Risk Assessments

frameworkCMMC Level 2 sectionRA Risk Assessment csf 2.0DE.AE-07 GV.OC-02 GV.OV-01 GV.OV-02 GV.OV-03 GV.RM-06 GV.RM-07 GV.SC-03 GV.SC-04 GV.SC-05 GV.SC-06 GV.SC-07 GV.SC-09 GV.SC-10 ID.IM-01 ID.IM-02 ID.IM-03 ID.RA-01 ID.RA-02 ID.RA-03 ID.RA-04 ID.RA-05 ID.RA-09 ID.RA-10 RS.AN-08 topicsRisk Management, Risk Assessment frameworks6 4 0

Official textPeriodically assess the risk to organizational operations (including mission, functions, image, or reputation), organizational assets, and individuals, resulting from the operation of organizational systems and the associated processing, storage, or transmission of CUI.NIST SP 800-171 Rev 2 requirement, the basis of the CMMC Level 2 practice (public domain)

gap from CMMC → gap to CMMC →

Wrong or missing mapping? Report it

Equivalents of RA.L2-3.11.1 in other frameworks
Framework	Requirement	Title	Link	Source / reason
NIST CSF 2.0	GV.RM-01 GV.RM-02 GV.RM-03 GV.RM-06 ID.RA-03 ID.RA-04 ID.RA-05 ID.RA-06	Risk management objectives are established and agreed to by organizational stakeholders; Risk appetite and risk tolerance statements are established, communicated, and maintained…	Crosswalk	Same topic: Risk Management, Risk Assessment 18 loosely related (not mappings) DE.AE-07 Cyber threat intelligence and other contextual information are integrated into the analysis Loosely related Only shares CSF DE.AE-07: related, not a mapping GV.OC-02 Internal and external stakeholders are understood, and their needs and expectations regarding cybersecurity risk management are understood and considered Loosely related Only shares CSF GV.OC-02: related, not a mapping GV.OV-01 Cybersecurity risk management strategy outcomes are reviewed to inform and adjust strategy and direction Loosely related Only shares CSF GV.OV-01: related, not a mapping GV.OV-02 The cybersecurity risk management strategy is reviewed and adjusted to ensure coverage of organizational requirements and risks Loosely related Only shares CSF GV.OV-02: related, not a mapping GV.OV-03 Organizational cybersecurity risk management performance is evaluated and reviewed for adjustments needed Loosely related Only shares CSF GV.OV-03: related, not a mapping GV.RM-07 Strategic opportunities (i.e., positive risks) are characterized and are included in organizational cybersecurity risk discussions Loosely related Only shares CSF GV.RM-07: related, not a mapping GV.SC-03 Cybersecurity supply chain risk management is integrated into cybersecurity and enterprise risk management, risk assessment, and improvement processes Loosely related Only shares CSF GV.SC-03: related, not a mapping GV.SC-04 Suppliers are known and prioritized by criticality Loosely related Only shares CSF GV.SC-04: related, not a mapping …and 10 more in the downloads
ISO 27001	Clause 6.1.1 Clause 6.1.2 Clause 6.1.3	General; Information security risk assessment…	Crosswalk	Same topic: Risk Management, Risk Assessment 27 loosely related (not mappings) A.5.19 Information security in supplier relationships Loosely related Only shares CSF GV.OV-01, GV.OV-02, GV.OV-03, GV.SC-03…: related, not a mapping A.5.20 Addressing information security within supplier agreements Loosely related Only shares CSF GV.OV-03, GV.SC-03, GV.SC-05, GV.SC-06…: related, not a mapping A.5.22 Monitoring, review and change management of supplier services Loosely related Only shares CSF GV.SC-04, GV.SC-07, GV.SC-09, GV.SC-10…: related, not a mapping A.5.1 Policies for information security Loosely related Only shares CSF GV.OV-01, GV.OV-02, GV.OV-03, GV.RM-06…: related, not a mapping A.5.7 Threat intelligence Loosely related Only shares CSF DE.AE-07, ID.RA-02, ID.RA-03, ID.RA-05: related, not a mapping Clause 9.1 Monitoring, measurement, analysis and evaluation Loosely related Only shares CSF GV.OV-01, GV.OV-02, GV.OV-03, ID.IM-03: related, not a mapping A.5.21 Managing information security in the ICT supply chain Loosely related Only shares CSF GV.SC-03, GV.SC-09, GV.SC-10: related, not a mapping A.5.31 Legal, statutory, regulatory and contractual requirements Loosely related Only shares CSF GV.SC-05, GV.SC-06, GV.SC-07: related, not a mapping …and 19 more in the downloads
