ISO 27001:2022 5.25: Assessment and decision on information security events

What else in your programme already covers this

This control maps to 102 controls across 35 other frameworks. If you already hold one of them, the evidence you collected for it is the starting point here rather than new work.

NIST Cybersecurity Framework 2.0 · 11 controls

NIST-CSF-DE.AE-02 Potentially adverse events are analyzed to better understand associated activities
NIST-CSF-DE.AE-03 Information is correlated from multiple sources
NIST-CSF-DE.AE-04 The estimated impact and scope of adverse events are understood
NIST-CSF-DE.AE-08 Incidents are declared when adverse events meet the defined incident criteria
NIST-CSF-DE.CM-03 Personnel activity and technology usage are monitored to find potentially adverse events
NIST-CSF-RS.AN-03 Analysis is performed to establish what has taken place during an incident and the root cause of the incident
NIST-CSF-RS.MA-02 Incident reports are triaged and validated
NIST-CSF-RS.MA-03 Incidents are categorized and prioritized
NIST-CSF-RS.MA-04 Incidents are escalated or elevated as needed
NIST-CSF-RS.MA-05 The criteria for initiating incident recovery are applied
NIST-CSF-RS.MI-02 Incidents are eradicated

NIST SP 800-53 Rev 5 · 10 controls

NIST800-AU-6 AU-6 Audit Record Review, Analysis, and Reporting
NIST800-IR-1 IR-1 Policy and Procedures
NIST800-IR-4 IR-4 Incident Handling
NIST800-IR-5 IR-5 Incident Monitoring
NIST800-IR-7 IR-7 Incident Response Assistance
NIST800-IR-9 IR-9 Information Spillage Response
NIST800-RA-3 RA-3 Risk Assessment
NIST800-RA-7 RA-7 Risk Response
NIST800-SI-6 SI-6 Security and Privacy Function Verification
SP800-53-IR Incident Response Family

FedRAMP High · 9 controls

AC-2(12) Account Monitoring for Atypical Usage
AU-6 Audit Record Review, Analysis, and Reporting
IR-1 Policy and Procedures
IR-4 Incident Handling
IR-5 Incident Monitoring
IR-9(4) Information Spillage Response | Exposure to Unauthorized Personnel (IR-9(4))
SA-1 Policy and Procedures
SI-4(5) System-Generated Alerts
SR-10 Inspection of Systems or Components (SR-10)

FedRAMP Moderate · 9 controls

AC-2(12) Account Monitoring for Atypical Usage
AU-6 Audit Record Review, Analysis, and Reporting
IR-1 Policy and Procedures
IR-4 Incident Handling
IR-5 Incident Monitoring
IR-9(4) Information Spillage Response | Exposure to Unauthorized Personnel (IR-9(4))
SA-1 Policy and Procedures
SI-4(5) System-Generated Alerts
SR-10 Inspection of Systems or Components (SR-10)

CIS Controls v8 · 5 controls

CIS-13.1 Centralize Security Event Alerting
CIS-13.11 Tune Security Event Alerting Thresholds
CIS-17.9 Establish and Maintain Security Incident Thresholds
CIS-18.4 Validate Security Measures
CIS-8.11 Conduct Audit Log Reviews

PCI DSS 4.0 · 5 controls

10.4.3 10.4.3 Exceptions and anomalies from log review addressed
10.7.1 10.7.1 Service providers detect critical control failures (superseded)
10.7.3 10.7.3 Respond promptly to critical security control failures
12.10.5 12.10.5 Plan covers alerts from security monitoring systems
12.3.2 12.3.2 Targeted risk analysis for each customized-approach requirement

CMMC 2.0 · 4 controls

AU.L2-3.3.3 Event Review
IR.L2-3.6.1 Incident Handling
IR.L2-3.6.2 Incident Reporting
SI.L2-3.14.7 Identify Unauthorized Use

ISO 27701:2019 · 4 controls

5.6.2 Information security risk assessment
5.8.1 Nonconformity and corrective action
6.13 Information security incident management
6.13.1 Management of information security incidents and improvements

