API 1164

Respond (RS): response planning, communications, analysis, mitigation, improvements (Section 9) – API 1164

API 1164 RS.AN-5: RS.AN-5 Vulnerability disclosure intake (no profile-specific requirement)

API 1164 sets no profile-specific requirement for this CSF subcategory at any profile; the handling of vulnerabilities disclosed from internal and external sources is required through the vulnerability management plan (PR.IP-12).

Maintained by Gerard BlokdykControl text last updated 21 May 2026

Other controls in Respond (RS): response planning, communications, analysis, mitigation, improvements (Section 9) – API 1164

RS.AN-1 RS.AN-1 Notifications and alerts investigated
RS.AN-2 RS.AN-2 Incident impact analysed within and beyond the environment where detected, feeding lessons learned
RS.AN-3 RS.AN-3 Evidence preservation, collection and forensic analysis for root cause
RS.AN-4 RS.AN-4 Incident categorisation by disruption of essential functions, type, severity and sensitivity
RS.CO-1 RS.CO-1 Response structure, roles and contacts documented, distributed, updated and tested
RS.CO-2 RS.CO-2 A reporting mechanism for suspected incidents and criteria for official declaration
RS.CO-3 RS.CO-3 Incident communications plan with defined recipients, content and authorised external communicators
RS.CO-4 RS.CO-4 Coordination of response with internal and external stakeholders

Query this from an agent

The graph holds this control, the 0 it maps to, and the evidence behind each claim, over MCP and REST.

MCP endpoint All API 1164 controls