CIS v8.1	CIS 15.4 CIS 15.7 CIS 15.6 CIS 7.1	Ensure Service Provider Contracts Include Security Requirements; Securely Decommission Service Providers…	Loosely related	No mapping. Only shares CSF GV.SC-04, GV.SC-05, GV.SC-06, GV.SC-07…: related, not a mapping +12 more loosely related (not mappings) CIS 15.1 Establish and Maintain an Inventory of Service Providers Loosely related Only shares CSF GV.SC-04: related, not a mapping CIS 15.3 Classify Service Providers Loosely related Only shares CSF GV.SC-04: related, not a mapping CIS 15.5 Assess Service Providers Loosely related Only shares CSF GV.SC-06: related, not a mapping CIS 7.5 Perform Automated Vulnerability Scans of Internal Enterprise Assets Loosely related Only shares CSF ID.RA-01: related, not a mapping …and 8 more in the downloads
SOC 2	CC3.1 CC3.2 CC3.3 CC3.4 CC5.1 CC9.1	Objectives specified clearly enough to identify risks; Risk identification and analysis…	Editorial	Same topic: Risk Management, Risk Assessment (editorial pick) 4 loosely related (not mappings) CC9.2 Managing vendor and business partner risk Loosely related Only shares CSF GV.SC-03, GV.SC-04, GV.SC-05, GV.SC-06…: related, not a mapping CC4.1 Ongoing and/or separate evaluations of controls Loosely related Only shares CSF GV.OV-03: related, not a mapping CC4.2 Communicating and remediating control deficiencies Loosely related Only shares CSF GV.OV-03: related, not a mapping CC7.1 Detecting configuration changes and new vulnerabilities Loosely related Only shares CSF ID.RA-01: related, not a mapping
PCI DSS	12.3.1	Targeted risk analysis for flexible-frequency requirements	Crosswalk	Same topic: Risk Management, Risk Assessment 48 loosely related (not mappings) 12.3.4 Hardware and software technologies reviewed annually Loosely related Only shares CSF DE.AE-07, GV.OV-02, GV.OV-03, GV.RM-06…: related, not a mapping 12.8.3 Due diligence before engaging service providers Loosely related Only shares CSF GV.RM-06, GV.SC-03, GV.SC-04, GV.SC-05…: related, not a mapping 6.3.1 Vulnerabilities identified and risk-ranked Loosely related Only shares CSF DE.AE-07, GV.RM-06, GV.SC-03, GV.SC-07…: related, not a mapping 12.8.1 List of third-party service providers kept Loosely related Only shares CSF GV.OC-02, GV.SC-04, GV.SC-05, GV.SC-06…: related, not a mapping 12.8.5 Responsibilities split with each provider documented Loosely related Only shares CSF GV.OC-02, GV.SC-04, GV.SC-05, GV.SC-06…: related, not a mapping 6.4.3 Payment page scripts authorised and integrity-checked Loosely related Only shares CSF DE.AE-07, GV.SC-03, GV.SC-07, GV.SC-09…: related, not a mapping 12.8.2 Written agreements with service providers Loosely related Only shares CSF GV.SC-04, GV.SC-05, GV.SC-06, GV.SC-07…: related, not a mapping 1.2.4 Accurate account-data flow diagram maintained Loosely related Only shares CSF GV.SC-04, GV.SC-06, GV.SC-07, GV.SC-10…: related, not a mapping …and 40 more in the downloads
800-53	PM-9 PM-28 RA-3 RA-7 SR-6	Risk Management Strategy; Risk Framing…	Crosswalk	Same topic: Risk Management, Risk Assessment NIST SP 800-171r3 03.11.01 → SP 800-53 36 loosely related (not mappings) SR-5 Acquisition Strategies, Tools, and Methods Loosely related Only shares CSF GV.OC-02, GV.SC-05, GV.SC-06, GV.SC-09…: related, not a mapping PM-30 Supply Chain Risk Management Strategy Loosely related Only shares CSF GV.OC-02, GV.OV-01, GV.OV-02, GV.RM-06…: related, not a mapping PM-31 Continuous Monitoring Strategy Loosely related Only shares CSF GV.OV-01, GV.OV-02, GV.SC-03, GV.SC-09…: related, not a mapping SA-4 Acquisition Process Loosely related Only shares CSF GV.SC-05, GV.SC-06, GV.SC-07, GV.SC-09…: related, not a mapping SA-9 External System Services Loosely related Only shares CSF GV.SC-04, GV.SC-05, GV.SC-06, GV.SC-07…: related, not a mapping SR-3 Supply Chain Controls and Processes Loosely related Only shares CSF GV.OC-02, GV.SC-03, GV.SC-05, GV.SC-07…: related, not a mapping CA-2 Control Assessments Loosely related Only shares CSF GV.OV-03, ID.IM-01, ID.IM-02, ID.IM-03…: related, not a mapping PM-18 Privacy Program Plan Loosely related Only shares CSF GV.OC-02, GV.OV-01, GV.RM-06, GV.RM-07…: related, not a mapping …and 28 more in the downloads
