Singapore Government Instruction Manual on ICT&SS Management (IM8)
Resilience and Incident Response

Singapore Government Instruction Manual on ICT&SS Management (IM8) RES.3: Incident Response

Agencies must implement incident response procedures to detect, contain, and recover from cybersecurity incidents.

Maintained by Gerard BlokdykVerified against the published standard Control text last updated

What else in your programme already covers this

This control maps to 225 controls across 113 other frameworks. If you already hold one of them, the evidence you collected for it is the starting point here rather than new work.

Nebraska Data Privacy Act · 4 controls

  • NDPA-1 Applicability, Scope, and Carve-Outs
  • NDPA-2 Consumer Rights - Access, Correct, Delete, Portability, Appeal
  • NDPA-5 Privacy Notice, Data Minimisation, and Purpose Limitation
  • NDPA-6 Reasonable Security Practices and Incident Response

Nigeria Data Protection Act 2023 (NDPA) · 4 controls

  • NG-NDPA-1 Scope, Applicability, and Establishment of Nigeria Data Protection Commission
  • NG-NDPA-2 Lawful Basis, Consent, and Data Protection Principles
  • NG-NDPA-5 Security of Processing, Breach Notification, and DPIA
  • NG-NDPA-6 Data Protection Officer, DPCO, and Processor Agreements

API 1164 · 3 controls

BSI IT-Grundschutz · 3 controls

  • BSI-18 Incident response planning and testing
  • BSI-20 Incident reporting and notification
  • BSI-21 Forensic analysis capabilities

EASA Part-IS - Information Security in Aviation · 3 controls

FFIEC IT Examination Handbook · 3 controls

  • FFIEC-23 Regulatory reporting requirements
  • FFIEC-24 Customer notification procedures
  • FFIEC-25 Post-incident review and improvement

IEC 62443 · 3 controls

ISO 22320:2018 · 3 controls

ISO 27019 · 3 controls

NIST Cybersecurity Framework 2.0 · 3 controls

  • NIST-CSF-ID.IM-04 Incident response plans and other cybersecurity plans that affect operations are established, communicated, maintained, and improved
  • NIST-CSF-RC.RP-01 The recovery portion of the incident response plan is executed once initiated from the incident response process
  • NIST-CSF-RS.MA-01 The incident response plan is executed in coordination with relevant third parties once an incident is declared

NIST SP 1800-32 · 3 controls

NIST SP 800-53 Rev 5 · 3 controls

OSFI B-13 · 3 controls

  • OSFIB13-3 Cyber Security: Identification, Protection, Detection, Response, Recovery
  • OSFIB13-7 Incident Reporting to OSFI and Regulatory Coordination
  • OSFIB13-8 Metrics, Monitoring, Continuous Improvement, Maturity

PCI P2PE · 3 controls

PCI PIN Security · 3 controls

PCI SSF · 3 controls

SANS Incident Handler's Handbook and PICERL Methodology · 3 controls

Security of Critical Infrastructure Act 2018 (SOCI) · 3 controls

Switzerland New Federal Act on Data Protection (nFADP/nDSG, 2023) · 3 controls

APPI · 2 controls

  • APPI-A41 Preparation and Handling of Pseudonymized Personal Information
  • APPI-A43 Preparation of Anonymized Personal Information

APRA CPS 234 · 2 controls

  • CPS234-21 Implementation of Information Security Controls
  • CPS234-25 Internal Audit Review of Information Security Controls

ASD Strategies to Mitigate Cyber Security Incidents · 2 controls

  • ASD37-31 Hunt to discover incidents (Very Good)
  • ASD37-33 Capture network traffic (Limited)

Bahrain PDPL · 2 controls

Federal Decree-Law No. 45 of 2021 on the Protection of Personal Data (UAE PDPL) · 2 controls

ISO/IEC 30111:2019 · 2 controls

Jamaica Data Protection Act 2020 · 2 controls

Kentucky Consumer Data Protection Act · 2 controls

MTCS (Singapore) · 2 controls

Malaysia PDPA 2010 · 2 controls

Maryland Online Data Privacy Act of 2024 · 2 controls

New Jersey Data Privacy Act · 2 controls

  • NJDPA-2 Consumer Rights - Access, Correct, Delete, Portability, Appeal
  • NJDPA-6 Reasonable Data Security and Incident Response

