NIST CSF 2.0 · Identify (ID)
ID.RA-06
Risk responses are chosen, prioritized, planned, tracked, and communicated
frameworkNIST Cybersecurity Framework 2.0
sectionIdentify (ID)
topicsRisk Assessment
frameworks6 4 3
Wrong or missing mapping? Report it
| Framework | Requirement | Title | Link | Source / reason |
|---|---|---|---|---|
| ISO 27001 | Clause 6.1.2Clause 6.1.3 | Information security risk assessment; Information security risk treatment | Crosswalk | Same topic: Risk Assessment1 loosely related (not mappings) |
| CIS v8.1 | — | No requirement | No mapping in our data | No mapping in our data (most CIS links are editorial: CIS's published crosswalk covers 49 of 153 safeguards). |
| SOC 2 | CC3.2CC3.3CC3.4 | Risk identification and analysis; Considering the potential for fraud… | Editorial | Same topic: Risk Assessment (editorial pick) |
| PCI DSS | 12.3.1 | Targeted risk analysis for flexible-frequency requirements | Crosswalk | Same topic: Risk Assessment4 loosely related (not mappings)11.3.1 Internal vulnerability scans every three months Only shares CSF ID.RA-06: related, not a mapping |
| CMMC | RA.L2-3.11.1 | Risk Assessments | Crosswalk | Same topic: Risk Assessment |
| 800-53 | RA-3RA-7 | Risk Assessment; Risk Response | Crosswalk | Same topic: Risk Assessment |
| HIPAA | §164.308(a)(1)(ii)(A) | Risk Analysis | Crosswalk | Same topic: Risk Assessment |
| GDPR | Art.35(1)Art.35(7) | Data protection impact assessment; Data protection impact assessment | Editorial | Same topic: Risk Assessment (editorial pick) |
| NIS2 | 2.1 | Risk management framework | Crosswalk | Same topic: Risk Assessment1 loosely related (not mappings) |
| Essential Eight | — | No requirement | No mapping in our data | No mapping in our data (Essential Eight links are editorial only). |
| DORA | Art.8(2)Art.8(3)Art.8(7) | Identification; Identification… | Editorial | Same topic: Risk Assessment (editorial pick) |
| CPS 234 | Para 17Para 21 | Keep capability current as threats and vulnerabilities change; Timely controls commensurate with risk and asset life-cycle | Editorial | Same topic: Risk Assessment (editorial pick) |
| Cyber Essentials | — | No requirement | No mapping in our data | No mapping in our data (Cyber Essentials covers five technical controls only). |
Crosswalk a published crosswalk (NIST, ENISA, CIS, PCI SSC) makes the link · Editorial ControlMapping's judgement where no crosswalk exists; the reason is shown · only shares a CSF 2.0 outcome: worth checking, not a mapping · No mapping in our data nothing mapped in our data; often new work, but check the coverage notes. How links are sourced.