Frameworks / IAEA Nuclear Security Series - Computer Security at Nuclear Facilities (NSS-17-T Rev 1) / IAEA-NSS17-Detect-Monitor-Logging-IR-Recovery-Exercises IAEA Nuclear Security Series - Computer Security at Nuclear Facilities (NSS-17-T Rev 1)
IAEA NSS-17 Detect + IR + Recovery
IAEA Nuclear Security Series - Computer Security at Nuclear Facilities (NSS-17-T Rev 1) IAEA-NSS17-Detect-Monitor-Logging-IR-Recovery-Exercises: IAEA NSS-17 - Detection + Monitoring + Logging + Incident Response + Recovery + Computer Security Exercises NSS-17 + NSS-42-G require continuous monitoring + detection + incident response + recovery aligned with CSL. Logging: all CBS log security-relevant events (authentication + authorization + privileged action + configuration change + network connection + system start/stop + safety event + integrity check + emergency override); centralised log server / SIEM (on-site + air-gapped from corporate IT for CSL 1-2 zones); log retention (typically 1 year minimum + 7 years for safety/security-significant + 30 days online); log integrity protection (signed + write-once + tamper-evident); accurate time synchronisation (NTP + GPS time + atomic clock); log review periodic + automated correlation. Network monitoring: passive network traffic analysis on OT segments; intrusion detection + signatures + behavioral + anomaly; alert generation; on-site Security Operations Centre (SOC) or hybrid with national CSIRT; integration with plant computer system + alarm management. Incident Response Plan (IRP): detection triggers + classification (safety-impact + security-impact + reportable per Regulatory Body) + response team + roles + procedures + escalation + reporting + communication (operator + State + Regulatory Body + national CSIRT + IAEA Incident and Emergency Centre IEC + emergency response organisation); coordination with Emergency Preparedness arrangements per IAEA GSR Part 7. Recovery: backup strategy per CBS (frequency + location + retention + offline + air-gapped) + RTO + RPO; restoration testing + tabletop + recovery time validation; degraded mode operation procedures; safety-critical system manual override + recovery; voyage / operational continuity vs shutdown decision. Computer Security Exercises (CSE): annual minimum + scenarios + red team + tabletop + functional + capstone + IAEA NUSEC simulator; post-exercise improvement. IAEA NSS-17 + Detect + IR + Recovery + Exercises + CSE applies.
Maintained by Gerard Blokdyk · Verified against the published standard 31 May 2026 · Control text last updated 21 May 2026 What else in your programme already covers this This control maps to 252 controls across 120 other frameworks. If you already hold one of them, the evidence you collected for it is the starting point here rather than new work.
ASD37-29 Host-based IDS/IPS (Very Good) ASD37-31 Hunt to discover incidents (Very Good) ASD37-32 Network-based IDS/IPS (Limited) ASD37-33 Capture network traffic (Limited) ASD37-34 Regular backups (Essential) ASD37-35 Business continuity and disaster recovery plans (Very Good) ASD37-36 System recovery capabilities (Very Good) NIST-CSF-ID.IM-04 Incident response plans and other cybersecurity plans that affect operations are established, communicated, maintained, and improved NIST-CSF-PR.PS-04 Log records are generated and made available for continuous monitoring NIST-CSF-RC.RP-01 The recovery portion of the incident response plan is executed once initiated from the incident response process NIST-CSF-RC.RP-06 The end of incident recovery is declared based on criteria, and incident-related documentation is completed NIST-CSF-RS.MA-01 The incident response plan is executed in coordination with relevant third parties once an incident is declared NIST-CSF-RS.MA-05 The criteria for initiating incident recovery are applied API1164-13 Business Continuity and Recovery API1164-17 Wireless and Field Communications API1164-18 Field Device Security API1164-19 Safety Instrumented Systems Interface BSI-17 Continuous monitoring strategy BSI-18 Incident response planning and testing BSI-20 Incident reporting and notification BSI-21 Forensic analysis capabilities FFIEC-12 Disaster recovery procedures FFIEC-23 Regulatory reporting requirements