Frameworks / NIST Cybersecurity Framework 2.0 / NIST-CSF-ID.IM-04 NIST Cybersecurity Framework 2.0
ID - Identify
NIST Cybersecurity Framework 2.0 NIST-CSF-ID.IM-04: Incident response plans and other cybersecurity plans that affect operations are established, communicated, maintained, and improved Incident response plans and other cybersecurity plans that affect operations are established, communicated, maintained, and improved
Maintained by Gerard Blokdyk · Verified against the published standard 31 May 2026 · Control text last updated 21 May 2026 What else in your programme already covers this This control maps to 310 controls across 119 other frameworks. If you already hold one of them, the evidence you collected for it is the starting point here rather than new work.
CIS-11.1 Establish and Maintain a Data Recovery Process CIS-17.1 Designate Personnel to Manage Incident Handling CIS-17.2 Establish and Maintain Contact Information for Reporting Security Incidents CIS-17.3 Establish and Maintain an Enterprise Process for Reporting Incidents CIS-17.4 Establish and Maintain an Incident Response Process CIS-17.5 Assign Key Roles and Responsibilities CIS-17.6 Define Mechanisms for Communicating During Incident Response CIS-17.7 Conduct Routine Incident Response Exercises CP-2 Contingency Plan CP-2(1) Coordinate with Related Plans CP-7(2) Alternate Processing Site | Accessibility (CP-7(2)) CP-8 Telecommunications Services IR-3 Incident Response Testing IR-7 Incident Response Assistance IR-8 Incident Response Plan CP-2 Contingency Plan CP-2(1) Coordinate with Related Plans CP-7(2) Alternate Processing Site | Accessibility (CP-7(2)) CP-8 Telecommunications Services IR-3 Incident Response Testing IR-7 Incident Response Assistance IR-8 Incident Response Plan 4.4 Business continuity management system 8.3.2 Identification of strategies and solutions 8.4 Business continuity plans and procedures 8.4.1 General 8.4.2 Response structure 8.4.4 Business continuity plans CPS230-13 Board Accountability for Operational Risk Management CPS230-26 Critical Operations Register, Continuity Plan and Activation CPS230-P18 Integration with the Risk Management Framework and Recovery Planning CPS230-P40 Required Content of the Business Continuity Plan CPS230-P45 Annual Update of the Business Continuity Plan CPS234-21 Implementation of Information Security Controls CPS234-25 Internal Audit Review of Information Security Controls CPS234-32 Annual Review and Testing of Response Plans CPS234-P24 Information Security Response Plans CPS234-P25 Response Plan Content and Escalation Mechanisms CFTC-SS-16 Security Incident Response Plan and Testing CFTC-SS-22 Business Continuity and Disaster Recovery Planning Category CFTC-SS-24 Periodic Update of the Recovery Plan and Emergency Procedures CFTC-SS-8 Business Continuity and Disaster Recovery Plan and Resources PR.IP-10 PR.IP-10: Response and recovery plans are tested PR.IP-9 PR.IP-9: Response plans (Incident Response and Business Continuity) and recovery plans (Incident Recovery and Disaster Recovery) are in place and managed RC.IM-1 RC.IM-1: Recovery plans incorporate lessons learned RS.IM-1 RS.IM-1: Response plans incorporate lessons learned PR.IP-10 PR.IP-10: Response and recovery plans are tested PR.IP-9 PR.IP-9: Response plans (Incident Response and Business Continuity) and recovery plans (Incident Recovery and Disaster Recovery) are in place and managed RC.IM-1 RC.IM-1: Recovery plans incorporate lessons learned RS.IM-1 RS.IM-1: Response plans incorporate lessons learned 12.10.1 12.10.1 Incident response plan ready for activation 12.10.2 12.10.2 Annual review and testing of the incident response plan 12.10.3 12.10.3 Incident response personnel available 24/7 12.10.7 12.10.7 Response procedures for PAN found in unexpected locations SOC2-A1.3 A1.3 Testing recovery plan procedures SOC2-CC7.4 CC7.4 Responding to security incidents SOC2-CC7.5 CC7.5 Recovering from security incidents SOC2-CC9.1 CC9.1 Mitigating risks of business disruption API1164-17 Wireless and Field Communications API1164-18 Field Device Security API1164-19 Safety Instrumented Systems Interface ASD37-31 