ISO/IEC 42001:2023 A.8.4: Communication of incidents

What else in your programme already covers this

This control maps to 60 controls across 40 other frameworks. If you already hold one of them, the evidence you collected for it is the starting point here rather than new work.

NIST SP 800-53 Rev 5 · 4 controls

NIST800-AU-13 AU-13 Monitoring for Information Disclosure
NIST800-CP-11 CP-11 Alternate Communications Protocols
NIST800-IR-6 IR-6 Incident Reporting
NIST800-IR-8 IR-8 Incident Response Plan

EU AI Act · 3 controls

EUAI-Art.20 Corrective actions and duty of information
EUAI-Art.55 Obligations of providers of GPAI models with systemic risk
EUAI-Art.73 Reporting of serious incidents

ISO 27001:2022 · 3 controls

5.24 Information security incident management planning and preparation
5.26 Response to information security incidents
5.27 Learning from information security incidents

SOC 2 · 3 controls

SOC2-CC7.4 CC7.4 Responding to security incidents
SOC2-CC7.5 CC7.5 Recovering from security incidents
SOC2-P6.6 P6.6 Notifying breaches and incidents

APRA CPS 234 · 2 controls

CPS234-P24 Information Security Response Plans
CPS234-P25 Response Plan Content and Escalation Mechanisms

FedRAMP High · 2 controls

IR-6 Incident Reporting
IR-8 Incident Response Plan

FedRAMP Moderate · 2 controls

IR-6 Incident Reporting
IR-8 Incident Response Plan

ISO 27002:2022 · 2 controls

5.24 Information security incident management planning and preparation
5.27 Learning from information security incidents

ISO 37002:2021 - Whistleblowing Management Systems · 2 controls

ISO-37002-7.4 Communication
ISO37002-7.4 Communication

ISO 41001:2018 - Facility Management Systems · 2 controls

ISO-41001-7.4 Communication
ISO41001-7.4 Communication

ISO 50001:2018 - Energy Management Systems · 2 controls

ISO-50001-7.4 Communication
7.4 Communication

ISO/IEC 27003:2017 · 2 controls

27003-7.4 Communication
ISO27003-7.4 Communication

NIST AI Risk Management Framework (AI RMF 1.0) · 2 controls

AIRMF-MN-2.3 Procedures are followed to respond to and recover from a previously unknown risk when it is identified
AIRMF-MN-4.3 Incidents and errors are communicated to relevant AI actors including affected communities, and processes for tracking, responding to, and recovering from incidents and errors are followed and documented

NIST Cybersecurity Framework 2.0 · 2 controls

NIST-CSF-ID.IM-03 Improvements are identified from execution of operational processes, procedures, and activities
NIST-CSF-RS.CO-02 Internal and external stakeholders are notified of incidents

AICPA SOC 3 · 1 control

SOC3-COMMS Communication

ANSSI Guide d'hygiene informatique (42 mesures, v2.0) · 1 control

ANSSI-HYG-40 Define a Security Incident Management Procedure

APPI · 1 control

APPI-A26 Report of Leakage to the Commission and Notification to the Person

AWS Well-Architected Security Pillar · 1 control

SEC10-BP02 Develop incident management plans

Authorised Economic Operator (AEO) Programmes - Global Standards · 1 control

P2-S5 Communication

BS 65000:2014 - Guidance on Organizational Resilience · 1 control

BS65000-7.4 Communication

CIS Controls v8 · 1 control

CIS-17.6 Define Mechanisms for Communicating During Incident Response

CMMC 2.0 · 1 control

IR.L2-3.6.2 Incident Reporting

Cloud Security Alliance Cloud Controls Matrix (CCM) v4.0.1 · 1 control

CCM-BCR-07 Communication

DORA · 1 control

DORA-Art.14 Communication

ISO 22313:2020 - Guidance on Business Continuity Management Systems · 1 control

ISO-22313-7.4 Communication

ISO 30401 · 1 control

ISO30401-7.4 Communication

ISO 39001:2012 - Road Traffic Safety Management · 1 control

ISO-39001-7.4 Communication

ISO 56002 · 1 control

ISO-56002-7.4 Communication

NSW AI Operational Policy (2026) · 1 control

7.3 7.3 Report AI related incidents

Every mapping shown was judged rather than inferred from wording similarity, and the ones that failed review are published too. See the coverage reports and what was rejected.

You are reading one control. How much of ISO/IEC 42001:2023 have you already done?

ISO/IEC 42001:2023 A.8.4 is one control. If you already hold one of the frameworks below, a reviewed crosswalk already says how much of ISO/IEC 42001:2023 your existing evidence covers. Hold NIST AI Risk Management Framework (AI RMF 1.0) and 30 of 38 ISO/IEC 42001:2023 controls already carry evidence.

If you hold NIST AI Risk Management Framework (AI RMF 1.0)78.9% covered · 8 gaps If you hold EU AI Act57.9% covered · 16 gaps

Each report names every control your existing framework evidences, every one it does not, the reasoning behind each claim, and the claims that were argued against and rejected. 0 were rejected on the NIST AI Risk Management Framework (AI RMF 1.0) pair alone.

See the released pairs, $299 each Browse the graph free