Actions to address risks and opportunities

frameworkISO/IEC 27001:2022 sectionISMS clauses 4–10 csf 2.0GV.OC-01 GV.OC-02 topics— frameworks1 0 6

Official text · not licensableTitle: Actions to address risks and opportunities. The control text is ISO's copyright; see ISO/IEC 27001:2022.

gap from ISO 27001 → gap to ISO 27001 →

Wrong or missing mapping? Report it

Equivalents of Clause 6.1 in other frameworks
Framework	Requirement	Title	Link	Source / reason
NIST CSF 2.0	GV.OC-01 GV.OC-02	The organizational mission is understood and informs cybersecurity risk management; Internal and external stakeholders are understood, and their needs and expectations regarding cybersecurity risk management are understood and considered	Loosely related	No mapping. Only shares CSF GV.OC-01, GV.OC-02: related, not a mapping
CIS v8.1	—	No requirement	No mapping in our data	No mapping in our data (most CIS links are editorial: CIS's published crosswalk covers 49 of 153 safeguards).
SOC 2	CC3.1	Objectives specified clearly enough to identify risks	Loosely related	No mapping. Only shares CSF GV.OC-01: related, not a mapping
PCI DSS	12.1.1 12.1.4 12.8.1 12.8.5	Information security policy established and published; Executive responsibility for information security assigned…	Loosely related	No mapping. Only shares CSF GV.OC-01, GV.OC-02: related, not a mapping +2 more loosely related (not mappings) 12.9.1 Service providers acknowledge responsibilities to customers Loosely related Only shares CSF GV.OC-02: related, not a mapping 12.9.2 Service providers support customer compliance requests Loosely related Only shares CSF GV.OC-02: related, not a mapping
CMMC	RA.L2-3.11.1	Risk Assessments	Loosely related	No mapping. Only shares CSF GV.OC-02: related, not a mapping
800-53	PM-9 PM-11 PM-18 PM-30	Risk Management Strategy; Mission and Business Process Definition…	Loosely related	No mapping. Only shares CSF GV.OC-02, GV.OC-01: related, not a mapping +4 more loosely related (not mappings) SR-3 Supply Chain Controls and Processes Loosely related Only shares CSF GV.OC-02: related, not a mapping SR-5 Acquisition Strategies, Tools, and Methods Loosely related Only shares CSF GV.OC-02: related, not a mapping SR-6 Supplier Assessments and Reviews Loosely related Only shares CSF GV.OC-02: related, not a mapping SR-8 Notification Agreements Loosely related Only shares CSF GV.OC-02: related, not a mapping
HIPAA	—	No requirement	No mapping in our data	No mapping in our data.
GDPR	—	No requirement	No mapping in our data	No mapping in our data (only GDPR's security articles are mapped, editorially).
NIS2	2.1	Risk management framework	Crosswalk	ENISA NIS2 → ISO 27001 mapping 1 loosely related (not mappings) 1.1 Policy on the security of network and information systems Loosely related Only shares CSF GV.OC-02: related, not a mapping
Essential Eight	—	No requirement	No mapping in our data	No mapping in our data (Essential Eight links are editorial only).
DORA	Art.8(1)Art.11(5)	Identification; Response and recovery	Loosely related	No mapping. Only shares CSF GV.OC-01: related, not a mapping
CPS 234	—	No requirement	No mapping in our data	No mapping in our data (CPS 234 is principles-based and its links are editorial).
Cyber Essentials	—	No requirement	No mapping in our data	No mapping in our data (Cyber Essentials covers five technical controls only).

Crosswalk a published crosswalk (NIST, ENISA, CIS, PCI SSC) makes the link · Editorial ControlMapping's judgement where no crosswalk exists; the reason is shown · Loosely related only shares a CSF 2.0 outcome: worth checking, not a mapping · No mapping in our data nothing mapped in our data; often new work, but check the coverage notes. How links are sourced.