800-53 · PM Program Management
PM-9
Risk Management Strategy
frameworkNIST SP 800-53 Rev 5.2
sectionPM Program Management
csf 2.0DE.AE-04 GV.OC-02 GV.OV-01 GV.OV-02 GV.RM-01 GV.RM-02 GV.RM-03 GV.RM-04 GV.RM-05 GV.RM-06 GV.RM-07 GV.SC-03 GV.SC-09 ID.RA-04 ID.RA-06 PR.IR-04 RC.RP-04
topicsRisk Management
frameworks5 5 1
Official texta. Develops a comprehensive strategy to manage:
1. Security risk to organizational operations and assets, individuals, other organizations, and the Nation associated with the operation and use of organizational systems; and
2. Privacy risk to individuals resulting from the authorized processing of personally identifiable information;
b. Implement the risk management strategy consistently across the organization; and
c. Review and update the risk management strategy [Assignment: organization-defined frequency] or as required, to address organizational changes.NIST SP 800-53 Rev 5.2 control statement (public domain)
1. Security risk to organizational operations and assets, individuals, other organizations, and the Nation associated with the operation and use of organizational systems; and
2. Privacy risk to individuals resulting from the authorized processing of personally identifiable information;
b. Implement the risk management strategy consistently across the organization; and
c. Review and update the risk management strategy [Assignment: organization-defined frequency] or as required, to address organizational changes.NIST SP 800-53 Rev 5.2 control statement (public domain)
Wrong or missing mapping? Report it
| Framework | Requirement | Title | Link | Source / reason |
|---|---|---|---|---|
| NIST CSF 2.0 | GV.RM-01GV.RM-02GV.RM-03GV.RM-06 | Risk management objectives are established and agreed to by organizational stakeholders; Risk appetite and risk tolerance statements are established, communicated, and maintained… | Crosswalk | Same topic: Risk Management13 loosely related (not mappings)DE.AE-04 The estimated impact and scope of adverse events are understood Only shares CSF DE.AE-04: related, not a mapping GV.OC-02 Internal and external stakeholders are understood, and their needs and expectations regarding cybersecurity risk management are understood and considered Only shares CSF GV.OC-02: related, not a mapping GV.OV-01 Cybersecurity risk management strategy outcomes are reviewed to inform and adjust strategy and direction Only shares CSF GV.OV-01: related, not a mapping GV.OV-02 The cybersecurity risk management strategy is reviewed and adjusted to ensure coverage of organizational requirements and risks Only shares CSF GV.OV-02: related, not a mapping GV.RM-04 Strategic direction that describes appropriate risk response options is established and communicated Only shares CSF GV.RM-04: related, not a mapping GV.RM-05 Lines of communication across the organization are established for cybersecurity risks, including risks from suppliers and other third parties Only shares CSF GV.RM-05: related, not a mapping GV.RM-07 Strategic opportunities (i.e., positive risks) are characterized and are included in organizational cybersecurity risk discussions Only shares CSF GV.RM-07: related, not a mapping GV.SC-03 Cybersecurity supply chain risk management is integrated into cybersecurity and enterprise risk management, risk assessment, and improvement processes Only shares CSF GV.SC-03: related, not a mapping …and 5 more in the downloads |
| ISO 27001 | Clause 6.1.1Clause 6.1.3Clause 4.3Clause 4.4Clause 6.1.2Clause 6.2Clause 7.5.1Clause 7.5.2Clause 7.5.3Clause 10.1 | General; Information security risk treatment… | Crosswalk | Same topic: Risk Management NIST SP 800-53 → ISO 27001 mapping 21 loosely related (not mappings)A.5.1 Policies for information security Only shares CSF GV.OV-01, GV.OV-02, GV.RM-01, GV.RM-02…: related, not a mapping A.5.19 Information security in supplier relationships Only shares CSF GV.OV-01, GV.OV-02, GV.RM-05, GV.SC-03…: related, not a mapping Clause 8.1 Operational planning and control Only shares CSF GV.OC-02, GV.SC-03, RC.RP-04: related, not a mapping A.5.20 Addressing information security within supplier agreements Only shares CSF GV.SC-03, GV.SC-09: related, not a mapping A.5.21 Managing information security in the ICT supply chain Only shares CSF GV.SC-03, GV.SC-09: related, not a mapping Clause 9.1 Monitoring, measurement, analysis and evaluation Only shares CSF GV.OV-01, GV.OV-02: related, not a mapping …and 13 more in the downloads |
| CIS v8.1 | CIS 15.6 | Monitor Service Providers | No mapping. Only shares CSF GV.SC-09: related, not a mapping | |
| SOC 2 | CC3.1CC5.1CC9.1 | Objectives specified clearly enough to identify risks; Control activities that mitigate risks… | Editorial | Same topic: Risk Management (editorial pick)7 loosely related (not mappings)CC3.3 Considering the potential for fraud Only shares CSF ID.RA-04, ID.RA-06: related, not a mapping CC3.4 Identifying and assessing significant changes Only shares CSF ID.RA-04, ID.RA-06: related, not a mapping CC9.2 Managing vendor and business partner risk Only shares CSF GV.SC-03, GV.SC-09: related, not a mapping A1.1 Capacity management to meet availability commitments Only shares CSF RC.RP-04: related, not a mapping A1.2 Environmental protections, backups and recovery infrastructure Only shares CSF RC.RP-04: related, not a mapping |
