NIST SP 800-53 Rev 5
IR - Incident Response

NIST SP 800-53 Rev 5 NIST800-IR-2: IR-2 Incident Response Training

a. Provide incident response training to system users consistent with assigned roles and responsibilities: 1. Within [Assignment: organization-defined time period] of assuming an incident response role or responsibility or acquiring system access; 2. When required by system changes; and 3. [Assignment: organization-defined frequency] thereafter; and b. Review and update incident response training content [Assignment: organization-defined frequency] and following [Assignment: organization-defined events].

Maintained by Gerard BlokdykVerified against the published standard Control text last updated

What else in your programme already covers this

This control maps to 209 controls across 101 other frameworks. If you already hold one of them, the evidence you collected for it is the starting point here rather than new work.

NIST Cybersecurity Framework 2.0 · 5 controls

  • NIST-CSF-ID.IM-04 Incident response plans and other cybersecurity plans that affect operations are established, communicated, maintained, and improved
  • NIST-CSF-PR.AT-01 Personnel are provided with awareness and training so that they possess the knowledge and skills to perform general tasks with cybersecurity risks in mind
  • NIST-CSF-PR.AT-02 Individuals in specialized roles are provided with awareness and training so that they possess the knowledge and skills to perform relevant tasks with cybersecurity risks in mind
  • NIST-CSF-RC.RP-01 The recovery portion of the incident response plan is executed once initiated from the incident response process
  • NIST-CSF-RS.MA-01 The incident response plan is executed in coordination with relevant third parties once an incident is declared

API 1164 · 3 controls

  • API1164-17 Wireless and Field Communications
  • API1164-18 Field Device Security
  • API1164-19 Safety Instrumented Systems Interface

BSI IT-Grundschutz · 3 controls

  • BSI-18 Incident response planning and testing
  • BSI-20 Incident reporting and notification
  • BSI-21 Forensic analysis capabilities

EASA Part-IS - Information Security in Aviation · 3 controls

  • IS.AR.215 Information Security Incident Response
  • IS.D.OR.225 External Reporting of Information Security Events
  • IS.I.OR.225 External Reporting

FFIEC IT Examination Handbook · 3 controls

  • FFIEC-23 Regulatory reporting requirements
  • FFIEC-24 Customer notification procedures
  • FFIEC-25 Post-incident review and improvement

IEC 62443 · 3 controls

  • IEC62443-16 Incident response plan for operational disruptions
  • IEC62443-17 Recovery plan for critical systems
  • IEC62443-20 Exercises and drills for OT incidents

ISO 22320:2018 · 3 controls

  • ISO-22320-5.2 Incident management process
  • ISO-22320-B Annex B: Incident management plan structure
  • ISO-22320-C Annex C: Incident management task examples

ISO/IEC 27019:2024 · 3 controls

  • ISO27019-16 Incident response plan for operational disruptions
  • ISO27019-18 Reporting obligations to authorities
  • ISO27019-20 Exercises and drills for OT incidents

NIST SP 1800-32 · 3 controls

OSFI B-13 · 3 controls

  • OSFIB13-3 Cyber Security: Identification, Protection, Detection, Response, Recovery
  • OSFIB13-7 Incident Reporting to OSFI and Regulatory Coordination
  • OSFIB13-8 Metrics, Monitoring, Continuous Improvement, Maturity

PCI P2PE · 3 controls

  • PCI-P2PE-21 Incident detection and classification
  • PCI-P2PE-22 Incident response and containment
  • PCI-P2PE-25 Post-incident review and improvement

PCI PIN Security · 3 controls

  • PCI-PIN-23 Regulatory reporting requirements
  • PCI-PIN-24 Customer notification procedures
  • PCI-PIN-25 Post-incident review and improvement

PCI SSF · 3 controls

  • PCI-SSF-21 Incident detection and classification
  • PCI-SSF-24 Customer notification procedures
  • PCI-SSF-25 Post-incident review and improvement

SANS Incident Handler's Handbook and PICERL Methodology · 3 controls

  • PICERL-C2 System Backup
  • PICERL-C3 Long-Term Containment
  • PICERL-L3 Plan Improvement

Security of Critical Infrastructure Act 2018 (SOCI) · 3 controls

  • SOCI-CIRMP-PHYSICAL CIRMP hazard vector: Physical security and natural hazards
  • SOCI-S30CB Statutory incident response planning
  • SOCI-S35AB Ministerial authorisation for government assistance