FFIEC-24 Customer notification procedures FFIEC-25 Post-incident review and improvement IEC62443-13 Network security monitoring IEC62443-16 Incident response plan for operational disruptions IEC62443-17 Recovery plan for critical systems IEC62443-20 Exercises and drills for OT incidents ISO27019-13 Network security monitoring ISO27019-16 Incident response plan for operational disruptions ISO27019-18 Reporting obligations to authorities ISO27019-20 Exercises and drills for OT incidents NDPA-1 Applicability, Scope, and Carve-Outs NDPA-2 Consumer Rights - Access, Correct, Delete, Portability, Appeal NDPA-5 Privacy Notice, Data Minimisation, and Purpose Limitation NDPA-6 Reasonable Security Practices and Incident Response NG-NDPA-1 Scope, Applicability, and Establishment of Nigeria Data Protection Commission NG-NDPA-2 Lawful Basis, Consent, and Data Protection Principles NG-NDPA-5 Security of Processing, Breach Notification, and DPIA NG-NDPA-6 Data Protection Officer, DPCO, and Processor Agreements IM8-RES.2 Disaster Recovery IM8-RES.3 Incident Response IM8-RES.4 Resilience Testing IM8-SEC.3 Network Security ISMSP-PI-06 Personal Information Destruction ISMSP-SYS-03 Security Monitoring and Log Management ISMSP-SYS-05 Incident Response ISMSP-SYS-06 Business Continuity and Disaster Recovery IS.AR.215 Information Security Incident Response IS.D.OR.225 External Reporting of Information Security Events IS.I.OR.225 External Reporting IMO-MSC-FAL-Detect-AnomalyDetection-OT-IT-Monitoring-Reporting-BridgeAlarms IMO MSC-FAL Detect Function - Anomaly Detection + OT and IT System Monitoring + Bridge Alarms + Log Aggregation + Incident Reporting Channels + Crew Observation IMO-MSC-FAL-Recover-BackupRestore-ContinuityOfNavigation-LessonsLearned-Drills IMO MSC-FAL Recover Function - Backup and Restore + Continuity of Navigation + Continuity of Cargo Operations + Continuity of Propulsion + Lessons Learned + Drills + Resilience IMO-MSC-FAL-Respond-IncidentResponse-Communication-FlagState-PortAuthority-CIRT-USCGNVIC IMO MSC-FAL Respond Function - Incident Response Plan + Containment + Communication + Flag State + Port Authority + USCG NVIC + Class Society Notification + CIRT ISO-22320-5.2 Incident management process ISO-22320-B Annex B: Incident management plan structure ISO-22320-C Annex C: Incident management task examples 27031-8.1 Exercising and Testing 27031-8.2 Maintaining IRBC 27031-9.3 Management Review MTCS-Acquisition-Development-Maintenance-Supplier-Vulnerability-DevSecOps-SBOM-SDLC-SCA-API-Container MTCS Acquisition + Development + Maintenance + Supplier + Vulnerability + DevSecOps + SBOM + SDLC + SCA MTCS-Incident-Business-Continuity-CSC-Data-Protection-72-Hour-Notification-BCP-DR-PDPA MTCS Incident + Business Continuity + CSC Data Protection + 72-Hour Notification + BCP + DR + PDPA MTCS-Logging-Monitoring-Compliance-Audit-SLA-Configuration-SIEM-SOAR-Cloud-Monitoring-CSPM MTCS Logging + Monitoring + Compliance + Audit + SLA + Configuration + SIEM + SOAR + CSPM NFPA1600-5.3 Resource Needs Assessment NFPA1600-6.3 Emergency Response Operations NFPA1600-6.4 Continuity and Recovery D.1 Incident Response Planning D.2 Incident Reporting D.3 Backup and Recovery APPI-A41 Preparation and Handling of Pseudonymized Personal Information APPI-A43 Preparation of Anonymized Personal Information CPS234-21 Implementation of Information Security Controls CPS234-25 Internal Audit Review of Information Security Controls 4.4.7 Emergency and Incident Response 4.4.8 Business Continuity and Recovery CAT-D3-2 Detective controls CAT-D5-1 Incident planning and strategy CA-8 Penetration Testing IR-4 Incident Handling CA-8 Penetration Testing IR-4 Incident Handling UAE-PDPL-Art.10 Data Protection Officer (DPO) (UAE PDPL Article 10) UAE-PDPL-Art.18_19_20_21 Security measures, controller/processor relationship, DPIA (UAE PDPL Articles 18-21) IEEE1686-IR-Recovery-Reporting-Exercises-Drills-RECOV IEEE 1686 - Incident Response + Recovery from Failed Update + Reporting to Authorities + Coordination with Sector-Specific Agencies + Exercises and Drills IEEE1686-Section5.2-5.3-AuditLog-Retention-Export-Monitoring IEEE 1686 Section 5.2 + 5.3 - Audit Trail Records + Retention + Export + Supervisory Monitoring and