Information security risk treatment

frameworkISO/IEC 27001:2022 sectionISMS clauses 4–10 csf 2.0GV.RM-03 GV.RM-04 GV.RM-05 GV.SC-04 GV.SC-07 GV.SC-10 ID.RA-03 ID.RA-04 ID.RA-05 ID.RA-06 ID.RA-07 topicsRisk Management, Risk Assessment frameworks6 4 2

Official text · not licensableTitle: Information security risk treatment. The control text is ISO's copyright; see ISO/IEC 27001:2022.

gap from ISO 27001 → gap to ISO 27001 →

Wrong or missing mapping? Report it

Equivalents of Clause 6.1.3 in other frameworks
Framework	Requirement	Title	Link	Source / reason
NIST CSF 2.0	GV.RM-01 GV.RM-02 GV.RM-03 GV.RM-06 ID.RA-03 ID.RA-04 ID.RA-05 ID.RA-06	Risk management objectives are established and agreed to by organizational stakeholders; Risk appetite and risk tolerance statements are established, communicated, and maintained…	Crosswalk	Same topic: Risk Management, Risk Assessment 6 loosely related (not mappings) GV.RM-04 Strategic direction that describes appropriate risk response options is established and communicated Loosely related Only shares CSF GV.RM-04: related, not a mapping GV.RM-05 Lines of communication across the organization are established for cybersecurity risks, including risks from suppliers and other third parties Loosely related Only shares CSF GV.RM-05: related, not a mapping GV.SC-04 Suppliers are known and prioritized by criticality Loosely related Only shares CSF GV.SC-04: related, not a mapping GV.SC-07 The risks posed by a supplier, their products and services, and other third parties are understood, recorded, prioritized, assessed, responded to, and monitored over the course of the relationship Loosely related Only shares CSF GV.SC-07: related, not a mapping GV.SC-10 Cybersecurity supply chain risk management plans include provisions for activities that occur after the conclusion of a partnership or service agreement Loosely related Only shares CSF GV.SC-10: related, not a mapping ID.RA-07 Changes and exceptions are managed, assessed for risk impact, recorded, and tracked Loosely related Only shares CSF ID.RA-07: related, not a mapping
CIS v8.1	CIS 15.7 CIS 15.1 CIS 15.3 CIS 15.6	Securely Decommission Service Providers; Establish and Maintain an Inventory of Service Providers…	Loosely related	No mapping. Only shares CSF GV.SC-04, GV.SC-07, GV.SC-10: related, not a mapping +1 more loosely related (not mappings) CIS 15.4 Ensure Service Provider Contracts Include Security Requirements Loosely related Only shares CSF GV.SC-04, GV.SC-07: related, not a mapping
SOC 2	CC3.1 CC3.2 CC3.3 CC3.4 CC5.1 CC9.1 CC5.2	Objectives specified clearly enough to identify risks; Risk identification and analysis…	Editorial	Same topic: Risk Management, Risk Assessment (editorial pick) ControlMapping editorial: General controls over technology are chosen in ISO's risk treatment (6.1.3) and recorded in the Statement of Applicability. 1 loosely related (not mappings) CC9.2 Managing vendor and business partner risk Loosely related Only shares CSF GV.SC-04, GV.SC-07: related, not a mapping
PCI DSS	12.3.1	Targeted risk analysis for flexible-frequency requirements	Crosswalk	Same topic: Risk Management, Risk Assessment 39 loosely related (not mappings) 12.8.2 Written agreements with service providers Loosely related Only shares CSF GV.RM-05, GV.SC-04, GV.SC-07, GV.SC-10: related, not a mapping 12.8.3 Due diligence before engaging service providers Loosely related Only shares CSF GV.RM-03, GV.SC-04, GV.SC-07, GV.SC-10: related, not a mapping 12.8.5 Responsibilities split with each provider documented Loosely related Only shares CSF GV.RM-05, GV.SC-04, GV.SC-07, GV.SC-10: related, not a mapping 12.10.1 Incident response plan ready to activate Loosely related Only shares CSF