCurrent | View → |
| NIST-CSF | NIST Cybersecurity Framework (CSF) The NIST Cybersecurity Framework provides high-lev... Clause: RS.CO – Incident Response Reporting and Communication | RS.CO-02 – Internal and external stakeholders are notified of incidents |
NIST
Framework
|
v2 | View → |
| NIST80053 | NIST SP 800-53 NIST SP 800-53 Rev. 5 presents control families, i... Clause: 3.8 – INCIDENT RESPONSE; IR-6 – INCIDENT REPORTING, IR-7 – INCIDENT RESPONSE ASSISTANCE |
NIST
Control Catalog
|
vRev. 5 | View → |
| NPCI-ISR | NPCI Information Security Requirements NPCI information-security requirements define cont... Clause: Security Measures / Controls; Incident Management – Reporting |
India
Standard
|
vLatest | View → |
| PCI-DSS | PCI DSS PCI DSS is an industry security standard maintaine... Clause: 12.10.1 – An incident response plan exists and is; 12.10.2 – At least once every 12 months, the security; 12.10.3 – Specific personnel are designated to be; 12.10.4 – Personnel responsible for responding to; 12.10.5 – The security incident response plan; 12.10.6 – The security incident response plan is; 12.10.7 – Incident response procedures are in place, |
PCI
Standard
|
v4 | View → |
| RBI-CSF | RBI Cyber Security Framework / Master Directions RBI cyber-security requirements and directions set... Clause: Circular §14 – Sharing of information on cyber-security incidents with RBI; Circular §15 – Supervisory Reporting framework |
India
Regulation
|
vLatest | View → |
| SEBI-CSCRF | SEBI Cyber Security & Cyber Resilience Framework SEBI’s Cybersecurity and Cyber Resilience Framewor... Clause: 5.2 RS.CO: Incident Response Reporting and Communication |
India
Regulation
|
vLatest | View → |
| SOC2 | SOC 2 Trust Services Criteria SOC 2 is an independent examination and reporting... Clause: CC7.4 – System Operations – The entity responds to identified security incidents by executing a defined incident-response program to understand, contain, remediate, and communicate security incidents, as appropriate. CC2.3 – Information and Communication – COSO Principle 15: The entity communicates with external parties regarding matters affecting the functioning of internal control. |
AICPA
Audit Framework
|
vLatest | View → |