Control + Network Security Monitoring ISO22316-08 Recovery time and point objectives ISO22316-12 Recovery strategy for critical activities ISO28001-PC-04 Supply Chain Continuity Planning ISO28001-PS-01 Facility Security 30111-3 Terms and definitions 30111-5.2 Vulnerability handling team ISO22317-08 Recovery time and point objectives ISO22317-12 Recovery strategy for critical activities ISO22318-08 Recovery time and point objectives ISO22318-12 Recovery strategy for critical activities JP-FSA-CYB-Incident-Response-Playbooks-Containment-Eradication-Recovery-Post-Mortem-Tabletop-CSIRT Japan FSA Cybersecurity Incident Response + Playbooks + Containment + Eradication + Recovery + Post-Mortem + Tabletop Exercises + CSIRT + FSA Notification + Customer Communication + Forensics + Lessons Learned JP-FSA-CYB-Security-Monitoring-SOC-Operations-SIEM-EDR-MDR-XDR-24x7-Detection-Alert-Triage Japan FSA Cybersecurity Security Monitoring + SOC 24x7 Operations + SIEM + EDR + MDR + XDR + Detection + Alert Triage + Threat Hunting + Incident Response Integration + Threat Intelligence Integration + UEBA MY-PDPA-Cross-Border-Transfer-Section-129-Whitelist-Abolition-2024-Adequacy-SCC-BCR-Processor-Direct-Marketing Malaysia PDPA Cross-Border + Section 129 + Whitelist Abolition 2024 + Adequacy + SCC + BCR + Processor + Marketing MY-PDPA-Security-Principle-Retention-Data-Integrity-Breach-Notification-72-Hour-Section-12B-2024-Amendment Malaysia PDPA Security + Retention + Data Integrity + Breach Notification 72 Hour + Section 12B + 2024 Amendment MAS-TRM-Cyber-Resilience-Chapter-11-Threat-Intelligence-Penetration-Testing-Incident-Response-1-Hour-Notification MAS TRM Cyber Resilience + Chapter 11 + Threat Intelligence + Penetration Testing + Incident Response + 1-Hour Notification MAS-TRM-Reliability-Data-Centre-Chapters-7-8-RTO-RPO-BCP-DR-System-Availability-4-Hours-12-Months MAS TRM Reliability + Data Centre + Chapters 7-8 + RTO + RPO + BCP + DR + System Availability 4 Hours 12 Months NERCCIP-5 System Security Management + Configuration Change Management and Vulnerability Assessments (CIP-007 + CIP-010) NERCCIP-6 Incident Reporting and Response Planning + Recovery Plans (CIP-008 + CIP-009) NISTSP144-6 Availability, Resilience, BCP/DR, and SLA Management NISTSP144-8 Monitoring, Incident Response, Exit Strategy, and Compliance NISTSP145-3 Rapid Elasticity Characteristic and Capacity Management NISTSP145-8 Governance, Reporting, and Stakeholder Education on Cloud Definition NISTSP146-6 Cloud Security and Privacy Recommendations NISTSP146-7 Service Level, Performance, Reliability, Interoperability, and Portability NISTSP82-6 OT Audit, Monitoring, Anomaly Detection, and OT-Specific SOC NISTSP82-7 OT Incident Response, Forensics, Recovery, and Continuity NISTSP34-2 Business Impact Analysis (BIA): Critical Resources, Recovery Priorities NISTSP34-4 Information System Contingency Plan (ISCP) Development NJDPA-2 Consumer Rights - Access, Correct, Delete, Portability, Appeal NJDPA-6 Reasonable Data Security and Incident Response DSOMM-1 Culture, Organization, Education, and Governance DSOMM-5 Information Gathering, Logging, Monitoring, and Incident Response CYB-5 Cyber Incident Response Plan USMTSA-2 Cybersecurity Assessment and CSO Designation CPS230-13 Board Accountability for Operational Risk Management AT-DSG-6 Sections 12-13 - Image processing (video surveillance/CCTV) BB-DPA-20 Sections 50-60 - Registration and Responsibilities CA-12 Deploys Through Policies and Procedures CA-ITSG33-SC-01 Security Control Catalogue DIQ-1 Data Integration and Interoperability LOPDP-EC-Security-Processor-Breach-Notification-Articles-37-45-Encryption-72-Hour-SPDP-Notification-CSIRT Ecuador LOPDP Security + Processor + Breach Notification + Articles 37-45 + 72-Hour FTC-Safeguards-IR-Plan-BoardReporting-FTC-Notification Written Incident Response Plan + Board Reporting + FTC Breach Notification (16 CFR 314.4(h), (i), (j)) FEDRAMP-CP-9 System Backup FDBR-Enforcement-AG-CurePeriod Enforcement by Florida Department of Legal Affairs + Penalties + 45-Day Cure (Fla. Stat. 501.72, 501.721, 501.722) ICP-24 Macroprudential Surveillance and Insurance Supervision ISO20000-11 Incident management 27006-9.4 Surveillance and recertification 