Information security risk assessment

frameworkISO/IEC 27001:2022 sectionISMS clauses 4–10 csf 2.0GV.RM-01 GV.RM-02 GV.RM-06 GV.SC-04 GV.SC-07 GV.SC-09 GV.SC-10 ID.RA-03 ID.RA-04 ID.RA-05 ID.RA-08 topicsRisk Assessment frameworks6 4 0

Official text · not licensableTitle: Information security risk assessment. The control text is ISO's copyright; see ISO/IEC 27001:2022.

gap from ISO 27001 → gap to ISO 27001 →

Wrong or missing mapping? Report it

Equivalents of Clause 6.1.2 in other frameworks
Framework	Requirement	Title	Link	Source / reason
NIST CSF 2.0	ID.RA-03 ID.RA-04 ID.RA-05 ID.RA-06	Internal and external threats to the organization are identified and recorded; Potential impacts and likelihoods of threats exploiting vulnerabilities are identified and recorded…	Crosswalk	Same topic: Risk Assessment 8 loosely related (not mappings) GV.RM-01 Risk management objectives are established and agreed to by organizational stakeholders Loosely related Only shares CSF GV.RM-01: related, not a mapping GV.RM-02 Risk appetite and risk tolerance statements are established, communicated, and maintained Loosely related Only shares CSF GV.RM-02: related, not a mapping GV.RM-06 A standardized method for calculating, documenting, categorizing, and prioritizing cybersecurity risks is established and communicated Loosely related Only shares CSF GV.RM-06: related, not a mapping GV.SC-04 Suppliers are known and prioritized by criticality Loosely related Only shares CSF GV.SC-04: related, not a mapping GV.SC-07 The risks posed by a supplier, their products and services, and other third parties are understood, recorded, prioritized, assessed, responded to, and monitored over the course of the relationship Loosely related Only shares CSF GV.SC-07: related, not a mapping GV.SC-09 Supply chain security practices are integrated into cybersecurity and enterprise risk management programs, and their performance is monitored throughout the technology product and service life cycle Loosely related Only shares CSF GV.SC-09: related, not a mapping GV.SC-10 Cybersecurity supply chain risk management plans include provisions for activities that occur after the conclusion of a partnership or service agreement Loosely related Only shares CSF GV.SC-10: related, not a mapping ID.RA-08 Processes for receiving, analyzing, and responding to vulnerability disclosures are established Loosely related Only shares CSF ID.RA-08: related, not a mapping
CIS v8.1	CIS 15.7 CIS 15.6 CIS 7.2 CIS 15.1	Securely Decommission Service Providers; Monitor Service Providers…	Loosely related	No mapping. Only shares CSF GV.SC-04, GV.SC-07, GV.SC-10, GV.SC-09…: related, not a mapping +11 more loosely related (not mappings) CIS 15.3 Classify Service Providers Loosely related Only shares CSF GV.SC-04: related, not a mapping CIS 15.4 Ensure Service Provider Contracts Include Security Requirements Loosely related Only shares CSF GV.SC-04, GV.SC-07: related, not a mapping CIS 7.5 Perform Automated Vulnerability Scans of Internal Enterprise Assets Loosely related Only shares CSF ID.RA-08: related, not a mapping CIS 7.6 Perform Automated Vulnerability Scans of Externally-Exposed Enterprise Assets Loosely related Only shares CSF ID.RA-08: related, not a mapping …and 7 more in the downloads
SOC 2	CC3.2 CC3.3 CC3.4	Risk identification and analysis; Considering the potential for fraud…	Editorial	Same topic: Risk Assessment (editorial pick) 5 loosely related (not mappings) CC3.1 Objectives specified clearly enough to identify risks Loosely related Only shares CSF GV.RM-01, GV.RM-02, GV.RM-06: related, not a mapping CC5.1 Control activities that mitigate risks Loosely related Only shares CSF GV.RM-01, GV.RM-02, GV.RM-06: related, not a mapping CC9.1 Mitigating risks from business disruptions Loosely related Only shares CSF GV.RM-01, GV.RM-02, GV.RM-06: related, not a mapping CC9.2 Managing vendor and business partner risk Loosely related Only shares CSF GV.SC-04, GV.SC-07, GV.SC-09: related, not a mapping CC7.1 Detecting configuration changes and new vulnerabilities Loosely related Only shares CSF ID.RA-08: related, not a mapping