Switzerland New Federal Act on Data Protection (nFADP/nDSG, 2023) · 3 controls

APPI · 2 controls

  • APPI-A41 Preparation and Handling of Pseudonymized Personal Information
  • APPI-A43 Preparation of Anonymized Personal Information

APRA CPS 234 · 2 controls

  • CPS234-21 Implementation of Information Security Controls
  • CPS234-25 Internal Audit Review of Information Security Controls

ASD Strategies to Mitigate Cyber Security Incidents · 2 controls

  • ASD37-31 Hunt to discover incidents (Very Good)
  • ASD37-33 Capture network traffic (Limited)

Bahrain PDPL · 2 controls

CIS Controls v8 · 2 controls

  • CIS-14.6 Train Workforce Members on Recognizing and Reporting Security Incidents
  • CIS-17.7 Conduct Routine Incident Response Exercises

Cloud Security Alliance Cloud Controls Matrix (CCM) v4.0.1 · 2 controls

FedRAMP High · 2 controls

  • AT-2(2) Insider Threat
  • IR-9(2) Information Spillage Response | Training (IR-9(2))

FedRAMP Moderate · 2 controls

  • AT-2(2) Insider Threat
  • IR-9(2) Information Spillage Response | Training (IR-9(2))

Federal Decree-Law No. 45 of 2021 on the Protection of Personal Data (UAE PDPL) · 2 controls

  • UAE-PDPL-Art.10 Data Protection Officer (DPO) (UAE PDPL Article 10)
  • UAE-PDPL-Art.18_19_20_21 Security measures, controller/processor relationship, DPIA (UAE PDPL Articles 18-21)

ISO 27001:2022 · 2 controls

  • 5.24 Information security incident management planning and preparation 
  • 6.3 Information security awareness, education and training

ISO 27002:2022 · 2 controls

  • 5.24 Information security incident management planning and preparation
  • 6.3 Information security awareness, education and training

ISO 27701:2019 · 2 controls

  • 5.5.2 Competence
  • 6.13.1 Management of information security incidents and improvements

ISO/IEC 30111:2019 · 2 controls

  • 30111-3 Terms and definitions
  • 30111-5.2 Vulnerability handling team

NIST SP 800-181 · 2 controls

New Jersey Data Privacy Act · 2 controls

  • NJDPA-2 Consumer Rights - Access, Correct, Delete, Portability, Appeal
  • NJDPA-6 Reasonable Data Security and Incident Response

Open Banking Security · 2 controls

  • OPENBANK-7 Logging, Monitoring, Regulatory Reporting, SLA, Availability
  • OPENBANK-8 Incident Detection, Response, Customer Notification, Post-Incident Review, BCM

PCI DSS 4.0 · 2 controls

  • 12.10.4 12.10.4 Periodic training for incident response personnel
  • 12.10.4.1 12.10.4.1 Responder training frequency set by targeted risk analysis

PSD2 SCA · 2 controls

  • PSDTWO-3 Common and Secure Communication, API Access for AISPs and PISPs
  • PSDTWO-4 Fraud Reporting and Incident Management

Peru DPL · 2 controls

  • PERU-7 DPO, Records, Retention, Marketing, Training
  • PERU-8 Breach Notification, ANPD Cooperation, Sanctions, Compliance

Qatar DPL · 2 controls

  • QATAR-5 Security of Processing
  • QATAR-8 Breach Notification, Compliance, Enforcement

SOC 2 · 2 controls

  • SOC2-CC7.4 CC7.4 Responding to security incidents
  • SOC2-CC7.5 CC7.5 Recovering from security incidents

SSAE 18 - Attestation Standards (SOC Reporting) · 2 controls

  • SSAE18-CC7.4 CC7.4 - Incident Response
  • SSAE18-CC7.5 CC7.5 - Incident Recovery

Saudi Arabia PDPL · 2 controls

  • SA-PDPL-16 Data breach notification requirements
  • SA-PDPL-17 Security incident response procedures

South Korea PIPA · 2 controls

  • PIPA-CPO-DPO-Privacy-Officer-PIA-Personal-Information-Impact-Assessment-Articles-31-33 Korea PIPA CPO + DPO + Privacy Officer + PIA + Personal Information Impact Assessment + Articles 31-33
  • PIPA-Sensitive-Information-Unique-ID-Resident-Registration-Numbers-CCTV-Articles-23-24-25 Korea PIPA Sensitive Information + Unique ID + RRN + CCTV + Articles 23-25

