NIS2 · 2. Risk management policy

Risk management framework

frameworkNIS2 Implementing Regulation (EU) 2024/2690 section2. Risk management policy csf 2.0GV.RM-01 GV.RM-03 GV.RM-06 GV.RR-03 ID.RA-01 ID.RA-02 ID.RA-03 ID.RA-04 ID.RA-05 ID.RA-06 topicsRisk Management, Risk Assessment frameworks6 4 0

Official text · not licensableTitle from ENISA's guidance: Risk management framework. See the Annex to Implementing Regulation (EU) 2024/2690 for the legal text.

gap from NIS2 → gap to NIS2 →

Wrong or missing mapping? Report it

Equivalents of 2.1 in other frameworks
Framework	Requirement	Title	Link	Source / reason
NIST CSF 2.0	GV.RM-01 GV.RM-02 GV.RM-03 GV.RM-06 ID.RA-03 ID.RA-04 ID.RA-05 ID.RA-06	Risk management objectives are established and agreed to by organizational stakeholders; Risk appetite and risk tolerance statements are established, communicated, and maintained…	Crosswalk	Same topic: Risk Management, Risk Assessment 3 loosely related (not mappings) GV.RR-03 Adequate resources are allocated commensurate with the cybersecurity risk strategy, roles, responsibilities, and policies Loosely related Only shares CSF GV.RR-03: related, not a mapping ID.RA-01 Vulnerabilities in assets are identified, validated, and recorded Loosely related Only shares CSF ID.RA-01: related, not a mapping ID.RA-02 Cyber threat intelligence is received from information sharing forums and sources Loosely related Only shares CSF ID.RA-02: related, not a mapping
ISO 27001	Clause 6.1.1 Clause 6.1.2 Clause 6.1.3 A.5.7 A.5.19 A.5.20 A.5.21 Clause 6.1 Clause 6.2 Clause 8.2 Clause 8.3	General; Information security risk assessment…	Crosswalk	Same topic: Risk Management, Risk Assessment ENISA NIS2 → ISO 27001 mapping 7 loosely related (not mappings) A.5.1 Policies for information security Loosely related Only shares CSF GV.RM-01, GV.RM-03, GV.RM-06: related, not a mapping A.5.22 Monitoring, review and change management of supplier services Loosely related Only shares CSF ID.RA-02, ID.RA-03: related, not a mapping A.8.16 Monitoring activities Loosely related Only shares CSF ID.RA-02, ID.RA-03: related, not a mapping A.6.6 Confidentiality or non-disclosure agreements Loosely related Only shares CSF GV.RR-03: related, not a mapping A.8.8 Management of technical vulnerabilities Loosely related Only shares CSF ID.RA-01: related, not a mapping Clause 7.1 Resources Loosely related Only shares CSF GV.RR-03: related, not a mapping Clause 7.2 Competence Loosely related Only shares CSF GV.RR-03: related, not a mapping
CIS v8.1	CIS 7.1 CIS 7.5 CIS 7.6 CIS 7.7	Establish and Maintain a Vulnerability Management Process; Perform Automated Vulnerability Scans of Internal Enterprise Assets…	Loosely related	No mapping. Only shares CSF ID.RA-01: related, not a mapping +6 more loosely related (not mappings) CIS 16.6 Establish and Maintain a Severity Rating System and Process for Application Vulnerabilities Loosely related Only shares CSF ID.RA-01: related, not a mapping CIS 18.1 Establish and Maintain a Penetration Testing Program Loosely related Only shares CSF ID.RA-01: related, not a mapping CIS 18.2 Perform Periodic External Penetration Tests Loosely related Only shares CSF ID.RA-01: related, not a mapping CIS 18.3 Remediate Penetration Test Findings Loosely related Only shares CSF ID.RA-01: related, not a mapping …and 2 more in the downloads
SOC 2	CC3.1 CC3.2 CC3.3 CC3.4 CC5.1 CC9.1	Objectives specified clearly enough to identify risks; Risk identification and analysis…	Editorial	Same topic: Risk Management, Risk Assessment (editorial pick) 4 loosely related (not mappings) CC1.2 Board independence and oversight of internal control Loosely related Only shares CSF GV.RR-03: related, not a mapping CC1.3 Structures, reporting lines, authorities and responsibilities Loosely related Only shares CSF GV.RR-03: related, not a mapping CC1.5 Accountability for internal control responsibilities Loosely related Only shares CSF GV.RR-03: related, not a mapping CC7.1 Detecting configuration changes and new vulnerabilities Loosely related Only shares CSF ID.RA-01: related, not a mapping