PCI DSS	12.3.1	Targeted risk analysis for flexible-frequency requirements	Crosswalk	Same topic: Risk Assessment 38 loosely related (not mappings) 6.3.1 Vulnerabilities identified and risk-ranked Loosely related Only shares CSF GV.RM-06, GV.SC-07, GV.SC-09, ID.RA-05: related, not a mapping 12.8.3 Due diligence before engaging service providers Loosely related Only shares CSF GV.RM-06, GV.SC-04, GV.SC-07, GV.SC-10: related, not a mapping 12.8.5 Responsibilities split with each provider documented Loosely related Only shares CSF GV.SC-04, GV.SC-07, GV.SC-09, GV.SC-10: related, not a mapping 1.2.4 Accurate account-data flow diagram maintained Loosely related Only shares CSF GV.SC-04, GV.SC-07, GV.SC-10: related, not a mapping 6.3.2 Inventory of custom software and its components Loosely related Only shares CSF GV.SC-04, GV.SC-07, GV.SC-09: related, not a mapping 6.3.3 Security patches installed promptly Loosely related Only shares CSF GV.RM-06, GV.SC-09, ID.RA-05: related, not a mapping 6.4.3 Payment page scripts authorised and integrity-checked Loosely related Only shares CSF GV.SC-07, GV.SC-09, GV.SC-10: related, not a mapping 11.6.1 Payment page changes and tampering detected Loosely related Only shares CSF GV.RM-06, GV.SC-07, GV.SC-09: related, not a mapping …and 30 more in the downloads
CMMC	RA.L2-3.11.1	Risk Assessments	Crosswalk	Same topic: Risk Assessment 3 loosely related (not mappings) RA.L2-3.11.2 Vulnerability Scan Loosely related Only shares CSF GV.SC-10, ID.RA-08: related, not a mapping RA.L2-3.11.3 Vulnerability Remediation Loosely related Only shares CSF GV.SC-10, ID.RA-08: related, not a mapping SI.L2-3.14.3 Security Alerts & Advisories Loosely related Only shares CSF ID.RA-03: related, not a mapping
800-53	RA-3 RA-7 PM-9 PM-28	Risk Assessment; Risk Response…	Crosswalk	Same topic: Risk Assessment NIST SP 800-53 → ISO 27001 mapping 18 loosely related (not mappings) SA-9 External System Services Loosely related Only shares CSF GV.SC-04, GV.SC-07, GV.SC-09, GV.SC-10: related, not a mapping SR-6 Supplier Assessments and Reviews Loosely related Only shares CSF GV.SC-04, GV.SC-07, GV.SC-09, GV.SC-10: related, not a mapping RA-9 Criticality Analysis Loosely related Only shares CSF GV.SC-04, GV.SC-07, ID.RA-04: related, not a mapping SA-4 Acquisition Process Loosely related Only shares CSF GV.SC-07, GV.SC-09, GV.SC-10: related, not a mapping SR-2 Supply Chain Risk Management Plan Loosely related Only shares CSF GV.RM-01, GV.SC-09, GV.SC-10: related, not a mapping SR-3 Supply Chain Controls and Processes Loosely related Only shares CSF GV.SC-07, GV.SC-09, GV.SC-10: related, not a mapping PM-16 Threat Awareness Program Loosely related Only shares CSF ID.RA-03, ID.RA-05: related, not a mapping PM-30 Supply Chain Risk Management Strategy Loosely related Only shares CSF GV.RM-06, GV.SC-09: related, not a mapping …and 10 more in the downloads
HIPAA	§164.308(a)(1)(ii)(A)	Risk Analysis	Crosswalk	Same topic: Risk Assessment 10 loosely related (not mappings) §164.308(a)(1)(ii)(B) Risk Management Loosely related Only shares CSF GV.RM-01, GV.RM-02, GV.RM-06, GV.SC-09…: related, not a mapping §164.316(a) Policies and Procedures Loosely related Only shares CSF GV.RM-06, GV.SC-09, GV.SC-10, ID.RA-03…: related, not a mapping §164.308(b)(1) Business Associate Contracts and Other Arrangements Loosely related Only shares CSF GV.SC-04, GV.SC-07, GV.SC-09, GV.SC-10: related, not a mapping §164.308(b)(4) Written Contract or Other Arrangement Loosely related Only shares CSF GV.SC-04, GV.SC-07, GV.SC-09, GV.SC-10: related, not a mapping §164.314(a) Business Associate Contracts or Other Arrangements Loosely related Only shares CSF GV.SC-04, GV.SC-07, GV.SC-09, GV.SC-10: related, not a mapping §164.314(a)(2)(i) Business Associate Contracts Loosely related Only shares CSF GV.SC-04, GV.SC-07, GV.SC-09, GV.SC-10: related, not a mapping §164.314(a)(2)(ii) Other Arrangements Loosely related Only shares CSF GV.SC-04, GV.SC-07, GV.SC-09, GV.SC-10: related, not a mapping §164.314(a)(2)(iii) Business associate contracts with subcontractors Loosely related Only shares CSF GV.SC-04, GV.SC-07, GV.SC-09, GV.SC-10: related, not a mapping …and 2 more in the downloads
GDPR	Art.35(1)Art.35(7)	Data protection impact assessment; Data protection impact assessment	Editorial	Same topic: Risk Assessment (editorial pick) 5 loosely related (not mappings) Art.24(1) Responsibility of the controller Loosely related Only shares CSF GV.RM-01, GV.RM-02, GV.RM-06: related, not a mapping Art.28(1) Processor Loosely related Only shares CSF GV.SC-04, GV.SC-07, GV.SC-09: related, not a mapping Art.32(2) Security of processing Loosely related Only shares CSF GV.RM-01, GV.RM-02, GV.RM-06: related, not a mapping Art.28(3) Processor Loosely related Only shares CSF GV.SC-04, GV.SC-07: related, not a mapping Art.32(1)(d) Security of processing Loosely related Only shares CSF ID.RA-08: related, not a mapping
