Cloud Security Alliance Cloud Controls Matrix (CCM) v4.0.1 CCM-BCR-09: Disaster Response Plan

What else in your programme already covers this

This control maps to 46 controls across 23 other frameworks. If you already hold one of them, the evidence you collected for it is the starting point here rather than new work.

NIST Cybersecurity Framework 2.0 · 6 controls

NIST-CSF-ID.IM-04 Incident response plans and other cybersecurity plans that affect operations are established, communicated, maintained, and improved
NIST-CSF-RC.RP-01 The recovery portion of the incident response plan is executed once initiated from the incident response process
NIST-CSF-RC.RP-02 Recovery actions are selected, scoped, prioritized, and performed
NIST-CSF-RC.RP-04 Critical mission functions and cybersecurity risk management are considered to establish post-incident operational norms
NIST-CSF-RC.RP-06 The end of incident recovery is declared based on criteria, and incident-related documentation is completed
NIST-CSF-RS.MA-05 The criteria for initiating incident recovery are applied

CFTC System Safeguards (17 CFR 37, 38, 39, 49) · 4 controls

CFTC-SS-24 Periodic Update of the Recovery Plan and Emergency Procedures
CFTC-SS-26 Own Resources or Contractual Arrangements to Meet the Recovery Objective
CFTC-SS-37 Protection of Swap Data Repository Data
CFTC-SS-8 Business Continuity and Disaster Recovery Plan and Resources

ISO 22301:2019 · 4 controls

8.4 Business continuity plans and procedures
8.4.2 Response structure
8.4.4 Business continuity plans
8.4.5 Recovery

APRA CPS 230 Operational Risk Management · 3 controls

CPS230-20 Prevention, Adaptation and Return to Normal Operations
CPS230-26 Critical Operations Register, Continuity Plan and Activation
CPS230-P45 Annual Update of the Business Continuity Plan

FedRAMP High · 3 controls

CP-10 System Recovery and Reconstitution
CP-2 Contingency Plan
IR-8 Incident Response Plan

FedRAMP Moderate · 3 controls

CP-10 System Recovery and Reconstitution
CP-2 Contingency Plan
IR-8 Incident Response Plan

HIPAA Security Rule · 2 controls

164.308(a)(7)(ii)(B) Disaster Recovery Plan (Required)
164.310(a)(2)(i) Contingency Operations (Addressable)

ISO 27001:2022 · 2 controls

5.29 Information security during disruption
5.30 ICT readiness for business continuity

ISO 27002:2022 · 2 controls

5.29 Information security during disruption
5.30 ICT readiness for business continuity

NIST SP 800-53 Rev 5 · 2 controls

NIST800-CP-10 CP-10 System Recovery and Reconstitution
NIST800-CP-2 CP-2 Contingency Plan

NIST SP 800-66 Rev 2 · 2 controls

164.308(a)(7)(ii)(B) Disaster Recovery Plan (Required)
164.310(a)(2)(i) Contingency Operations (Addressable)

SOC 2 · 2 controls

SOC2-A1.3 A1.3 Testing recovery plan procedures
SOC2-CC7.5 CC7.5 Recovering from security incidents

ASD Strategies to Mitigate Cyber Security Incidents · 1 control

ASD37-35 Business continuity and disaster recovery plans (Very Good)

Authorised Economic Operator (AEO) Programmes - Global Standards · 1 control

AEO-12 Crisis Management and Incident Recovery

Azure Security Benchmark · 1 control

ASBv3-IR-1 Preparation - update incident response plan and handling process

C5 (Germany) · 1 control

C5-BCM-03 Planning business continuity

CIS Controls v8 · 1 control

CIS-11.1 Establish and Maintain a Data Recovery Process

CMMC 2.0 · 1 control

IR.L2-3.6.1 Incident Handling

Cloud Security Alliance Cloud Controls Matrix (CCM) v4.1 · 1 control

BCR-09 Disaster Response Plan

DORA · 1 control

DORA-Art.11 Response and recovery

NIS2 Directive · 1 control

Art.21.2.c Business continuity, backup management, disaster recovery and crisis management

NIST SP 800-161 Rev 1 · 1 control

161R1-CP-2 Contingency Plan

PCI DSS 4.0 · 1 control

12.10.1 12.10.1 Incident response plan ready for activation

Every mapping shown was judged rather than inferred from wording similarity, and the ones that failed review are published too. See the coverage reports and what was rejected.

You are reading one control. How much of Cloud Security Alliance Cloud Controls Matrix (CCM) v4.0.1 have you already done?

Cloud Security Alliance Cloud Controls Matrix (CCM) v4.0.1 CCM-BCR-09 is one control. If you already hold one of the frameworks below, a reviewed crosswalk already says how much of Cloud Security Alliance Cloud Controls Matrix (CCM) v4.0.1 your existing evidence covers. Hold NIST SP 800-53 Rev 5 and 140 of 197 Cloud Security Alliance Cloud Controls Matrix (CCM) v4.0.1 controls already carry evidence.

If you hold NIST SP 800-53 Rev 571.1% covered · 57 gaps If you hold FedRAMP Moderate60.4% covered · 78 gaps If you hold PCI DSS 4.060.4% covered · 78 gaps If you hold C5 (Germany)58.4% covered · 82 gaps If you hold ISO 27001:202256.3% covered · 86 gaps If you hold ISO 27002:202256.3% covered · 86 gaps

Each report names every control your existing framework evidences, every one it does not, the reasoning behind each claim, and the claims that were argued against and rejected. 12 were rejected on the NIST SP 800-53 Rev 5 pair alone.

See the released pairs, $299 each Browse the graph free