Frameworks / NIST SP 1800-32 / NIST1800-32-18 NIST SP 1800-32
NIST SP 1800-32: Incident Response & Recovery
NIST SP 1800-32 NIST1800-32-18: Reporting obligations to authorities Reporting obligations to authorities. Control from NIST SP 1800-32 framework, domain: NIST SP 1800-32: Incident Response & Recovery.
Maintained by Gerard Blokdyk · Verified against the published standard 31 May 2026 · Control text last updated 21 May 2026 What else in your programme already covers this This control maps to 262 controls across 105 other frameworks. If you already hold one of them, the evidence you collected for it is the starting point here rather than new work.
ASD37-31 Hunt to discover incidents (Very Good) ASD37-33 Capture network traffic (Limited) ASD37-34 Regular backups (Essential) ASD37-35 Business continuity and disaster recovery plans (Very Good) ASD37-36 System recovery capabilities (Very Good) NIST-CSF-ID.IM-04 Incident response plans and other cybersecurity plans that affect operations are established, communicated, maintained, and improved NIST-CSF-RC.RP-01 The recovery portion of the incident response plan is executed once initiated from the incident response process NIST-CSF-RC.RP-06 The end of incident recovery is declared based on criteria, and incident-related documentation is completed NIST-CSF-RS.MA-01 The incident response plan is executed in coordination with relevant third parties once an incident is declared NIST-CSF-RS.MA-05 The criteria for initiating incident recovery are applied PICERL-C2 System Backup PICERL-C3 Long-Term Containment PICERL-L3 Plan Improvement PICERL-R1 System Restoration PICERL-R2 Security Verification FFIEC-12 Disaster recovery procedures FFIEC-23 Regulatory reporting requirements FFIEC-24 Customer notification procedures FFIEC-25 Post-incident review and improvement IEC62443-16 Incident response plan for operational disruptions IEC62443-17 Recovery plan for critical systems IEC62443-18 Reporting obligations to authorities IEC62443-20 Exercises and drills for OT incidents PCI-P2PE-12 Disaster recovery procedures PCI-P2PE-21 Incident detection and classification PCI-P2PE-22 Incident response and containment PCI-P2PE-25 Post-incident review and improvement PCI-PIN-12 Disaster recovery procedures PCI-PIN-23 Regulatory reporting requirements PCI-PIN-24 Customer notification procedures PCI-PIN-25 Post-incident review and improvement PCI-SSF-12 Disaster recovery procedures PCI-SSF-21 Incident detection and classification PCI-SSF-24 Customer notification procedures PCI-SSF-25 Post-incident review and improvement SOC2-A1.2 A1.2 Environmental protection, backup and recovery infrastructure SOC2-A1.3 A1.3 Testing recovery plan procedures SOC2-CC7.4 CC7.4 Responding to security incidents SOC2-CC7.5 CC7.5 Recovering from security incidents SSAE18-A1.2 A1.2 - Environmental Protections and Recovery SSAE18-A1.3 A1.3 - Recovery Plan Testing SSAE18-CC7.4 CC7.4 - Incident Response SSAE18-CC7.5 CC7.5 - Incident Recovery API1164-17 Wireless and Field Communications API1164-18 Field Device Security API1164-19 Safety Instrumented Systems Interface BSI-18 Incident response planning and testing BSI-20 Incident reporting and notification BSI-21 Forensic analysis capabilities IS.AR.215 Information Security Incident Response IS.D.OR.225 External Reporting of Information Security Events IS.I.OR.225 External Reporting ISO-22320-5.2 Incident management process ISO-22320-B Annex B: Incident management plan structure ISO-22320-C Annex C: Incident management task examples ISO27019-16 Incident response plan for operational disruptions ISO27019-18 Reporting obligations to authorities ISO27019-20 Exercises and drills for OT incidents 27031-8.1 Exercising and Testing 27031-8.2 Maintaining IRBC 27031-9.3 Management Review NFPA1600-5.3 Resource Needs Assessment NFPA1600-6.3 Emergency Response Operations NFPA1600-6.4 Continuity and Recovery OSFIB13-3 Cyber Security: Identification, Protection, Detection, Response, Recovery OSFIB13-7 Incident Reporting to OSFI and Regulatory Coordination OSFIB13-8 Metrics, Monitoring, Continuous Improvement, Maturity PSDTWO-2 SCA Exemptions and Risk-Based Authentication PSDTWO-3 Common and Secure Communication, API Access for AISPs and PISPs PSDTWO-4 Fraud Reporting and Incident Management SOCI-CIRMP-PHYSICAL CIRMP hazard vector: Physical security and natural hazards SOCI-S30CB Statutory incident response planning SOCI-S35AB Ministerial authorisation for government assistance IM8-RES.2 Disaster Recovery IM8-RES.3 Incident Response IM8-RES.4 Resilience Testing ISMSP-PI-06 Personal Information Destruction ISMSP-SYS-05 Incident Response ISMSP-SYS-06 Business Continuity and Disaster Recovery D.1 Incident Response Planning D.2 Incident Reporting D.3 Backup and Recovery APPI-A41 Preparation and Handling of Pseudonymized Personal Information APPI-A43 Preparation of Anonymized Personal Information CPS234-21 Implementation of Information Security Controls CPS234-25 Internal Audit Review of Information Security Controls 4.4.7 Emergency and Incident Response 4.4.8 Business Continuity and Recovery BB-DPA-20 Sections 50-60 - Registration and Responsibilities BB-DPA-22 