SOC 2 · 4 controls

SOC2-CC4.2 CC4.2 Evaluating and communicating control deficiencies (COSO principle 17)
SOC2-CC7.2 CC7.2 Monitoring system components for anomalies
SOC2-CC7.3 CC7.3 Evaluating security events to identify incidents
SOC2-CC7.4 CC7.4 Responding to security incidents

COBIT 2019 · 3 controls

DSS02.01 DSS02.01 Define classification schemes for incidents and service requests
DSS02.02 DSS02.02 Record, classify and prioritize requests and incidents
DSS02.04 DSS02.04 Investigate, diagnose and allocate incidents

DORA · 3 controls

DORA-Art.10 Detection
DORA-Art.17 ICT-related incident management process
DORA-Art.18 Classification of ICT-related incidents and cyber threats

HIPAA Security Rule · 3 controls

164.308(a)(1)(ii)(B) Risk Management (Required)
164.308(a)(1)(ii)(D) Information System Activity Review (Required)
164.308(a)(6)(ii) Response and Reporting (Required)

NIST SP 800-66 Rev 2 · 3 controls

164.308(a)(1)(ii)(B) Risk Management (Required)
164.308(a)(1)(ii)(D) Information System Activity Review (Required)
164.308(a)(6)(ii) Response and Reporting (Required)

ASD Strategies to Mitigate Cyber Security Incidents · 2 controls

ASD37-28 Continuous incident detection and response (Excellent)
ASD37-31 Hunt to discover incidents (Very Good)

AWS Well-Architected Security Pillar · 2 controls

SEC04-BP03 Correlate and enrich security alerts
SEC10-BP02 Develop incident management plans

Azure Security Benchmark · 2 controls

ASBv3-IR-3 Detection and analysis - create incidents based on high-quality alerts
ASBv3-IR-5 Detection and analysis - prioritize incidents

C5 (Germany) · 2 controls

C5-OPS-13 Logging and Monitoring - Identification of Events
C5-SIM-02 Processing of security incidents

ISO 27002:2022 · 2 controls

5.25 Assessment and decision on information security events
6.8 Information security event reporting

NIS2 Directive · 2 controls

Art.21.2.b Incident handling
Art.23.1 Notify significant incidents to the CSIRT or competent authority, and warn affected service recipients

NIST SP 800-171 Rev 3 · 2 controls

03.06.01 Incident Handling
03.06.02 Incident Monitoring, Reporting, and Response Assistance

ACSC Essential Eight · 1 control

E8-APP-ML2 Application Control (ML2)

ANSSI Guide d'hygiene informatique (42 mesures, v2.0) · 1 control

ANSSI-HYG-40 Define a Security Incident Management Procedure

APRA CPS 230 Operational Risk Management · 1 control

CPS230-27 Identification and Escalation of Incidents and Near Misses

APRA CPS 234 · 1 control

CPS234-30 Detection and Response Mechanisms

Australia Consumer Data Right - Banking (CDR) · 1 control

AUCDR-IS-STEP5 Step 5 - Manage and report security incidents

Australia My Health Records Act 2012 · 1 control

MYHR-SEC-3 Audit logging and access monitoring

CFTC System Safeguards (17 CFR 37, 38, 39, 49) · 1 control

CFTC-SS-16 Security Incident Response Plan and Testing

Cloud Security Alliance Cloud Controls Matrix (CCM) v4.0.1 · 1 control

CCM-SEF-06 Event Triage Processes

EU AI Act · 1 control

EUAI-Art.73 Reporting of serious incidents

GDPR · 1 control

GDPR-Art.33 Notification of a personal data breach to the supervisory authority

ISO 22301:2019 · 1 control

10.2 Continual improvement

ISO 27001:2013 · 1 control

A.16.1.4 Assessment of and decision on information security events

ISO/IEC 42001:2023 · 1 control

10.2 Nonconformity and corrective action

NIST SP 800-161 Rev 1 · 1 control

161R1-IR-5 Incident Monitoring

NIST SP 800-172 · 1 control

3.6.1e Establish Security Operations Center (SOC)

Every mapping shown was judged rather than inferred from wording similarity, and the ones that failed review are published too. See the coverage reports and what was rejected.