Risk Response

frameworkNIST SP 800-53 Rev 5.2 sectionRA Risk Assessment csf 2.0GV.OC-05 GV.OV-01 GV.OV-02 GV.OV-03 GV.RM-01 GV.RM-03 GV.SC-03 GV.SC-09 GV.SC-10 ID.IM-01 ID.IM-02 ID.IM-03 ID.RA-05 ID.RA-06 RS.AN-08 topicsRisk Management, Risk Assessment frameworks6 4 2

Official textRespond to findings from security and privacy assessments, monitoring, and audits in accordance with organizational risk tolerance.NIST SP 800-53 Rev 5.2 control statement (public domain)

gap from 800-53 → gap to 800-53 →

Wrong or missing mapping? Report it

Equivalents of RA-7 in other frameworks
Framework	Requirement	Title	Link	Source / reason
NIST CSF 2.0	GV.RM-01 GV.RM-02 GV.RM-03 GV.RM-06 ID.RA-03 ID.RA-04 ID.RA-05 ID.RA-06	Risk management objectives are established and agreed to by organizational stakeholders; Risk appetite and risk tolerance statements are established, communicated, and maintained…	Crosswalk	Same topic: Risk Management, Risk Assessment 8 loosely related (not mappings) GV.OC-05 Outcomes, capabilities, and services that the organization depends on are understood and communicated Loosely related Only shares CSF GV.OC-05: related, not a mapping GV.OV-01 Cybersecurity risk management strategy outcomes are reviewed to inform and adjust strategy and direction Loosely related Only shares CSF GV.OV-01: related, not a mapping GV.OV-02 The cybersecurity risk management strategy is reviewed and adjusted to ensure coverage of organizational requirements and risks Loosely related Only shares CSF GV.OV-02: related, not a mapping GV.OV-03 Organizational cybersecurity risk management performance is evaluated and reviewed for adjustments needed Loosely related Only shares CSF GV.OV-03: related, not a mapping GV.SC-03 Cybersecurity supply chain risk management is integrated into cybersecurity and enterprise risk management, risk assessment, and improvement processes Loosely related Only shares CSF GV.SC-03: related, not a mapping GV.SC-09 Supply chain security practices are integrated into cybersecurity and enterprise risk management programs, and their performance is monitored throughout the technology product and service life cycle Loosely related Only shares CSF GV.SC-09: related, not a mapping GV.SC-10 Cybersecurity supply chain risk management plans include provisions for activities that occur after the conclusion of a partnership or service agreement Loosely related Only shares CSF GV.SC-10: related, not a mapping RS.AN-08 An incident's magnitude is estimated and validated Loosely related Only shares CSF RS.AN-08: related, not a mapping
ISO 27001	Clause 6.1.1 Clause 6.1.2 Clause 6.1.3 Clause 8.3 Clause 10.2	General; Information security risk assessment…	Crosswalk	Same topic: Risk Management, Risk Assessment NIST SP 800-53 → ISO 27001 mapping 20 loosely related (not mappings) A.5.19 Information security in supplier relationships Loosely related Only shares CSF GV.OV-01, GV.OV-02, GV.OV-03, GV.SC-03…: related, not a mapping A.5.1 Policies for information security Loosely related Only shares CSF GV.OV-01, GV.OV-02, GV.OV-03, GV.RM-01…: related, not a mapping A.5.20 Addressing information security within supplier agreements Loosely related Only shares CSF GV.OV-03, GV.SC-03, GV.SC-09, GV.SC-10: related, not a mapping Clause 9.1 Monitoring, measurement, analysis and evaluation Loosely related Only shares CSF GV.OV-01, GV.OV-02, GV.OV-03, ID.IM-03: related, not a mapping A.5.21 Managing information security in the ICT supply chain Loosely related Only shares CSF GV.SC-03, GV.SC-09, GV.SC-10: related, not a mapping A.5.35 Independent review of information security Loosely related Only shares CSF GV.OV-02, ID.IM-01, ID.IM-02: related, not a mapping A.5.7 Threat intelligence Loosely related Only shares CSF ID.RA-05, ID.RA-06: related, not a mapping A.5.22 Monitoring, review and change management of supplier services Loosely related Only shares CSF GV.SC-09, GV.SC-10: related, not a mapping …and 12 more in the downloads
CIS v8.1	CIS 15.6 CIS 15.7	Monitor Service Providers; Securely Decommission Service Providers	Loosely related	No mapping. Only shares CSF GV.SC-09, GV.SC-10: related, not a mapping
