UK Security and Emergency Measures Direction (SEMD) - Water Industry
Emergency Response and Customer Protection

UK Security and Emergency Measures Direction (SEMD) - Water Industry SEMD-ER-1: Emergency Exercise and Testing

Companies must carry out regular testing and exercising with Local Resilience Forum partners and other agencies.

Maintained by Gerard BlokdykVerified against the published standard Control text last updated

What else in your programme already covers this

This control maps to 71 controls across 30 other frameworks. If you already hold one of them, the evidence you collected for it is the starting point here rather than new work.

ASIS SPC.1-2009 - Organizational Resilience Standard · 3 controls

  • 4.3.2 Legal and Other Requirements
  • 4.4.1 Resources, Roles, Responsibility, and Authority
  • 4.4.2 Competence, Training, and Awareness

FFIEC IT Examination Handbook · 3 controls

  • FFIEC-11 Business continuity planning and testing
  • FFIEC-12 Disaster recovery procedures
  • FFIEC-14 Critical service identification

NIST Cybersecurity Framework 2.0 · 3 controls

  • NIST-CSF-PR.DS-10 The confidentiality, integrity, and availability of data-in-use are protected
  • NIST-CSF-PR.IR-03 Mechanisms are implemented to achieve resilience requirements in normal and adverse situations
  • NIST-CSF-PR.IR-04 Adequate resource capacity to ensure availability is maintained

PCI P2PE · 3 controls

PCI PIN Security · 3 controls

PCI SSF · 3 controls

SOC 2 · 3 controls

  • SOC2-A1.1 Maintains capacity to meet availability commitments
  • SOC2-A1.2 Environmental protections, data backups, and recovery infrastructure support availability
  • SOC2-A1.3 Recovery plan procedures support system recovery from failures

Singapore Government Instruction Manual on ICT&SS Management (IM8) · 3 controls

APRA CPS 234 · 2 controls

  • CPS234-14 Definition of Information Security Roles and Responsibilities
  • CPS234-15 Information Security Capability

IEC 62351 - Power Systems Communication Security · 2 controls

  • 62351-12 Resilience and security recommendations for DER
  • 62351-13 Cyber-physical generation and storage resilience

ISO/IEC 27031:2011 · 2 controls

Security of Critical Infrastructure Act 2018 (SOCI) · 2 controls

  • SOCI-S30BC Notification of critical cyber security incidents (12 hours)
  • SOCI-S30BD Notification of other cyber security incidents (72 hours)

UK Open Banking Standard · 2 controls

ASD Strategies to Mitigate Cyber Security Incidents · 1 control

  • ASD37-20 Multi-factor authentication (Essential)

BS 65000:2014 - Guidance on Organizational Resilience · 1 control

COBIT 2019 · 1 control

DAMA-DMBOK2 - Data Management Body of Knowledge (2nd Edition) · 1 control

  • RMD-1 Reference Data Management

FFIEC Cybersecurity Assessment Tool (CAT) · 1 control

  • CAT-D5-4 Resilience planning and testing

ISO 20000-1 · 1 control

ISO/IEC 25012:2008 - Data Quality Model · 1 control

ISO/IEC 27007:2020 · 1 control

  • 27007-5.4 Establishing the Programme Resources

ISO/IEC 38500:2024 - Governance of IT · 1 control

ITIL 4 · 1 control

  • ITIL4-03 Capacity and availability management

ITU-T X.805 - Security Architecture for End-to-End Communications · 1 control

SASB Standards · 1 control

SOC for Cybersecurity - Cybersecurity Risk Management Examination · 1 control

SSAE 18 - Attestation Standards (SOC Reporting) · 1 control

  • SSAE18-A1.1 A1.1 - Availability Commitments and Requirements

UK AI Regulation Framework · 1 control

  • UKAI-3 Bias Detection, Fairness, Validation

UK FCA/PRA Operational Resilience Framework · 1 control

  • UKOPRES-5 Third-Party Risk, Concentration Risk

US EPA Safe Drinking Water Act (SDWA) - Cybersecurity Requirements · 1 control

  • CERT-1 RRA Certification to EPA

Every mapping shown was judged rather than inferred from wording similarity, and the ones that failed review are published too. See the coverage reports and what was rejected.

Other controls in Emergency Response and Customer Protection

Query this from an agent

The graph holds this control, the 71 it maps to, and the evidence behind each claim, over MCP and REST.

MCP endpointAll UK Security and Emergency Measures Direction (SEMD) - Water Industry controls