Risk appetite and risk tolerance statements are established, communicated, and maintained

frameworkNIST Cybersecurity Framework 2.0 sectionGovern (GV) topicsRisk Management frameworks5 5 3

gap from NIST CSF 2.0 → gap to NIST CSF 2.0 →

Wrong or missing mapping? Report it

Equivalents of GV.RM-02 in other frameworks
Framework	Requirement	Title	Link	Source / reason
ISO 27001	Clause 6.1.1 Clause 6.1.3	General; Information security risk treatment	Crosswalk	Same topic: Risk Management 2 loosely related (not mappings) A.5.1 Policies for information security Loosely related Only shares CSF GV.RM-02: related, not a mapping Clause 6.1.2 Information security risk assessment Loosely related Only shares CSF GV.RM-02: related, not a mapping
CIS v8.1	—	No requirement	No mapping in our data	No mapping in our data (most CIS links are editorial: CIS's published crosswalk covers 49 of 153 safeguards).
SOC 2	CC3.1 CC5.1 CC9.1	Objectives specified clearly enough to identify risks; Control activities that mitigate risks…	Editorial	Same topic: Risk Management (editorial pick)
PCI DSS	12.3.1	Targeted risk analysis for flexible-frequency requirements	Crosswalk	Same topic: Risk Management
CMMC	RA.L2-3.11.1	Risk Assessments	Crosswalk	Same topic: Risk Management
800-53	PM-9 PM-28 RA-7	Risk Management Strategy; Risk Framing…	Crosswalk	Same topic: Risk Management
HIPAA	§164.308(a)(1)(ii)(B)	Risk Management	Editorial	Same topic: Risk Management (editorial pick)
GDPR	Art.24(1)Art.32(2)	Responsibility of the controller; Security of processing	Editorial	Same topic: Risk Management (editorial pick)
NIS2	2.1 7.1	Risk management framework; Policies and procedures to assess the effectiveness of cybersecurity risk-management measures	Crosswalk	Same topic: Risk Management
Essential Eight	—	No requirement	No mapping in our data	No mapping in our data (Essential Eight links are editorial only).
DORA	Art.5(2)(a)Art.6(1)Art.6(8)Art.16(1)Art.24(1)	Governance and organisation; ICT risk management framework…	Editorial	Same topic: Risk Management (editorial pick)
CPS 234	Para 13 Para 15 Para 27 Para 31	Board ultimately responsible for information security; Maintain a capability commensurate with threats…	Editorial	Same topic: Risk Management (editorial pick)
Cyber Essentials	—	No requirement	No mapping in our data	No mapping in our data (Cyber Essentials covers five technical controls only).

Crosswalk a published crosswalk (NIST, ENISA, CIS, PCI SSC) makes the link · Editorial ControlMapping's judgement where no crosswalk exists; the reason is shown · Loosely related only shares a CSF 2.0 outcome: worth checking, not a mapping · No mapping in our data nothing mapped in our data; often new work, but check the coverage notes. How links are sourced.