Frameworks / NIST SP 800-144 / NISTSP144-8 NIST SP 800-144
Monitoring and IR
NIST SP 800-144 NISTSP144-8: Monitoring, Incident Response, Exit Strategy, and Compliance Apply Section 7.6 cloud security monitoring and logging via cloud-native services (CloudTrail + GuardDuty + Security Hub + Azure Monitor + Sentinel + Google Cloud Logging + Security Command Center) + SIEM/SOAR integration + 24/7 SOC. Implement incident response in cloud per Section 8.10 including provider coordination + customer responsibilities + forensic readiness + chain of custody + cloud-specific IR playbooks. Develop portability and interoperability + cloud exit strategy per Section 7.16 including data egress + format conversion + dependency mapping + alternative provider selection + crypto-shredding on exit. Address Section 7.11 privacy + Section 7.12 compliance mapping + Section 7.14 supply chain + Section 7.17 personnel security + Section 7.19 continuous monitoring of cloud services.
Maintained by Gerard Blokdyk · Verified against the published standard 31 May 2026 · Control text last updated 21 May 2026 What else in your programme already covers this This control maps to 161 controls across 69 other frameworks. If you already hold one of them, the evidence you collected for it is the starting point here rather than new work.
BSI-17 Continuous monitoring strategy BSI-18 Incident response planning and testing BSI-20 Incident reporting and notification BSI-21 Forensic analysis capabilities BSI-28 Audit event logging and storage BSI-29 Audit record review and analysis BSI-31 Audit log protection and retention API1164-13 Business Continuity and Recovery API1164-17 Wireless and Field Communications API1164-18 Field Device Security API1164-19 Safety Instrumented Systems Interface ASD37-29 Host-based IDS/IPS (Very Good) ASD37-31 Hunt to discover incidents (Very Good) ASD37-32 Network-based IDS/IPS (Limited) ASD37-33 Capture network traffic (Limited) IEC62443-13 Network security monitoring IEC62443-16 Incident response plan for operational disruptions IEC62443-17 Recovery plan for critical systems IEC62443-20 Exercises and drills for OT incidents ISO27019-13 Network security monitoring ISO27019-16 Incident response plan for operational disruptions ISO27019-18 Reporting obligations to authorities ISO27019-20 Exercises and drills for OT incidents NIST-CSF-ID.IM-04 Incident response plans and other cybersecurity plans that affect operations are established, communicated, maintained, and improved NIST-CSF-PR.PS-04 Log records are generated and made available for continuous monitoring NIST-CSF-RC.RP-01 The recovery portion of the incident response plan is executed once initiated from the incident response process NIST-CSF-RS.MA-01 The incident response plan is executed in coordination with relevant third parties once an incident is declared IS.AR.215 Information Security Incident Response IS.D.OR.225 External Reporting of Information Security Events IS.I.OR.225 External Reporting FFIEC-23 Regulatory reporting requirements FFIEC-24 Customer notification procedures FFIEC-25 Post-incident review and improvement ISO-22320-5.2 Incident management process ISO-22320-B Annex B: Incident management plan structure ISO-22320-C Annex C: Incident management task examples DSOMM-1 Culture, Organization, Education, and Governance DSOMM-3 Build, Deployment, Infrastructure Hardening, and Secrets Management DSOMM-5 Information Gathering, Logging, Monitoring, and Incident Response APPI-A41 Preparation and Handling of Pseudonymized Personal Information APPI-A43 Preparation of Anonymized Personal Information CPS234-21 Implementation of Information Security Controls CPS234-25 Internal Audit Review of Information Security Controls CAT-D3-2 Detective controls CAT-D5-1 Incident planning and strategy