CISA Cross-Sector Cybersecurity Performance Goals (CPG) 2.0
Response & Recovery

CISA Cross-Sector Cybersecurity Performance Goals (CPG) 2.0 CPG-7.A: Incident Reporting

Establish processes to report cybersecurity incidents to CISA and other authorities as required.

Maintained by Gerard BlokdykVerified against the published standard Control text last updated

What else in your programme already covers this

This control maps to 31 controls across 14 other frameworks. If you already hold one of them, the evidence you collected for it is the starting point here rather than new work.

API 1164 · 3 controls

  • API1164-17 Wireless and Field Communications
  • API1164-18 Field Device Security
  • API1164-19 Safety Instrumented Systems Interface

BSI IT-Grundschutz · 3 controls

  • BSI-18 Incident response planning and testing
  • BSI-20 Incident reporting and notification
  • BSI-21 Forensic analysis capabilities

APPI · 2 controls

  • APPI-A41 Preparation and Handling of Pseudonymized Personal Information
  • APPI-A43 Preparation of Anonymized Personal Information

ASD Strategies to Mitigate Cyber Security Incidents · 2 controls

  • ASD37-31 Hunt to discover incidents (Very Good)
  • ASD37-33 Capture network traffic (Limited)

Bahrain PDPL · 2 controls

ISO/IEC 30111:2019 · 2 controls

  • 30111-3 Terms and definitions
  • 30111-5.2 Vulnerability handling team

Switzerland New Federal Act on Data Protection (nFADP/nDSG, 2023) · 2 controls

ASIS SPC.1-2009 - Organizational Resilience Standard · 1 control

  • 4.4.7 Emergency and Incident Response

Barbados Data Protection Act 2019 · 1 control

  • BB-DPA-20 Sections 50-60 - Registration and Responsibilities

COSO Internal Control - Integrated Framework (2013) · 1 control

  • CA-12 Deploys Through Policies and Procedures

Canada ITSG-33 - IT Security Risk Management · 1 control

  • CA-ITSG33-SC-01 Security Control Catalogue

FFIEC Cybersecurity Assessment Tool (CAT) · 1 control

  • CAT-D5-1 Incident planning and strategy

ISO/IEC 27010:2015 · 1 control

  • 27010-16.1 Continuity of Sharing

ISO/IEC 27400:2022 · 1 control

  • 27400-6.5 Security monitoring and incident response

Every mapping shown was judged rather than inferred from wording similarity, and the ones that failed review are published too. See the coverage reports and what was rejected.

Other controls in Response & Recovery

Query this from an agent

The graph holds this control, the 31 it maps to, and the evidence behind each claim, over MCP and REST.

MCP endpointAll CISA Cross-Sector Cybersecurity Performance Goals (CPG) 2.0 controls