ISO 27701:2019
PIMS-specific guidance related to ISO/IEC 27002, ISO 27701:2019

ISO 27701:2019 6.13.1: Management of information security incidents and improvements

The organization must set responsibilities and procedures for spotting and logging personal data breaches and for notifying required parties, including timing, and for disclosure to authorities under applicable law; an incident involving personal data must trigger a review to decide whether a breach requiring response has occurred, and where it has, response must include the relevant notifications and a record holding enough detail for regulatory or forensic reporting, including a description of the incident, its time period and consequences, who reported it, to whom, the steps taken to resolve it, whether personal data became unavailable, lost, disclosed or altered, what data was compromised and what notifications were made. A processor must have breach notification provisions in its customer contract specifying how it supplies the information the customer needs to notify authorities and the expected notification response times, and must notify the customer without undue delay.

Maintained by Gerard Blokdyk

What else in your programme already covers this

This control maps to 113 controls across 23 other frameworks. If you already hold one of them, the evidence you collected for it is the starting point here rather than new work.

NIST Cybersecurity Framework 2.0 · 20 controls

  • NIST-CSF-DE.AE-02 Potentially adverse events are analyzed to better understand associated activities
  • NIST-CSF-DE.AE-04 The estimated impact and scope of adverse events are understood
  • NIST-CSF-DE.AE-06 Information on adverse events is provided to authorized staff and tools
  • NIST-CSF-DE.AE-08 Incidents are declared when adverse events meet the defined incident criteria
  • NIST-CSF-GV.SC-08 Relevant suppliers and other third parties are included in incident planning, response, and recovery activities
  • NIST-CSF-ID.IM-01 Improvements are identified from evaluations
  • NIST-CSF-ID.IM-02 Improvements are identified from security tests and exercises, including those done in coordination with suppliers and relevant third parties
  • NIST-CSF-ID.IM-03 Improvements are identified from execution of operational processes, procedures, and activities
  • NIST-CSF-ID.IM-04 Incident response plans and other cybersecurity plans that affect operations are established, communicated, maintained, and improved
  • NIST-CSF-RC.CO-04 Public updates on incident recovery are shared using approved methods and messaging
  • NIST-CSF-RS.AN-03 Analysis is performed to establish what has taken place during an incident and the root cause of the incident
  • NIST-CSF-RS.AN-07 Incident data and metadata are collected, and their integrity and provenance are preserved
  • NIST-CSF-RS.AN-08 An incident's magnitude is estimated and validated
  • NIST-CSF-RS.CO-02 Internal and external stakeholders are notified of incidents
  • NIST-CSF-RS.MA-01 The incident response plan is executed in coordination with relevant third parties once an incident is declared
  • NIST-CSF-RS.MA-02 Incident reports are triaged and validated
  • NIST-CSF-RS.MA-03 Incidents are categorized and prioritized
  • NIST-CSF-RS.MA-04 Incidents are escalated or elevated as needed
  • NIST-CSF-RS.MI-01 Incidents are contained
  • NIST-CSF-RS.MI-02 Incidents are eradicated

PCI DSS 4.0 · 13 controls

  • 10.2.1.1 10.2.1.1 Logs capture individual user access to cardholder data
  • 10.4.3 10.4.3 Exceptions and anomalies from log review addressed
  • 10.7.1 10.7.1 Service providers detect critical control failures (superseded)
  • 10.7.2 10.7.2 Detect and alert on critical security control failures
  • 10.7.3 10.7.3 Respond promptly to critical security control failures
  • 12.10.1 12.10.1 Incident response plan ready for activation
  • 12.10.2 12.10.2 Annual review and testing of the incident response plan
  • 12.10.3 12.10.3 Incident response personnel available 24/7
  • 12.10.4 12.10.4 Periodic training for incident response personnel
  • 12.10.4.1 12.10.4.1 Responder training frequency set by targeted risk analysis
  • 12.10.5 12.10.5 Plan covers alerts from security monitoring systems
  • 12.10.6 12.10.6 Plan evolved from lessons learned and industry developments
  • 12.10.7 12.10.7 Response procedures for PAN found in unexpected locations

NIST SP 800-53 Rev 5 · 11 controls

CIS Controls v8 · 10 controls

  • CIS-16.2 Establish and Maintain a Process to Accept and Address Software Vulnerabilities
  • CIS-17.1 Designate Personnel to Manage Incident Handling
  • CIS-17.2 Establish and Maintain Contact Information for Reporting Security Incidents
  • CIS-17.3 Establish and Maintain an Enterprise Process for Reporting Incidents
  • CIS-17.4 Establish and Maintain an Incident Response Process
  • CIS-17.6 Define Mechanisms for Communicating During Incident Response
  • CIS-17.7 Conduct Routine Incident Response Exercises
  • CIS-17.8 Conduct Post-Incident Reviews
  • CIS-17.9 Establish and Maintain Security Incident Thresholds
  • CIS-3.14 Log Sensitive Data Access

