NRF Cybersecurity and Data Privacy Framework (National Retail Federation)
Detection, IR, Breach, Fraud

NRF Cybersecurity and Data Privacy Framework (National Retail Federation) NRFCS-7: Detection, Logging, Incident Response, Breach Notification, and Fraud Detection

Operate detection + logging + IR + breach notification + fraud detection per NRF framework + NIST SP 800-61 + state breach notification laws + PCI DSS incident response + brand operating rules. Logging and detection must (a) collect logs from POS + e-commerce + payment processing + IAM + endpoint + network + cloud + mobile app + in-store IoT + loyalty + customer service applications with retail-aware correlation rules, (b) deploy detection rules covering retail-specific patterns (skimming + form-jacking + account takeover + credential stuffing + return fraud + chargeback abuse + gift card fraud + insider misuse + ransomware staging), (c) integrate threat intelligence from R-CISC / RH-ISAC + payment brand fraud feeds + commercial threat intelligence. Incident response must (a) maintain IR plan covering retail scenarios with cross-functional team (cyber + privacy + payments + legal + comms + customer service + store operations + loss prevention + executive leadership + brand/marketing), (b) coordinate with payment brands per their operating rules (Visa CISP + Mastercard SDP + AmEx EISP + Discover DISC + JCB-DSP) on cardholder data incidents, (c) maintain forensic readiness + chain of custody + investigator contracting for PFI (PCI Forensic Investigator) engagement. Breach notification must (a) maintain matrix of applicable laws across all 50 US states + DC + territories + international jurisdictions with timing + content + recipient requirements per law, (b) trigger notification clocks at awareness per applicable law (some 30 days some 45 some 60 some 72 hours + GDPR 72 hours + similar), (c) coordinate with state AGs + federal regulators + payment brands + insurance + customers + employees + investors + boards. Fraud detection and prevention must (a) operate real-time fraud detection across digital channels (e-commerce + mobile + buy-online-pickup-in-store + curbside), (b) operate physical fraud prevention in stores including return fraud + sweet-hearting + employee fraud, (c) integrate fraud + cybersecurity functions where compromise enables fraud.

Maintained by Gerard BlokdykVerified against the published standard Control text last updated

What else in your programme already covers this

This control maps to 206 controls across 74 other frameworks. If you already hold one of them, the evidence you collected for it is the starting point here rather than new work.

Switzerland New Federal Act on Data Protection (nFADP/nDSG, 2023) · 8 controls

APPI · 5 controls

  • APPI-A23 Security Control Measures
  • APPI-A24 Supervision of Employees
  • APPI-A33 Request for Disclosure of Retained Personal Data
  • APPI-A41 Preparation and Handling of Pseudonymized Personal Information
  • APPI-A43 Preparation of Anonymized Personal Information

Bahrain PDPL · 5 controls

GDPR · 5 controls

  • GDPR-Art.10 Processing of personal data relating to criminal convictions
  • GDPR-Art.11 Processing which does not require identification
  • GDPR-Art.15 Right of access by the data subject
  • GDPR-Art.19 Notification obligation regarding rectification, erasure or restriction
  • GDPR-Art.9 Processing of special categories of personal data

Barbados Data Protection Act 2019 · 4 controls

  • BB-DPA-14 Section 15 - Right to Data Portability
  • BB-DPA-16 Section 22 - General Principle for Transfers
  • BB-DPA-20 Sections 50-60 - Registration and Responsibilities
  • BB-DPA-21 Sections 61-69 - Data Privacy Officer

South Korea ISMS-P · 4 controls

  • ISMSP-PI-01 Personal Information Collection
  • ISMSP-PI-04 Cross-Border Transfer
  • ISMSP-SYS-02 Encryption Implementation
  • ISMSP-SYS-05 Incident Response

API 1164 · 3 controls

  • API1164-17 Wireless and Field Communications
  • API1164-18 Field Device Security
  • API1164-19 Safety Instrumented Systems Interface

Armenia Law on Protection of Personal Data (2015) · 3 controls

Australian Privacy Principles (APPs) · 3 controls

  • APP-1 APP 1 - Open and transparent management of personal information
  • APP-3 APP 3 - Collection of solicited personal information
  • APP-5 APP 5 - Notification of the collection of personal information