27010-16.1 Continuity of Sharing 27011-8.6 Data protection and backup ISO27043-23 Backup and recovery procedures 27400-6.5 Security monitoring and incident response ISO21434-23 Backup and recovery procedures ITIL4-11 Incident management INCDPA-Security-ReasonablePractices-Breach-Notification-Records-Encryption-Pseudonymisation Indiana CDPA Security + Reasonable Practices + Breach Notification + Indiana Breach Notification Law (IC 24-4.9) + Records + Encryption + Pseudonymisation + De-Identification LGPD-BR-Security-Article-46-48-Breach-Notification-ANPD-Reasonable-Time-Incident-Response-CSIRT Brazil LGPD Security + Article 46-48 + Breach Notification + ANPD + Incident Response LAOS-CC-LaoCERT-Incident-Response-National-Cybersecurity-Coordination-Article-22 Laos Cybercrime LaoCERT + Incident Response + National Cybersecurity Coordination + Article 22 DOM172-Security-Measures-Article-25-Encryption-Pseudonymization-Access-Control-Incident-Handling-Breach-Notification-Article-22 Dominican Republic Law 172-13 Security Measures + Article 25 + Encryption + Breach Notification MU-DPA-Governance-DPO-Designation-Section-25-DPO-ROPA-DPIA-Codes-Section-38-Commissioner-Registration Mauritius DPA Governance + DPO + ROPA + DPIA + Codes Section 38 + Commissioner Registration MX-LFPDPPP-Governance-Officer-Reglamento-47-50-Security-Manual-57-Risk-Assessment-61-Self-Regulation-Parameters-2014 Mexico LFPDPPP Governance + Officer + Reglamento 47 + Security Manual 50 + Risk Assessment 57 + Self-Regulation Parameters 2014 MN-CDPA-Chief-Privacy-Officer-Section-325O-06-MN-UNIQUE-Designation-Privacy-Programme-Training Minnesota CDPA Chief Privacy Officer + Section 325O.06 + MINNESOTA-UNIQUE Designation + Privacy Programme + Training MT-CDPA-Sensitive-Data-MCA-30-14-2802-Opt-In-Children-13-Parental-Consent-Minors-13-16-Opt-In Montana CDPA Sensitive Data + MCA 30-14-2802 + Affirmative Opt-In + Children Under 13 Parental + Minors 13-16 Opt-In NABERS-3 NABERS Water Performance Rating NAIC-5 Third Party Service Provider Oversight - Section 4(F)(3) and Section 5 AQAP2110-2 Government Quality Assurance Representative (GQAR) Authority and Access NISTSP115-8 Operational Considerations - Tools, Reporting Templates, ISMS Integration, Annex Material NISTSP123-5 Server Operations - Patching, Malware, Logging, Backup NISTSP137-7 Incident Response Integration and Ongoing Authorization NISTSP61-5 Containment, Eradication, and Recovery NISTSP63R4-4 Authenticator Lifecycle: Binding, Recovery, Replacement, Suspension, Revocation NISTSP88-5 Media Inventory, Tracking, Chain of Custody, and Sanitization Records NISTSP92-6 Log Retention: Policy, Tiered Storage, Backup, Secure Disposal, Legal Hold NRFCS-7 Detection, Logging, Incident Response, Breach Notification, and Fraud Detection NGCB-6 Incident Response, 72-Hour NGCB Notification, and Independent Investigation NHPA-6 Reasonable Data Security and Breach Response NGNDPR-5 Security of Personal Data, Breach Notification, and DPIA under NDPR Section 2.6-Security NGOB-5 Fraud Monitoring, Incident Notification, and Reporting to CBN OWASPMASVS-7 MASVS-RESILIENCE: Resilience Against Reverse Engineering OWASPTOP10-9 A09:2025 Security Logging and Monitoring Failures PAKPDPB-5 Security of Processing and Personal Data Breach Notification NORWAY-8 Breach Notification, Complaints, Compliance, Enforcement AUPRV-7 Notifiable Data Breaches (NDB) Scheme, Incident Response PSPF24-1 Security Culture, Governance, Risk Management SGCYBER-1 Critical Information Infrastructure (CII) Designation and Registration TEFCAREC-1 Common Agreement Conformance and Onboarding TURKEYKVKK-2 Information Notice and Data Subject Rights UAEVARA-1 Activity Licensing (Advisory, Exchange, Custody, Broker-Dealer, etc.) USSDWA-2 Cybersecurity Practices (Assessment, Access, Network, IR) VIETNAMCYBER-2 Prohibited Acts (Access, Interception, Forgery, Content) VPSHR-3 Implementation Guidance and Reporting Every mapping shown was judged rather than inferred from wording similarity, and the ones that failed review are published too. See the coverage reports and what was rejected .
Query this from an agent The graph holds this control, the 252 it maps to, and the evidence behind each claim, over MCP and REST.