FFIEC IT Examination Handbook
FFIEC IT Examination Handbook: Operational Resilience

FFIEC IT Examination Handbook FFIEC-14: Critical service identification

Critical service identification. Control from FFIEC IT Examination Handbook framework, domain: FFIEC IT Examination Handbook: Operational Resilience.

What else in your programme already covers this

This control maps to 95 controls across 49 other frameworks. If you already hold one of them, the evidence you collected for it is the starting point here rather than new work.

ASIS SPC.1-2009 - Organizational Resilience Standard · 3 controls

  • 4.3.2 Legal and Other Requirements
  • 4.4.1 Resources, Roles, Responsibility, and Authority
  • 4.4.2 Competence, Training, and Awareness

NIST Cybersecurity Framework 2.0 · 3 controls

  • NIST-CSF-PR.DS-10 The confidentiality, integrity, and availability of data-in-use are protected
  • NIST-CSF-PR.IR-03 Mechanisms are implemented to achieve resilience requirements in normal and adverse situations
  • NIST-CSF-PR.IR-04 Adequate resource capacity to ensure availability is maintained

PCI P2PE · 3 controls

PCI PIN Security · 3 controls

PCI SSF · 3 controls

SOC 2 · 3 controls

  • SOC2-A1.1 Maintains capacity to meet availability commitments
  • SOC2-A1.2 Environmental protections, data backups, and recovery infrastructure support availability
  • SOC2-A1.3 Recovery plan procedures support system recovery from failures

Singapore Government Instruction Manual on ICT&SS Management (IM8) · 3 controls

APRA CPS 234 · 2 controls

  • CPS234-14 Definition of Information Security Roles and Responsibilities
  • CPS234-15 Information Security Capability

IEC 62351 - Power Systems Communication Security · 2 controls

  • 62351-12 Resilience and security recommendations for DER
  • 62351-13 Cyber-physical generation and storage resilience

ISO/IEC 27031:2011 · 2 controls

Monetary Authority of Singapore Technology Risk Management Guidelines · 2 controls

NIST Privacy Framework · 2 controls

  • NISTPF-6 Protect-P Data Security (PR.DS-P)
  • NISTPF-7 Protect-P Maintenance and Protective Technology (PR.MA-P, PR.PT-P)

NIST SP 800-82 Revision 3: Guide to Industrial Control Systems (ICS) Security · 2 controls

  • NISTSP82-1 OT Security Program Governance, Policy, Roles, and Safety-Security Integration
  • NISTSP82-5 OT Configuration Management, Patching, Vulnerability Management, and Malware Protection

OSFI B-13 · 2 controls

  • OSFIB13-4 Third-Party Risk Management and Cloud
  • OSFIB13-7 Incident Reporting to OSFI and Regulatory Coordination

Open Banking Security · 2 controls

  • OPENBANK-4 Third Party Provider (TPP) Onboarding, Directory Integration, Due Diligence
  • OPENBANK-8 Incident Detection, Response, Customer Notification, Post-Incident Review, BCM

SASB Standards · 2 controls

Security of Critical Infrastructure Act 2018 (SOCI) · 2 controls

  • SOCI-S30BC Notification of critical cyber security incidents (12 hours)
  • SOCI-S30BD Notification of other cyber security incidents (72 hours)

UK Open Banking Standard · 2 controls

UK Security and Emergency Measures Direction (SEMD) - Water Industry · 2 controls

ASD Strategies to Mitigate Cyber Security Incidents · 1 control

  • ASD37-20 Multi-factor authentication (Essential)

BS 65000:2014 - Guidance on Organizational Resilience · 1 control

COBIT 2019 · 1 control

DAMA-DMBOK2 - Data Management Body of Knowledge (2nd Edition) · 1 control

  • RMD-1 Reference Data Management

FFIEC Cybersecurity Assessment Tool (CAT) · 1 control

  • CAT-D5-4 Resilience planning and testing

FTC GLBA Safeguards Rule (16 CFR Part 314) · 1 control

GLBA · 1 control

HKMA SPM · 1 control

IEEE 7000 · 1 control

IMO Maritime Cybersecurity Guidelines (MSC-FAL.1/Circ.3/Rev.2) · 1 control

IRM Enterprise Risk Management Framework (Institute of Risk Management) · 1 control

ISO 20000-1 · 1 control

ISO/IEC 25012:2008 - Data Quality Model · 1 control

ISO/IEC 27007:2020 · 1 control

  • 27007-5.4 Establishing the Programme Resources

ISO/IEC 38500:2024 - Governance of IT · 1 control

ITIL 4 · 1 control

  • ITIL4-03 Capacity and availability management

ITU-T X.805 - Security Architecture for End-to-End Communications · 1 control

Japan AI Guidelines · 1 control

MTCS (Singapore) · 1 control

NATO Cyber Defence Policy and NATO Computer Incident Response Capability (NCIRC) · 1 control

  • NATO-NCIRC-8 Cyberspace as Operational Domain + Cyber Defence Pledge + Annual Self-Assessment

Nevada Gaming Control Board Cybersecurity Requirements · 1 control

  • NGCB-6 Incident Response, 72-Hour NGCB Notification, and Independent Investigation

O-RAN WG11 Security Specification · 1 control

  • ORANWG11-2 O-RAN Interface Security: E2, A1, O1, O2, Open Fronthaul

OECD AI Principles · 1 control

  • OECDAI-3 Robustness, Security, Safety, and Adversarial Attack Protection

PSD2 SCA · 1 control

  • PSDTWO-2 SCA Exemptions and Risk-Based Authentication

SOC for Cybersecurity - Cybersecurity Risk Management Examination · 1 control

SSAE 18 - Attestation Standards (SOC Reporting) · 1 control

  • SSAE18-A1.1 A1.1 - Availability Commitments and Requirements

South Africa Promotion of Access to Information Act (PAIA) · 1 control

  • SAPAIA-2 Right of Access and Request Processes

UK AI Regulation Framework · 1 control

  • UKAI-3 Bias Detection, Fairness, Validation

UK FCA/PRA Operational Resilience Framework · 1 control

  • UKOPRES-5 Third-Party Risk, Concentration Risk

US EPA Safe Drinking Water Act (SDWA) - Cybersecurity Requirements · 1 control

  • CERT-1 RRA Certification to EPA

Every mapping shown was judged rather than inferred from wording similarity, and the ones that failed review are published too. See the coverage reports and what was rejected.

Other controls in FFIEC IT Examination Handbook: Operational Resilience

Query this from an agent

The graph holds this control, the 95 it maps to, and the evidence behind each claim, over MCP and REST.

MCP endpointAll FFIEC IT Examination Handbook controls