800-53 · PM Program Management
PM-28
Risk Framing
frameworkNIST SP 800-53 Rev 5.2
sectionPM Program Management
csf 2.0DE.AE-04 GV.OC-03 GV.RM-04 GV.RM-06 GV.RM-07 GV.SC-09
topicsRisk Management
frameworks5 5 1
Official texta. Identify and document:
1. Assumptions affecting risk assessments, risk responses, and risk monitoring;
2. Constraints affecting risk assessments, risk responses, and risk monitoring;
3. Priorities and trade-offs considered by the organization for managing risk; and
4. Organizational risk tolerance;
b. Distribute the results of risk framing activities to [Assignment: organization-defined personnel]; and
c. Review and update risk framing considerations [Assignment: organization-defined frequency].NIST SP 800-53 Rev 5.2 control statement (public domain)
1. Assumptions affecting risk assessments, risk responses, and risk monitoring;
2. Constraints affecting risk assessments, risk responses, and risk monitoring;
3. Priorities and trade-offs considered by the organization for managing risk; and
4. Organizational risk tolerance;
b. Distribute the results of risk framing activities to [Assignment: organization-defined personnel]; and
c. Review and update risk framing considerations [Assignment: organization-defined frequency].NIST SP 800-53 Rev 5.2 control statement (public domain)
Wrong or missing mapping? Report it
| Framework | Requirement | Title | Link | Source / reason |
|---|---|---|---|---|
| NIST CSF 2.0 | GV.RM-01GV.RM-02GV.RM-03GV.RM-06 | Risk management objectives are established and agreed to by organizational stakeholders; Risk appetite and risk tolerance statements are established, communicated, and maintained… | Crosswalk | Same topic: Risk Management5 loosely related (not mappings)DE.AE-04 The estimated impact and scope of adverse events are understood Only shares CSF DE.AE-04: related, not a mapping GV.OC-03 Legal, regulatory, and contractual requirements regarding cybersecurity - including privacy and civil liberties obligations - are understood and managed Only shares CSF GV.OC-03: related, not a mapping GV.RM-04 Strategic direction that describes appropriate risk response options is established and communicated Only shares CSF GV.RM-04: related, not a mapping GV.RM-07 Strategic opportunities (i.e., positive risks) are characterized and are included in organizational cybersecurity risk discussions Only shares CSF GV.RM-07: related, not a mapping GV.SC-09 Supply chain security practices are integrated into cybersecurity and enterprise risk management programs, and their performance is monitored throughout the technology product and service life cycle Only shares CSF GV.SC-09: related, not a mapping |
| ISO 27001 | Clause 6.1.1Clause 6.1.3Clause 4.3Clause 6.1.2Clause 6.2Clause 7.4Clause 7.5.1Clause 7.5.2Clause 7.5.3 | General; Information security risk treatment… | Crosswalk | Same topic: Risk Management NIST SP 800-53 → ISO 27001 mapping 9 loosely related (not mappings)A.5.20 Addressing information security within supplier agreements Only shares CSF GV.OC-03, GV.SC-09: related, not a mapping A.5.19 Information security in supplier relationships Only shares CSF GV.SC-09: related, not a mapping A.5.21 Managing information security in the ICT supply chain Only shares CSF GV.SC-09: related, not a mapping A.5.22 Monitoring, review and change management of supplier services Only shares CSF GV.SC-09: related, not a mapping A.5.25 Assessment and decision on information security events Only shares CSF DE.AE-04: related, not a mapping A.5.31 Legal, statutory, regulatory and contractual requirements Only shares CSF GV.OC-03: related, not a mapping Clause 4.2 Understanding the needs and expectations of interested parties Only shares CSF GV.OC-03: related, not a mapping …and 1 more in the downloads |
| CIS v8.1 | CIS 15.6 | Monitor Service Providers | No mapping. Only shares CSF GV.SC-09: related, not a mapping | |
