SekitCrosswalk
ENES
Start now
NIST CSF 2.0 · derived mapping target

ID.IM-04Response and recovery plans maintained

Create, communicate, maintain, and improve your incident response and other plans that affect operations, so they work when you need them.

Mapping at a glance
ID.IM-04Response and recovery plans maintainedNIST CSF 2.0
RCF-0022Internal auditGovernance & Risk · PolicyRCF-0023Internal auditGovernance & Risk · ProcessRCF-0024Internal auditGovernance & Risk · TechnicalRCF-0034Issues managementGovernance & Risk · PolicyRCF-0035Issues managementGovernance & Risk · Process

ID.IM-04 is covered by 18 Sekit CSF controls. +13 more in the table below. Open in the full graph →

Mapped from the Sekit CSF

The Sekit controls that cover this requirement, lens by lens.

RCF-0022Internal audit · PolicyRCF-0023Internal audit · ProcessRCF-0024Internal audit · TechnicalRCF-0034Issues management · PolicyRCF-0035Issues management · ProcessRCF-0036Issues management · TechnicalRCF-0373Control evidence management · PolicyRCF-0374Control evidence management · ProcessRCF-0375Control evidence management · TechnicalRCF-0382Audit readiness · PolicyRCF-0383Audit readiness · ProcessRCF-0384Audit readiness · TechnicalRCF-0385Corrective action tracking · PolicyRCF-0386Corrective action tracking · ProcessRCF-0387Corrective action tracking · TechnicalRCF-0415Problem management · PolicyRCF-0416Problem management · ProcessRCF-0417Problem management · Technical

ISO/IEC 27001:2022 counterparts

Reached through the Sekit CSF controls both map to — a mapping, not a formal equivalence.

A.5.36 Compliance with policies, rules and standards for information securityA.8.15 LoggingA.5.27 Learning from information security incidentsA.5.35 Independent review of information securityA.5.33 Protection of recordsA.8.16 Monitoring activitiesA.5.25 Assessment and decision on information security eventsA.5.24 Information security incident management planning and preparationA.5.26 Response to information security incidentsA.5.37 Documented operating proceduresA.5.28 Collection of evidenceA.8.34 Protection of information systems during audit testing

ISO/IEC 42001:2023 — Annex A counterparts

A.5.3 Documentation of AI system impact assessmentsA.6.2.3 Documentation of AI system design and developmentA.3.3 Reporting of concernsA.6.2.7 AI system technical documentationA.8.2 System documentation and information for users

Evidence that proves this control

What an auditor, or Sekit's evidence engine, asks for.

Disaster recovery plan and runbooks
The plan defining how long each critical system can be down (RTO/RPO) and the step-by-step guides to recover it after a serious failure.
Business continuity plan
The plan describing how the company keeps operating during a major disruption: impact analysis, critical functions, and crisis management.
Incident response plan
The plan defining how the company acts when a security incident occurs: who does what, who is notified, and within what timeframes.
From the Sekit evidence catalog

Related controls

Via the shared Sekit CSF topic, not the framework's own index.

GV.RM-05 Lines of communication for risk establishedGV.RM-06 Standardized risk method establishedGV.RM-07 Strategic opportunities characterizedID.IM-03 Improvements from operationsRS.AN-07 Incident data preservedRS.MA-04 Incidents escalated
Ask Sekura: “What evidence proves ID.IM-04?”
Also via MCP, free with account