Draft v0.1.06 of 6 frameworks
Incident response and breach notification
Documented incident response plan, defined roles, testing at least annually, and notification obligations.
Where it appears
- SOC 2
CC7.3Evaluates security events to determine whether they are incidentsCC7.4Responds to identified security incidentsCC7.5Identifies, develops and implements activities to recover from incidents- PCI DSS 4.0
12.10Suspected and confirmed security incidents that could impact the CDE are responded to immediately (12.10.1 IR plan, 12.10.2 annual review and test)- NIST CSF 2.0
RS.MAIncident managementRS.ANIncident analysisRS.COIncident response reporting and communicationRS.MIIncident mitigationDE.AEAdverse event analysis- ISO 27001:2022
A.5.24Information security incident management planning and preparationA.5.25Assessment and decision on information security eventsA.5.26Response to information security incidentsA.5.27Learning from information security incidents- HIPAA Security Rule
164.308(a)(6)Security incident procedures164.404Notification to individuals (Breach Notification Rule)- NIST 800-53 r5
IR-4Incident handlingIR-8Incident response planIR-6Incident reportingIR-3Incident response testing
Evidence auditors usually ask for
A typical starting list. Your assessor's request list is the one that counts.
- Incident response plan with roles, escalation paths and contact lists
- Evidence the plan was tested or exercised (tabletop report) within the last 12 months
- Incident tickets/records with timeline, root cause and lessons learned (or a statement that none occurred)
- Breach notification procedure aligned to contractual and regulatory deadlines
Crosswalks that include this
SOC 2 to PCI DSS 4.0SOC 2 to NIST CSF 2.0SOC 2 to ISO 27001:2022SOC 2 to HIPAA Security RuleSOC 2 to NIST 800-53 r5PCI DSS 4.0 to SOC 2PCI DSS 4.0 to NIST CSF 2.0PCI DSS 4.0 to ISO 27001:2022PCI DSS 4.0 to HIPAA Security RulePCI DSS 4.0 to NIST 800-53 r5NIST CSF 2.0 to SOC 2NIST CSF 2.0 to PCI DSS 4.0