Austria Data Protection Act (Datenschutzgesetz, DSG, amended 2018) · 3 controls

  • AT-DSG-11 Sections 42-45 - Data subject rights (law enforcement)
  • AT-DSG-13 Section 36 - Scope of law enforcement processing
  • AT-DSG-14 Section 38 - Lawfulness of law enforcement processing

Azerbaijan Law on Personal Data (2010) · 3 controls

  • AZ-DPA-12 Article 13 - Cross-border transfer
  • AZ-DPA-14 Article 16 - Liability for violations
  • AZ-DPA-15 Article 17 - Dispute resolution

BSI IT-Grundschutz · 3 controls

  • BSI-18 Incident response planning and testing
  • BSI-20 Incident reporting and notification
  • BSI-21 Forensic analysis capabilities

EASA Part-IS - Information Security in Aviation · 3 controls

  • IS.AR.215 Information Security Incident Response
  • IS.D.OR.225 External Reporting of Information Security Events
  • IS.I.OR.225 External Reporting

FFIEC IT Examination Handbook · 3 controls

  • FFIEC-23 Regulatory reporting requirements
  • FFIEC-24 Customer notification procedures
  • FFIEC-25 Post-incident review and improvement

Federal Decree-Law No. 45 of 2021 on the Protection of Personal Data (UAE PDPL) · 3 controls

  • UAE-PDPL-Art.10 Data Protection Officer (DPO) (UAE PDPL Article 10)
  • UAE-PDPL-Art.18_19_20_21 Security measures, controller/processor relationship, DPIA (UAE PDPL Articles 18-21)
  • UAE-PDPL-Art.4_5 Lawful basis and principles for processing personal data (UAE PDPL Articles 4-5)

IEC 62443 · 3 controls

  • IEC62443-16 Incident response plan for operational disruptions
  • IEC62443-17 Recovery plan for critical systems
  • IEC62443-20 Exercises and drills for OT incidents

ISO 22320:2018 · 3 controls

  • ISO-22320-5.2 Incident management process
  • ISO-22320-B Annex B: Incident management plan structure
  • ISO-22320-C Annex C: Incident management task examples

ISO/IEC 27019:2024 · 3 controls

  • ISO27019-16 Incident response plan for operational disruptions
  • ISO27019-18 Reporting obligations to authorities
  • ISO27019-20 Exercises and drills for OT incidents

ISO/IEC 27400:2022 · 3 controls

  • 27400-5.4 Data and privacy risks
  • 27400-6.5 Security monitoring and incident response
  • 27400-7.3 Data minimization and purpose limitation

ISO/IEC 29100:2024 · 3 controls

  • 29100-6.10 Information security
  • 29100-6.5 Use, retention and disclosure limitation
  • 29100-6.9 Accountability

ISO/IEC 29134:2023 · 3 controls

  • 29134-1 Scope
  • 29134-3 Terms and definitions
  • 29134-9.1 PIA report structure

NIST Cybersecurity Framework 2.0 · 3 controls

  • NIST-CSF-ID.IM-04 Incident response plans and other cybersecurity plans that affect operations are established, communicated, maintained, and improved
  • NIST-CSF-RC.RP-01 The recovery portion of the incident response plan is executed once initiated from the incident response process
  • NIST-CSF-RS.MA-01 The incident response plan is executed in coordination with relevant third parties once an incident is declared

NIST Privacy Framework · 3 controls

  • NISTPF-3 Control-P - Privacy Controls, Data Management, and Disassociated Processing
  • NISTPF-4 Communicate-P - Privacy Notice, Transparency, and Individual Awareness
  • NISTPF-7 Protect-P Maintenance and Protective Technology (PR.MA-P, PR.PT-P)

NIST SP 1800-32 · 3 controls

NIST SP 800-53 Rev 5 · 3 controls

  • NIST800-IR-2 IR-2 Incident Response Training
  • NIST800-IR-5 IR-5 Incident Monitoring
  • NIST800-IR-7 IR-7 Incident Response Assistance

