Singapore Government Instruction Manual on ICT&SS Management (IM8)
Resilience and Incident Response

Singapore Government Instruction Manual on ICT&SS Management (IM8) IM8-RES.2: Disaster Recovery

Agencies must establish disaster recovery procedures and infrastructure to restore critical systems within defined timeframes.

What else in your programme already covers this

This control maps to 419 controls across 166 other frameworks. If you already hold one of them, the evidence you collected for it is the starting point here rather than new work.

ISO/IEC 27031:2011 · 7 controls

ISO 15189:2022 - Medical Laboratories Requirements for Quality and Competence · 6 controls

ISO 22316 · 5 controls

  • ISO22316-01 Organizational resilience and security - business continuity policy for building security and resilience
  • ISO22316-08 Recovery time and point objectives
  • ISO22316-12 Recovery strategy for critical activities
  • ISO22316-14 Supply chain continuity
  • ISO22316-15 Communication strategy during disruption

ISO 22317 · 5 controls

ISO 22318 · 5 controls

NIST Cybersecurity Framework 2.0 · 5 controls

  • NIST-CSF-DE.AE-08 Incidents are declared when adverse events meet the defined incident criteria
  • NIST-CSF-PR.AA-05 Access permissions, entitlements, and authorizations are defined in a policy, managed, enforced, and reviewed, and incorporate the principles of least privilege and separation of duties
  • NIST-CSF-RC.RP-01 The recovery portion of the incident response plan is executed once initiated from the incident response process
  • NIST-CSF-RC.RP-06 The end of incident recovery is declared based on criteria, and incident-related documentation is completed
  • NIST-CSF-RS.MA-05 The criteria for initiating incident recovery are applied

NRC 10 CFR 73.54 - Nuclear Facility Cybersecurity · 5 controls

  • NRC7354-2 Critical Digital Asset (CDA) Identification, Scope, and Boundary
  • NRC7354-4 Security Controls Implementation per NRC RG 5.71 Appendix B/C
  • RG5.71-C.3 Cyber Security Training
  • RG5.71-C.5 Recovery and Restoration
  • RG5.71-C.6 Configuration Management

SANS Incident Handler's Handbook and PICERL Methodology · 5 controls

SSAE 18 - Attestation Standards (SOC Reporting) · 5 controls

Annex 11 to EU GMP - Computerised Systems · 4 controls

DAMA-DMBOK2 - Data Management Body of Knowledge (2nd Edition) · 4 controls

  • DA-1 Enterprise Data Architecture
  • DIQ-1 Data Integration and Interoperability
  • DIQ-2 Data Quality Management
  • RMD-1 Reference Data Management

IAEA Nuclear Security Series - Computer Security at Nuclear Facilities (NSS-17-T Rev 1) · 4 controls

ISO 22320:2018 · 4 controls

ISO/IEC 27011:2024 · 4 controls

ISO/IEC 27557:2022 - Organisational Privacy Risk Management · 4 controls

NFPA 1600 - Standard on Continuity, Emergency, and Crisis Management · 4 controls

NIST SP 800-171A Rev 3 - Assessing CUI Security Requirements · 4 controls

SOC 2 · 4 controls

  • SOC2-A1.2 Environmental protections, data backups, and recovery infrastructure support availability
  • SOC2-A1.3 Recovery plan procedures support system recovery from failures
  • SOC2-CC4.2 COSO principle 17: Evaluates and communicates deficiencies in a timely manner
  • SOC2-CC7.4 Responds to identified security incidents through defined procedures

API 1164 · 3 controls

ASD Strategies to Mitigate Cyber Security Incidents · 3 controls

  • ASD37-34 Regular backups (Essential)
  • ASD37-35 Business continuity and disaster recovery plans (Very Good)
  • ASD37-36 System recovery capabilities (Very Good)

BRCGS Global Standard for Food Safety Issue 9 · 3 controls

  • 1.2 Operating System Privileged Account Control
  • 1.3 Virtualisation Platform Protection
  • 3.3 Configure Data Access Control Lists

FFIEC IT Examination Handbook · 3 controls

  • FFIEC-05 Roles and responsibilities definition
  • FFIEC-11 Business continuity planning and testing
  • FFIEC-12 Disaster recovery procedures