Sections 70-75 - Commissioner Functions UAE-PDPL-Art.10 Data Protection Officer (DPO) (UAE PDPL Article 10) UAE-PDPL-Art.18_19_20_21 Security measures, controller/processor relationship, DPIA (UAE PDPL Articles 18-21) ISO22316-08 Recovery time and point objectives ISO22316-12 Recovery strategy for critical activities 30111-3 Terms and definitions 30111-5.2 Vulnerability handling team ISO22317-08 Recovery time and point objectives ISO22317-12 Recovery strategy for critical activities ISO22318-08 Recovery time and point objectives ISO22318-12 Recovery strategy for critical activities NJDPA-2 Consumer Rights - Access, Correct, Delete, Portability, Appeal NJDPA-6 Reasonable Data Security and Incident Response OMANCS-6 Security Monitoring, Detection, Incident Response, and OmanCERT Notification OMANCS-7 Business Continuity, Disaster Recovery, and Resilience OPENBANK-7 Logging, Monitoring, Regulatory Reporting, SLA, Availability OPENBANK-8 Incident Detection, Response, Customer Notification, Post-Incident Review, BCM PERU-7 DPO, Records, Retention, Marketing, Training PERU-8 Breach Notification, ANPD Cooperation, Sanctions, Compliance QATAR-5 Security of Processing QATAR-8 Breach Notification, Compliance, Enforcement SOC-CY-A2 Disaster Recovery SOC-CY-S2 System Operations SA-PDPL-16 Data breach notification requirements SA-PDPL-17 Security incident response procedures PIPA-CPO-DPO-Privacy-Officer-PIA-Personal-Information-Impact-Assessment-Articles-31-33 Korea PIPA CPO + DPO + Privacy Officer + PIA + Personal Information Impact Assessment + Articles 31-33 PIPA-Sensitive-Information-Unique-ID-Resident-Registration-Numbers-CCTV-Articles-23-24-25 Korea PIPA Sensitive Information + Unique ID + RRN + CCTV + Articles 23-25 UKOSA-TR-01 Annual Transparency Reports UKOSA-TR-02 Content Moderation Information PMF-M.4 Privacy Incident Management CPS230-13 Board Accountability for Operational Risk Management CA-12 Deploys Through Policies and Procedures CA-ITSG33-SC-01 Security Control Catalogue DIQ-1 Data Integration and Interoperability CAT-D5-1 Incident planning and strategy FTC-Safeguards-IR-Plan-BoardReporting-FTC-Notification Written Incident Response Plan + Board Reporting + FTC Breach Notification (16 CFR 314.4(h), (i), (j)) FEDRAMP-CP-9 System Backup ISO28001-PC-04 Supply Chain Continuity Planning ISO20000-11 Incident management 27010-16.1 Continuity of Sharing 27011-8.6 Data protection and backup ISO27043-23 Backup and recovery procedures 27400-6.5 Security monitoring and incident response ISO21434-23 Backup and recovery procedures ITIL4-11 Incident management NISTPF-8 Protect-P Information Protection Processes (PR.PO-P) NISTSP61-5 Containment, Eradication, and Recovery NISTSP63R4-4 Authenticator Lifecycle: Binding, Recovery, Replacement, Suspension, Revocation NISTSP82-7 OT Incident Response, Forensics, Recovery, and Continuity NISTSP88-5 Media Inventory, Tracking, Chain of Custody, and Sanitization Records NISTSP92-6 Log Retention: Policy, Tiered Storage, Backup, Secure Disposal, Legal Hold NRFCS-7 Detection, Logging, Incident Response, Breach Notification, and Fraud Detection NGCB-6 Incident Response, 72-Hour NGCB Notification, and Independent Investigation NGOB-5 Fraud Monitoring, Incident Notification, and Reporting to CBN OWASPSAMM-5 Operations: Incident Management, Environment Management, Operational Management OSSFSC-8 Project Maintenance, Sustainability, Integration with Supply Chain Security OREGONCPA-3 Consent, Sensitive Data, Children and Teen Protections PASONE-6 Incident Management, Audit, Handover, Operational Phase, Decommissioning PDPASG-8 Data Breach Notification, Incident Response, and Enforcement PDPATH-8 Data Breach Notification, Complaints, Compliance, Enforcement POPIASA-5 Security Safeguards, Encryption, Access Control, Operator Obligations PTESPHASE-3 Threat Modeling PNGCYBER-4 Incident Response, Investigation, Evidence Preservation, Data Retention NORWAY-8 Breach Notification, Complaints, Compliance, Enforcement NZPRV-7 Notifiable Privacy Breach Scheme SASB-SOC-7 Selling Practices and Product Labeling SHAREASSESS-4 Vulnerability Management, Patching, Application Security SUPCHAIN-2 Source Integrity - Branch Protection, Code Review, Two-Person Rule TSAPIPE-2 OT/IT Network Segmentation and Access Control TAIWAN-3 Data Subject Rights TANZANIA-4 Security and Cross-Border TSSR-NOT-2 Security Incident Notification TEXASTDPSA-2 Consumer Rights TRINIDAD-3 Data Subject Rights UKGDPRREG-3 Controller and Processor (Articles 24-43) UKGAMBLE-4 Resilience and Incident Response OB-OPS.4 Incident Management SEMD-CS-3 Cyber Resilience UK-TSA-MON-02 Incident Notification CYB-5 Cyber Incident Response Plan URUGUAY-4 Security and Cross-Border VIETNAMPDP-2 Consent and Notice VIRGINIAVCDPA-3 Sensitive Data Consent and Children Every mapping shown was judged rather than inferred from wording similarity, and the ones that failed review are published too. See the coverage reports and what was rejected .
Other controls in NIST SP 1800-32: Incident Response & Recovery Query this from an agent The graph holds this control, the 262 it maps to, and the evidence behind each claim, over MCP and REST.