ISO 27001:2022 · 6 controls

  • 5.24 Information security incident management planning and preparation 
  • 5.25 Assessment and decision on information security events
  • 5.26 Response to information security incidents
  • 5.27 Learning from information security incidents
  • 5.28 Collection of evidence
  • 6.8 Information security event reporting

ISO 27002:2022 · 6 controls

  • 5.24 Information security incident management planning and preparation
  • 5.25 Assessment and decision on information security events
  • 5.26 Response to information security incidents
  • 5.27 Learning from information security incidents
  • 5.28 Collection of evidence
  • 6.8 Information security event reporting

SOC 2 · 6 controls

  • SOC2-CC4.2 CC4.2 Evaluating and communicating control deficiencies (COSO principle 17)
  • SOC2-CC7.3 CC7.3 Evaluating security events to identify incidents
  • SOC2-CC7.4 CC7.4 Responding to security incidents
  • SOC2-CC7.5 CC7.5 Recovering from security incidents
  • SOC2-P6.3 P6.3 Record of unauthorised disclosures and breaches
  • SOC2-P6.6 P6.6 Notifying breaches and incidents

HIPAA Security Rule · 5 controls

FedRAMP High · 4 controls

  • IR-4 Incident Handling
  • IR-5 Incident Monitoring
  • IR-6 Incident Reporting
  • IR-8 Incident Response Plan

FedRAMP Moderate · 4 controls

  • IR-4 Incident Handling
  • IR-5 Incident Monitoring
  • IR-6 Incident Reporting
  • IR-8 Incident Response Plan

NIST SP 800-161 Rev 1 · 4 controls

Azure Security Benchmark · 3 controls

  • ASBv3-IR-1 Preparation - update incident response plan and handling process
  • ASBv3-IR-4 Detection and analysis - investigate an incident
  • ASBv3-IR-7 Post-incident activity - conduct lesson learned and retain evidence

CMMC 2.0 · 3 controls

Cloud Security Alliance Cloud Controls Matrix (CCM) v4.0.1 · 3 controls

NIST SP 800-66 Rev 2 · 3 controls

AWS Well-Architected Security Pillar · 2 controls

  • SEC10-BP01 Identify key personnel and external resources
  • SEC10-BP02 Develop incident management plans

C5 (Germany) · 2 controls

  • C5-SIM-01 Policy for security incident management
  • C5-SIM-03 Documentation and reporting of security incidents

GDPR · 2 controls

  • GDPR-Art.33 Notification of a personal data breach to the supervisory authority
  • GDPR-Art.34 Communication of a personal data breach to the data subject

NIST SP 800-171 Rev 3 · 2 controls

  • 03.06.01 Incident Handling
  • 03.06.02 Incident Monitoring, Reporting, and Response Assistance

APPI · 1 control

  • APPI-A26 Report of Leakage to the Commission and Notification to the Person

Australia Consumer Data Right - Banking (CDR) · 1 control

ISO 27017:2015 · 1 control

  • 16.1 Management of information security incidents and improvements

ISO 27018:2019 · 1 control

  • 16.1 Management of information security incidents and improvements

Every mapping shown was judged rather than inferred from wording similarity, and the ones that failed review are published too. See the coverage reports and what was rejected.

Other controls in PIMS-specific guidance related to ISO/IEC 27002, ISO 27701:2019

You are reading one control. How much of ISO 27701:2019 have you already done?

ISO 27701:2019 6.13.1 is one control. If you already hold one of the frameworks below, a reviewed crosswalk already says how much of ISO 27701:2019 your existing evidence covers. Hold SOC 2 and 58 of 108 ISO 27701:2019 controls already carry evidence.

If you hold SOC 253.7% covered · 50 gapsIf you hold Cloud Security Alliance Cloud Controls Matrix (CCM) v4.0.147.2% covered · 57 gapsIf you hold NIST Cybersecurity Framework 2.047.2% covered · 57 gapsIf you hold ISO 27001:202243.5% covered · 61 gapsIf you hold Australia Consumer Data Right - Banking (CDR)35.2% covered · 70 gapsIf you hold C5 (Germany)34.3% covered · 71 gaps

Each report names every control your existing framework evidences, every one it does not, the reasoning behind each claim, and the claims that were argued against and rejected. 289 were rejected on the SOC 2 pair alone.

See the released pairs, $299 eachBrowse the graph free

Query this from an agent

The graph holds this control, the 113 it maps to, and the evidence behind each claim, over MCP and REST.

MCP endpointAll ISO 27701:2019 controls