SOC 2 · CC3 Risk assessment
CC3.2
Risk identification and analysis
frameworkSOC 2 (Trust Services Criteria)
sectionCC3 Risk assessment
csf 2.0ID.RA-03 ID.RA-04 ID.RA-05 ID.RA-06
topicsRisk Assessment
frameworks0 10 3
Official text · not licensableSummary (ControlMapping's wording): Risk identification and analysis. The criterion text is AICPA's copyright.
Wrong or missing mapping? Report it
| Framework | Requirement | Title | Link | Source / reason |
|---|---|---|---|---|
| NIST CSF 2.0 | ID.RA-03ID.RA-04ID.RA-05ID.RA-06 | Internal and external threats to the organization are identified and recorded; Potential impacts and likelihoods of threats exploiting vulnerabilities are identified and recorded… | Editorial | Same topic: Risk Assessment (editorial pick) |
| ISO 27001 | Clause 6.1.2Clause 6.1.3Clause 8.2 | Information security risk assessment; Information security risk treatment… | Editorial | Same topic: Risk Assessment (editorial pick) ControlMapping editorial: Risk identification and analysis: ISO's risk assessment process (6.1.2) and performing it (8.2). 4 loosely related (not mappings)A.5.22 Monitoring, review and change management of supplier services Only shares CSF ID.RA-03: related, not a mapping |
| CIS v8.1 | — | No requirement | No mapping in our data | No mapping in our data (most CIS links are editorial: CIS's published crosswalk covers 49 of 153 safeguards). |
| PCI DSS | 12.3.1 | Targeted risk analysis for flexible-frequency requirements | Editorial | Same topic: Risk Assessment (editorial pick)6 loosely related (not mappings)6.3.3 Security patches installed promptly Only shares CSF ID.RA-05, ID.RA-06: related, not a mapping 11.3.1 Internal vulnerability scans every three months Only shares CSF ID.RA-06: related, not a mapping 11.3.1.1 Lower-ranked vulnerabilities handled by risk analysis Only shares CSF ID.RA-05: related, not a mapping |
| CMMC | RA.L2-3.11.1 | Risk Assessments | Editorial | Same topic: Risk Assessment (editorial pick)1 loosely related (not mappings) |
| 800-53 | RA-3RA-7 | Risk Assessment; Risk Response | Editorial | Same topic: Risk Assessment (editorial pick)10 loosely related (not mappings)…and 2 more in the downloads |
| HIPAA | §164.308(a)(1)(ii)(A) | Risk Analysis | Editorial | Same topic: Risk Assessment (editorial pick)3 loosely related (not mappings)§164.308(a)(1)(ii)(B) Risk Management Only shares CSF ID.RA-03, ID.RA-04, ID.RA-05: related, not a mapping §164.316(a) Policies and Procedures Only shares CSF ID.RA-03, ID.RA-04, ID.RA-05: related, not a mapping §164.308(a)(7)(ii)(E) Applications and Data Criticality Analysis Only shares CSF ID.RA-04, ID.RA-05: related, not a mapping |
| GDPR | Art.35(1)Art.35(7) | Data protection impact assessment; Data protection impact assessment | Editorial | Same topic: Risk Assessment (editorial pick) |
| NIS2 | 2.1 | Risk management framework | Editorial | Same topic: Risk Assessment (editorial pick)1 loosely related (not mappings)6.10 Vulnerability handling and disclosure Only shares CSF ID.RA-04, ID.RA-05, ID.RA-06: related, not a mapping |
| Essential Eight | — | No requirement | No mapping in our data | No mapping in our data (Essential Eight links are editorial only). |
| DORA | Art.8(2)Art.8(3)Art.8(7) | Identification; Identification… | Editorial | Same topic: Risk Assessment (editorial pick) |
| CPS 234 | Para 17Para 21 | Keep capability current as threats and vulnerabilities change; Timely controls commensurate with risk and asset life-cycle | Editorial | Same topic: Risk Assessment (editorial pick) |
| Cyber Essentials | — | No requirement | No mapping in our data | No mapping in our data (Cyber Essentials covers five technical controls only). |
Crosswalk a published crosswalk (NIST, ENISA, CIS, PCI SSC) makes the link · Editorial ControlMapping's judgement where no crosswalk exists; the reason is shown · only shares a CSF 2.0 outcome: worth checking, not a mapping · No mapping in our data nothing mapped in our data; often new work, but check the coverage notes. How links are sourced.