South Korea PIPA · 3 controls

  • PIPA-CPO-DPO-Privacy-Officer-PIA-Personal-Information-Impact-Assessment-Articles-31-33 Korea PIPA CPO + DPO + Privacy Officer + PIA + Personal Information Impact Assessment + Articles 31-33
  • PIPA-Data-Subject-Rights-Access-Correction-Erasure-Portability-Automated-Decisions-Articles-35-37-2 Korea PIPA Data Subject Rights + Access + Correction + Erasure + Portability + Article 35-37
  • PIPA-Sensitive-Information-Unique-ID-Resident-Registration-Numbers-CCTV-Articles-23-24-25 Korea PIPA Sensitive Information + Unique ID + RRN + CCTV + Articles 23-25

APRA CPS 234 · 2 controls

  • CPS234-21 Implementation of Information Security Controls
  • CPS234-25 Internal Audit Review of Information Security Controls

ASD Strategies to Mitigate Cyber Security Incidents · 2 controls

  • ASD37-31 Hunt to discover incidents (Very Good)
  • ASD37-33 Capture network traffic (Limited)

COSO Internal Control - Integrated Framework (2013) · 2 controls

  • CA-10 Selects and Develops Control Activities
  • CA-12 Deploys Through Policies and Procedures

FTC GLBA Safeguards Rule (16 CFR Part 314) · 2 controls

  • FTC-Safeguards-IR-Plan-BoardReporting-FTC-Notification Written Incident Response Plan + Board Reporting + FTC Breach Notification (16 CFR 314.4(h), (i), (j))
  • FTC-Safeguards-Scope-Defs Scope, Definitions and Financial Institution Applicability (16 CFR 314.1, 314.2)

Florida Digital Bill of Rights (FDBR) · 2 controls

  • FDBR-ControllerObligations-DPA-Notice Controller + Processor Obligations + Data Protection Assessments (Fla. Stat. 501.707, 501.708, 501.71, 501.711)
  • FDBR-Scope-Defs Scope, Applicability Thresholds and Definitions (Fla. Stat. 501.701, 501.702, 501.703, 501.704)

ISO/IEC 27557:2022 - Organisational Privacy Risk Management · 2 controls

  • 27557-3 Terms and definitions
  • 27557-4.3 Individual impact consideration

ISO/IEC 30111:2019 · 2 controls

  • 30111-3 Terms and definitions
  • 30111-5.2 Vulnerability handling team

Pakistan Personal Data Protection Bill 2023 · 2 controls

  • PAKPDPB-5 Security of Processing and Personal Data Breach Notification
  • PAKPDPB-8 Enforcement, Penalties, Complaints, Retention, Training

Personal Data Act (personopplysningsloven) · 2 controls

  • NORWAY-5 Security of Processing, Encryption, Pseudonymization, Access Control
  • NORWAY-8 Breach Notification, Complaints, Compliance, Enforcement

Privacy Act 1988 (Australia) · 2 controls

  • AUPRV-4 APP 10-11 Quality, Security of Personal Information
  • AUPRV-7 Notifiable Data Breaches (NDB) Scheme, Incident Response

Russia Federal Law on Personal Data (152-FZ) · 2 controls

  • RUSPD-1 Scope, Definitions, Principles under 152-FZ
  • RUSPD-4 Special Categories, Biometric Data

UK Defence Standard 05-138 - Cyber Security for Defence Suppliers · 2 controls

  • D.1 Incident Response Planning
  • D.2 Incident Reporting

US Maritime Transportation Security Act (MTSA) and USCG Cybersecurity Requirements · 2 controls

  • CYB-5 Cyber Incident Response Plan
  • USMTSA-2 Cybersecurity Assessment and CSO Designation

USMCA Chapter 19 - Digital Trade (United States-Mexico-Canada Agreement) · 2 controls

  • USMCADIGITAL-1 Cross-Border Data Flows and Localisation
  • USMCADIGITAL-2 Personal Information Protection and Consumer Protection

Vietnam Law on Cybersecurity (No. 116/2025/QH15) · 2 controls

  • VIETNAMCYBER-2 Prohibited Acts (Access, Interception, Forgery, Content)
  • VIETNAMCYBER-4 Incident Reporting and Cooperation