Hunt to discover incidents (Very Good) ASD37-33 Capture network traffic (Limited) ASD37-35 Business continuity and disaster recovery plans (Very Good) ISM-0043 Cyber security incident response plan contents ISM-0576 Incident management policy and response plan ISM-0734 CISO contribution to continuity and recovery planning ASBv3-GS-7 Define and implement logging, threat detection and incident response strategy ASBv3-GS-8 Define and implement backup and recovery strategy ASBv3-IR-1 Preparation - update incident response plan and handling process BSI-18 Incident response planning and testing BSI-20 Incident reporting and notification BSI-21 Forensic analysis capabilities IS.AR.215 Information Security Incident Response IS.D.OR.225 External Reporting of Information Security Events IS.I.OR.225 External Reporting FFIEC-23 Regulatory reporting requirements FFIEC-24 Customer notification procedures FFIEC-25 Post-incident review and improvement IEC62443-16 Incident response plan for operational disruptions IEC62443-17 Recovery plan for critical systems IEC62443-20 Exercises and drills for OT incidents ISO-22320-5.2 Incident management process ISO-22320-B Annex B: Incident management plan structure ISO-22320-C Annex C: Incident management task examples 5.24 Information security incident management planning and preparation 5.29 Information security during disruption 5.30 ICT readiness for business continuity ISO27019-16 Incident response plan for operational disruptions ISO27019-18 Reporting obligations to authorities ISO27019-20 Exercises and drills for OT incidents 7.5 Documented information 7.5.3 Control of documented information A.9.2 Processes for responsible use of AI systems OSFIB13-3 Cyber Security: Identification, Protection, Detection, Response, Recovery OSFIB13-7 Incident Reporting to OSFI and Regulatory Coordination OSFIB13-8 Metrics, Monitoring, Continuous Improvement, Maturity PCI-P2PE-21 Incident detection and classification PCI-P2PE-22 Incident response and containment PCI-P2PE-25 Post-incident review and improvement PCI-PIN-23 Regulatory reporting requirements PCI-PIN-24 Customer notification procedures PCI-PIN-25 Post-incident review and improvement PCI-SSF-21 Incident detection and classification PCI-SSF-24 Customer notification procedures PCI-SSF-25 Post-incident review and improvement PICERL-C2 System Backup PICERL-C3 Long-Term Containment PICERL-L3 Plan Improvement SEC-CYB-13 Incident Response Plan Alignment with Disclosure Obligations SEC-REG-S-P Regulation S-P Customer Notification Coordination SECCYB-4 Disclosure Process Integration and Materiality Workflow SOCI-CIRMP-PHYSICAL CIRMP hazard vector: Physical security and natural hazards SOCI-S30CB Statutory incident response planning SOCI-S35AB Ministerial authorisation for government assistance APPI-A41 Preparation and Handling of Pseudonymized Personal Information APPI-A43 Preparation of Anonymized Personal Information UAE-PDPL-Art.10 Data Protection Officer (DPO) (UAE PDPL Article 10) UAE-PDPL-Art.18_19_20_21 Security measures, controller/processor relationship, DPIA (UAE PDPL Articles 18-21) 30111-3 Terms and definitions 30111-5.2 Vulnerability handling team NJDPA-2 Consumer Rights - Access, Correct, Delete, Portability, Appeal NJDPA-6 Reasonable Data Security and Incident Response OPENBANK-7 Logging, Monitoring, Regulatory Reporting, SLA, Availability OPENBANK-8 Incident Detection, Response, Customer Notification, Post-Incident Review, BCM PSDTWO-3 Common and Secure Communication, API Access for AISPs and PISPs PSDTWO-4 Fraud Reporting and Incident Management PERU-7 DPO, Records, Retention, Marketing, Training PERU-8 Breach Notification, ANPD Cooperation, Sanctions, Compliance QATAR-5 Security of Processing QATAR-8 Breach Notification, Compliance, Enforcement SSAE18-CC7.4 CC7.4 - Incident Response SSAE18-CC7.5 CC7.5 - Incident Recovery SA-PDPL-16 Data breach notification requirements SA-PDPL-17 Security incident response procedures PIPA-CPO-DPO-Privacy-Officer-PIA-Personal-Information-Impact-Assessment-Articles-31-33 Korea PIPA CPO + DPO + Privacy Officer + PIA + Personal Information Impact Assessment + Articles 