GV.RM-04, GV.RM-05, GV.SC-10, ID.RA-06: related, not a mapping 1.2.4 Accurate account-data flow diagram maintained Loosely related Only shares CSF GV.SC-04, GV.SC-07, GV.SC-10: related, not a mapping 6.3.1 Vulnerabilities identified and risk-ranked Loosely related Only shares CSF GV.RM-03, GV.SC-07, ID.RA-05: related, not a mapping 6.3.3 Security patches installed promptly Loosely related Only shares CSF GV.RM-03, ID.RA-05, ID.RA-06: related, not a mapping 12.5.2 PCI DSS scope confirmed annually and on change Loosely related Only shares CSF GV.SC-04, GV.SC-07, GV.SC-10: related, not a mapping …and 31 more in the downloads
CMMC	RA.L2-3.11.1	Risk Assessments	Crosswalk	Same topic: Risk Management, Risk Assessment 5 loosely related (not mappings) CM.L2-3.4.3 System Change Management Loosely related Only shares CSF ID.RA-07: related, not a mapping CM.L2-3.4.4 Security Impact Analysis Loosely related Only shares CSF ID.RA-07: related, not a mapping RA.L2-3.11.2 Vulnerability Scan Loosely related Only shares CSF GV.SC-10: related, not a mapping RA.L2-3.11.3 Vulnerability Remediation Loosely related Only shares CSF GV.SC-10: related, not a mapping SI.L2-3.14.3 Security Alerts & Advisories Loosely related Only shares CSF ID.RA-03: related, not a mapping
800-53	PM-9 PM-28 RA-3 RA-7	Risk Management Strategy; Risk Framing…	Crosswalk	Same topic: Risk Management, Risk Assessment 22 loosely related (not mappings) PM-30 Supply Chain Risk Management Strategy Loosely related Only shares CSF GV.RM-03, GV.RM-04, GV.RM-05, ID.RA-06: related, not a mapping RA-9 Criticality Analysis Loosely related Only shares CSF GV.SC-04, GV.SC-07, ID.RA-04: related, not a mapping SA-9 External System Services Loosely related Only shares CSF GV.SC-04, GV.SC-07, GV.SC-10: related, not a mapping SR-2 Supply Chain Risk Management Plan Loosely related Only shares CSF GV.RM-03, GV.RM-04, GV.SC-10: related, not a mapping SR-6 Supplier Assessments and Reviews Loosely related Only shares CSF GV.SC-04, GV.SC-07, GV.SC-10: related, not a mapping PM-16 Threat Awareness Program Loosely related Only shares CSF ID.RA-03, ID.RA-05: related, not a mapping RA-2 Security Categorization Loosely related Only shares CSF ID.RA-04, ID.RA-05: related, not a mapping SA-4 Acquisition Process Loosely related Only shares CSF GV.SC-07, GV.SC-10: related, not a mapping …and 14 more in the downloads
HIPAA	§164.308(a)(1)(ii)(A)§164.308(a)(1)(ii)(B)	Risk Analysis; Risk Management	Crosswalk	Same topic: Risk Assessment, Risk Management 11 loosely related (not mappings) §164.316(a) Policies and Procedures Loosely related Only shares CSF GV.SC-10, ID.RA-03, ID.RA-04, ID.RA-05: related, not a mapping §164.308(b)(1) Business Associate Contracts and Other Arrangements Loosely related Only shares CSF GV.SC-04, GV.SC-07, GV.SC-10: related, not a mapping §164.308(b)(4) Written Contract or Other Arrangement Loosely related Only shares CSF GV.SC-04, GV.SC-07, GV.SC-10: related, not a mapping §164.314(a) Business Associate Contracts or Other Arrangements Loosely related Only shares CSF GV.SC-04, GV.SC-07, GV.SC-10: related, not a mapping §164.314(a)(2)(i) Business Associate Contracts Loosely related Only shares CSF GV.SC-04, GV.SC-07, GV.SC-10: related, not a mapping §164.314(a)(2)(ii) Other Arrangements Loosely related Only shares CSF GV.SC-04, GV.SC-07, GV.SC-10: related, not a mapping §164.314(a)(2)(iii) Business associate contracts with subcontractors Loosely related Only shares CSF GV.SC-04, GV.SC-07, GV.SC-10: related, not a mapping §164.314(b)(2)(iii) Group Health Plan Implementation Specification Loosely related Only shares CSF GV.SC-04, GV.SC-07, GV.SC-10: related, not a mapping …and 3 more in the downloads