IEC 62304:2015 Medical Device Software Lifecycle Processes · 3 controls

IEC 62443 · 3 controls

IMO Maritime Cybersecurity Guidelines (MSC-FAL.1/Circ.3/Rev.2) · 3 controls

ISO 19650 - Organisation and Digitisation of Information about Buildings and Civil Engineering Works (BIM) · 3 controls

ISO 22313:2020 - Guidance on Business Continuity Management Systems · 3 controls

ISO 22739:2024 - Blockchain and Distributed Ledger Technologies Vocabulary · 3 controls

ISO 27019 · 3 controls

ISO 37000:2021 - Governance of Organizations · 3 controls

ISO/IEC 23837 - Security Requirements for Quantum Key Distribution · 3 controls

ISO/IEC 23894:2023 · 3 controls

ISO/IEC 27004:2016 · 3 controls

ISO/IEC 27014:2020 · 3 controls

ISO/IEC 27400:2022 · 3 controls

ISO/IEC 29100:2024 · 3 controls

ISO/IEC 29134:2023 · 3 controls

ISO/IEC 29147:2018 · 3 controls

ISO/IEC 30111:2019 · 3 controls

ISO/IEC 38500:2024 - Governance of IT · 3 controls

Illinois Biometric Information Privacy Act (BIPA) · 3 controls

MTCS (Singapore) · 3 controls

NIST SP 1800-32 · 3 controls

NIST SP 800-124 Revision 2 - Guidelines for Managing the Security of Mobile Devices · 3 controls

Nebraska Data Privacy Act · 3 controls

  • NDPA-1 Applicability, Scope, and Carve-Outs
  • NDPA-2 Consumer Rights - Access, Correct, Delete, Portability, Appeal
  • NDPA-5 Privacy Notice, Data Minimisation, and Purpose Limitation

Nigeria Data Protection Act 2023 (NDPA) · 3 controls

  • NG-NDPA-1 Scope, Applicability, and Establishment of Nigeria Data Protection Commission
  • NG-NDPA-2 Lawful Basis, Consent, and Data Protection Principles
  • NG-NDPA-5 Security of Processing, Breach Notification, and DPIA

O-RAN WG11 Security Specification · 3 controls

  • ORANWG11-2 O-RAN Interface Security: E2, A1, O1, O2, Open Fronthaul
  • ORANWG11-3 Cryptography, TLS, SSH, IPsec, and PKI Lifecycle Management
  • ORANWG11-6 Security Test Specifications, Certification, and Conformance

PCI P2PE · 3 controls

PCI PIN Security · 3 controls

PCI SSF · 3 controls

PIC/S Guide to Good Manufacturing Practice for Medicinal Products · 3 controls

  • PICSGMP-2 Chapter 2: Personnel - Qualified Personnel, Key Responsibilities, Training
  • PICSGMP-5 Chapter 5: Production Operations and Material Management
  • PICSGMP-7 Chapter 7: Outsourced Activities and Supplier Management

South Korea ISMS-P · 3 controls

Trinidad and Tobago Data Protection Act 2011 · 3 controls

UK Bribery Act 2010 · 3 controls

21 CFR Part 58 - Good Laboratory Practice (GLP) · 2 controls

AICPA Privacy Management Framework (PMF) · 2 controls

ASIS SPC.1-2009 - Organizational Resilience Standard · 2 controls

  • 4.4.1 Resources, Roles, Responsibility, and Authority
  • 4.4.8 Business Continuity and Recovery

Albania Law on Protection of Personal Data (Law No. 9887, 2008, amended 2014) · 2 controls

Austria Data Protection Act (Datenschutzgesetz, DSG, amended 2018) · 2 controls

  • AT-DSG-2 Section 2 - Scope and application
  • AT-DSG-8 Section 22 - Functions and powers of the DPA

Automotive SPICE (ASPICE) v4.0 - Process Assessment Model · 2 controls

  • MLE.1 Machine Learning Requirements Analysis
  • MLE.3 Machine Learning Training

Florida Digital Bill of Rights (FDBR) · 2 controls

  • FDBR-702 Definitions (§501.702)
  • FDBR-Scope-Defs Scope, Applicability Thresholds and Definitions (Fla. Stat. 501.701, 501.702, 501.703, 501.704)

