RES-01 · Resilience and Response
Incident response plan and roles
An incident response plan exists, names roles, and is exercised.
6frameworks fully address it
2partially
0leave it out
SOC 2 ISO 27001 NIST CSF PCI DSS HIPAA GDPR EU AI Act NIST AI RMF
1Where each framework asks for it
- SOC 2FullCC7.4
- ISO 27001FullA.5.24
- NIST CSFFullRS.MA-01
- PCI DSSFull12.10.1
- HIPAAFull164.308(a)(6)
- GDPRPartialArt. 33 Notification duty implies a process.
- EU AI ActPartialArt. 73 Serious incident reporting for providers.
- NIST AI RMFFullMANAGE 4.3
Build the control once against this objective and cite the clause each auditor asks about. A partial mapping says what the framework leaves out; an absence is a finding about the framework, not a gap in your program.
2What usually proves it
Plan document, exercise records, contact tree.
?Why it exists
Plans nobody has rehearsed fail in the first hour.
For a smaller organizationA two-page plan and one tabletop a year.