GDPR	Art.24(1)Art.32(2)Art.35(1)Art.35(7)	Responsibility of the controller; Security of processing…	Editorial	Same topic: Risk Management, Risk Assessment (editorial pick) 2 loosely related (not mappings) Art.28(1) Processor Loosely related Only shares CSF GV.SC-04, GV.SC-07: related, not a mapping Art.28(3) Processor Loosely related Only shares CSF GV.SC-04, GV.SC-07: related, not a mapping
NIS2	2.1 7.1	Risk management framework; Policies and procedures to assess the effectiveness of cybersecurity risk-management measures	Crosswalk	Same topic: Risk Management, Risk Assessment 5 loosely related (not mappings) 5.1 Supply chain security policy Loosely related Only shares CSF GV.SC-04, GV.SC-07, GV.SC-10: related, not a mapping 6.10 Vulnerability handling and disclosure Loosely related Only shares CSF ID.RA-04, ID.RA-05, ID.RA-06: related, not a mapping 1.1 Policy on the security of network and information systems Loosely related Only shares CSF GV.RM-03: related, not a mapping 5.2 Directory of suppliers and service providers Loosely related Only shares CSF GV.SC-04: related, not a mapping 6.4 Change management, repairs and maintenance Loosely related Only shares CSF ID.RA-07: related, not a mapping
Essential Eight	—	No requirement	No mapping in our data	No mapping in our data (Essential Eight links are editorial only).
DORA	Art.5(2)(a)Art.6(1)Art.6(8)Art.8(2)Art.8(3)Art.8(7)Art.16(1)Art.24(1)	Governance and organisation; ICT risk management framework…	Editorial	Same topic: Risk Management, Risk Assessment (editorial pick) 8 loosely related (not mappings) Art.28(3) General principles Loosely related Only shares CSF GV.SC-04, GV.SC-07: related, not a mapping Art.28(4) General principles Loosely related Only shares CSF GV.SC-04, GV.SC-07: related, not a mapping Art.28(5) General principles Loosely related Only shares CSF GV.SC-04, GV.SC-07: related, not a mapping Art.28(8) General principles Loosely related Only shares CSF GV.SC-04, GV.SC-07: related, not a mapping Art.30(2) Key contractual provisions Loosely related Only shares CSF GV.SC-04, GV.SC-07: related, not a mapping Art.30(3) Key contractual provisions Loosely related Only shares CSF GV.SC-04, GV.SC-07: related, not a mapping Art.13(1) Learning and evolving Loosely related Only shares CSF ID.RA-03: related, not a mapping Art.45(1) Information-sharing arrangements on cyber threat information and intelligence Loosely related Only shares CSF ID.RA-03: related, not a mapping
CPS 234	Para 13 Para 15 Para 17 Para 21 Para 27 Para 31	Board ultimately responsible for information security; Maintain a capability commensurate with threats…	Editorial	Same topic: Risk Management, Risk Assessment (editorial pick) 4 loosely related (not mappings) Para 16 Assess third parties' information security capability Loosely related Only shares CSF GV.SC-04, GV.SC-07: related, not a mapping Para 22 Evaluate the design of third parties' controls Loosely related Only shares CSF GV.SC-04, GV.SC-07: related, not a mapping Para 28 Check third parties' control testing is adequate Loosely related Only shares CSF GV.SC-04, GV.SC-07: related, not a mapping Para 34 Internal audit assesses third-party assurance relied on Loosely related Only shares CSF GV.SC-04, GV.SC-07: related, not a mapping
Cyber Essentials	—	No requirement	No mapping in our data	No mapping in our data (Cyber Essentials covers five technical controls only).

Crosswalk a published crosswalk (NIST, ENISA, CIS, PCI SSC) makes the link · Editorial ControlMapping's judgement where no crosswalk exists; the reason is shown · Loosely related only shares a CSF 2.0 outcome: worth checking, not a mapping · No mapping in our data nothing mapped in our data; often new work, but check the coverage notes. How links are sourced.