Frameworks / Cloud Security Alliance Cloud Controls Matrix (CCM) v4.0.1 / CCM-SEF-03 Cloud Security Alliance Cloud Controls Matrix (CCM) v4.0.1
SEF - Security Incident Management, E-Discovery & Cloud Forensics
Cloud Security Alliance Cloud Controls Matrix (CCM) v4.0.1 CCM-SEF-03: Incident Response Plans Maintain an approved security incident response plan that names the internal departments, affected cloud customers and business-critical relationships such as the supply chain that may be drawn in.
Maintained by Gerard Blokdyk · Control text last updated 19 August 2026 What else in your programme already covers this This control maps to 76 controls across 34 other frameworks. If you already hold one of them, the evidence you collected for it is the starting point here rather than new work.
NIST-CSF-GV.SC-08 Relevant suppliers and other third parties are included in incident planning, response, and recovery activities NIST-CSF-ID.IM-04 Incident response plans and other cybersecurity plans that affect operations are established, communicated, maintained, and improved NIST-CSF-RC.RP-01 The recovery portion of the incident response plan is executed once initiated from the incident response process NIST-CSF-RS.AN-06 Actions performed during an investigation are recorded, and the records' integrity and provenance are preserved NIST-CSF-RS.MA-01 The incident response plan is executed in coordination with relevant third parties once an incident is declared NIST-CSF-RS.MA-04 Incidents are escalated or elevated as needed NIST-CSF-RS.MA-05 The criteria for initiating incident recovery are applied NIST-CSF-RS.MI-01 Incidents are contained NIST-CSF-RS.MI-02 Incidents are eradicated CP-2 Contingency Plan IR-2 Incident Response Training IR-4 Incident Handling IR-4(1) Automated Incident Handling Processes IR-6(3) Incident Reporting | Supply Chain Coordination (IR-6(3)) IR-8 Incident Response Plan CP-2 Contingency Plan IR-2 Incident Response Training IR-4 Incident Handling IR-4(1) Automated Incident Handling Processes IR-6(3) Incident Reporting | Supply Chain Coordination (IR-6(3)) IR-8 Incident Response Plan CIS-17.1 Designate Personnel to Manage Incident Handling CIS-17.3 Establish and Maintain an Enterprise Process for Reporting Incidents CIS-17.4 Establish and Maintain an Incident Response Process CIS-17.5 Assign Key Roles and Responsibilities CIS-17.6 Define Mechanisms for Communicating During Incident Response 10.7.3 10.7.3 Respond promptly to critical security control failures 12.10.1 12.10.1 Incident response plan ready for activation 12.10.3 12.10.3 Incident response personnel available 24/7 12.10.5 12.10.5 Plan covers alerts from security monitoring systems 12.10.7 12.10.7 Response procedures for PAN found in unexpected locations SOC2-CC7.3 CC7.3 Evaluating security events to identify incidents SOC2-CC7.4 CC7.4 Responding to security incidents SOC2-CC7.5 CC7.5 Recovering from security incidents CPS234-P24 Information Security Response Plans CPS234-P25 Response Plan Content and Escalation Mechanisms C5-OPS-21 Involvement of Cloud Customers in the Event of Incidents C5-SIM-01 Policy for security incident management 8.4.2 Response structure 8.4.4 Business continuity plans 5.24 Information security incident management planning and preparation 5.26 Response to information security incidents 5.24 Information security incident management planning and preparation 5.26 Response to information security incidents E8-ADMIN-ML2 Restrict Administrative Privileges (ML2) ANSSI-HYG-40 Define a Security Incident Management Procedure CBPR-PR-32 Detection, prevention and response measures CPS220-P35 Required Content of Risk Management Policies and Procedures CPS230-27 Identification and Escalation of Incidents and Near Misses ASBv3-IR-1 Preparation - update incident response plan and handling process CFTC-SS-16 Security Incident Response Plan and Testing SEF-03 Incident Response Plans 6.13.1 Management of information security incidents and improvements 3.6.2e Establish and Maintain a Cyber Incident Response Team Every mapping shown was judged rather than inferred from wording similarity, and the ones that failed review are published too. See the coverage reports and what was rejected .
Other controls in SEF - Security Incident Management, E-Discovery & Cloud Forensics You are reading one control. How much of Cloud Security Alliance Cloud Controls Matrix (CCM) v4.0.1 have you already done? Cloud Security Alliance Cloud Controls Matrix (CCM) v4.0.1 CCM-SEF-03 is one control. If you already hold one of the frameworks below, a reviewed crosswalk already says how much of Cloud Security Alliance Cloud Controls Matrix (CCM) v4.0.1 your existing evidence covers. Hold NIST SP 800-53 Rev 5 and 140 of 197 Cloud Security Alliance Cloud Controls Matrix (CCM) v4.0.1 controls already carry evidence.
Each report names every control your existing framework evidences, every one it does not, the reasoning behind each claim, and the claims that were argued against and rejected. 12 were rejected on the NIST SP 800-53 Rev 5 pair alone.
Query this from an agent The graph holds this control, the 76 it maps to, and the evidence behind each claim, over MCP and REST.