NIST Cybersecurity Framework 2.0 NIST-CSF-ID.IM-03: Improvements are identified from execution of operational processes, procedures, and activities

What else in your programme already covers this

This control maps to 79 controls across 36 other frameworks. If you already hold one of them, the evidence you collected for it is the starting point here rather than new work.

NIST Cybersecurity Framework 1.0 · 7 controls

DE.DP-5 DE.DP-5: Detection processes are continuously improved
PR.IP-7 PR.IP-7: Protection processes are continuously improved
PR.IP-8 PR.IP-8: Effectiveness of protection technologies is shared with appropriate parties
RC.IM-1 RC.IM-1: Recovery plans incorporate lessons learned
RC.IM-2 RC.IM-2: Recovery strategies are updated
RS.IM-1 RS.IM-1: Response plans incorporate lessons learned
RS.IM-2 RS.IM-2: Response strategies are updated

NIST Cybersecurity Framework 1.1 · 7 controls

DE.DP-5 DE.DP-5: Detection processes are continuously improved
PR.IP-7 PR.IP-7: Protection processes are improved
PR.IP-8 PR.IP-8: Effectiveness of protection technologies is shared
RC.IM-1 RC.IM-1: Recovery plans incorporate lessons learned
RC.IM-2 RC.IM-2: Recovery strategies are updated
RS.IM-1 RS.IM-1: Response plans incorporate lessons learned
RS.IM-2 RS.IM-2: Response strategies are updated

NIST SP 800-53 Rev 5 · 7 controls

NIST800-AT-6 AT-6 Training Feedback
NIST800-CA-7 CA-7 Continuous Monitoring
NIST800-CP-4 CP-4 Contingency Plan Testing
NIST800-IR-4 IR-4 Incident Handling
NIST800-MA-2 MA-2 Controlled Maintenance
NIST800-PM-31 PM-31 Continuous Monitoring Strategy
NIST800-SI-2 SI-2 Flaw Remediation

ISO 27701:2019 · 5 controls

5.4.1 Actions to address risks and opportunities
5.8 Improvement
5.8.1 Nonconformity and corrective action
5.8.2 Continual improvement
6.13.1 Management of information security incidents and improvements

SOC 2 · 5 controls

SOC2-CC3.4 CC3.4 Identifying and assessing significant changes (COSO principle 9)
SOC2-CC4.1 CC4.1 Ongoing and separate evaluations of control (COSO principle 16)
SOC2-CC4.2 CC4.2 Evaluating and communicating control deficiencies (COSO principle 17)
SOC2-CC7.5 CC7.5 Recovering from security incidents
SOC2-CC8.1 CC8.1 Managing changes to procedures, software, data and infrastructure

ISO 22301:2019 · 4 controls

10.1 Nonconformity and corrective action
10.2 Continual improvement
8.5 Exercise programme
9.3.2 Management review input

APRA CPS 230 Operational Risk Management · 3 controls

CPS230-27 Identification and Escalation of Incidents and Near Misses
CPS230-P31 Remediation of Material Operational Risk Weaknesses
CPS230-P45 Annual Update of the Business Continuity Plan

CFTC System Safeguards (17 CFR 37, 38, 39, 49) · 3 controls

CFTC-SS-16 Security Incident Response Plan and Testing
CFTC-SS-21 Remediation of Vulnerabilities and Deficiencies
CFTC-SS-24 Periodic Update of the Recovery Plan and Emergency Procedures

CIS Controls v8 · 3 controls

CIS-13.11 Tune Security Event Alerting Thresholds
CIS-16.3 Perform Root Cause Analysis on Security Vulnerabilities
CIS-17.8 Conduct Post-Incident Reviews

ISO/IEC 42001:2023 · 3 controls

10.1 Continual improvement
10.2 Nonconformity and corrective action
A.8.4 Communication of incidents

APRA CPS 234 · 2 controls

CPS234-P17 Active Maintenance of Capability Against Change
CPS234-P25 Response Plan Content and Escalation Mechanisms

Australian Information Security Manual · 2 controls

ISM-1526 Continuous security monitoring by system owners
ISM-1909 Root cause analysis of vulnerabilities

FedRAMP High · 2 controls

CA-7 Continuous Monitoring
IR-4 Incident Handling

FedRAMP Moderate · 2 controls

CA-7 Continuous Monitoring
IR-4 Incident Handling

NIST SP 800-171 Rev 3 · 2 controls

03.06.01 Incident Handling
03.12.03 Continuous Monitoring

NIST SP 800-218 · 2 controls

SP800-218-RV.3.3 Review SDLC to Prevent Recurrence
SP800-218-RV.3.4 Document Lessons Learned

ANSSI Guide d'hygiene informatique (42 mesures, v2.0) · 1 control

ANSSI-HYG-40 Define a Security Incident Management Procedure

ASEAN Data Management Framework · 1 control

ADMF-6.5 Update policies, procedures and processes

AWS Well-Architected Security Pillar · 1 control

SEC10-BP08 Establish a framework for learning from incidents

Australia Consumer Data Right - Banking (CDR) · 1 control

AUCDR-IS-STEP5 Step 5 - Manage and report security incidents

Authorised Economic Operator (AEO) Programmes - Global Standards · 1 control

AEO-13 Measurement, Analyses and Improvement

Azure Security Benchmark · 1 control

ASBv3-IR-7 Post-incident activity - conduct lesson learned and retain evidence

C5 (Germany) · 1 control

C5-SIM-05 Evaluation and learning process

CMMC 2.0 · 1 control

CA.L2-3.12.3 Security Control Monitoring

Cloud Security Alliance Cloud Controls Matrix (CCM) v4.0.1 · 1 control

CCM-SEF-05 Incident Response Metrics

DORA · 1 control

DORA-Art.13 Learning and evolving

HIPAA Security Rule · 1 control

164.308(a)(6)(ii) Response and Reporting (Required)

ISO 27001:2022 · 1 control

5.27 Learning from information security incidents

ISO 27002:2022 · 1 control

5.27 Learning from information security incidents

NIS2 Directive · 1 control

Art.21.4 Take corrective measures without undue delay on finding that the measures are not met

NIST SP 800-161 Rev 1 · 1 control

161R1-IR-4 Incident Handling

NIST SP 800-171A - Assessing Security Requirements for Controlled Unclassified Information (CUI) · 1 control

171A-03.06.03 Incident Response Testing

NIST SP 800-172 · 1 control

3.11.5e Assess Effectiveness of Security Solutions

NIST SP 800-61 Rev. 3 · 1 control

ID.IM-03 ID.IM-03 Lessons learned from incident response and recovery feed improvement

NIST SP 800-66 Rev 2 · 1 control

164.308(a)(6)(ii) Response and Reporting (Required)

PCI DSS 4.0 · 1 control

12.10.6 12.10.6 Plan evolved from lessons learned and industry developments

Every mapping shown was judged rather than inferred from wording similarity, and the ones that failed review are published too. See the coverage reports and what was rejected.