API 1164

Respond (RS): response planning, communications, analysis, mitigation, improvements (Section 9) – API 1164

API 1164 RS.CO-2: RS.CO-2 A reporting mechanism for suspected incidents and criteria for official declaration

The plan must require that the response capability provides and communicates a way for staff to report incidents they suspect, suspicious activity and anomalous events, and that the response plan sets the criteria for formally declaring an incident, which triggers plan execution.

Maintained by Gerard BlokdykControl text last updated 21 May 2026

Other controls in Respond (RS): response planning, communications, analysis, mitigation, improvements (Section 9) – API 1164

RS.AN-1 RS.AN-1 Notifications and alerts investigated
RS.AN-2 RS.AN-2 Incident impact analysed within and beyond the environment where detected, feeding lessons learned
RS.AN-3 RS.AN-3 Evidence preservation, collection and forensic analysis for root cause
RS.AN-4 RS.AN-4 Incident categorisation by disruption of essential functions, type, severity and sensitivity
RS.AN-5 RS.AN-5 Vulnerability disclosure intake (no profile-specific requirement)
RS.CO-1 RS.CO-1 Response structure, roles and contacts documented, distributed, updated and tested
RS.CO-3 RS.CO-3 Incident communications plan with defined recipients, content and authorised external communicators
RS.CO-4 RS.CO-4 Coordination of response with internal and external stakeholders

Query this from an agent

The graph holds this control, the 0 it maps to, and the evidence behind each claim, over MCP and REST.

MCP endpoint All API 1164 controls