Frameworks / NIST SP 800-66 Rev 2 / 164.308(a)(6)(i) NIST SP 800-66 Rev 2
Administrative
NIST SP 800-66 Rev 2 164.308(a)(6)(i): Security Incident Procedures (Standard) Implement policies to address security incidents. NIST recommends an incident response plan aligned to NIST SP 800-61 with detection, analysis, containment, eradication, and recovery phases.
Maintained by Gerard Blokdyk · Verified against the published standard 31 May 2026 · Control text last updated 21 May 2026 What else in your programme already covers this This control maps to 73 controls across 27 other frameworks. If you already hold one of them, the evidence you collected for it is the starting point here rather than new work.
NIST-CSF-ID.IM-04 Incident response plans and other cybersecurity plans that affect operations are established, communicated, maintained, and improved NIST-CSF-RC.RP-01 The recovery portion of the incident response plan is executed once initiated from the incident response process NIST-CSF-RS.AN-03 Analysis is performed to establish what has taken place during an incident and the root cause of the incident NIST-CSF-RS.AN-08 An incident's magnitude is estimated and validated NIST-CSF-RS.MA-01 The incident response plan is executed in coordination with relevant third parties once an incident is declared NIST-CSF-RS.MA-02 Incident reports are triaged and validated CIS-13.8 Deploy a Network Intrusion Prevention Solution CIS-14.6 Train Workforce Members on Recognizing and Reporting Security Incidents CIS-17.3 Establish and Maintain an Enterprise Process for Reporting Incidents CIS-17.4 Establish and Maintain an Incident Response Process CIS-17.5 Assign Key Roles and Responsibilities 6.1.2 Addressing risks and opportunities 8.2.3 Risk assessment 8.4.1 General 8.4.2 Response structure 8.4.4 Business continuity plans 11.2.1 11.2.1 Detect authorized and rogue wireless access points 12.10.1 12.10.1 Incident response plan ready for activation 6.4.1 6.4.1 Public web application review or automated protection 6.4.2 6.4.2 Automated web attack detection and prevention 6.3.1 6.3.1 Vulnerability identification and risk ranking SOC2-CC7.1 CC7.1 Detecting configuration changes and new vulnerabilities SOC2-CC7.3 CC7.3 Evaluating security events to identify incidents SOC2-CC7.4 CC7.4 Responding to security incidents SOC2-CC7.5 CC7.5 Recovering from security incidents SOC2-P6.3 P6.3 Record of unauthorised disclosures and breaches CPS234-30 Detection and Response Mechanisms CPS234-P24 Information Security Response Plans CPS234-P25 Response Plan Content and Escalation Mechanisms IR-2 Incident Response Training IR-4 Incident Handling IR-8 Incident Response Plan IR-2 Incident Response Training IR-4 Incident Handling IR-8 Incident Response Plan SEC10-BP02 Develop incident management plans SEC10-BP04 Develop and test security incident response playbooks ASBv3-GS-7 Define and implement logging, threat detection and incident response strategy ASBv3-IR-1 Preparation - update incident response plan and handling process C5-SIM-01 Policy for security incident management C5-SIM-04 Duty of the users to report security incidents to a central body 5.24 Information security incident management planning and preparation 5.26 Response to information security incidents 5.24 Information security incident management planning and preparation 5.26 Response to information security incidents 6.13.1 Management of information security incidents and improvements 6.9 Operations security 3.6.1e Establish Security Operations Center (SOC) 3.6.2e Establish and Maintain a Cyber Incident Response Team E8-APP-ML2 Application Control (ML2) ANSSI-HYG-40 Define a Security Incident Management Procedure CPS230-27 Identification and Escalation of Incidents and Near Misses ASD37-28 Continuous incident detection and response (Excellent) Every mapping shown was judged rather than inferred from wording similarity, and the ones that failed review are published too. See the coverage reports and what was rejected .
Other controls in Administrative Query this from an agent The graph holds this control, the 73 it maps to, and the evidence behind each claim, over MCP and REST.