FTC-Safeguards-9-Elements 9 Safeguard Elements - Access, Inventory, Encryption, Secure-Dev, MFA, Disposal, Change-Mgmt, Monitoring, Pen-Test (16 CFR 314.4(c)) FTC-Safeguards-IR-Plan-BoardReporting-FTC-Notification Written Incident Response Plan + Board Reporting + FTC Breach Notification (16 CFR 314.4(h), (i), (j)) CA-8 Penetration Testing IR-4 Incident Handling CA-8 Penetration Testing IR-4 Incident Handling UAE-PDPL-Art.10 Data Protection Officer (DPO) (UAE PDPL Article 10) UAE-PDPL-Art.18_19_20_21 Security measures, controller/processor relationship, DPIA (UAE PDPL Articles 18-21) ISO28001-PC-04 Supply Chain Continuity Planning ISO28001-PS-01 Facility Security 30111-3 Terms and definitions 30111-5.2 Vulnerability handling team NJDPA-2 Consumer Rights - Access, Correct, Delete, Portability, Appeal NJDPA-6 Reasonable Data Security and Incident Response IM8-RES.3 Incident Response IM8-SEC.3 Network Security ISMSP-SYS-03 Security Monitoring and Log Management ISMSP-SYS-05 Incident Response PIPA-CPO-DPO-Privacy-Officer-PIA-Personal-Information-Impact-Assessment-Articles-31-33 Korea PIPA CPO + DPO + Privacy Officer + PIA + Personal Information Impact Assessment + Articles 31-33 PIPA-Sensitive-Information-Unique-ID-Resident-Registration-Numbers-CCTV-Articles-23-24-25 Korea PIPA Sensitive Information + Unique ID + RRN + CCTV + Articles 23-25 D.1 Incident Response Planning D.2 Incident Reporting CYB-5 Cyber Incident Response Plan USMTSA-2 Cybersecurity Assessment and CSO Designation CPS230-13 Board Accountability for Operational Risk Management 4.4.7 Emergency and Incident Response AWWA-4.4 Audit Logging and Monitoring AT-DSG-6 Sections 12-13 - Image processing (video surveillance/CCTV) BB-DPA-20 Sections 50-60 - Registration and Responsibilities CA-12 Deploys Through Policies and Procedures CA-ITSG33-SC-01 Security Control Catalogue FDBR-Enforcement-AG-CurePeriod Enforcement by Florida Department of Legal Affairs + Penalties + 45-Day Cure (Fla. Stat. 501.72, 501.721, 501.722) ICP-24 Macroprudential Surveillance and Insurance Supervision 62351-14 Cyber security event logging ISO27799-05 Audit trail for ePHI access ISO20000-11 Incident management ISO-25012-4.11 Traceability 27006-9.4 Surveillance and recertification 27010-16.1 Continuity of Sharing 27011-8.4 Logging and monitoring ISO27043-24 Logging and monitoring 27400-6.5 Security monitoring and incident response ISO21434-24 Logging and monitoring ITIL4-11 Incident management NFPA1600-6.3 Emergency Response Operations NISTPF-8 Protect-P Information Protection Processes (PR.PO-P) NGCB-6 Incident Response, 72-Hour NGCB Notification, and Independent Investigation NZISM-5 Network Security, System Hardening, and Application Security NGOB-5 Fraud Monitoring, Incident Notification, and Reporting to CBN OWASPTOP10-9 A09:2025 Security Logging and Monitoring Failures PAKPDPB-5 Security of Processing and Personal Data Breach Notification AUPRV-7 Notifiable Data Breaches (NDB) Scheme, Incident Response PSPF24-1 Security Culture, Governance, Risk Management SGCYBER-1 Critical Information Infrastructure (CII) Designation and Registration TEFCAREC-1 Common Agreement Conformance and Onboarding TURKEYKVKK-2 Information Notice and Data Subject Rights UAEVARA-1 Activity Licensing (Advisory, Exchange, Custody, Broker-Dealer, etc.) USSDWA-2 Cybersecurity Practices (Assessment, Access, Network, IR) VIETNAMCYBER-2 Prohibited Acts (Access, Interception, Forgery, Content) VPSHR-3 Implementation Guidance and Reporting Every mapping shown was judged rather than inferred from wording similarity, and the ones that failed review are published too. See the coverage reports and what was rejected .
Query this from an agent The graph holds this control, the 161 it maps to, and the evidence behind each claim, over MCP and REST.