Risk Assessment

frameworkNIST SP 800-53 Rev 5.2 sectionRA Risk Assessment csf 2.0DE.AE-07 GV.RM-06 GV.RM-07 GV.SC-03 GV.SC-09 GV.SC-10 ID.AM-05 ID.IM-01 ID.IM-02 ID.IM-03 ID.RA-01 ID.RA-03 ID.RA-04 ID.RA-05 RS.AN-08 topicsRisk Assessment frameworks6 4 0

Official texta. Conduct a risk assessment, including:
1. Identifying threats to and vulnerabilities in the system;
2. Determining the likelihood and magnitude of harm from unauthorized access, use, disclosure, disruption, modification, or destruction of the system, the information it processes, stores, or transmits, and any related information; and
3. Determining the likelihood and impact of adverse effects on individuals arising from the processing of personally identifiable information;
b. Integrate risk assessment results and risk management decisions from the organization and mission or business process perspectives with system-level risk assessments;
c. Document risk assessment results in [Selection: security and privacy plans; risk assessment report; [Assignment: organization-defined document] ];
d. Review risk assessment results [Assignment: organization-defined frequency];
e. Disseminate risk assessment results to [Assignment: organization-defined personnel or roles]; and
f. Update the risk assessment [Assignment: organization-defined frequency] or when there are significant changes to the system, its environment of operation, or other conditions that may impact the security or privacy state of the system.NIST SP 800-53 Rev 5.2 control statement (public domain)

gap from 800-53 → gap to 800-53 →

Wrong or missing mapping? Report it

Equivalents of RA-3 in other frameworks
Framework	Requirement	Title	Link	Source / reason
NIST CSF 2.0	ID.RA-03 ID.RA-04 ID.RA-05 ID.RA-06	Internal and external threats to the organization are identified and recorded; Potential impacts and likelihoods of threats exploiting vulnerabilities are identified and recorded…	Crosswalk	Same topic: Risk Assessment 9 loosely related (not mappings) DE.AE-07 Cyber threat intelligence and other contextual information are integrated into the analysis Loosely related Only shares CSF DE.AE-07: related, not a mapping GV.RM-06 A standardized method for calculating, documenting, categorizing, and prioritizing cybersecurity risks is established and communicated Loosely related Only shares CSF GV.RM-06: related, not a mapping GV.RM-07 Strategic opportunities (i.e., positive risks) are characterized and are included in organizational cybersecurity risk discussions Loosely related Only shares CSF GV.RM-07: related, not a mapping GV.SC-03 Cybersecurity supply chain risk management is integrated into cybersecurity and enterprise risk management, risk assessment, and improvement processes Loosely related Only shares CSF GV.SC-03: related, not a mapping GV.SC-09 Supply chain security practices are integrated into cybersecurity and enterprise risk management programs, and their performance is monitored throughout the technology product and service life cycle Loosely related Only shares CSF GV.SC-09: related, not a mapping GV.SC-10 Cybersecurity supply chain risk management plans include provisions for activities that occur after the conclusion of a partnership or service agreement Loosely related Only shares CSF GV.SC-10: related, not a mapping ID.AM-05 Assets are prioritized based on classification, criticality, resources, and impact on the mission Loosely related Only shares CSF ID.AM-05: related, not a mapping ID.RA-01 Vulnerabilities in assets are identified, validated, and recorded Loosely related Only shares CSF ID.RA-01: related, not a mapping …and 1 more in the downloads
