This requirement exists to improve notification effectiveness and compliance using reviews, regulatory changes, and benchmarking and to ensure security incidents are handled consistently, promptly, and with clear accountability.
Establish a documented process for improve notification effectiveness and compliance using reviews, regulatory changes, and benchmarking. Define accountable roles, inputs and outputs, decision criteria, approval or escalation points, timeframes where applicable, evidence requirements, monitoring, reporting, review, and exception handling. Integrate the process with security operations, risk management, business continuity, legal, compliance, communications, and technology operations as appropriate.
| FRAMEWORK CODE | FRAMEWORK NAME & DETAILS | FAMILY / CATEGORY | VERSION | ACTION |
|---|---|---|---|---|
| ISO27001 | ISO/IEC 27001 ISO/IEC 27001 specifies auditable requirements for... Clause: 10.1 – Continual improvement |
ISO
Standard
|
v2022 | View → |
| RBI-CSF | RBI Cyber Security Framework / Master Directions RBI cyber-security requirements and directions set... Clause: 4) Network Management and Security – 4.7 Detect and remedy unusual activity in systems, servers, network devices and endpoints; 4) Network Management and Security – 4.9 SOC monitoring of network logs and escalation of abnormal activity; 19) Incident Response & Management – 19.2 Written incident-response procedures, roles, scenarios, situational awareness and stakeholder coordination |
India
Regulation
|
vLatest | View → |
| SEBI-CSCRF | SEBI Cyber Security & Cyber Resilience Framework SEBI’s Cybersecurity and Cyber Resilience Framewor... Clause: 4.2 DE.DP: Detection Process; 5.3 RS.AN: Incident Analysis |
India
Regulation
|
vLatest | View → |
| DORA | Digital Operational Resilience Act The EU Digital Operational Resilience Act establis... Clause: Article 10(1) – Mechanisms to promptly detect anomalous activities and ICT-related incidents Article 10(2) – Multiple detection layers, alert thresholds and incident-response triggers Article 17(2) – Recording, monitoring, handling, follow-up and root-cause treatment of incidents |
EU
Regulation
|
vCurrent | View → |
| NIS2 | NIS2 Directive The NIS2 Directive establishes EU-wide cybersecuri... Clause: Article 21(2)(b) – Incident handling |
EU
Directive
|
vCurrent | View → |
| PCI-DSS | PCI DSS PCI DSS is an industry security standard maintaine... Clause: 12.10.1 – An incident response plan exists and is; 12.10.2 – At least once every 12 months, the security; 12.10.3 – Specific personnel are designated to be; 12.10.4 – Personnel responsible for responding to; 12.10.5 – The security incident response plan; 12.10.6 – The security incident response plan is; 12.10.7 – Incident response procedures are in place, |
PCI
Standard
|
v4 | View → |
| COBIT2019 | COBIT COBIT is an enterprise governance and management f... Clause: 4.4 – Deliver, Service and Support (DSS) > DSS05 – Managed Security Services > DSS05.07 – Manage vulnerabilities and monitor the infrastructure for |
COBIT
Governance Framework
|
v2019 | View → |
| ISO22301 | ISO/IEC 22301 ISO 22301 specifies requirements for a Business Co... Clause: 8.4.1 – General; 8.4.2 – Response structure; 8.4.5 – Recovery |
ISO
Standard
|
v2019 | View → |
| NIST-CSF | NIST Cybersecurity Framework (CSF) The NIST Cybersecurity Framework provides high-lev... Clause: RS.MA – Incident Management | RS.MA-01 – The incident response plan is executed in coordination with relevant third parties once an incident is declared RS.AN – Incident Analysis | RS.AN-03 – Analysis is performed to establish what has taken place during an incident and the root cause of the incident RS.CO – Incident Response Reporting and Communication | RS.CO-03 – Information is shared with designated internal and external stakeholders |
NIST
Framework
|
v2 | View → |
| NIST80053 | NIST SP 800-53 NIST SP 800-53 Rev. 5 presents control families, i... Clause: 3.8 – INCIDENT RESPONSE; IR-4 – INCIDENT HANDLING |
NIST
Control Catalog
|
vRev. 5 | View → |
| NPCI-ISR | NPCI Information Security Requirements NPCI information-security requirements define cont... Clause: Security Measures / Controls; Incident Response |
India
Standard
|
vLatest | View → |
| SOC2 | SOC 2 Trust Services Criteria SOC 2 is an independent examination and reporting... Clause: CC7.1 – System Operations – To meet its objectives, the entity uses detection and monitoring procedures to identify (1) changes to configurations that result in the introduction of new vulnerabilities, and (2) susceptibilities to newly discovered vulnerabilities. CC7.3 – System Operations – The entity evaluates security events to determine whether they could or have resulted in a failure of the entity to meet its objectives (security incidents) and, if so, takes actions to prevent or address such failures. CC4.1 – Monitoring of Controls – COSO Principle 16: The entity selects, develops, and performs ongoing and/or separate evaluations to ascertain whether the components of internal control are present and functioning. CC4.2 – Monitoring of Controls – COSO Principle 17: The entity evaluates and communicates internal control deficiencies in a timely manner to those parties responsible for taking corrective action, including senior management and the board of directors, as appropriate. |
AICPA
Audit Framework
|
vLatest | View → |