Implement NIST 800-53 IR Incident Response family + breach notification process integrated across HIPAA + ACA + IRS Pub 1075. Incident response capability with 24x7 SOC + Computer Security Incident Response Team (CSIRT) + incident response plan + tabletop and live exercises annually. Categorisation per US-CERT incident categories + CMS Incident Response Team (IRT) coordination + DHS/CISA reporting for major incidents. HIPAA Breach Notification Rule 45 CFR 164.400-414 (60 days to affected individuals + 60 days to HHS + media notification if 500+ residents in state). Risk Assessment (Acquisition + Unauthorised Access + Disposition + Identification) for PHI breaches per HHS guidance. ACA Section 1411 breach notification to CMS + affected consumers. IRS Pub 1075 Section 10 incident reporting (within 1 hour for known + 24 hours for suspected disclosure of FTI). State breach notification law coordination (47 states + DC). CMS-issued Incident Reporting Procedure + Authorization Protocol. Post-incident review + root cause analysis + lessons learned + control updates. Annual incident response capability assessment.
The graph holds this control, the 0 it maps to, and the evidence behind each claim, over MCP and REST.