NIST SP 800-66 Rev 2
Administrative

NIST SP 800-66 Rev 2 164.308(a)(7)(ii)(C): Emergency Mode Operation Plan (Required)

Establish procedures to enable continuation of critical processes and security of ePHI during emergency mode. NIST recommends documented manual workflows preserving access controls.

Maintained by Gerard BlokdykVerified against the published standard Control text last updated

What else in your programme already covers this

This control maps to 34 controls across 16 other frameworks. If you already hold one of them, the evidence you collected for it is the starting point here rather than new work.

ISO 27002:2022 · 4 controls

  • 5.24 Information security incident management planning and preparation
  • 5.29 Information security during disruption
  • 5.37 Documented operating procedures
  • 8.13 Information backup

NIST Cybersecurity Framework 2.0 · 4 controls

  • NIST-CSF-GV.SC-08 Relevant suppliers and other third parties are included in incident planning, response, and recovery activities
  • NIST-CSF-ID.IM-04 Incident response plans and other cybersecurity plans that affect operations are established, communicated, maintained, and improved
  • NIST-CSF-PR.IR-03 Mechanisms are implemented to achieve resilience requirements in normal and adverse situations
  • NIST-CSF-RC.RP-04 Critical mission functions and cybersecurity risk management are considered to establish post-incident operational norms

CFTC System Safeguards (17 CFR 37, 38, 39, 49) · 3 controls

  • CFTC-SS-37 Protection of Swap Data Repository Data
  • CFTC-SS-8 Business Continuity and Disaster Recovery Plan and Resources
  • CFTC-SS-9 Next Business Day Recovery Time Objective

FedRAMP High · 3 controls

  • CP-2(3) Resume Mission and Business Functions
  • CP-7 Alternate Processing Site
  • IR-3 Incident Response Testing

FedRAMP Moderate · 3 controls

  • CP-2(3) Resume Mission and Business Functions
  • CP-7 Alternate Processing Site
  • IR-3 Incident Response Testing

APRA CPS 230 Operational Risk Management · 2 controls

  • CPS230-20 Prevention, Adaptation and Return to Normal Operations
  • CPS230-P40 Required Content of the Business Continuity Plan

ASD Strategies to Mitigate Cyber Security Incidents · 2 controls

  • ASD37-35 Business continuity and disaster recovery plans (Very Good)
  • ASD37-36 System recovery capabilities (Very Good)

Cloud Security Alliance Cloud Controls Matrix (CCM) v4.0.1 · 2 controls

ISO 27001:2022 · 2 controls

  • 5.29 Information security during disruption
  • 5.30 ICT readiness for business continuity

NIST SP 800-53 Rev 5 · 2 controls

SOC 2 · 2 controls

  • SOC2-A1.3 A1.3 Testing recovery plan procedures
  • SOC2-CC9.1 CC9.1 Mitigating risks of business disruption

Azure Security Benchmark · 1 control

C5 (Germany) · 1 control

ISO 22301:2019 · 1 control

  • 8.4.4 Business continuity plans

ISO 27701:2019 · 1 control

  • 6.14.1 Information security continuity

NIST SP 800-161 Rev 1 · 1 control

Every mapping shown was judged rather than inferred from wording similarity, and the ones that failed review are published too. See the coverage reports and what was rejected.

Other controls in Administrative

Query this from an agent

The graph holds this control, the 34 it maps to, and the evidence behind each claim, over MCP and REST.

MCP endpointAll NIST SP 800-66 Rev 2 controls