HIPAA	§164.308(a)(1)(ii)(A)§164.308(a)(1)(ii)(B)	Risk Analysis; Risk Management	Crosswalk	Same topic: Risk Assessment, Risk Management 36 loosely related (not mappings) §164.316(a) Policies and Procedures Loosely related Only shares CSF DE.AE-07, GV.OV-01, GV.RM-06, GV.RM-07…: related, not a mapping §164.308(b)(4) Written Contract or Other Arrangement Loosely related Only shares CSF GV.SC-04, GV.SC-05, GV.SC-06, GV.SC-07…: related, not a mapping §164.314(a) Business Associate Contracts or Other Arrangements Loosely related Only shares CSF GV.SC-04, GV.SC-05, GV.SC-06, GV.SC-07…: related, not a mapping §164.314(a)(2)(i) Business Associate Contracts Loosely related Only shares CSF GV.SC-04, GV.SC-05, GV.SC-06, GV.SC-07…: related, not a mapping §164.314(a)(2)(iii) Business associate contracts with subcontractors Loosely related Only shares CSF GV.SC-04, GV.SC-05, GV.SC-06, GV.SC-07…: related, not a mapping §164.308(a)(8) Evaluation Loosely related Only shares CSF GV.OV-01, GV.OV-03, GV.SC-03, ID.IM-01…: related, not a mapping §164.308(a)(6) Security Incident Procedures Loosely related Only shares CSF GV.OV-01, GV.SC-03, ID.IM-01, ID.IM-02…: related, not a mapping §164.308(b)(1) Business Associate Contracts and Other Arrangements Loosely related Only shares CSF GV.SC-04, GV.SC-05, GV.SC-06, GV.SC-07…: related, not a mapping …and 28 more in the downloads
GDPR	Art.24(1)Art.32(2)Art.35(1)Art.35(7)	Responsibility of the controller; Security of processing…	Editorial	Same topic: Risk Management, Risk Assessment (editorial pick) 4 loosely related (not mappings) Art.28(1) Processor Loosely related Only shares CSF GV.SC-03, GV.SC-04, GV.SC-05, GV.SC-06…: related, not a mapping Art.28(3) Processor Loosely related Only shares CSF GV.SC-04, GV.SC-06, GV.SC-07, ID.RA-10: related, not a mapping Art.5(2) Principles relating to processing of personal data Loosely related Only shares CSF GV.OV-03: related, not a mapping Art.32(1)(d) Security of processing Loosely related Only shares CSF ID.RA-01: related, not a mapping
NIS2	2.1 7.1	Risk management framework; Policies and procedures to assess the effectiveness of cybersecurity risk-management measures	Crosswalk	Same topic: Risk Management, Risk Assessment 11 loosely related (not mappings) 5.1 Supply chain security policy Loosely related Only shares CSF GV.SC-04, GV.SC-05, GV.SC-06, GV.SC-07…: related, not a mapping 6.10 Vulnerability handling and disclosure Loosely related Only shares CSF ID.RA-01, ID.RA-02, ID.RA-04, ID.RA-05: related, not a mapping 6.1 Security in acquisition of ICT services, ICT systems or ICT products Loosely related Only shares CSF GV.SC-06, ID.RA-09, ID.RA-10: related, not a mapping 2.3 Independent review of information and network security Loosely related Only shares CSF GV.OV-02, GV.OV-03: related, not a mapping 1.1 Policy on the security of network and information systems Loosely related Only shares CSF GV.OC-02: related, not a mapping 2.2 Compliance monitoring Loosely related Only shares CSF GV.OV-02: related, not a mapping 3.6 Post-incident reviews Loosely related Only shares CSF RS.AN-08: related, not a mapping 4.3 Crisis management Loosely related Only shares CSF DE.AE-07: related, not a mapping …and 3 more in the downloads
