This requirement exists to define, assess, approve, monitor, manage, report, review, and validate impact tolerance and criticality for critical business services, with specific focus on impact tolerance framework, so that critical services remain resilient against disruption and decisions are accountable and traceable.
Establish and document the process for impact tolerance framework. Define accountable owners, required inputs and outputs, assessment or approval criteria, review frequency, monitoring, reporting, exception handling, evidence requirements, and escalation paths. Apply the process consistently to critical services and their dependencies, and integrate it with risk management, business continuity, incident management, technology operations, and third-party management where relevant.
| FRAMEWORK CODE | FRAMEWORK NAME & DETAILS | FAMILY / CATEGORY | VERSION | ACTION |
|---|---|---|---|---|
| COBIT2019 | COBIT COBIT is an enterprise governance and management f... Clause: 4.4 – Deliver, Service and Support (DSS) > DSS04 – Managed Continuity > DSS04.02 – Maintain business resilience. |
COBIT
Governance Framework
|
v2019 | View → |
| DORA | Digital Operational Resilience Act The EU Digital Operational Resilience Act establis... Clause: Article 11(1) – Comprehensive ICT business continuity policy Article 11(3) – ICT response and recovery plans |
EU
Regulation
|
vCurrent | View → |
| GDPR | General Data Protection Regulation (GDPR) The General Data Protection Regulation is a bindin... Clause: Article 32(1) – Security of processing; Article 32(1)(b) – Confidentiality, integrity, availability and access resilience; Article 32(1)(c) – Timely restoration of availability and access |
EU
Regulation
|
vCurrent | View → |
| IRDAI | IRDAI Information & Cyber Security Guidelines IRDAI information and cyber-security requirements... Clause: §1.8-II – Target Environments; §2.13-3.3-I – Business Impact Analysis |
India
Guideline
|
vLatest | View → |
| ISO22301 | ISO/IEC 22301 ISO 22301 specifies requirements for a Business Co... Clause: 8.2.2 – Business impact analysis; 8.3.4 – Resource requirements |
ISO
Standard
|
v2019 | View → |
| NIS2 | NIS2 Directive The NIS2 Directive establishes EU-wide cybersecuri... Clause: Article 21(2)(c) – Business continuity, including backup management, disaster recovery and crisis management |
EU
Directive
|
vCurrent | View → |
| NIST-CSF | NIST Cybersecurity Framework (CSF) The NIST Cybersecurity Framework provides high-lev... Clause: GV.RM – Risk Management Strategy | GV.RM-02 – Risk appetite and risk tolerance statements are established, communicated, and maintained GV.OC – Organizational Context | GV.OC-04 – Critical objectives, capabilities, and services that external stakeholders depend on or expect from the organization are understood and communicated |
NIST
Framework
|
v2 | View → |
| NIST80053 | NIST SP 800-53 NIST SP 800-53 Rev. 5 presents control families, i... Clause: 3.16 – RISK ASSESSMENT; RA-9 – CRITICALITY ANALYSIS |
NIST
Control Catalog
|
vRev. 5 | View → |
| NPCI-ISR | NPCI Information Security Requirements NPCI information-security requirements define cont... Clause: Operational Review; Business Continuity Plan – Recovery Time Objective |
India
Standard
|
vLatest | View → |
| PCI-DSS | PCI DSS PCI DSS is an industry security standard maintaine... Clause: 12.3.1 – For each PCI DSS requirement that specifies; 12.3.2 – A targeted risk analysis is performed for each |
PCI
Standard
|
v4 | View → |
| RBI-CSF | RBI Cyber Security Framework / Master Directions RBI cyber-security requirements and directions set... Clause: 19) Incident Response & Management – 19.4 BCP/DR supporting cyber resilience, rapid recovery and secure resumption aligned to RTOs |
India
Regulation
|
vLatest | View → |
| SEBI-CSCRF | SEBI Cyber Security & Cyber Resilience Framework SEBI’s Cybersecurity and Cyber Resilience Framewor... Clause: 1.5 GV.RM: Risk Management; 2.2 ID.RA: Risk Assessment |
India
Regulation
|
vLatest | View → |
| SOC2 | SOC 2 Trust Services Criteria SOC 2 is an independent examination and reporting... Clause: CC9.1 – Risk Mitigation – The entity identifies, selects, and develops risk mitigation activities for risks arising from potential business disruptions. |
AICPA
Audit Framework
|
vLatest | View → |