ISO 27001	Clause 6.1.2 Clause 6.1.3 A.8.8 Clause 8.2 Clause 9.3.2	Information security risk assessment; Information security risk treatment…	Crosswalk	Same topic: Risk Assessment NIST SP 800-53 → ISO 27001 mapping 13 loosely related (not mappings) Clause 6.1.1 General Loosely related Only shares CSF GV.RM-07, GV.SC-09, GV.SC-10, ID.RA-03…: related, not a mapping A.5.19 Information security in supplier relationships Loosely related Only shares CSF GV.SC-03, GV.SC-09, GV.SC-10, ID.IM-02: related, not a mapping A.5.7 Threat intelligence Loosely related Only shares CSF DE.AE-07, ID.RA-03, ID.RA-05: related, not a mapping A.5.20 Addressing information security within supplier agreements Loosely related Only shares CSF GV.SC-03, GV.SC-09, GV.SC-10: related, not a mapping A.5.21 Managing information security in the ICT supply chain Loosely related Only shares CSF GV.SC-03, GV.SC-09, GV.SC-10: related, not a mapping A.5.22 Monitoring, review and change management of supplier services Loosely related Only shares CSF GV.SC-09, GV.SC-10, ID.RA-03: related, not a mapping A.5.1 Policies for information security Loosely related Only shares CSF GV.RM-06, GV.SC-03: related, not a mapping A.5.9 Inventory of information and other associated assets Loosely related Only shares CSF ID.AM-05: related, not a mapping …and 5 more in the downloads
CIS v8.1	CIS 3.7 CIS 7.1 CIS 15.6 CIS 15.7	Establish and Maintain a Data Classification Scheme; Establish and Maintain a Vulnerability Management Process…	Loosely related	No mapping. Only shares CSF ID.AM-05, ID.RA-01, GV.SC-09, GV.SC-10: related, not a mapping +10 more loosely related (not mappings) CIS 3.8 Document Data Flows Loosely related Only shares CSF ID.AM-05: related, not a mapping CIS 7.5 Perform Automated Vulnerability Scans of Internal Enterprise Assets Loosely related Only shares CSF ID.RA-01: related, not a mapping CIS 7.6 Perform Automated Vulnerability Scans of Externally-Exposed Enterprise Assets Loosely related Only shares CSF ID.RA-01: related, not a mapping CIS 7.7 Remediate Detected Vulnerabilities Loosely related Only shares CSF ID.RA-01: related, not a mapping …and 6 more in the downloads
SOC 2	CC3.2 CC3.3 CC3.4	Risk identification and analysis; Considering the potential for fraud…	Editorial	Same topic: Risk Assessment (editorial pick) 6 loosely related (not mappings) CC9.2 Managing vendor and business partner risk Loosely related Only shares CSF GV.SC-03, GV.SC-09: related, not a mapping C1.1 Identifying and protecting confidential information Loosely related Only shares CSF ID.AM-05: related, not a mapping CC3.1 Objectives specified clearly enough to identify risks Loosely related Only shares CSF GV.RM-06: related, not a mapping CC5.1 Control activities that mitigate risks Loosely related Only shares CSF GV.RM-06: related, not a mapping CC7.1 Detecting configuration changes and new vulnerabilities Loosely related Only shares CSF ID.RA-01: related, not a mapping CC9.1 Mitigating risks from business disruptions Loosely related Only shares CSF GV.RM-06: related, not a mapping
PCI DSS	12.3.1	Targeted risk analysis for flexible-frequency requirements	Crosswalk	Same topic: Risk Assessment 39 loosely related (not mappings) 6.3.1 Vulnerabilities identified and risk-ranked Loosely related Only shares CSF DE.AE-07, GV.RM-06, GV.SC-03, GV.SC-09…: related, not a mapping 12.3.4 Hardware and software technologies reviewed annually Loosely related Only shares CSF DE.AE-07, GV.RM-06, GV.SC-03, GV.SC-09…: related, not a mapping 6.3.3 Security patches installed promptly Loosely related Only shares CSF GV.RM-06, GV.SC-09, ID.IM-03, ID.RA-05: related, not a mapping 6.4.3 Payment page scripts authorised and integrity-checked Loosely related Only shares CSF DE.AE-07, GV.SC-03, GV.SC-09, GV.SC-10: related, not a mapping 11.6.1 Payment page changes and tampering detected Loosely related Only shares CSF GV.RM-06, GV.SC-03, GV.SC-09, ID.AM-05: related, not a mapping 6.3.2 Inventory of custom software and its components Loosely related Only shares CSF GV.SC-03, GV.SC-09, ID.RA-01: related, not a mapping 9.5.1.2.1 Inspection frequency set by targeted risk analysis Loosely related Only shares CSF GV.RM-06, GV.SC-09, ID.AM-05: related, not a mapping 12.8.3 Due diligence before engaging service providers Loosely related Only shares CSF GV.RM-06, GV.SC-03, GV.SC-10: related, not a mapping …and 31 more in the downloads