APRA CPS 230 Operational Risk Management · 1 control

  • CPS230-13 Board Accountability for Operational Risk Management

ASIS SPC.1-2009 - Organizational Resilience Standard · 1 control

  • 4.4.7 Emergency and Incident Response

Albania Law No. 124/2024 on Personal Data Protection · 1 control

  • AL-DPA-12 International Data Transfers

Annex 11 to EU GMP - Computerised Systems · 1 control

Azure Security Benchmark · 1 control

  • DS-2 Ensure software supply chain security

Canada ITSG-33 - IT Security Risk Management · 1 control

  • CA-ITSG33-SC-01 Security Control Catalogue

Connecticut Data Privacy Act (CTDPA) · 1 control

  • CTDPA-1 Definitions

Estonia Personal Data Protection Act (Isikuandmete kaitse seadus, 2019) · 1 control

FFIEC Cybersecurity Assessment Tool (CAT) · 1 control

  • CAT-D5-1 Incident planning and strategy

IAEA Nuclear Security Series - Computer Security at Nuclear Facilities (NSS-17-T Rev 1) · 1 control

ISO 28001:2007 Supply Chain Security Management · 1 control

  • ISO28001-PC-04 Supply Chain Continuity Planning

ISO/IEC 20000-1:2018 · 1 control

  • ISO20000-11 Incident management

ISO/IEC 23894:2023 · 1 control

  • ISO23894-A.5 Privacy and Data Protection in AI

ISO/IEC 27010:2015 · 1 control

  • 27010-16.1 Continuity of Sharing

ITIL 4 · 1 control

  • ITIL4-11 Incident management

ITU-T X.805 - Security Architecture for End-to-End Communications · 1 control

NFPA 1600 - Standard on Continuity, Emergency, and Crisis Management · 1 control

  • NFPA1600-6.3 Emergency Response Operations

NIST SP 800-124 Revision 2 - Guidelines for Managing the Security of Mobile Devices · 1 control

NIST SP 800-190 · 1 control

Nevada Gaming Control Board Cybersecurity Requirements · 1 control

  • NGCB-6 Incident Response, 72-Hour NGCB Notification, and Independent Investigation

OWASP DevSecOps Maturity Model (DSOMM) · 1 control

  • DSOMM-1 Culture, Organization, Education, and Governance

OWASP Top 10 for LLM Applications 2025 · 1 control

  • OWASPLLM-3 Sensitive Information Disclosure and Privacy (LLM02)

OWASP Top 10:2025 · 1 control

  • OWASPTOP10-9 A09:2025 Security Logging and Monitoring Failures

Protective Security Policy Framework (PSPF) Release 2026 · 1 control

  • PSPF24-1 Security Culture, Governance, Risk Management

Rhode Island Data Transparency and Privacy Protection Act (RIDTPPA) · 1 control

  • RIDTPPA-2 Consumer Rights (Access, Correction, Deletion, Portability, Opt-Out)

Singapore Cybersecurity Act 2018 · 1 control

  • SGCYBER-1 Critical Information Infrastructure (CII) Designation and Registration

Singapore Government Instruction Manual on ICT&SS Management (IM8) · 1 control

  • IM8-RES.3 Incident Response

TEFCA - Trusted Exchange Framework and Common Agreement · 1 control

  • TEFCAREC-1 Common Agreement Conformance and Onboarding

Turkey KVKK · 1 control

  • TURKEYKVKK-2 Information Notice and Data Subject Rights

US EPA Safe Drinking Water Act (SDWA) - Cybersecurity Requirements · 1 control

  • USSDWA-2 Cybersecurity Practices (Assessment, Access, Network, IR)

US Gramm-Leach-Bliley Act (GLBA) - Higher Education Safeguards Rule · 1 control

Vermont Data Privacy and Online Surveillance Act · 1 control

  • VERMONTAICDA-3 Bias Testing, Discrimination Prevention, Transparency

Voluntary Principles on Security and Human Rights (VPs) · 1 control

  • VPSHR-3 Implementation Guidance and Reporting

Every mapping shown was judged rather than inferred from wording similarity, and the ones that failed review are published too. See the coverage reports and what was rejected.

Query this from an agent

The graph holds this control, the 206 it maps to, and the evidence behind each claim, over MCP and REST.

MCP endpointAll NRF Cybersecurity and Data Privacy Framework (National Retail Federation) controls