ICH Q10 - Pharmaceutical Quality System · 2 controls

IEC 60601-1 - Medical Electrical Equipment Safety · 2 controls

ISMAP (Japan) · 2 controls

ISO 19011 · 2 controls

  • 6.5 Preparing and Distributing Audit Report
  • 6.7 Conducting Audit Follow-up

ISO 20400:2017 - Sustainable Procurement · 2 controls

ISO 27017 · 2 controls

ISO 27018 · 2 controls

ISO 27043 · 2 controls

ISO 28001:2007 Supply Chain Security Management · 2 controls

ISO 41001:2018 - Facility Management Systems · 2 controls

ISO 56002 · 2 controls

ISO 8000 - Data Quality · 2 controls

ISO/IEC 17025:2017 - General Requirements for Testing and Calibration · 2 controls

ISO/IEC 25012:2008 - Data Quality Model · 2 controls

ISO/SAE 21434 · 2 controls

Israel Protection of Privacy Law (5741-1981) · 2 controls

MITRE ATT&CK · 2 controls

Monetary Authority of Singapore Technology Risk Management Guidelines · 2 controls

NATO STANAG 4774 (Confidentiality Metadata Labels) and STANAG 4778 (Metadata Binding) · 2 controls

  • STANAG-1 STANAG 4774 Confidentiality Label Schema and XML Structure
  • STANAG-2 STANAG 4778 Metadata Binding Mechanism and Cryptographic Binding

NIST SP 800-115 (Technical Guide to Information Security Testing and Assessment) · 2 controls

  • NISTSP115-1 Scope, Methodology, and Assessment Planning
  • NISTSP115-8 Operational Considerations - Tools, Reporting Templates, ISMS Integration, Annex Material

NIST SP 800-123 · 2 controls

  • NISTSP123-5 Server Operations - Patching, Malware, Logging, Backup
  • NISTSP123-8 Governance, Policies, and ISMS Integration

NIST SP 800-137 · 2 controls

  • NISTSP137-1 ISCM Strategy, Governance, and Volatility Assessment
  • NISTSP137-7 Incident Response Integration and Ongoing Authorization

NIST SP 800-144 · 2 controls

  • NISTSP144-1 Cloud Governance, Risk Assessment, and Provider Trust Evaluation
  • NISTSP144-6 Availability, Resilience, BCP/DR, and SLA Management

NIST SP 800-145 · 2 controls

  • NISTSP145-3 Rapid Elasticity Characteristic and Capacity Management
  • NISTSP145-7 Cloud Procurement Standards Aligned to NIST SP 800-145 Definition

NIST SP 800-146 · 2 controls

  • NISTSP146-1 Cloud Adoption Strategy, Workload Suitability, and Decision Framework
  • NISTSP146-7 Service Level, Performance, Reliability, Interoperability, and Portability

NIST SP 800-190 · 2 controls

NIST SP 800-53 Rev 5 · 2 controls

NIST SP 800-61 · 2 controls

  • NISTSP61-2 Computer Security Incident Response Team (CSIRT) Structure and Staffing
  • NISTSP61-5 Containment, Eradication, and Recovery

NIST SP 800-63-4 · 2 controls

  • NISTSP63R4-1 Digital Identity Risk Management and IAL/AAL/FAL Assurance Level Selection
  • NISTSP63R4-4 Authenticator Lifecycle: Binding, Recovery, Replacement, Suspension, Revocation

NIST SP 800-82 Revision 3: Guide to Industrial Control Systems (ICS) Security · 2 controls

  • NISTSP82-1 OT Security Program Governance, Policy, Roles, and Safety-Security Integration
  • NISTSP82-7 OT Incident Response, Forensics, Recovery, and Continuity

NIST SP 800-88 · 2 controls

  • NISTSP88-1 Media Sanitization Policy, Roles, and Decision Framework
  • NISTSP88-5 Media Inventory, Tracking, Chain of Custody, and Sanitization Records

NIST SP 800-92 · 2 controls

  • NISTSP92-1 Log Management Programme, Policy, Roles, and Operational Runbooks
  • NISTSP92-6 Log Retention: Policy, Tiered Storage, Backup, Secure Disposal, Legal Hold