| PCI DSS | 12.3.1 | Targeted risk analysis for flexible-frequency requirements | Crosswalk | Same topic: Risk Management47 loosely related (not mappings)12.3.4 Hardware and software technologies reviewed annually Only shares CSF GV.OV-02, GV.RM-03, GV.RM-06, GV.SC-03…: related, not a mapping 6.3.1 Vulnerabilities identified and risk-ranked Only shares CSF GV.RM-03, GV.RM-06, GV.SC-03, GV.SC-09: related, not a mapping 6.3.3 Security patches installed promptly Only shares CSF GV.RM-03, GV.RM-06, GV.SC-09, ID.RA-06: related, not a mapping 11.6.1 Payment page changes and tampering detected Only shares CSF GV.RM-03, GV.RM-06, GV.SC-03, GV.SC-09: related, not a mapping 12.10.1 Incident response plan ready to activate Only shares CSF GV.RM-04, GV.RM-05, ID.RA-06, RC.RP-04: related, not a mapping 9.5.1.2.1 Inspection frequency set by targeted risk analysis Only shares CSF GV.RM-03, GV.RM-06, GV.SC-09: related, not a mapping 10.7.1 Service providers detect security control failures Only shares CSF GV.OV-01, GV.OV-02, GV.RM-05: related, not a mapping 10.7.2 Critical security control failures detected and reported Only shares CSF GV.OV-01, GV.OV-02, GV.RM-05: related, not a mapping …and 39 more in the downloads |
| CMMC | RA.L2-3.11.1 | Risk Assessments | Crosswalk | Same topic: Risk Management |
| HIPAA | §164.308(a)(1)(ii)(B) | Risk Management | Editorial | Same topic: Risk Management (editorial pick)36 loosely related (not mappings)§164.316(a) Policies and Procedures Only shares CSF GV.OV-01, GV.RM-06, GV.RM-07, GV.SC-03…: related, not a mapping §164.308(a)(1)(ii)(A) Risk Analysis Only shares CSF GV.RM-06, GV.RM-07, GV.SC-03, GV.SC-09…: related, not a mapping §164.308(a)(6) Security Incident Procedures Only shares CSF GV.OV-01, GV.SC-03, RC.RP-04: related, not a mapping §164.316(b)(2)(ii) Availability Only shares CSF GV.OV-01, GV.SC-03, RC.RP-04: related, not a mapping §164.308(a)(1) Security Management Process Only shares CSF GV.OV-01, GV.SC-03: related, not a mapping §164.308(a)(3)(ii)(A) Authorization and/or Supervision Only shares CSF GV.OV-01, GV.SC-03: related, not a mapping …and 28 more in the downloads |
| GDPR | Art.24(1)Art.32(2) | Responsibility of the controller; Security of processing | Editorial | Same topic: Risk Management (editorial pick) |
| NIS2 | 2.17.1 | Risk management framework; Policies and procedures to assess the effectiveness of cybersecurity risk-management measures | Crosswalk | Same topic: Risk Management7 loosely related (not mappings)1.1 Policy on the security of network and information systems Only shares CSF GV.OC-02, GV.RM-03: related, not a mapping 6.10 Vulnerability handling and disclosure Only shares CSF ID.RA-04, ID.RA-06: related, not a mapping 2.3 Independent review of information and network security Only shares CSF GV.OV-02: related, not a mapping |
| Essential Eight | ISM-1228 | Cyber security events are analysed in a timely manner to identify cyber security incidents | No mapping. Only shares CSF DE.AE-04: related, not a mapping | |
| DORA | Art.5(2)(a)Art.6(1)Art.6(8)Art.16(1)Art.24(1) | Governance and organisation; ICT risk management framework… | Editorial | Same topic: Risk Management (editorial pick)10 loosely related (not mappings)Art.29(1) Preliminary assessment of ICT concentration risk at entity level Only shares CSF GV.SC-03, GV.SC-09: related, not a mapping Art.29(2) Preliminary assessment of ICT concentration risk at entity level Only shares CSF GV.SC-03, GV.SC-09: related, not a mapping …and 2 more in the downloads |
| CPS 234 | Para 13Para 15Para 27Para 31 | Board ultimately responsible for information security; Maintain a capability commensurate with threats… | Editorial | Same topic: Risk Management (editorial pick)4 loosely related (not mappings)Para 16 Assess third parties' information security capability Only shares CSF GV.SC-03, GV.SC-09: related, not a mapping Para 17 Keep capability current as threats and vulnerabilities change Only shares CSF ID.RA-04, ID.RA-06: related, not a mapping Para 21 Timely controls commensurate with risk and asset life-cycle Only shares CSF ID.RA-04, ID.RA-06: related, not a mapping Para 22 Evaluate the design of third parties' controls Only shares CSF GV.SC-03, GV.SC-09: related, not a mapping |
| Cyber Essentials | — | No requirement | No mapping in our data | No mapping in our data (Cyber Essentials covers five technical controls only). |
Crosswalk a published crosswalk (NIST, ENISA, CIS, PCI SSC) makes the link · Editorial ControlMapping's judgement where no crosswalk exists; the reason is shown · only shares a CSF 2.0 outcome: worth checking, not a mapping · No mapping in our data nothing mapped in our data; often new work, but check the coverage notes. How links are sourced.