800-53 · RA Risk Assessment
RA-8
Privacy Impact Assessments
Official textConduct privacy impact assessments for systems, programs, or other activities before:
a. Developing or procuring information technology that processes personally identifiable information; and
b. Initiating a new collection of personally identifiable information that:
1. Will be processed using information technology; and
2. Includes personally identifiable information permitting the physical or virtual (online) contacting of a specific individual, if identical questions have been posed to, or identical reporting requirements imposed on, ten or more individuals, other than agencies, instrumentalities, or employees of the federal government.NIST SP 800-53 Rev 5.2 control statement (public domain)
a. Developing or procuring information technology that processes personally identifiable information; and
b. Initiating a new collection of personally identifiable information that:
1. Will be processed using information technology; and
2. Includes personally identifiable information permitting the physical or virtual (online) contacting of a specific individual, if identical questions have been posed to, or identical reporting requirements imposed on, ten or more individuals, other than agencies, instrumentalities, or employees of the federal government.NIST SP 800-53 Rev 5.2 control statement (public domain)
Wrong or missing mapping? Report it
| Framework | Requirement | Title | Link | Source / reason |
|---|---|---|---|---|
| NIST CSF 2.0 | ID.RA-04 | Potential impacts and likelihoods of threats exploiting vulnerabilities are identified and recorded | No mapping. Only shares CSF ID.RA-04: related, not a mapping | |
| ISO 27001 | Clause 6.1.1Clause 6.1.2Clause 6.1.3 | General; Information security risk assessment… | No mapping. Only shares CSF ID.RA-04: related, not a mapping | |
| CIS v8.1 | — | No requirement | No mapping in our data | No mapping in our data (most CIS links are editorial: CIS's published crosswalk covers 49 of 153 safeguards). |
| SOC 2 | CC3.2CC3.3CC3.4 | Risk identification and analysis; Considering the potential for fraud… | No mapping. Only shares CSF ID.RA-04: related, not a mapping | |
| PCI DSS | 12.3.1 | Targeted risk analysis for flexible-frequency requirements | No mapping. Only shares CSF ID.RA-04: related, not a mapping | |
| CMMC | RA.L2-3.11.1 | Risk Assessments | No mapping. Only shares CSF ID.RA-04: related, not a mapping | |
| HIPAA | §164.308(a)(1)(ii)(A)§164.308(a)(1)(ii)(B)§164.308(a)(7)(ii)(E)§164.316(a) | Risk Analysis; Risk Management… | No mapping. Only shares CSF ID.RA-04: related, not a mapping | |
| GDPR | Art.35(1)Art.35(7) | Data protection impact assessment; Data protection impact assessment | No mapping. Only shares CSF ID.RA-04: related, not a mapping | |
| NIS2 | 2.16.10 | Risk management framework; Vulnerability handling and disclosure | No mapping. Only shares CSF ID.RA-04: related, not a mapping | |
| Essential Eight | — | No requirement | No mapping in our data | No mapping in our data (Essential Eight links are editorial only). |
| DORA | Art.8(2)Art.8(3)Art.8(7) | Identification; Identification… | No mapping. Only shares CSF ID.RA-04: related, not a mapping | |
| CPS 234 | Para 17Para 21 | Keep capability current as threats and vulnerabilities change; Timely controls commensurate with risk and asset life-cycle | No mapping. Only shares CSF ID.RA-04: related, not a mapping | |
| Cyber Essentials | — | No requirement | No mapping in our data | No mapping in our data (Cyber Essentials covers five technical controls only). |
Crosswalk a published crosswalk (NIST, ENISA, CIS, PCI SSC) makes the link · Editorial ControlMapping's judgement where no crosswalk exists; the reason is shown · only shares a CSF 2.0 outcome: worth checking, not a mapping · No mapping in our data nothing mapped in our data; often new work, but check the coverage notes. How links are sourced.