SOC 2	CC3.1 CC3.2 CC3.3 CC3.4 CC5.1 CC9.1	Objectives specified clearly enough to identify risks; Risk identification and analysis…	Editorial	Same topic: Risk Management, Risk Assessment (editorial pick) 3 loosely related (not mappings) CC9.2 Managing vendor and business partner risk Loosely related Only shares CSF GV.SC-03, GV.SC-09: related, not a mapping CC4.1 Ongoing and/or separate evaluations of controls Loosely related Only shares CSF GV.OV-03: related, not a mapping CC4.2 Communicating and remediating control deficiencies Loosely related Only shares CSF GV.OV-03: related, not a mapping
PCI DSS	12.3.1	Targeted risk analysis for flexible-frequency requirements	Crosswalk	Same topic: Risk Management, Risk Assessment 49 loosely related (not mappings) 12.3.4 Hardware and software technologies reviewed annually Loosely related Only shares CSF GV.OV-02, GV.OV-03, GV.RM-03, GV.SC-03…: related, not a mapping 6.3.3 Security patches installed promptly Loosely related Only shares CSF GV.RM-03, GV.SC-09, ID.IM-03, ID.RA-05…: related, not a mapping 6.3.1 Vulnerabilities identified and risk-ranked Loosely related Only shares CSF GV.RM-03, GV.SC-03, GV.SC-09, ID.RA-05: related, not a mapping 10.7.2 Critical security control failures detected and reported Loosely related Only shares CSF GV.OV-01, GV.OV-02, GV.OV-03, ID.IM-03: related, not a mapping 12.4.2 Service providers: quarterly reviews of operational tasks Loosely related Only shares CSF GV.OV-01, GV.OV-02, GV.OV-03, ID.IM-01: related, not a mapping 12.8.4 Service provider compliance monitored annually Loosely related Only shares CSF GV.OC-05, GV.OV-02, GV.SC-09, ID.IM-02: related, not a mapping 1.2.3 Accurate network diagram maintained Loosely related Only shares CSF GV.OC-05, GV.SC-10, RS.AN-08: related, not a mapping 1.2.4 Accurate account-data flow diagram maintained Loosely related Only shares CSF GV.OC-05, GV.SC-10, RS.AN-08: related, not a mapping …and 41 more in the downloads
CMMC	RA.L2-3.11.1	Risk Assessments	Crosswalk	Same topic: Risk Management, Risk Assessment 4 loosely related (not mappings) CA.L2-3.12.1 Security Control Assessment Loosely related Only shares CSF GV.OV-03, ID.IM-01, ID.IM-02, ID.IM-03: related, not a mapping IR.L2-3.6.1 Incident Handling Loosely related Only shares CSF ID.IM-01, ID.IM-02, ID.IM-03, RS.AN-08: related, not a mapping RA.L2-3.11.2 Vulnerability Scan Loosely related Only shares CSF GV.SC-10, ID.IM-01, ID.IM-02, ID.IM-03: related, not a mapping RA.L2-3.11.3 Vulnerability Remediation Loosely related Only shares CSF GV.SC-10, ID.IM-01, ID.IM-02, ID.IM-03: related, not a mapping
HIPAA	§164.308(a)(1)(ii)(A)§164.308(a)(1)(ii)(B)	Risk Analysis; Risk Management	Crosswalk	Same topic: Risk Assessment, Risk Management 32 loosely related (not mappings) §164.316(a) Policies and Procedures Loosely related Only shares CSF GV.OV-01, GV.SC-03, GV.SC-09, GV.SC-10…: related, not a mapping §164.308(a)(6) Security Incident Procedures Loosely related Only shares CSF GV.OV-01, GV.SC-03, ID.IM-01, ID.IM-02…: related, not a mapping §164.308(a)(8) Evaluation Loosely related Only shares CSF GV.OV-01, GV.OV-03, GV.SC-03, ID.IM-01…: related, not a mapping §164.308(a)(1) Security Management Process Loosely related Only shares CSF GV.OV-01, GV.SC-03, ID.IM-01, ID.IM-02…: related, not a mapping §164.308(a)(3) Workforce Security Loosely related Only shares CSF GV.OV-01, GV.SC-03, ID.IM-01, ID.IM-02…: related, not a mapping §164.308(a)(3)(ii)(A) Authorization and/or Supervision Loosely related Only shares CSF GV.OV-01, GV.SC-03, ID.IM-01, ID.IM-02…: related, not a mapping §164.308(a)(3)(ii)(B) Workforce Clearance Procedure Loosely related Only shares CSF GV.OV-01, GV.SC-03, ID.IM-01, ID.IM-02…: related, not a mapping §164.308(a)(3)(ii)(C) Termination Procedures Loosely related Only shares CSF GV.OV-01, GV.SC-03, ID.IM-01, ID.IM-02…: related, not a mapping …and 24 more in the downloads