UK Defence Standard 05-138 - Cyber Security for Defence Suppliers · 2 controls

  • D.1 Incident Response Planning
  • D.2 Incident Reporting

AICPA Privacy Management Framework (PMF) · 1 control

  • PMF-M.4 Privacy Incident Management

APRA CPS 230 Operational Risk Management · 1 control

  • CPS230-13 Board Accountability for Operational Risk Management

ASIS SPC.1-2009 - Organizational Resilience Standard · 1 control

  • 4.4.7 Emergency and Incident Response

AWS Well-Architected Security Pillar · 1 control

Annex 11 to EU GMP - Computerised Systems · 1 control

Barbados Data Protection Act 2019 · 1 control

  • BB-DPA-20 Sections 50-60 - Registration and Responsibilities

C5 (Germany) · 1 control

  • C5-HR-03 Security training and awareness programme

CMMC 2.0 · 1 control

COSO Internal Control - Integrated Framework (2013) · 1 control

  • CA-12 Deploys Through Policies and Procedures

Canada ITSG-33 - IT Security Risk Management · 1 control

  • CA-ITSG33-SC-01 Security Control Catalogue

FFIEC Cybersecurity Assessment Tool (CAT) · 1 control

  • CAT-D5-1 Incident planning and strategy

FTC GLBA Safeguards Rule (16 CFR Part 314) · 1 control

  • FTC-Safeguards-IR-Plan-BoardReporting-FTC-Notification Written Incident Response Plan + Board Reporting + FTC Breach Notification (16 CFR 314.4(h), (i), (j))

IAEA Nuclear Security Series - Computer Security at Nuclear Facilities (NSS-17-T Rev 1) · 1 control

ISO 22301:2019 · 1 control

ISO 28001:2007 Supply Chain Security Management · 1 control

  • ISO28001-PC-04 Supply Chain Continuity Planning

ISO/IEC 20000-1:2018 · 1 control

  • ISO20000-11 Incident management

ISO/IEC 27010:2015 · 1 control

  • 27010-16.1 Continuity of Sharing

ISO/IEC 27400:2022 · 1 control

  • 27400-6.5 Security monitoring and incident response

ITIL 4 · 1 control

  • ITIL4-11 Incident management

NFPA 1600 - Standard on Continuity, Emergency, and Crisis Management · 1 control

  • NFPA1600-6.3 Emergency Response Operations

NIST SP 800-124 Revision 2 - Guidelines for Managing the Security of Mobile Devices · 1 control

NIST SP 800-161 Rev 1 · 1 control

NIST SP 800-171 Rev 3 · 1 control

NIST SP 800-172 · 1 control

  • 3.2.2e Practical Exercises in Awareness Training

NIST SP 800-190 · 1 control

NIST SP 800-53 Rev 5 HIGH · 1 control

  • IR-2 IR-2 Incident Response Training

NIST SP 800-53 Rev 5 LOW · 1 control

  • IR-2 IR-2 Incident Response Training

NIST SP 800-53 Rev 5 MODERATE · 1 control

  • IR-2 IR-2 Incident Response Training

NIST SP 800-82 Revision 3: Guide to Industrial Control Systems (ICS) Security · 1 control

  • NISTSP82-7 OT Incident Response, Forensics, Recovery, and Continuity

NRC 10 CFR 73.54 - Nuclear Facility Cybersecurity · 1 control

NRF Cybersecurity and Data Privacy Framework (National Retail Federation) · 1 control

  • NRFCS-7 Detection, Logging, Incident Response, Breach Notification, and Fraud Detection

Nevada Gaming Control Board Cybersecurity Requirements · 1 control

  • NGCB-6 Incident Response, 72-Hour NGCB Notification, and Independent Investigation

Nigeria Open Banking Regulatory Framework (CBN, 2023) · 1 control

  • NGOB-5 Fraud Monitoring, Incident Notification, and Reporting to CBN

Oman National Cybersecurity Framework · 1 control

  • OMANCS-6 Security Monitoring, Detection, Incident Response, and OmanCERT Notification

Oregon Consumer Privacy Act · 1 control

  • OREGONCPA-3 Consent, Sensitive Data, Children and Teen Protections

PAS 1192-5:2015 - Security-Minded Approach to BIM and Digital Built Environments · 1 control

