Frameworks / NIST SP 800-146 / NISTSP146-7 NIST SP 800-146
Operational Quality and Portability
NIST SP 800-146 NISTSP146-7: Service Level, Performance, Reliability, Interoperability, and Portability Apply NIST SP 800-146 Section 9.1 (Performance Considerations) + Section 9.2 (Reliability and Availability Considerations) + Section 9.3 (Service Level Recommendations) + interoperability and portability recommendations. Service Level Agreements with cloud providers must specify (a) availability target with credit regime, (b) performance metrics relevant to workload (latency, throughput, IOPS), (c) reliability and disaster recovery (RTO / RPO + provider DR posture + consumer-side DR responsibility), (d) interoperability standards supported (open APIs, standard formats, standard authentication), (e) portability commitments (data export format, application export packaging, exit assistance period). Continuous measurement against SLA must feed the cloud governance dashboard and trigger formal escalation when targets are breached.
Maintained by Gerard Blokdyk · Verified against the published standard 31 May 2026 · Control text last updated 21 May 2026 What else in your programme already covers this This control maps to 136 controls across 55 other frameworks. If you already hold one of them, the evidence you collected for it is the starting point here rather than new work.
CH-FADP-19 Transparency and proactive information CH-FADP-21 Data protection impact assessments FADP-16 FDPIC Independence and Functions FADP-7 Data Protection Impact Assessment (Articles 9-10) FADP-9 Data Protection Advisor (Articles 14-15) ASD37-27 Outbound data loss prevention (Very Good) ASD37-34 Regular backups (Essential) ASD37-35 Business continuity and disaster recovery plans (Very Good) ASD37-36 System recovery capabilities (Very Good) IM8-DAT.2 Data Protection IM8-DAT.4 Data Retention and Disposal IM8-RES.2 Disaster Recovery IM8-RES.4 Resilience Testing API1164-17 Wireless and Field Communications API1164-18 Field Device Security API1164-19 Safety Instrumented Systems Interface AT-DSG-10 Section 29 - Liability and right to compensation / civil jurisdiction AT-DSG-12 Section 62 - Administrative penalties AT-DSG-7 Section 18 - Establishment of the Data Protection Authority IEC62443-16 Incident response plan for operational disruptions IEC62443-17 Recovery plan for critical systems IEC62443-20 Exercises and drills for OT incidents ISO27799-03 Minimum necessary standard enforcement ISO27799-04 Patient data de-identification procedures ISO27799-05 Audit trail for ePHI access 27011-5.2 Information Security Roles in Telecoms 27011-6.3 Awareness and Training 27011-8.6 Data protection and backup ISO27019-16 Incident response plan for operational disruptions ISO27019-18 Reporting obligations to authorities ISO27019-20 Exercises and drills for OT incidents 27031-8.1 Exercising and Testing 27031-8.2 Maintaining IRBC 27031-9.3 Management Review NIST-CSF-RC.RP-01 The recovery portion of the incident response plan is executed once initiated from the incident response process NIST-CSF-RC.RP-06 The end of incident recovery is declared based on criteria, and incident-related documentation is completed NIST-CSF-RS.MA-05 The criteria for initiating incident recovery are applied NISTPF-4 Communicate-P - Privacy Notice, Transparency, and Individual Awareness NISTPF-7 Protect-P Maintenance and Protective Technology (PR.MA-P, PR.PT-P) NISTPF-8 Protect-P Information Protection Processes (PR.PO-P) AZ-DPA-15 Article 17 - Dispute resolution AZ-DPA-6 Article 6 - State regulation in personal data protection BB-DPA-1 Section 1 - Short Title BB-DPA-4 Section 4 - Principles Relating to Processing UAE-PDPL-Art.10 Data Protection Officer (DPO) (UAE PDPL Article 10) UAE-PDPL-Art.18_19_20_21 Security measures, controller/processor relationship, DPIA (UAE PDPL Articles 18-21) ISO22316-08 Recovery time and point objectives ISO22316-12 Recovery strategy for critical activities 27400-7.1 Network Security for IoT 27400-7.4 Data retention and deletion ISO22317-08 Recovery time and point objectives ISO22317-12 Recovery strategy for critical activities ISO22318-08 Recovery time and point objectives ISO22318-12 Recovery strategy for critical activities NFPA1600-5.3 Resource Needs Assessment NFPA1600-6.4 Continuity and Recovery NISTSP34-2 Business Impact Analysis (BIA): Critical Resources, Recovery Priorities NISTSP34-4 Information System Contingency Plan (ISCP) Development NDPA-1 Applicability, Scope, and Carve-Outs NDPA-4 Sensitive Data Processing Consent and Childrens Protections NJDPA-7 Data Protection Assessments and Processor Contracts NJDPA-8 AG Platkin Enforcement, 18-Month Cure Sunset, and Division of Consumer Affairs PAKPDPB-6 Cross-Border Transfer and Data Localization PAKPDPB-7 NCPDP, Registration, Records, Processor Contracts, DPO AUPRV-1 APP 1 Open and Transparent Management + Privacy Management Framework AUPRV-6 Sensitive Information, PIA, Privacy by Design, Children ISMSP-PI-06 Personal Information Destruction ISMSP-SYS-06 Business Continuity and Disaster Recovery D.1 Incident Response Planning D.3 Backup and Recovery VERMONTAICDA-3 Bias Testing, Discrimination Prevention, Transparency VERMONTAICDA-4 Vermont AG Enforcement and Cure 4.4.8 Business Continuity and Recovery AWWA-3.4 Encryption and Data Protection AL-DPA-14 Direct Marketing CPG-3.C Strong and Agile Encryption DIQ-1 Data Integration and Interoperability FFIEC-12 Disaster recovery procedures FTC-Safeguards-9-Elements 9 Safeguard Elements - Access, Inventory, Encryption, Secure-Dev, MFA, Disposal, Change-Mgmt, Monitoring, Pen-Test (16 CFR 314.4(c)) FEDRAMP-CP-9 System Backup FDBR-ControllerObligations-DPA-Notice Controller + Processor Obligations + Data Protection Assessments (Fla. Stat. 501.707, 501.708, 501.71, 501.711) ISO-22320-5.2 Incident management process ISO-26000-6.7 Consumer issues ISO23894-A.5 Privacy and Data Protection in AI ISO27043-23 Backup and recovery procedures ISO21434-23 Backup and recovery procedures OWASPMASVS-7 MASVS-RESILIENCE: Resilience Against Reverse Engineering RUSPD-4 Special Categories, Biometric Data PIPA-CPO-DPO-Privacy-Officer-PIA-Personal-Information-Impact-Assessment-Articles-31-33 Korea PIPA CPO + DPO + Privacy Officer + PIA + Personal Information Impact Assessment + Articles 31-33 TURKEYKVKK-3 Special Categories and Sensitive Data CPSC-CS.3 Data Protection for Safety Systems CYB-5 Cyber Incident Response Plan VIETNAMCYBER-4 Incident Reporting and Cooperation Every mapping shown was judged rather than inferred from wording similarity, and the ones that failed review are published too. See the coverage reports and what was rejected .
Query this from an agent The graph holds this control, the 136 it maps to, and the evidence behind each claim, over MCP and REST.