Open Banking Security · 2 controls

  • OPENBANK-7 Logging, Monitoring, Regulatory Reporting, SLA, Availability
  • OPENBANK-8 Incident Detection, Response, Customer Notification, Post-Incident Review, BCM

PSD2 SCA · 2 controls

  • PSDTWO-3 Common and Secure Communication, API Access for AISPs and PISPs
  • PSDTWO-4 Fraud Reporting and Incident Management

Peru DPL · 2 controls

  • PERU-7 DPO, Records, Retention, Marketing, Training
  • PERU-8 Breach Notification, ANPD Cooperation, Sanctions, Compliance

Qatar DPL · 2 controls

  • QATAR-5 Security of Processing
  • QATAR-8 Breach Notification, Compliance, Enforcement

SOC 2 · 2 controls

  • SOC2-CC7.4 Responds to identified security incidents through defined procedures
  • SOC2-CC7.5 Identifies the root cause of security incidents

SSAE 18 - Attestation Standards (SOC Reporting) · 2 controls

Saudi Arabia PDPL · 2 controls

South Korea PIPA · 2 controls

UK Defence Standard 05-138 - Cyber Security for Defence Suppliers · 2 controls

  • D.1 Incident Response Planning
  • D.2 Incident Reporting

AICPA Privacy Management Framework (PMF) · 1 control

  • PMF-M.4 Privacy Incident Management

APRA CPS 230 Operational Risk Management · 1 control

  • CPS230-13 Board Accountability for Operational Risk Management

ASIS SPC.1-2009 - Organizational Resilience Standard · 1 control

  • 4.4.7 Emergency and Incident Response

Annex 11 to EU GMP - Computerised Systems · 1 control

Barbados Data Protection Act 2019 · 1 control

  • BB-DPA-20 Sections 50-60 - Registration and Responsibilities

COSO Internal Control - Integrated Framework (2013) · 1 control

  • CA-12 Deploys Through Policies and Procedures

Canada ITSG-33 - IT Security Risk Management · 1 control

FFIEC Cybersecurity Assessment Tool (CAT) · 1 control

FTC GLBA Safeguards Rule (16 CFR Part 314) · 1 control

IAEA Nuclear Security Series - Computer Security at Nuclear Facilities (NSS-17-T Rev 1) · 1 control

ISMAP (Japan) · 1 control

ISO 20000-1 · 1 control

ISO 27017 · 1 control

ISO 27018 · 1 control

ISO 28001:2007 Supply Chain Security Management · 1 control

ISO/IEC 27010:2015 · 1 control

ISO/IEC 27400:2022 · 1 control

  • 27400-6.5 Security monitoring and incident response

ISO/IEC 29147:2018 · 1 control

ITIL 4 · 1 control

Iceland Data Protection and Processing of Personal Data Act (Act No. 90/2018) · 1 control

Indiana Consumer Data Protection Act · 1 control

Japan FSA Cybersecurity Guidelines for Financial Institutions · 1 control

LGPD · 1 control

Laos Law on Prevention and Combating Cybercrime (2015) · 1 control

Liechtenstein DPA · 1 control

Mauritius DPA · 1 control

Mexico LFPDPPP · 1 control

Minnesota Consumer Data Privacy Act · 1 control

Monetary Authority of Singapore Technology Risk Management Guidelines · 1 control

Montana Consumer Data Privacy Act · 1 control

NERC CIP · 1 control

  • NERCCIP-6 Incident Reporting and Response Planning + Recovery Plans (CIP-008 + CIP-009)

NFPA 1600 - Standard on Continuity, Emergency, and Crisis Management · 1 control

NIS2 Directive Implementing Acts · 1 control

  • NIS2I-3 Incident Handling Policy, Reporting Significance Criteria, and Business Continuity

NIST SP 800-122 · 1 control

NIST SP 800-124 Revision 2 - Guidelines for Managing the Security of Mobile Devices · 1 control