  • PASONE-6 Incident Management, Audit, Handover, Operational Phase, Decommissioning

PDPA Singapore · 1 control

  • PDPASG-8 Data Breach Notification, Incident Response, and Enforcement

PDPA Thailand · 1 control

  • PDPATH-8 Data Breach Notification, Complaints, Compliance, Enforcement

POPIA · 1 control

  • POPIASA-5 Security Safeguards, Encryption, Access Control, Operator Obligations

Papua New Guinea National Cybersecurity Policy & Cybercrime Act (2016) · 1 control

  • PNGCYBER-4 Incident Response, Investigation, Evidence Preservation, Data Retention

Personal Data Act (personopplysningsloven) · 1 control

  • NORWAY-8 Breach Notification, Complaints, Compliance, Enforcement

Privacy Act 2020 · 1 control

  • NZPRV-7 Notifiable Privacy Breach Scheme

SOC for Cybersecurity - Cybersecurity Risk Management Examination · 1 control

  • SOC-CY-S2 System Operations

Singapore Government Instruction Manual on ICT&SS Management (IM8) · 1 control

  • IM8-RES.3 Incident Response

South Korea ISMS-P · 1 control

  • ISMSP-SYS-05 Incident Response

TISAX - Trusted Information Security Assessment Exchange · 1 control

TSA Pipeline Cybersecurity Directives · 1 control

  • TSAPIPE-2 OT/IT Network Segmentation and Access Control

Taiwan PDPA · 1 control

  • TAIWAN-3 Data Subject Rights

Tanzania Personal Data Protection Act 2022 · 1 control

  • TANZANIA-4 Security and Cross-Border

Telecommunications Sector Security Reforms (TSSR) · 1 control

  • TSSR-NOT-2 Security Incident Notification

Texas Data Privacy and Security Act (TDPSA) · 1 control

  • TEXASTDPSA-2 Consumer Rights

Trinidad and Tobago Data Protection Act 2011 · 1 control

  • TRINIDAD-3 Data Subject Rights

UK GDPR (UK General Data Protection Regulation) · 1 control

  • UKGDPRREG-3 Controller and Processor (Articles 24-43)

UK Gambling Commission LCCP and Remote Technical Standards · 1 control

  • UKGAMBLE-4 Resilience and Incident Response

UK Open Banking Standard · 1 control

  • OB-OPS.4 Incident Management

UK Telecommunications (Security) Act 2021 · 1 control

  • UK-TSA-MON-02 Incident Notification

US Maritime Transportation Security Act (MTSA) and USCG Cybersecurity Requirements · 1 control

  • CYB-5 Cyber Incident Response Plan

Uruguay DPL · 1 control

  • URUGUAY-4 Security and Cross-Border

Vietnam PDPD · 1 control

  • VIETNAMPDP-2 Consent and Notice

Virginia CDPA · 1 control

  • VIRGINIAVCDPA-3 Sensitive Data Consent and Children

Every mapping shown was judged rather than inferred from wording similarity, and the ones that failed review are published too. See the coverage reports and what was rejected.

Other controls in IR - Incident Response

You are reading one control. How much of NIST SP 800-53 Rev 5 have you already done?

NIST SP 800-53 Rev 5 NIST800-IR-2 is one control. If you already hold one of the frameworks below, a reviewed crosswalk already says how much of NIST SP 800-53 Rev 5 your existing evidence covers. Hold ISO 27001:2022 and 163 of 1014 NIST SP 800-53 Rev 5 controls already carry evidence.

If you hold ISO 27001:202216.1% covered · 851 gapsIf you hold ISO 27002:202210.8% covered · 904 gapsIf you hold Cloud Security Alliance Cloud Controls Matrix (CCM) v4.0.110.2% covered · 911 gapsIf you hold CIS Controls v810.1% covered · 912 gapsIf you hold NIST SP 800-171 Rev 310.1% covered · 912 gapsIf you hold C5 (Germany)9.6% covered · 917 gaps

Each report names every control your existing framework evidences, every one it does not, the reasoning behind each claim, and the claims that were argued against and rejected. 342 were rejected on the ISO 27001:2022 pair alone.

See the released pairs, $299 eachBrowse the graph free

Query this from an agent

The graph holds this control, the 209 it maps to, and the evidence behind each claim, over MCP and REST.

MCP endpointAll NIST SP 800-53 Rev 5 controls