GDPR	Art.24(1)Art.32(2)Art.35(1)Art.35(7)	Responsibility of the controller; Security of processing…	Editorial	Same topic: Risk Management, Risk Assessment (editorial pick) 2 loosely related (not mappings) Art.28(1) Processor Loosely related Only shares CSF GV.SC-03, GV.SC-09: related, not a mapping Art.5(2) Principles relating to processing of personal data Loosely related Only shares CSF GV.OV-03: related, not a mapping
NIS2	2.1 7.1	Risk management framework; Policies and procedures to assess the effectiveness of cybersecurity risk-management measures	Crosswalk	Same topic: Risk Management, Risk Assessment 8 loosely related (not mappings) 5.1 Supply chain security policy Loosely related Only shares CSF GV.OC-05, GV.SC-09, GV.SC-10: related, not a mapping 2.3 Independent review of information and network security Loosely related Only shares CSF GV.OV-02, GV.OV-03: related, not a mapping 6.10 Vulnerability handling and disclosure Loosely related Only shares CSF ID.RA-05, ID.RA-06: related, not a mapping 1.1 Policy on the security of network and information systems Loosely related Only shares CSF GV.RM-03: related, not a mapping 2.2 Compliance monitoring Loosely related Only shares CSF GV.OV-02: related, not a mapping 3.6 Post-incident reviews Loosely related Only shares CSF RS.AN-08: related, not a mapping 5.2 Directory of suppliers and service providers Loosely related Only shares CSF GV.OC-05: related, not a mapping 13.1 Supporting utilities Loosely related Only shares CSF GV.OC-05: related, not a mapping
Essential Eight	—	No requirement	No mapping in our data	No mapping in our data (Essential Eight links are editorial only).
DORA	Art.5(2)(a)Art.6(1)Art.6(8)Art.8(2)Art.8(3)Art.8(7)Art.16(1)Art.24(1)	Governance and organisation; ICT risk management framework…	Editorial	Same topic: Risk Management, Risk Assessment (editorial pick) 8 loosely related (not mappings) Art.28(2) General principles Loosely related Only shares CSF GV.SC-03, GV.SC-09: related, not a mapping Art.29(1) Preliminary assessment of ICT concentration risk at entity level Loosely related Only shares CSF GV.SC-03, GV.SC-09: related, not a mapping Art.29(2) Preliminary assessment of ICT concentration risk at entity level Loosely related Only shares CSF GV.SC-03, GV.SC-09: related, not a mapping Art.5(2)(f) Governance and organisation Loosely related Only shares CSF GV.OV-03: related, not a mapping Art.6(6) ICT risk management framework Loosely related Only shares CSF GV.OV-03: related, not a mapping Art.6(7) ICT risk management framework Loosely related Only shares CSF GV.OV-03: related, not a mapping Art.8(1) Identification Loosely related Only shares CSF GV.OC-05: related, not a mapping Art.11(5) Response and recovery Loosely related Only shares CSF GV.OC-05: related, not a mapping
CPS 234	Para 13 Para 15 Para 17 Para 21 Para 27 Para 31	Board ultimately responsible for information security; Maintain a capability commensurate with threats…	Editorial	Same topic: Risk Management, Risk Assessment (editorial pick) 5 loosely related (not mappings) Para 16 Assess third parties' information security capability Loosely related Only shares CSF GV.SC-03, GV.SC-09: related, not a mapping Para 22 Evaluate the design of third parties' controls Loosely related Only shares CSF GV.SC-03, GV.SC-09: related, not a mapping Para 32 Internal audit reviews control design and effectiveness Loosely related Only shares CSF GV.OV-03: related, not a mapping Para 33 Assurance provided by appropriately skilled personnel Loosely related Only shares CSF GV.OV-03: related, not a mapping Para 34 Internal audit assesses third-party assurance relied on Loosely related Only shares CSF GV.OV-03: related, not a mapping
Cyber Essentials	—	No requirement	No mapping in our data	No mapping in our data (Cyber Essentials covers five technical controls only).

Crosswalk a published crosswalk (NIST, ENISA, CIS, PCI SSC) makes the link · Editorial ControlMapping's judgement where no crosswalk exists; the reason is shown · Loosely related only shares a CSF 2.0 outcome: worth checking, not a mapping · No mapping in our data nothing mapped in our data; often new work, but check the coverage notes. How links are sourced.