NIST SP 800-144 · 1 control

  • NISTSP144-8 Monitoring, Incident Response, Exit Strategy, and Compliance

NIST SP 800-145 · 1 control

  • NISTSP145-8 Governance, Reporting, and Stakeholder Education on Cloud Definition

NIST SP 800-146 · 1 control

NIST SP 800-190 · 1 control

NIST SP 800-82 Revision 3: Guide to Industrial Control Systems (ICS) Security · 1 control

  • NISTSP82-7 OT Incident Response, Forensics, Recovery, and Continuity

NRC 10 CFR 73.54 - Nuclear Facility Cybersecurity · 1 control

NRF Cybersecurity and Data Privacy Framework (National Retail Federation) · 1 control

  • NRFCS-7 Detection, Logging, Incident Response, Breach Notification, and Fraud Detection

Nevada Gaming Control Board Cybersecurity Requirements · 1 control

  • NGCB-6 Incident Response, 72-Hour NGCB Notification, and Independent Investigation

New Hampshire Data Privacy Act · 1 control

  • NHPA-6 Reasonable Data Security and Breach Response

Nigeria Data Protection Regulation (NDPR) · 1 control

  • NGNDPR-5 Security of Personal Data, Breach Notification, and DPIA under NDPR Section 2.6-Security

Nigeria Open Banking Regulatory Framework (CBN, 2023) · 1 control

  • NGOB-5 Fraud Monitoring, Incident Notification, and Reporting to CBN

Oman National Cybersecurity Framework · 1 control

  • OMANCS-6 Security Monitoring, Detection, Incident Response, and OmanCERT Notification

Oregon Consumer Privacy Act · 1 control

  • OREGONCPA-3 Consent, Sensitive Data, Children and Teen Protections

PAS 1192-5:2015 - Security-Minded Approach to BIM and Digital Built Environments · 1 control

  • PASONE-6 Incident Management, Audit, Handover, Operational Phase, Decommissioning

PDPA Singapore · 1 control

  • PDPASG-8 Data Breach Notification, Incident Response, and Enforcement

PDPA Thailand · 1 control

  • PDPATH-8 Data Breach Notification, Complaints, Compliance, Enforcement

POPIA · 1 control

  • POPIASA-5 Security Safeguards, Encryption, Access Control, Operator Obligations

Papua New Guinea National Cybersecurity Policy & Cybercrime Act (2016) · 1 control

  • PNGCYBER-4 Incident Response, Investigation, Evidence Preservation, Data Retention

Personal Data Act (personopplysningsloven) · 1 control

  • NORWAY-8 Breach Notification, Complaints, Compliance, Enforcement

Privacy Act 2020 · 1 control

  • NZPRV-7 Notifiable Privacy Breach Scheme

SOC for Cybersecurity - Cybersecurity Risk Management Examination · 1 control

South Korea ISMS-P · 1 control

TISAX - Trusted Information Security Assessment Exchange · 1 control

TSA Pipeline Cybersecurity Directives · 1 control

  • TSAPIPE-2 OT/IT Network Segmentation and Access Control

Taiwan PDPA · 1 control

Tanzania Personal Data Protection Act (Draft) · 1 control

Telecommunications Sector Security Reforms (TSSR) · 1 control

Texas Data Privacy Act · 1 control

Trinidad and Tobago Data Protection Act 2011 · 1 control

Turkey KVKK · 1 control

UK GDPR (UK General Data Protection Regulation) · 1 control

UK Gambling Commission - Cyber Resilience Requirements · 1 control

UK Open Banking Standard · 1 control

UK Telecommunications (Security) Act 2021 · 1 control

US Maritime Transportation Security Act (MTSA) and USCG Cybersecurity Requirements · 1 control

  • CYB-5 Cyber Incident Response Plan

Uruguay DPL · 1 control

Vietnam PDPD · 1 control

Virginia CDPA · 1 control

Every mapping shown was judged rather than inferred from wording similarity, and the ones that failed review are published too. See the coverage reports and what was rejected.

Other controls in Resilience and Incident Response

Query this from an agent

The graph holds this control, the 225 it maps to, and the evidence behind each claim, over MCP and REST.

MCP endpointAll Singapore Government Instruction Manual on ICT&SS Management (IM8) controls