CMMC	RA.L2-3.11.1	Risk Assessments	Crosswalk	Same topic: Risk Assessment 10 loosely related (not mappings) RA.L2-3.11.2 Vulnerability Scan Loosely related Only shares CSF GV.SC-10, ID.IM-01, ID.IM-02, ID.IM-03…: related, not a mapping RA.L2-3.11.3 Vulnerability Remediation Loosely related Only shares CSF GV.SC-10, ID.IM-01, ID.IM-02, ID.IM-03…: related, not a mapping CA.L2-3.12.1 Security Control Assessment Loosely related Only shares CSF ID.IM-01, ID.IM-02, ID.IM-03, ID.RA-01: related, not a mapping CA.L2-3.12.3 Security Control Monitoring Loosely related Only shares CSF ID.IM-01, ID.IM-02, ID.IM-03, ID.RA-01: related, not a mapping CM.L2-3.4.9 User-Installed Software Loosely related Only shares CSF ID.IM-01, ID.IM-02, ID.IM-03, ID.RA-01: related, not a mapping IR.L2-3.6.1 Incident Handling Loosely related Only shares CSF ID.IM-01, ID.IM-02, ID.IM-03, RS.AN-08: related, not a mapping SI.L2-3.14.6 Monitor Communications for Attacks Loosely related Only shares CSF ID.IM-01, ID.IM-02, ID.IM-03, ID.RA-01: related, not a mapping SI.L2-3.14.7 Identify Unauthorized Use Loosely related Only shares CSF ID.IM-01, ID.IM-02, ID.IM-03, ID.RA-01: related, not a mapping …and 2 more in the downloads
HIPAA	§164.308(a)(1)(ii)(A)§164.308(a)(1)(ii)(B)§164.316(a)	Risk Analysis; Risk Management…	Crosswalk	Same topic: Risk Assessment NIST HIPAA → SP 800-53 crosswalk 33 loosely related (not mappings) §164.308(a)(7)(ii)(E) Applications and Data Criticality Analysis Loosely related Only shares CSF ID.AM-05, ID.IM-01, ID.IM-02, ID.IM-03…: related, not a mapping §164.308(a)(6) Security Incident Procedures Loosely related Only shares CSF GV.SC-03, ID.IM-01, ID.IM-02, ID.IM-03…: related, not a mapping §164.308(a)(8) Evaluation Loosely related Only shares CSF GV.SC-03, ID.IM-01, ID.IM-02, ID.IM-03…: related, not a mapping §164.308(a)(1) Security Management Process Loosely related Only shares CSF GV.SC-03, ID.IM-01, ID.IM-02, ID.IM-03: related, not a mapping §164.308(a)(1)(ii)(D) Information System Activity Review Loosely related Only shares CSF ID.IM-01, ID.IM-02, ID.IM-03, ID.RA-01: related, not a mapping §164.308(a)(3) Workforce Security Loosely related Only shares CSF GV.SC-03, ID.IM-01, ID.IM-02, ID.IM-03: related, not a mapping §164.308(a)(3)(ii)(A) Authorization and/or Supervision Loosely related Only shares CSF GV.SC-03, ID.IM-01, ID.IM-02, ID.IM-03: related, not a mapping §164.308(a)(3)(ii)(B) Workforce Clearance Procedure Loosely related Only shares CSF GV.SC-03, ID.IM-01, ID.IM-02, ID.IM-03: related, not a mapping …and 25 more in the downloads
GDPR	Art.35(1)Art.35(7)	Data protection impact assessment; Data protection impact assessment	Editorial	Same topic: Risk Assessment (editorial pick) 4 loosely related (not mappings) Art.28(1) Processor Loosely related Only shares CSF GV.SC-03, GV.SC-09: related, not a mapping Art.24(1) Responsibility of the controller Loosely related Only shares CSF GV.RM-06: related, not a mapping Art.32(1)(d) Security of processing Loosely related Only shares CSF ID.RA-01: related, not a mapping Art.32(2) Security of processing Loosely related Only shares CSF GV.RM-06: related, not a mapping
NIS2	2.1	Risk management framework	Crosswalk	Same topic: Risk Assessment 7 loosely related (not mappings) 6.10 Vulnerability handling and disclosure Loosely related Only shares CSF ID.RA-01, ID.RA-04, ID.RA-05: related, not a mapping 5.1 Supply chain security policy Loosely related Only shares CSF GV.SC-09, GV.SC-10: related, not a mapping 3.6 Post-incident reviews Loosely related Only shares CSF RS.AN-08: related, not a mapping 4.3 Crisis management Loosely related Only shares CSF DE.AE-07: related, not a mapping 6.5 Security testing Loosely related Only shares CSF ID.RA-01: related, not a mapping 7.1 Policies and procedures to assess the effectiveness of cybersecurity risk-management measures Loosely related Only shares CSF GV.RM-06: related, not a mapping 12.1 Asset classification Loosely related Only shares CSF ID.AM-05: related, not a mapping
