SekitCrosswalk
ENES
Start now
NIST CSF 2.0 · derived mapping target

PR.IR-04Adequate capacity maintained

Maintain enough resource capacity to keep systems and services available, so demand spikes or attacks do not exhaust your infrastructure.

Mapping at a glance
PR.IR-04Adequate capacity maintainedNIST CSF 2.0
RCF-0238Backup policyBackup & Recovery · PolicyRCF-0239Backup policyBackup & Recovery · ProcessRCF-0240Backup policyBackup & Recovery · TechnicalRCF-0241Immutable/offsite backupsBackup & Recovery · PolicyRCF-0242Immutable/offsite backupsBackup & Recovery · Process

PR.IR-04 is covered by 42 Sekit CSF controls. +37 more in the table below. Open in the full graph →

Mapped from the Sekit CSF

The Sekit controls that cover this requirement, lens by lens.

RCF-0238Backup policy · PolicyRCF-0239Backup policy · ProcessRCF-0240Backup policy · TechnicalRCF-0241Immutable/offsite backups · PolicyRCF-0242Immutable/offsite backups · ProcessRCF-0243Immutable/offsite backups · TechnicalRCF-0244Backup coverage · PolicyRCF-0245Backup coverage · ProcessRCF-0246Backup coverage · TechnicalRCF-0247Restore testing · PolicyRCF-0248Restore testing · ProcessRCF-0249Restore testing · TechnicalRCF-0250RTO/RPO definitions · PolicyRCF-0251RTO/RPO definitions · ProcessRCF-0252RTO/RPO definitions · TechnicalRCF-0253DR exercises · PolicyRCF-0254DR exercises · ProcessRCF-0255DR exercises · TechnicalRCF-0280Business impact analysis · PolicyRCF-0281Business impact analysis · ProcessRCF-0282Business impact analysis · TechnicalRCF-0283Continuity plans · PolicyRCF-0284Continuity plans · ProcessRCF-0285Continuity plans · TechnicalRCF-0289Alternate work sites · PolicyRCF-0290Alternate work sites · ProcessRCF-0291Alternate work sites · TechnicalRCF-0292BCP exercises · PolicyRCF-0293BCP exercises · ProcessRCF-0294BCP exercises · TechnicalRCF-0295Supply chain continuity · PolicyRCF-0296Supply chain continuity · ProcessRCF-0297Supply chain continuity · TechnicalRCF-0406SRE/Resilience practices · PolicyRCF-0407SRE/Resilience practices · ProcessRCF-0408SRE/Resilience practices · TechnicalRCF-0409Availability management · PolicyRCF-0410Availability management · ProcessRCF-0411Availability management · TechnicalRCF-0412Capacity & performance mgmt · PolicyRCF-0413Capacity & performance mgmt · ProcessRCF-0414Capacity & performance mgmt · Technical

ISO/IEC 27001:2022 counterparts

Reached through the Sekit CSF controls both map to — a mapping, not a formal equivalence.

A.5.30 ICT readiness for business continuityA.8.13 Information backupA.5.29 Information security during disruptionA.8.14 Redundancy of information processing facilitiesA.8.16 Monitoring activitiesA.8.6 Capacity managementA.5.1 Policies for information securityA.5.22 Monitoring, review and change management of supplier servicesA.5.37 Documented operating proceduresA.5.19 Information security in supplier relationshipsA.5.21 Managing information security in the ICT supply chainA.8.15 LoggingA.5.36 Compliance with policies, rules and standards for information securityA.8.24 Use of cryptographyA.5.27 Learning from information security incidentsA.6.7 Remote working

Cyber Essentials counterparts

CE4.3 Require multi-factor authenticationCE1.3 Block unauthenticated inbound trafficCE1.2 Protect the administrative interface

Evidence that proves this control

What an auditor, or Sekit's evidence engine, asks for.

Availability and capacity management
How the company ensures its critical services are available as expected, plans their capacity, and prevents problems from recurring.
From the Sekit evidence catalog

Related controls

Via the shared Sekit CSF topic, not the framework's own index.

GV.SC-07 Supplier risk managed over relationshipPR.DS-10 Data-in-use protectedPR.IR-03 Resilience mechanisms implementedRC.RP-01 Recovery plan executedRC.RP-02 Recovery actions performed
Ask Sekura: “What evidence proves PR.IR-04?”
Also via MCP, free with account