NIST CSF: PR.IP-9 Subcategory

From NIST's Cyber Security Framework (version 1):

Response plans (Incident Response and Business Continuity) and recovery plans (Incident Recovery and Disaster Recovery) are in place and managed

Cyber Threat Graph Context

Explore how this control relates to the wider threat graph

CSF Mapped to SP800-53 Controls

Generated from NIST's SP800-53/CSF Crosswalk mappings.

Node
IR-8: Incident Response Plan
CP-2: Contingency Plan
PE-17: Alternate Work Site
IR-7: Incident Response Assistance
CP-7: Alternate Processing Site
CP-13: Alternative Security Mechanisms
CP-12: Safe Mode
IR-9: Information Spillage Response

Related ISO 27001 Controls

Annex A controls from ISO 27001 (2013) which are related to this CSF subcategory, taken from mappings by NIST and additional data from Ofgem.

  • Verify, review, and evaluate information security continuity (17.1.3)
    ISO 27001:2013
  • Planning information security continuity (17.1.1)
    ISO 27001:2013
  • Responsibilities and procedures (16.1.1)
    ISO 27001:2013
  • Implementing information security continuity (17.1.2)
    ISO 27001:2013

Related ISA/IEC 62443 Controls

Clauses and controls from IEC 62443 (62443-2-1 and 62443-3-3) which are related to this CSF subcategory, taken from mappings by NIST and additional data from Ofgem.

  • Develop and implement business continuity plans (4.3.2.5.3)
    ISA/IEC 62443-2-1:2009
  • Implement an incident response plan (4.3.4.5.1)
    ISA/IEC 62443-2-1:2009

MITRE ATT&CK Techniques

See which MITRE ATT&CK techniques this control helps to protect against. This is based on mappings to associated SP800-53 controls.

ATT&CK ID Title Associated Tactics
T1561 Disk Wipe Impact
T1561.001 Disk Content Wipe Impact
T1486 Data Encrypted for Impact Impact
T1490 Inhibit System Recovery Impact
T1491.001 Internal Defacement Impact
T1485 Data Destruction Impact
T1561.002 Disk Structure Wipe Impact
T1491.002 External Defacement Impact
T1491 Defacement Impact
T1565 Data Manipulation Impact
T1070 Indicator Removal Defense Evasion
T1070.008 Clear Mailbox Data Defense Evasion
T1070.001 Clear Windows Event Logs Defense Evasion
T1565.001 Stored Data Manipulation Impact
T1119 Automated Collection Collection
T1070.002 Clear Linux or Mac System Logs Defense Evasion

CSF Mapped to the NCSC CAF

Cyber Assessment Framework mappings generated from UK Cabinet Office data.

Control ID Name Description
B5.a Resilience Preparation You are prepared to restore the operation of your essential function following adverse impact.
D1.b Response and Recovery Capability You have the capability to enact your incident response plan, including effective limitation of impact on the operation of your essential function. During an incident, you have access to timely information on which to base your response decisions.
D1.a Response Plan You have an up-to-date incident response plan that is grounded in a thorough risk assessment that takes account of your essential function and covers a range of incident scenarios.