OSFI B-13 · 2 controls

  • OSFIB13-1 Governance, Risk Management, and Three Lines of Defense
  • OSFIB13-3 Cyber Security: Identification, Protection, Detection, Response, Recovery

OWASP MASVS · 2 controls

  • OWASPMASVS-7 MASVS-RESILIENCE: Resilience Against Reverse Engineering
  • OWASPMASVS-8 MASVS-PRIVACY: Privacy and Data Protection

OWASP SAMM · 2 controls

  • OWASPSAMM-1 Governance: Strategy, Policy, Compliance, Education, Champions
  • OWASPSAMM-5 Operations: Incident Management, Environment Management, Operational Management

Open Banking Security · 2 controls

  • OPENBANK-2 Strong Customer Authentication (SCA), Consent Lifecycle, and Customer UX
  • OPENBANK-8 Incident Detection, Response, Customer Notification, Post-Incident Review, BCM

OpenSSF Scorecard · 2 controls

  • OSSFSC-1 Branch Protection, Code Review, and Repository Governance
  • OSSFSC-8 Project Maintenance, Sustainability, Integration with Supply Chain Security

PSD2 SCA · 2 controls

  • PSDTWO-1 Strong Customer Authentication (SCA) Core Requirements
  • PSDTWO-2 SCA Exemptions and Risk-Based Authentication

PTES · 2 controls

SIG (Shared Assessments) · 2 controls

SLSA · 2 controls

  • SUPCHAIN-1 Build Integrity - Source, Build, Provenance
  • SUPCHAIN-2 Source Integrity - Branch Protection, Code Review, Two-Person Rule

Science Based Targets Initiative (SBTi) - Net-Zero Standard · 2 controls

  • C1 Organizational Boundary
  • C3 Scope 1 and 2 Coverage

Tanzania Personal Data Protection Act (Draft) · 2 controls

UK Gambling Commission - Cyber Resilience Requirements · 2 controls

US SEC Digital Assets and Crypto Regulatory Framework · 2 controls

21 CFR Part 211 - Current Good Manufacturing Practice · 1 control

APRA CPS 230 Operational Risk Management · 1 control

  • CPS230-26 Critical Operations Register, Continuity Plan and Activation

AWWA Cybersecurity Guidance for the Water Sector (American Water Works Association) · 1 control

Azerbaijan Law on Personal Data (2010) · 1 control

BS 65000:2014 - Guidance on Organizational Resilience · 1 control

Barbados Data Protection Act 2019 · 1 control

CISA Cross-Sector Cybersecurity Performance Goals (CPG) 2.0 · 1 control

  • CPG-6.B Supply Chain Incident Reporting

COBIT 2019 · 1 control

FDA Quality Management System Regulation (QMSR) · 1 control

  • QMSR-ISO13485-Sec5 Management responsibility (ISO 13485:2016 Section 5 - incorporated via §820.10)

FTC GLBA Safeguards Rule (16 CFR Part 314) · 1 control

FedRAMP High · 1 control

  • CA-9 Internal System Connections

FedRAMP Moderate · 1 control

  • CA-9 Internal System Connections

French Sapin II Law (Law No. 2016-1691) · 1 control

IAIS Insurance Core Principles (ICPs) · 1 control

  • ICP-1 Objectives, Powers and Responsibilities of the Supervisor

IATA Operational Safety Audit (IOSA) Standards Manual · 1 control

IEC 62351 - Power Systems Communication Security · 1 control

ISO 14064 - Greenhouse Gas Accounting and Verification (Parts 1-3) · 1 control

ISO 26262:2018 - Functional Safety for Road Vehicles · 1 control

ISO 31000:2018 · 1 control

  • 6.7 Conducting Audit Follow-up

ISO/IEC 27003:2017 · 1 control

ISO/IEC 27007:2020 · 1 control

ISO/IEC 27010:2015 · 1 control

ISO/IEC 27050 - Electronic Discovery (Parts 1-4) · 1 control

ISO/IEC 29115:2023 - Entity Authentication Assurance Framework · 1 control

ITAR - International Traffic in Arms Regulations · 1 control

ITU Radio Regulations and Space Security Standards · 1 control

Japan FSA Cybersecurity Guidelines for Financial Institutions · 1 control

Kuwait National Cybersecurity Framework · 1 control

NABERS - National Australian Built Environment Rating System · 1 control

  • NABERS-3 NABERS Water Performance Rating

NAIC Insurance Data Security Model Law (MDL-668) · 1 control

  • NAIC-5 Third Party Service Provider Oversight - Section 4(F)(3) and Section 5

NERC CIP · 1 control

  • NERCCIP-6 Incident Reporting and Response Planning + Recovery Plans (CIP-008 + CIP-009)