PCI DSS	12.3.1	Targeted risk analysis for flexible-frequency requirements	Crosswalk	Same topic: Risk Management, Risk Assessment 25 loosely related (not mappings) 6.3.1 Vulnerabilities identified and risk-ranked Loosely related Only shares CSF GV.RM-03, GV.RM-06, ID.RA-01, ID.RA-05: related, not a mapping 6.3.3 Security patches installed promptly Loosely related Only shares CSF GV.RM-03, GV.RM-06, ID.RA-05, ID.RA-06: related, not a mapping 11.3.1.1 Lower-ranked vulnerabilities handled by risk analysis Loosely related Only shares CSF GV.RM-03, GV.RM-06, ID.RA-05: related, not a mapping 5.2.3.1 Re-evaluation frequency set by targeted risk analysis Loosely related Only shares CSF GV.RM-03, GV.RM-06: related, not a mapping 5.3.2.1 Scan frequency set by targeted risk analysis Loosely related Only shares CSF GV.RM-03, GV.RM-06: related, not a mapping 7.2.5.1 System and application account access periodically reviewed Loosely related Only shares CSF GV.RM-03, GV.RM-06: related, not a mapping 8.6.3 System account passwords protected and changed Loosely related Only shares CSF GV.RM-03, GV.RM-06: related, not a mapping 9.5.1.2.1 Inspection frequency set by targeted risk analysis Loosely related Only shares CSF GV.RM-03, GV.RM-06: related, not a mapping …and 17 more in the downloads
CMMC	RA.L2-3.11.1	Risk Assessments	Crosswalk	Same topic: Risk Management, Risk Assessment 8 loosely related (not mappings) SI.L2-3.14.3 Security Alerts & Advisories Loosely related Only shares CSF ID.RA-01, ID.RA-03: related, not a mapping CA.L2-3.12.1 Security Control Assessment Loosely related Only shares CSF ID.RA-01: related, not a mapping CA.L2-3.12.3 Security Control Monitoring Loosely related Only shares CSF ID.RA-01: related, not a mapping CM.L2-3.4.9 User-Installed Software Loosely related Only shares CSF ID.RA-01: related, not a mapping RA.L2-3.11.2 Vulnerability Scan Loosely related Only shares CSF ID.RA-01: related, not a mapping RA.L2-3.11.3 Vulnerability Remediation Loosely related Only shares CSF ID.RA-01: related, not a mapping SI.L2-3.14.6 Monitor Communications for Attacks Loosely related Only shares CSF ID.RA-01: related, not a mapping SI.L2-3.14.7 Identify Unauthorized Use Loosely related Only shares CSF ID.RA-01: related, not a mapping
800-53	PM-9 PM-28 RA-3 RA-7	Risk Management Strategy; Risk Framing…	Crosswalk	Same topic: Risk Management, Risk Assessment 21 loosely related (not mappings) PM-16 Threat Awareness Program Loosely related Only shares CSF ID.RA-02, ID.RA-03, ID.RA-05: related, not a mapping PM-30 Supply Chain Risk Management Strategy Loosely related Only shares CSF GV.RM-03, GV.RM-06, ID.RA-06: related, not a mapping SI-5 Security Alerts, Advisories, and Directives Loosely related Only shares CSF ID.RA-01, ID.RA-02, ID.RA-03: related, not a mapping PM-3 Information Security and Privacy Resources Loosely related Only shares CSF GV.RM-03, GV.RR-03: related, not a mapping PM-18 Privacy Program Plan Loosely related Only shares CSF GV.RM-06, ID.RA-06: related, not a mapping RA-2 Security Categorization Loosely related Only shares CSF ID.RA-04, ID.RA-05: related, not a mapping SR-2 Supply Chain Risk Management Plan Loosely related Only shares CSF GV.RM-01, GV.RM-03: related, not a mapping CA-2 Control Assessments Loosely related Only shares CSF ID.RA-01: related, not a mapping …and 13 more in the downloads
HIPAA	§164.308(a)(1)(ii)(A)§164.308(a)(1)(ii)(B)	Risk Analysis; Risk Management	Crosswalk	Same topic: Risk Assessment, Risk Management 5 loosely related (not mappings) §164.316(a) Policies and Procedures Loosely related Only shares CSF GV.RM-06, ID.RA-01, ID.RA-03, ID.RA-04…: related, not a mapping §164.308(a)(7)(ii)(E) Applications and Data Criticality Analysis Loosely related Only shares CSF ID.RA-04, ID.RA-05: related, not a mapping §164.308(a)(1)(ii)(D) Information System Activity Review Loosely related Only shares CSF ID.RA-01: related, not a mapping §164.308(a)(8) Evaluation Loosely related Only shares CSF ID.RA-01: related, not a mapping §164.316(b) Documentation Loosely related Only shares CSF ID.RA-01: related, not a mapping