31-33 PIPA-Sensitive-Information-Unique-ID-Resident-Registration-Numbers-CCTV-Articles-23-24-25 Korea PIPA Sensitive Information + Unique ID + RRN + CCTV + Articles 23-25 D.1 Incident Response Planning D.2 Incident Reporting E8-ADMIN-ML2 Restrict Administrative Privileges (ML2) PMF-M.4 Privacy Incident Management ANSSI-HYG-40 Define a Security Incident Management Procedure CPS220-P35 Required Content of Risk Management Policies and Procedures 4.4.7 Emergency and Incident Response AEO-12 Crisis Management and Incident Recovery BB-DPA-20 Sections 50-60 - Registration and Responsibilities CA-12 Deploys Through Policies and Procedures CA-ITSG33-SC-01 Security Control Catalogue CAT-D5-1 Incident planning and strategy FTC-Safeguards-IR-Plan-BoardReporting-FTC-Notification Written Incident Response Plan + Board Reporting + FTC Breach Notification (16 CFR 314.4(h), (i), (j)) 5.24 Information security incident management planning and preparation 6.13.1 Management of information security incidents and improvements ISO28001-PC-04 Supply Chain Continuity Planning ISO20000-11 Incident management 27010-16.1 Continuity of Sharing 27400-6.5 Security monitoring and incident response ITIL4-11 Incident management NFPA1600-6.3 Emergency Response Operations NISTSP144-8 Monitoring, Incident Response, Exit Strategy, and Compliance NISTSP145-8 Governance, Reporting, and Stakeholder Education on Cloud Definition 3.6.2e Establish and Maintain a Cyber Incident Response Team ID.IM-04 ID.IM-04 Incident response, vulnerability management and continuity plans maintained and synchronized NISTSP82-7 OT Incident Response, Forensics, Recovery, and Continuity NRFCS-7 Detection, Logging, Incident Response, Breach Notification, and Fraud Detection NGCB-6 Incident Response, 72-Hour NGCB Notification, and Independent Investigation NGOB-5 Fraud Monitoring, Incident Notification, and Reporting to CBN OMANCS-6 Security Monitoring, Detection, Incident Response, and OmanCERT Notification OREGONCPA-3 Consent, Sensitive Data, Children and Teen Protections PASONE-6 Incident Management, Audit, Handover, Operational Phase, Decommissioning PDPASG-8 Data Breach Notification, Incident Response, and Enforcement PDPATH-8 Data Breach Notification, Complaints, Compliance, Enforcement POPIASA-5 Security Safeguards, Encryption, Access Control, Operator Obligations PNGCYBER-4 Incident Response, Investigation, Evidence Preservation, Data Retention NORWAY-8 Breach Notification, Complaints, Compliance, Enforcement NZPRV-7 Notifiable Privacy Breach Scheme SOC-CY-S2 System Operations IM8-RES.3 Incident Response ISMSP-SYS-05 Incident Response TSAPIPE-2 OT/IT Network Segmentation and Access Control TAIWAN-3 Data Subject Rights TANZANIA-4 Security and Cross-Border TSSR-NOT-2 Security Incident Notification TEXASTDPSA-2 Consumer Rights TRINIDAD-3 Data Subject Rights UKGDPRREG-3 Controller and Processor (Articles 24-43) UKGAMBLE-4 Resilience and Incident Response OB-OPS.4 Incident Management UK-TSA-MON-02 Incident Notification CYB-5 Cyber Incident Response Plan URUGUAY-4 Security and Cross-Border VIETNAMPDP-2 Consent and Notice VIRGINIAVCDPA-3 Sensitive Data Consent and Children Every mapping shown was judged rather than inferred from wording similarity, and the ones that failed review are published too. See the coverage reports and what was rejected .
Other controls in ID - Identify You are reading one control. How much of NIST Cybersecurity Framework 2.0 have you already done? NIST Cybersecurity Framework 2.0 NIST-CSF-ID.IM-04 is one control. If you already hold one of the frameworks below, a reviewed crosswalk already says how much of NIST Cybersecurity Framework 2.0 your existing evidence covers. Hold ISO 27001:2022 and 73 of 106 NIST Cybersecurity Framework 2.0 controls already carry evidence.
Each report names every control your existing framework evidences, every one it does not, the reasoning behind each claim, and the claims that were argued against and rejected. 174 were rejected on the ISO 27001:2022 pair alone.
Query this from an agent The graph holds this control, the 310 it maps to, and the evidence behind each claim, over MCP and REST.