NIS2	2.1	Risk management framework	Crosswalk	Same topic: Risk Assessment 4 loosely related (not mappings) 5.1 Supply chain security policy Loosely related Only shares CSF GV.SC-04, GV.SC-07, GV.SC-09, GV.SC-10: related, not a mapping 6.10 Vulnerability handling and disclosure Loosely related Only shares CSF ID.RA-04, ID.RA-05, ID.RA-08: related, not a mapping 5.2 Directory of suppliers and service providers Loosely related Only shares CSF GV.SC-04: related, not a mapping 7.1 Policies and procedures to assess the effectiveness of cybersecurity risk-management measures Loosely related Only shares CSF GV.RM-06: related, not a mapping
Essential Eight	ISM-1698 ISM-1699 ISM-1701 ISM-1702	A vulnerability scanner is used at least daily to identify missing patches or updates for vulnerabilities in online…; A vulnerability scanner is used at least weekly to identify missing patches or updates……	Loosely related	No mapping. Only shares CSF ID.RA-08: related, not a mapping +2 more loosely related (not mappings) ISM-1807 An automated method of asset discovery is used at least fortnightly to support the… Loosely related Only shares CSF ID.RA-08: related, not a mapping ISM-1808 A vulnerability scanner with an up-to-date vulnerability database is used for… Loosely related Only shares CSF ID.RA-08: related, not a mapping
DORA	Art.8(2)Art.8(3)Art.8(7)	Identification; Identification…	Editorial	Same topic: Risk Assessment (editorial pick) 19 loosely related (not mappings) Art.5(2)(a) Governance and organisation Loosely related Only shares CSF GV.RM-01, GV.RM-02, GV.RM-06: related, not a mapping Art.6(1) ICT risk management framework Loosely related Only shares CSF GV.RM-01, GV.RM-02, GV.RM-06: related, not a mapping Art.6(8) ICT risk management framework Loosely related Only shares CSF GV.RM-01, GV.RM-02, GV.RM-06: related, not a mapping Art.16(1) Simplified ICT risk management framework Loosely related Only shares CSF GV.RM-01, GV.RM-02, GV.RM-06: related, not a mapping Art.24(1) General requirements for the performance of digital operational resilience testing Loosely related Only shares CSF GV.RM-01, GV.RM-02, GV.RM-06: related, not a mapping Art.28(3) General principles Loosely related Only shares CSF GV.SC-04, GV.SC-07: related, not a mapping Art.28(4) General principles Loosely related Only shares CSF GV.SC-04, GV.SC-07: related, not a mapping Art.28(5) General principles Loosely related Only shares CSF GV.SC-04, GV.SC-07: related, not a mapping …and 11 more in the downloads
CPS 234	Para 17 Para 21	Keep capability current as threats and vulnerabilities change; Timely controls commensurate with risk and asset life-cycle	Editorial	Same topic: Risk Assessment (editorial pick) 9 loosely related (not mappings) Para 27 Systematic testing programme for control effectiveness Loosely related Only shares CSF GV.RM-01, GV.RM-02, GV.RM-06, ID.RA-08: related, not a mapping Para 13 Board ultimately responsible for information security Loosely related Only shares CSF GV.RM-01, GV.RM-02, GV.RM-06: related, not a mapping Para 15 Maintain a capability commensurate with threats Loosely related Only shares CSF GV.RM-01, GV.RM-02, GV.RM-06: related, not a mapping Para 16 Assess third parties' information security capability Loosely related Only shares CSF GV.SC-04, GV.SC-07, GV.SC-09: related, not a mapping Para 22 Evaluate the design of third parties' controls Loosely related Only shares CSF GV.SC-04, GV.SC-07, GV.SC-09: related, not a mapping Para 31 Review the testing programme at least annually Loosely related Only shares CSF GV.RM-01, GV.RM-02, GV.RM-06: related, not a mapping Para 28 Check third parties' control testing is adequate Loosely related Only shares CSF GV.SC-04, GV.SC-07: related, not a mapping Para 34 Internal audit assesses third-party assurance relied on Loosely related Only shares CSF GV.SC-04, GV.SC-07: related, not a mapping …and 1 more in the downloads
Cyber Essentials	CE 3	Security Update Management	Loosely related	No mapping. Only shares CSF ID.RA-08: related, not a mapping

Crosswalk a published crosswalk (NIST, ENISA, CIS, PCI SSC) makes the link · Editorial ControlMapping's judgement where no crosswalk exists; the reason is shown · Loosely related only shares a CSF 2.0 outcome: worth checking, not a mapping · No mapping in our data nothing mapped in our data; often new work, but check the coverage notes. How links are sourced.