NIST SP 800-137
IR and Authorisation

NIST SP 800-137 NISTSP137-7: Incident Response Integration and Ongoing Authorization

Integrate ISCM with Incident Response per Section 4.7 including: SIEM alerts feeding IR + threat hunting + playbook automation per SOAR + Continuous Adversary Emulation per MITRE Caldera or a breach and attack simulation tool. Support Ongoing Authorization per Section 4.8 + NIST SP 800-37 RMF including event-driven authorisation reviews + system risk monitoring + control effectiveness assessment + authorisation decision support + Authorisation to Operate (ATO) reviews and Type Authorizations. Apply Asset Inventory Currency monitoring including HW + SW + Cloud + IoT + OT asset discovery + classification + ownership.

Maintained by Gerard BlokdykVerified against the published standard Control text last updated

What else in your programme already covers this

This control maps to 60 controls across 27 other frameworks. If you already hold one of them, the evidence you collected for it is the starting point here rather than new work.

API 1164 · 3 controls

  • API1164-17 Wireless and Field Communications
  • API1164-18 Field Device Security
  • API1164-19 Safety Instrumented Systems Interface

ASD Strategies to Mitigate Cyber Security Incidents · 3 controls

  • ASD37-34 Regular backups (Essential)
  • ASD37-35 Business continuity and disaster recovery plans (Very Good)
  • ASD37-36 System recovery capabilities (Very Good)

IEC 62443 · 3 controls

  • IEC62443-16 Incident response plan for operational disruptions
  • IEC62443-17 Recovery plan for critical systems
  • IEC62443-20 Exercises and drills for OT incidents

ISO/IEC 27019:2024 · 3 controls

  • ISO27019-16 Incident response plan for operational disruptions
  • ISO27019-18 Reporting obligations to authorities
  • ISO27019-20 Exercises and drills for OT incidents

ISO/IEC 27031:2011 · 3 controls

  • 27031-8.1 Exercising and Testing
  • 27031-8.2 Maintaining IRBC
  • 27031-9.3 Management Review

NIST Cybersecurity Framework 2.0 · 3 controls

  • NIST-CSF-RC.RP-01 The recovery portion of the incident response plan is executed once initiated from the incident response process
  • NIST-CSF-RC.RP-06 The end of incident recovery is declared based on criteria, and incident-related documentation is completed
  • NIST-CSF-RS.MA-05 The criteria for initiating incident recovery are applied

ISO 22316 · 2 controls

  • ISO22316-08 Recovery time and point objectives
  • ISO22316-12 Recovery strategy for critical activities

ISO/TS 22317:2021 · 2 controls

  • ISO22317-08 Recovery time and point objectives
  • ISO22317-12 Recovery strategy for critical activities

ISO/TS 22318:2021 · 2 controls

  • ISO22318-08 Recovery time and point objectives
  • ISO22318-12 Recovery strategy for critical activities

NFPA 1600 - Standard on Continuity, Emergency, and Crisis Management · 2 controls

  • NFPA1600-5.3 Resource Needs Assessment
  • NFPA1600-6.4 Continuity and Recovery

NIST Special Publication 800-34 Revision 1, Contingency Planning Guide for Federal Information Systems · 2 controls

  • NISTSP34-2 Business Impact Analysis (BIA): Critical Resources, Recovery Priorities
  • NISTSP34-4 Information System Contingency Plan (ISCP) Development

Singapore Government Instruction Manual on ICT&SS Management (IM8) · 2 controls

  • IM8-RES.2 Disaster Recovery
  • IM8-RES.4 Resilience Testing

South Korea ISMS-P · 2 controls

  • ISMSP-PI-06 Personal Information Destruction
  • ISMSP-SYS-06 Business Continuity and Disaster Recovery

ASIS SPC.1-2009 - Organizational Resilience Standard · 1 control

  • 4.4.8 Business Continuity and Recovery

DAMA-DMBOK2 - Data Management Body of Knowledge (2nd Edition) · 1 control

  • DIQ-1 Data Integration and Interoperability

FFIEC IT Examination Handbook · 1 control

  • FFIEC-12 Disaster recovery procedures

FedRAMP Rev 5 · 1 control

  • FEDRAMP-CP-9 System Backup

IAEA Nuclear Security Series - Computer Security at Nuclear Facilities (NSS-17-T Rev 1) · 1 control

ISO 22320:2018 · 1 control

  • ISO-22320-5.2 Incident management process

ISO/IEC 27011:2024 · 1 control

  • 27011-8.6 Data protection and backup

ISO/IEC 27043:2015 · 1 control

  • ISO27043-23 Backup and recovery procedures

ISO/SAE 21434 · 1 control

  • ISO21434-23 Backup and recovery procedures

NIST Privacy Framework · 1 control

  • NISTPF-8 Protect-P Information Protection Processes (PR.PO-P)

OWASP ASVS · 1 control

OWASP MASVS · 1 control

  • OWASPMASVS-7 MASVS-RESILIENCE: Resilience Against Reverse Engineering

UK Defence Standard 05-138 - Cyber Security for Defence Suppliers · 1 control

  • D.3 Backup and Recovery

US Maritime Transportation Security Act (MTSA) and USCG Cybersecurity Requirements · 1 control

  • CYB-5 Cyber Incident Response Plan

Every mapping shown was judged rather than inferred from wording similarity, and the ones that failed review are published too. See the coverage reports and what was rejected.

Query this from an agent

The graph holds this control, the 60 it maps to, and the evidence behind each claim, over MCP and REST.

MCP endpointAll NIST SP 800-137 controls