Frameworks / Papua New Guinea National Cybersecurity Policy & Cybercrime Act (2016) / PNGCYBER-4 Papua New Guinea National Cybersecurity Policy & Cybercrime Act (2016)
Incident Response and Investigation
Papua New Guinea National Cybersecurity Policy & Cybercrime Act (2016) PNGCYBER-4: Incident Response, Investigation, Evidence Preservation, Data Retention Per Papua New Guinea National Cybersecurity Policy and Cybercrime Act: incident response + investigation cooperation. Requirements include (a) operate Incident Response and Notification capability including detection + triage + containment + recovery + lessons learned + (b) maintain notification to NICTA + CERT + law enforcement per applicable obligations + (c) cooperate with Investigation Powers including evidence preservation + production orders + interception warrants per the Act + (d) maintain Data Retention for Service Providers including subscriber + traffic + content data per applicable obligations and timeframes + (e) maintain chain of custody for evidence + supporting prosecution + (f) integrate organisational logging + monitoring + retention with investigation cooperation obligations.
Maintained by Gerard Blokdyk · Verified against the published standard 31 May 2026 · Control text last updated 21 May 2026 What else in your programme already covers this This control maps to 118 controls across 60 other frameworks. If you already hold one of them, the evidence you collected for it is the starting point here rather than new work.
API1164-17 Wireless and Field Communications API1164-18 Field Device Security API1164-19 Safety Instrumented Systems Interface BSI-18 Incident response planning and testing BSI-20 Incident reporting and notification BSI-21 Forensic analysis capabilities IS.AR.215 Information Security Incident Response IS.D.OR.225 External Reporting of Information Security Events IS.I.OR.225 External Reporting FFIEC-23 Regulatory reporting requirements FFIEC-24 Customer notification procedures FFIEC-25 Post-incident review and improvement IEC62443-16 Incident response plan for operational disruptions IEC62443-17 Recovery plan for critical systems IEC62443-20 Exercises and drills for OT incidents ISO-22320-5.2 Incident management process ISO-22320-B Annex B: Incident management plan structure ISO-22320-C Annex C: Incident management task examples ISO27019-16 Incident response plan for operational disruptions ISO27019-18 Reporting obligations to authorities ISO27019-20 Exercises and drills for OT incidents NIST-CSF-ID.IM-04 Incident response plans and other cybersecurity plans that affect operations are established, communicated, maintained, and improved NIST-CSF-RC.RP-01 The recovery portion of the incident response plan is executed once initiated from the incident response process NIST-CSF-RS.MA-01 The incident response plan is executed in coordination with relevant third parties once an incident is declared NIST800-IR-2 IR-2 Incident Response Training NIST800-IR-5 IR-5 Incident Monitoring NIST800-IR-7 IR-7 Incident Response Assistance PCI-P2PE-21 Incident detection and classification PCI-P2PE-22 Incident response and containment PCI-P2PE-25 Post-incident review and improvement PCI-PIN-23 Regulatory reporting requirements PCI-PIN-24 Customer notification procedures PCI-PIN-25 Post-incident review and improvement PCI-SSF-21 Incident detection and classification PCI-SSF-24 Customer notification procedures PCI-SSF-25 Post-incident review and improvement PICERL-C2 System Backup PICERL-C3 Long-Term Containment PICERL-L3 Plan Improvement APPI-A41 Preparation and Handling of Pseudonymized Personal Information APPI-A43 Preparation of Anonymized Personal Information CPS234-21 Implementation of Information Security Controls CPS234-25 Internal Audit Review of Information Security Controls ASD37-31 Hunt to discover incidents (Very Good) ASD37-33 Capture network traffic (Limited) UAE-PDPL-Art.10 Data Protection Officer (DPO) (UAE PDPL Article 10) UAE-PDPL-Art.18_19_20_21 Security measures, controller/processor relationship, DPIA (UAE PDPL Articles 18-21) 30111-3 Terms and definitions 30111-5.2 Vulnerability handling team PERU-7 DPO, Records, Retention, Marketing, Training PERU-8 Breach Notification, ANPD Cooperation, Sanctions, Compliance D.1 Incident Response Planning D.2 Incident Reporting CYB-5 Cyber Incident Response Plan USMTSA-2 Cybersecurity Assessment and CSO Designation PMF-M.4 Privacy Incident Management CPS230-13 Board Accountability for Operational Risk Management 4.4.7 Emergency and Incident Response BB-DPA-20 Sections 50-60 - Registration and Responsibilities CA-12 Deploys Through Policies and Procedures CA-ITSG33-SC-01 Security Control Catalogue CAT-D5-1 Incident planning and strategy FTC-Safeguards-IR-Plan-BoardReporting-FTC-Notification Written Incident Response Plan + Board Reporting + FTC Breach Notification (16 CFR 314.4(h), (i), (j)) ISO28001-PC-04 Supply Chain Continuity Planning ISO20000-11 Incident management 27010-16.1 Continuity of Sharing 27400-6.5 Security monitoring and incident response ITIL4-11 Incident management NFPA1600-6.3 Emergency Response Operations NGCB-6 Incident Response, 72-Hour NGCB Notification, and Independent Investigation PASONE-6 Incident Management, Audit, Handover, Operational Phase, Decommissioning PDPASG-8 Data Breach Notification, Incident Response, and Enforcement PDPATH-8 Data Breach Notification, Complaints, Compliance, Enforcement NORWAY-8 Breach Notification, Complaints, Compliance, Enforcement AUPRV-7 Notifiable Data Breaches (NDB) Scheme, Incident Response NZPRV-7 Notifiable Privacy Breach Scheme PSPF24-1 Security Culture, Governance, Risk Management SGCYBER-1 Critical Information Infrastructure (CII) Designation and Registration IM8-RES.3 Incident Response ISMSP-SYS-05 Incident Response TEFCAREC-1 Common Agreement Conformance and Onboarding TURKEYKVKK-2 Information Notice and Data Subject Rights OB-OPS.4 Incident Management USSDWA-2 Cybersecurity Practices (Assessment, Access, Network, IR) VIETNAMCYBER-2 Prohibited Acts (Access, Interception, Forgery, Content) VIETNAMPDP-2 Consent and Notice VPSHR-3 Implementation Guidance and Reporting Every mapping shown was judged rather than inferred from wording similarity, and the ones that failed review are published too. See the coverage reports and what was rejected .
Query this from an agent The graph holds this control, the 118 it maps to, and the evidence behind each claim, over MCP and REST.