CSF 2.0 outcome: roles, responsibilities and authorities related to cybersecurity risk management are established, communicated, understood and enforced. Priority Medium. N1: incident response roles exist throughout the organization and often include third parties under contract. R1: document all roles and responsibilities involving incident response in the organization's policies. R2: designate every appropriate individual or party the authority needed to carry out its incident response responsibilities. R3: see the GV.RR recommendation. Section 2.2 adds that where third parties share responsibility, the contract should define their responsibilities, information flows, coordination, authority to act for the organization and restrictions (such as sharing sanitized incident data with other customers), and the incident response team should know that division.
This control maps to 1 controls across 1 other frameworks. If you already hold one of them, the evidence you collected for it is the starting point here rather than new work.
Every mapping shown was judged rather than inferred from wording similarity, and the ones that failed review are published too. See the coverage reports and what was rejected.
The graph holds this control, the 1 it maps to, and the evidence behind each claim, over MCP and REST.