Essential Eight	ISM-0304 ISM-1407 ISM-1501 ISM-1690	Applications other than office productivity suites, web browsers and their extensions…; The latest release, or the previous release, of operating systems are used…	Loosely related	No mapping. Only shares CSF ID.RA-01: related, not a mapping +25 more loosely related (not mappings) ISM-1691 Patches, updates or other vendor mitigations for vulnerabilities in office productivity suites, web browsers and their extensions, email clients, PDF applications, and security products are applied within two weeks of release Loosely related Only shares CSF ID.RA-01: related, not a mapping ISM-1692 Patches, updates or other vendor mitigations for vulnerabilities in office productivity suites, web browsers and their extensions, email clients, PDF applications, and security products are applied within 48… Loosely related Only shares CSF ID.RA-01: related, not a mapping ISM-1693 Patches, updates or other vendor mitigations for vulnerabilities in applications other… Loosely related Only shares CSF ID.RA-01: related, not a mapping ISM-1694 Patches, updates or other vendor mitigations for vulnerabilities in operating systems of internet-facing servers and internet-facing network devices are applied within two weeks… Loosely related Only shares CSF ID.RA-01: related, not a mapping …and 21 more in the downloads
DORA	Art.8(2)Art.8(3)Art.8(7)	Identification; Identification…	Editorial	Same topic: Risk Assessment (editorial pick) 14 loosely related (not mappings) Art.13(1) Learning and evolving Loosely related Only shares CSF DE.AE-07, ID.RA-03: related, not a mapping Art.28(2) General principles Loosely related Only shares CSF GV.SC-03, GV.SC-09: related, not a mapping Art.29(1) Preliminary assessment of ICT concentration risk at entity level Loosely related Only shares CSF GV.SC-03, GV.SC-09: related, not a mapping Art.29(2) Preliminary assessment of ICT concentration risk at entity level Loosely related Only shares CSF GV.SC-03, GV.SC-09: related, not a mapping Art.45(1) Information-sharing arrangements on cyber threat information and intelligence Loosely related Only shares CSF DE.AE-07, ID.RA-03: related, not a mapping Art.5(2)(a) Governance and organisation Loosely related Only shares CSF GV.RM-06: related, not a mapping Art.6(1) ICT risk management framework Loosely related Only shares CSF GV.RM-06: related, not a mapping Art.6(8) ICT risk management framework Loosely related Only shares CSF GV.RM-06: related, not a mapping …and 6 more in the downloads
CPS 234	Para 17 Para 21	Keep capability current as threats and vulnerabilities change; Timely controls commensurate with risk and asset life-cycle	Editorial	Same topic: Risk Assessment (editorial pick) 8 loosely related (not mappings) Para 16 Assess third parties' information security capability Loosely related Only shares CSF GV.SC-03, GV.SC-09: related, not a mapping Para 22 Evaluate the design of third parties' controls Loosely related Only shares CSF GV.SC-03, GV.SC-09: related, not a mapping Para 27 Systematic testing programme for control effectiveness Loosely related Only shares CSF GV.RM-06, ID.RA-01: related, not a mapping Para 13 Board ultimately responsible for information security Loosely related Only shares CSF GV.RM-06: related, not a mapping Para 15 Maintain a capability commensurate with threats Loosely related Only shares CSF GV.RM-06: related, not a mapping Para 20 Classify information assets by criticality and sensitivity Loosely related Only shares CSF ID.AM-05: related, not a mapping Para 30 Testing by skilled, functionally independent specialists Loosely related Only shares CSF ID.RA-01: related, not a mapping Para 31 Review the testing programme at least annually Loosely related Only shares CSF GV.RM-06: related, not a mapping
Cyber Essentials	CE 3	Security Update Management	Loosely related	No mapping. Only shares CSF ID.RA-01: related, not a mapping

Crosswalk a published crosswalk (NIST, ENISA, CIS, PCI SSC) makes the link · Editorial ControlMapping's judgement where no crosswalk exists; the reason is shown · Loosely related only shares a CSF 2.0 outcome: worth checking, not a mapping · No mapping in our data nothing mapped in our data; often new work, but check the coverage notes. How links are sourced.