Internal and external threats to the organization are identified and recorded

frameworkNIST Cybersecurity Framework 2.0 sectionIdentify (ID) topicsRisk Assessment, Threat Intelligence frameworks6 4 3

gap from NIST CSF 2.0 → gap to NIST CSF 2.0 →

Wrong or missing mapping? Report it

Equivalents of ID.RA-03 in other frameworks
Framework	Requirement	Title	Link	Source / reason
ISO 27001	A.5.7 Clause 6.1.2 Clause 6.1.3	Threat intelligence; Information security risk assessment…	Crosswalk	Same topic: Threat Intelligence, Risk Assessment 3 loosely related (not mappings) A.5.22 Monitoring, review and change management of supplier services Loosely related Only shares CSF ID.RA-03: related, not a mapping A.8.16 Monitoring activities Loosely related Only shares CSF ID.RA-03: related, not a mapping Clause 6.1.1 General Loosely related Only shares CSF ID.RA-03: related, not a mapping
CIS v8.1	—	No requirement	No mapping in our data	No mapping in our data (most CIS links are editorial: CIS's published crosswalk covers 49 of 153 safeguards).
SOC 2	CC3.2 CC3.3 CC3.4	Risk identification and analysis; Considering the potential for fraud…	Editorial	Same topic: Risk Assessment (editorial pick)
PCI DSS	6.3.1 12.3.1	Vulnerabilities identified and risk-ranked; Targeted risk analysis for flexible-frequency requirements	Crosswalk	Same topic: Threat Intelligence, Risk Assessment
CMMC	RA.L2-3.11.1 SI.L2-3.14.3	Risk Assessments; Security Alerts & Advisories	Crosswalk	Same topic: Risk Assessment, Threat Intelligence
800-53	PM-15 PM-16 RA-3 RA-7 SI-5	Security and Privacy Groups and Associations; Threat Awareness Program…	Crosswalk	Same topic: Threat Intelligence, Risk Assessment 1 loosely related (not mappings) PM-12 Insider Threat Program Loosely related Only shares CSF ID.RA-03: related, not a mapping
HIPAA	§164.308(a)(1)(ii)(A)	Risk Analysis	Crosswalk	Same topic: Risk Assessment 2 loosely related (not mappings) §164.308(a)(1)(ii)(B) Risk Management Loosely related Only shares CSF ID.RA-03: related, not a mapping §164.316(a) Policies and Procedures Loosely related Only shares CSF ID.RA-03: related, not a mapping
GDPR	Art.35(1)Art.35(7)	Data protection impact assessment; Data protection impact assessment	Editorial	Same topic: Risk Assessment (editorial pick)
NIS2	2.1	Risk management framework	Crosswalk	Same topic: Risk Assessment
Essential Eight	—	No requirement	No mapping in our data	No mapping in our data (Essential Eight links are editorial only).
DORA	Art.8(2)Art.8(3)Art.8(7)Art.13(1)Art.45(1)	Identification; Identification…	Editorial	Same topic: Risk Assessment, Threat Intelligence (editorial pick)
CPS 234	Para 17 Para 21	Keep capability current as threats and vulnerabilities change; Timely controls commensurate with risk and asset life-cycle	Editorial	Same topic: Risk Assessment, Threat Intelligence (editorial pick)
Cyber Essentials	—	No requirement	No mapping in our data	No mapping in our data (Cyber Essentials covers five technical controls only).

Crosswalk a published crosswalk (NIST, ENISA, CIS, PCI SSC) makes the link · Editorial ControlMapping's judgement where no crosswalk exists; the reason is shown · Loosely related only shares a CSF 2.0 outcome: worth checking, not a mapping · No mapping in our data nothing mapped in our data; often new work, but check the coverage notes. How links are sourced.