| SOC 2 | CC3.1CC5.1CC9.1 | Objectives specified clearly enough to identify risks; Control activities that mitigate risks… | Editorial | Same topic: Risk Management (editorial pick) |
| PCI DSS | 12.3.1 | Targeted risk analysis for flexible-frequency requirements | Crosswalk | Same topic: Risk Management38 loosely related (not mappings)6.3.1 Vulnerabilities identified and risk-ranked Only shares CSF GV.RM-06, GV.SC-09: related, not a mapping 6.3.3 Security patches installed promptly Only shares CSF GV.RM-06, GV.SC-09: related, not a mapping 9.5.1.2.1 Inspection frequency set by targeted risk analysis Only shares CSF GV.RM-06, GV.SC-09: related, not a mapping 11.6.1 Payment page changes and tampering detected Only shares CSF GV.RM-06, GV.SC-09: related, not a mapping 12.3.4 Hardware and software technologies reviewed annually Only shares CSF GV.RM-06, GV.SC-09: related, not a mapping 12.8.1 List of third-party service providers kept Only shares CSF GV.OC-03, GV.SC-09: related, not a mapping 12.8.4 Service provider compliance monitored annually Only shares CSF GV.OC-03, GV.SC-09: related, not a mapping 12.8.5 Responsibilities split with each provider documented Only shares CSF GV.OC-03, GV.SC-09: related, not a mapping …and 30 more in the downloads |
| CMMC | RA.L2-3.11.1 | Risk Assessments | Crosswalk | Same topic: Risk Management1 loosely related (not mappings) |
| HIPAA | §164.308(a)(1)(ii)(B) | Risk Management | Editorial | Same topic: Risk Management (editorial pick)31 loosely related (not mappings)§164.316(a) Policies and Procedures Only shares CSF GV.OC-03, GV.RM-06, GV.RM-07, GV.SC-09: related, not a mapping §164.308(a)(1)(ii)(A) Risk Analysis Only shares CSF GV.RM-06, GV.RM-07, GV.SC-09: related, not a mapping §164.308(a)(3)(ii)(A) Authorization and/or Supervision Only shares CSF GV.OC-03: related, not a mapping §164.308(a)(3)(ii)(B) Workforce Clearance Procedure Only shares CSF GV.OC-03: related, not a mapping …and 23 more in the downloads |
| GDPR | Art.24(1)Art.32(2) | Responsibility of the controller; Security of processing | Editorial | Same topic: Risk Management (editorial pick) |
| NIS2 | 2.17.1 | Risk management framework; Policies and procedures to assess the effectiveness of cybersecurity risk-management measures | Crosswalk | Same topic: Risk Management |
| Essential Eight | ISM-1228 | Cyber security events are analysed in a timely manner to identify cyber security incidents | No mapping. Only shares CSF DE.AE-04: related, not a mapping | |
| DORA | Art.5(2)(a)Art.6(1)Art.6(8)Art.16(1)Art.24(1) | Governance and organisation; ICT risk management framework… | Editorial | Same topic: Risk Management (editorial pick) |
| CPS 234 | Para 13Para 15Para 27Para 31 | Board ultimately responsible for information security; Maintain a capability commensurate with threats… | Editorial | Same topic: Risk Management (editorial pick)5 loosely related (not mappings)Para 16 Assess third parties' information security capability Only shares CSF GV.SC-09: related, not a mapping Para 22 Evaluate the design of third parties' controls Only shares CSF GV.SC-09: related, not a mapping Para 32 Internal audit reviews control design and effectiveness Only shares CSF GV.OC-03: related, not a mapping Para 33 Assurance provided by appropriately skilled personnel Only shares CSF GV.OC-03: related, not a mapping Para 34 Internal audit assesses third-party assurance relied on Only shares CSF GV.OC-03: related, not a mapping |
| Cyber Essentials | — | No requirement | No mapping in our data | No mapping in our data (Cyber Essentials covers five technical controls only). |
Crosswalk a published crosswalk (NIST, ENISA, CIS, PCI SSC) makes the link · Editorial ControlMapping's judgement where no crosswalk exists; the reason is shown · only shares a CSF 2.0 outcome: worth checking, not a mapping · No mapping in our data nothing mapped in our data; often new work, but check the coverage notes. How links are sourced.