GDPR	Art.24(1)Art.32(2)Art.35(1)Art.35(7)	Responsibility of the controller; Security of processing…	Editorial	Same topic: Risk Management, Risk Assessment (editorial pick) 3 loosely related (not mappings) Art.32(1)(d) Security of processing Loosely related Only shares CSF ID.RA-01: related, not a mapping Art.37(1) Designation of the data protection officer Loosely related Only shares CSF GV.RR-03: related, not a mapping Art.39(1) Tasks of the data protection officer Loosely related Only shares CSF GV.RR-03: related, not a mapping
Essential Eight	ISM-0304 ISM-1407 ISM-1501 ISM-1690	Applications other than office productivity suites, web browsers and their extensions…; The latest release, or the previous release, of operating systems are used…	Loosely related	No mapping. Only shares CSF ID.RA-01: related, not a mapping +25 more loosely related (not mappings) ISM-1691 Patches, updates or other vendor mitigations for vulnerabilities in office productivity suites, web browsers and their extensions, email clients, PDF applications, and security products are applied within two weeks of release Loosely related Only shares CSF ID.RA-01: related, not a mapping ISM-1692 Patches, updates or other vendor mitigations for vulnerabilities in office productivity suites, web browsers and their extensions, email clients, PDF applications, and security products are applied within 48… Loosely related Only shares CSF ID.RA-01: related, not a mapping ISM-1693 Patches, updates or other vendor mitigations for vulnerabilities in applications other… Loosely related Only shares CSF ID.RA-01: related, not a mapping ISM-1694 Patches, updates or other vendor mitigations for vulnerabilities in operating systems of internet-facing servers and internet-facing network devices are applied within two weeks… Loosely related Only shares CSF ID.RA-01: related, not a mapping …and 21 more in the downloads
DORA	Art.5(2)(a)Art.6(1)Art.6(8)Art.8(2)Art.8(3)Art.8(7)Art.16(1)Art.24(1)	Governance and organisation; ICT risk management framework…	Editorial	Same topic: Risk Management, Risk Assessment (editorial pick) 8 loosely related (not mappings) Art.13(1) Learning and evolving Loosely related Only shares CSF ID.RA-02, ID.RA-03: related, not a mapping Art.45(1) Information-sharing arrangements on cyber threat information and intelligence Loosely related Only shares CSF ID.RA-02, ID.RA-03: related, not a mapping Art.5(2)(c) Governance and organisation Loosely related Only shares CSF GV.RR-03: related, not a mapping Art.5(3) Governance and organisation Loosely related Only shares CSF GV.RR-03: related, not a mapping Art.6(4) ICT risk management framework Loosely related Only shares CSF GV.RR-03: related, not a mapping Art.25(1) Testing of ICT tools and systems Loosely related Only shares CSF ID.RA-01: related, not a mapping Art.26(1) Advanced testing of ICT tools, systems and processes based on TLPT Loosely related Only shares CSF ID.RA-01: related, not a mapping Art.27(1) Requirements for testers for the carrying out of TLPT Loosely related Only shares CSF ID.RA-01: related, not a mapping
CPS 234	Para 13 Para 15 Para 17 Para 21 Para 27 Para 31	Board ultimately responsible for information security; Maintain a capability commensurate with threats…	Editorial	Same topic: Risk Management, Risk Assessment (editorial pick) 2 loosely related (not mappings) Para 14 Define information security roles and responsibilities Loosely related Only shares CSF GV.RR-03: related, not a mapping Para 30 Testing by skilled, functionally independent specialists Loosely related Only shares CSF ID.RA-01: related, not a mapping
Cyber Essentials	CE 3	Security Update Management	Loosely related	No mapping. Only shares CSF ID.RA-01: related, not a mapping

Crosswalk a published crosswalk (NIST, ENISA, CIS, PCI SSC) makes the link · Editorial ControlMapping's judgement where no crosswalk exists; the reason is shown · Loosely related only shares a CSF 2.0 outcome: worth checking, not a mapping · No mapping in our data nothing mapped in our data; often new work, but check the coverage notes. How links are sourced.