← HIPAA · Administrative safeguards

164.308(a)(6)(ii) — Response and reporting (R)

critical incident-responsebreach-notification

Requirement

Identify and respond to suspected or known security incidents; mitigate, to the extent practicable, harmful effects of security incidents that are known to the entity; and document security incidents and their outcomes.

What the engine looks for

Every group below must be satisfied — by an affirmative statement, not a plan, a hedge or a denial — for the control to count as covered. A term ending in … matches any word it begins. Supporting terms do not change the verdict — they raise confidence and distinguish a policy that names a mechanism from one that gestures at a category.

Required element 1 — any one of

security incidentincident responseincident management

Required element 2 — any one of

respondmitigat…documentreportdocumentation

Supporting terms — specificity signals

log of incidentsoutcomeroot causeescalationwho to contactplan

Contradiction markers

Finding any of these outranks coverage — a policy that admits the gap is worse than silence.

no incident response plan incidents are not documented

Equivalent controls elsewhere

Matched on shared topics. Satisfying this control usually moves these too.

Framework	Control	Title	Shared topics
GDPR	Art.33	Notification of a breach to the supervisory authority	breach-notification incident-response
SOC 2	CC7.4	Incident response programme	incident-response breach-notification
PCI DSS 4.0.1	12.10	Incident response plan for suspected compromise of account data	incident-response breach-notification
NIST CSF 2.0	RS.CO-02	Internal and external stakeholders are notified	breach-notification incident-response
NDPA 2023	s.40	Personal data breaches: notification and breach records	breach-notification incident-response
GDPR	Art.34	Communication of a breach to data subjects	breach-notification
SOC 2	CC7.3	Evaluation of security events	incident-response
SOC 2	CC7.5	Recovery from identified incidents	incident-response