APRA CPS 220 Risk Management CPS220-19: APRA Notification of Framework Breach within 10 Business Days

What else in your programme already covers this

This control maps to 13 controls across 10 other frameworks. If you already hold one of them, the evidence you collected for it is the starting point here rather than new work.

Cloud Security Alliance Cloud Controls Matrix (CCM) v4.0.1 · 3 controls

CCM-A&A-06 Remediation
CCM-GRC-04 Policy Exception Process
CCM-SEF-08 Points of Contact Maintenance

SOC 2 · 2 controls

SOC2-CC2.3 CC2.3 Communication with external parties about internal control (COSO principle 15)
SOC2-CC4.2 CC4.2 Evaluating and communicating control deficiencies (COSO principle 17)

CMMC 2.0 · 1 control

IR.L2-3.6.2 Incident Reporting

FedRAMP High · 1 control

IR-6 Incident Reporting

FedRAMP Moderate · 1 control

IR-6 Incident Reporting

HIPAA Security Rule · 1 control

164.308(a)(6)(ii) Response and Reporting (Required)

NIST Cybersecurity Framework 2.0 · 1 control

NIST-CSF-GV.OC-03 Legal, regulatory, and contractual requirements regarding cybersecurity - including privacy and civil liberties obligations - are understood and managed

NIST SP 800-161 Rev 1 · 1 control

161R1-IR-6 Incident Reporting

NIST SP 800-53 Rev 5 · 1 control

NIST800-CA-5 CA-5 Plan of Action and Milestones

NIST SP 800-66 Rev 2 · 1 control

164.308(a)(6)(ii) Response and Reporting (Required)

Every mapping shown was judged rather than inferred from wording similarity, and the ones that failed review are published too. See the coverage reports and what was rejected.