Essential Eight	ISM-0304 ISM-1407 ISM-1501 ISM-1690	Applications other than office productivity suites, web browsers and their extensions…; The latest release, or the previous release, of operating systems are used…	Loosely related	No mapping. Only shares CSF ID.RA-01: related, not a mapping +25 more loosely related (not mappings) ISM-1691 Patches, updates or other vendor mitigations for vulnerabilities in office productivity suites, web browsers and their extensions, email clients, PDF applications, and security products are applied within two weeks of release Loosely related Only shares CSF ID.RA-01: related, not a mapping ISM-1692 Patches, updates or other vendor mitigations for vulnerabilities in office productivity suites, web browsers and their extensions, email clients, PDF applications, and security products are applied within 48… Loosely related Only shares CSF ID.RA-01: related, not a mapping ISM-1693 Patches, updates or other vendor mitigations for vulnerabilities in applications other… Loosely related Only shares CSF ID.RA-01: related, not a mapping ISM-1694 Patches, updates or other vendor mitigations for vulnerabilities in operating systems of internet-facing servers and internet-facing network devices are applied within two weeks… Loosely related Only shares CSF ID.RA-01: related, not a mapping …and 21 more in the downloads
DORA	Art.5(2)(a)Art.6(1)Art.6(8)Art.8(2)Art.8(3)Art.8(7)Art.16(1)Art.24(1)	Governance and organisation; ICT risk management framework…	Editorial	Same topic: Risk Management, Risk Assessment (editorial pick) 17 loosely related (not mappings) Art.28(2) General principles Loosely related Only shares CSF GV.SC-03, GV.SC-05, GV.SC-09, ID.RA-09: related, not a mapping Art.28(3) General principles Loosely related Only shares CSF GV.SC-04, GV.SC-06, GV.SC-07, ID.RA-10: related, not a mapping Art.28(4) General principles Loosely related Only shares CSF GV.SC-04, GV.SC-06, GV.SC-07, ID.RA-10: related, not a mapping Art.28(5) General principles Loosely related Only shares CSF GV.SC-04, GV.SC-06, GV.SC-07, ID.RA-10: related, not a mapping Art.28(8) General principles Loosely related Only shares CSF GV.SC-04, GV.SC-06, GV.SC-07, ID.RA-10: related, not a mapping Art.29(1) Preliminary assessment of ICT concentration risk at entity level Loosely related Only shares CSF GV.SC-03, GV.SC-05, GV.SC-09, ID.RA-09: related, not a mapping Art.29(2) Preliminary assessment of ICT concentration risk at entity level Loosely related Only shares CSF GV.SC-03, GV.SC-05, GV.SC-09, ID.RA-09: related, not a mapping Art.30(2) Key contractual provisions Loosely related Only shares CSF GV.SC-04, GV.SC-06, GV.SC-07, ID.RA-10: related, not a mapping …and 9 more in the downloads
CPS 234	Para 13 Para 15 Para 17 Para 21 Para 27 Para 31	Board ultimately responsible for information security; Maintain a capability commensurate with threats…	Editorial	Same topic: Risk Management, Risk Assessment (editorial pick) 7 loosely related (not mappings) Para 16 Assess third parties' information security capability Loosely related Only shares CSF GV.SC-03, GV.SC-04, GV.SC-05, GV.SC-06…: related, not a mapping Para 22 Evaluate the design of third parties' controls Loosely related Only shares CSF GV.SC-03, GV.SC-04, GV.SC-05, GV.SC-06…: related, not a mapping Para 34 Internal audit assesses third-party assurance relied on Loosely related Only shares CSF GV.OV-03, GV.SC-04, GV.SC-06, GV.SC-07…: related, not a mapping Para 28 Check third parties' control testing is adequate Loosely related Only shares CSF GV.SC-04, GV.SC-06, GV.SC-07, ID.RA-10: related, not a mapping Para 30 Testing by skilled, functionally independent specialists Loosely related Only shares CSF ID.RA-01: related, not a mapping Para 32 Internal audit reviews control design and effectiveness Loosely related Only shares CSF GV.OV-03: related, not a mapping Para 33 Assurance provided by appropriately skilled personnel Loosely related Only shares CSF GV.OV-03: related, not a mapping
Cyber Essentials	CE 3	Security Update Management	Loosely related	No mapping. Only shares CSF ID.RA-01: related, not a mapping

Crosswalk a published crosswalk (NIST, ENISA, CIS, PCI SSC) makes the link · Editorial ControlMapping's judgement where no crosswalk exists; the reason is shown · Loosely related only shares a CSF 2.0 outcome: worth checking, not a mapping · No mapping in our data nothing mapped in our data; often new work, but check the coverage notes. How links are sourced.