NIS2 Directive Implementing Acts · 1 control

  • NIS2I-3 Incident Handling Policy, Reporting Significance Criteria, and Business Continuity

NIST Privacy Framework · 1 control

  • NISTPF-8 Protect-P Information Protection Processes (PR.PO-P)

NIST SP 800-53 Rev 5 LOW · 1 control

  • CA-9 Internal System Connections

NIST SP 800-53 Rev 5 MODERATE · 1 control

  • CA-9 Internal System Connections

NIST SP 800-53 Revision 5.1 HIGH · 1 control

  • CA-9 Internal System Connections

Nevada Gaming Control Board Cybersecurity Requirements · 1 control

  • NGCB-6 Incident Response, 72-Hour NGCB Notification, and Independent Investigation

Notifiable Data Breaches Scheme (Australia) · 1 control

  • AUNDB-A3 Eligible Data Breach Determination and Serious Harm Threshold

Oman National Cybersecurity Framework · 1 control

  • OMANCS-7 Business Continuity, Disaster Recovery, and Resilience

PCI DSS 4.0 · 1 control

  • 2.2.2 Vendor default accounts are managed as follows: • If the vendor default account(s) will be used, the default password is changed per Requirement 8.3.6. • If the vendor default account(s) will not be used,

Philippines Cybercrime Prevention Act (RA 10175) · 1 control

  • PHILCC-1 Computer Crime Offences (Illegal Access, Interference, Misuse of Devices)

Regional Comprehensive Economic Partnership (RCEP) - E-Commerce Chapter · 1 control

  • RCEPEC-1 Online Personal Information Protection (12.13)

Rhode Island Data Transparency and Privacy Protection Act (RIDTPPA) · 1 control

SOC for Cybersecurity - Cybersecurity Risk Management Examination · 1 control

Singapore Cybersecurity Act 2018 · 1 control

  • SCA-S2 Interpretation and Definitions

South Korea Korea Internet Self-Governance Organisation (KISO) Code of Ethics · 1 control

South Korea PIPA · 1 control

Sweden Data Protection Act (Dataskyddslag, 2018:218) · 1 control

  • SWE-2 Relationship to GDPR

Switzerland New Federal Act on Data Protection (nFADP/nDSG, 2023) · 1 control

  • FADP-5 Definitions (Article 5)

TISAX - Trusted Information Security Assessment Exchange · 1 control

TSA Pipeline Cybersecurity Directives · 1 control

  • TSAPIPE-2 OT/IT Network Segmentation and Access Control

UK Defence Standard 05-138 - Cyber Security for Defence Suppliers · 1 control

  • D.3 Backup and Recovery

UK GDPR (UK General Data Protection Regulation) · 1 control

  • UKGDPRREG-1 Subject Matter, Scope, Principles (Articles 1-11)

UK Open Banking Standard · 1 control

UK Security and Emergency Measures Direction (SEMD) - Water Industry · 1 control

UK Telecommunications (Security) Act 2021 · 1 control

US Foreign Corrupt Practices Act (FCPA) · 1 control

US Maritime Transportation Security Act (MTSA) and USCG Cybersecurity Requirements · 1 control

  • CYB-5 Cyber Incident Response Plan

WCAG 2.2 · 1 control

WHO Global Strategy on Digital Health 2020-2025 · 1 control

  • SO2.2 Digital health architecture blueprint

Every mapping shown was judged rather than inferred from wording similarity, and the ones that failed review are published too. See the coverage reports and what was rejected.

Other controls in Resilience and Incident Response

Query this from an agent

The graph holds this control, the 419 it maps to, and the evidence behind each claim, over MCP and REST.

MCP endpointAll Singapore Government Instruction Manual on ICT&SS Management (IM8) controls