This requirement exists to evaluate containment, eradication, and recovery effectiveness against established criteria and to ensure security incidents are handled consistently, promptly, and with clear accountability.
Establish a documented process for evaluate containment, eradication, and recovery effectiveness against established criteria. Define accountable roles, inputs and outputs, decision criteria, approval or escalation points, timeframes where applicable, evidence requirements, monitoring, reporting, review, and exception handling. Integrate the process with security operations, risk management, business continuity, legal, compliance, communications, and technology operations as appropriate.
| FRAMEWORK CODE | FRAMEWORK NAME & DETAILS | FAMILY / CATEGORY | VERSION | ACTION |
|---|---|---|---|---|
| COBIT2019 | COBIT COBIT is an enterprise governance and management f... Clause: 4.4 – Deliver, Service and Support (DSS) > DSS04 – Managed Continuity > DSS04.03 – Develop and implement a business continuity response. 4.4 – Deliver, Service and Support (DSS) > DSS05 – Managed Security Services > DSS05.07 – Manage vulnerabilities and monitor the infrastructure for |
COBIT
Governance Framework
|
v2019 | View → |
| DORA | Digital Operational Resilience Act The EU Digital Operational Resilience Act establis... Clause: Article 11(2)(c) – Containment measures and response/recovery procedures for ICT incidents Article 11(3) – ICT response and recovery plans Article 17(3)(f) – ICT incident response procedures and timely secure service restoration |
EU
Regulation
|
vCurrent | View → |
| GDPR | General Data Protection Regulation (GDPR) The General Data Protection Regulation is a bindin... Clause: Article 32(1) – Security of processing; Article 32(1)(c) – Timely restoration of availability and access; Article 32(1)(d) – Testing, assessing and evaluating security measures |
EU
Regulation
|
vCurrent | View → |
| HIPAA | Health Insurance Portability and Accountability Act HIPAA is a U.S. federal law supported by implement... Clause: § 164.308(a)(12) Standard: Security incident procedures; § 164.308(a)(12)(ii)(B) Response |
US
Law
|
vCurrent | View → |
| IRDAI | IRDAI Information & Cyber Security Guidelines IRDAI information and cyber-security requirements... Clause: §2.10-3.4 – Management of IS Incidents and Improvement; §2.13-3.3-IV – IT DR Recovery Planning |
India
Guideline
|
vLatest | View → |
| ISO22301 | ISO/IEC 22301 ISO 22301 specifies requirements for a Business Co... Clause: 8.4.1 – General; 8.4.2 – Response structure; 8.4.5 – Recovery |
ISO
Standard
|
v2019 | View → |
| ISO27002 | ISO/IEC 27002 ISO/IEC 27002 is a guidance standard containing a... Clause: 5.26 – Response to information security incidents |
ISO
Standard
|
v2022 | View → |
| NIS2 | NIS2 Directive The NIS2 Directive establishes EU-wide cybersecuri... Clause: Article 21(2)(b) – Incident handling |
EU
Directive
|
vCurrent | View → |
| NIST-CSF | NIST Cybersecurity Framework (CSF) The NIST Cybersecurity Framework provides high-lev... Clause: GV.OV – Oversight | GV.OV-03 – Organizational cybersecurity risk management performance is evaluated and reviewed for adjustments needed |
NIST
Framework
|
v2 | View → |
| NIST80053 | NIST SP 800-53 NIST SP 800-53 Rev. 5 presents control families, i... Clause: 3.8 – INCIDENT RESPONSE, 3.6 – CONTINGENCY PLANNING; IR-4 – INCIDENT HANDLING, CP-10 – SYSTEM RECOVERY AND RECONSTITUTION |
NIST
Control Catalog
|
vRev. 5 | View → |
| NPCI-ISR | NPCI Information Security Requirements NPCI information-security requirements define cont... Clause: Operational Review; Business Continuity Plan – Disaster Recovery (DR) |
India
Standard
|
vLatest | View → |
| PCI-DSS | PCI DSS PCI DSS is an industry security standard maintaine... Clause: 12.10.1 – An incident response plan exists and is; 12.10.2 – At least once every 12 months, the security; 12.10.3 – Specific personnel are designated to be; 12.10.4 – Personnel responsible for responding to; 12.10.5 – The security incident response plan; 12.10.6 – The security incident response plan is; 12.10.7 – Incident response procedures are in place, |
PCI
Standard
|
v4 | View → |
| RBI-CSF | RBI Cyber Security Framework / Master Directions RBI cyber-security requirements and directions set... Clause: 19) Incident Response & Management – 19(e) Containment using shielding controls/quarantine; 19) Incident Response & Management – 19.4 BCP/DR supporting cyber resilience, rapid recovery and secure resumption aligned to RTOs |
India
Regulation
|
vLatest | View → |
| SEBI-CSCRF | SEBI Cyber Security & Cyber Resilience Framework SEBI’s Cybersecurity and Cyber Resilience Framewor... Clause: 5.1 RS.MA: Incident Management; 6.1 RC.RP: Incident Recovery Plan Execution |
India
Regulation
|
vLatest | View → |
| SOC2 | SOC 2 Trust Services Criteria SOC 2 is an independent examination and reporting... Clause: CC7.4 – System Operations – The entity responds to identified security incidents by executing a defined incident-response program to understand, contain, remediate, and communicate security incidents, as appropriate. CC7.5 – System Operations – The entity identifies, develops, and implements activities to recover from identified security incidents. CC4.1 – Monitoring of Controls – COSO Principle 16: The entity selects, develops, and performs ongoing and/or separate evaluations to ascertain whether the components of internal control are present and functioning. |
AICPA
Audit Framework
|
vLatest | View → |