风险评估
了解网络安全风险对运营和资产的影响。
风险评估由以下 NIST CSF 2.0 成果定义：ID.RA-03 (Internal and external threats to the organization are identified and recorded); ID.RA-04 (Potential impacts and likelihoods of threats exploiting vulnerabilities are identified and recorded); ID.RA-05 (Threats, vulnerabilities, likelihoods, and impacts are used to understand inherent risk and inform risk response prioritization); ID.RA-06 (Risk responses are chosen, prioritized, planned, tracked, and communicated)。 对照映射 通过 ISO 27001, PCI DSS, CMMC, 800-53, HIPAA 和 NIS2 中已发布的对照表完成映射。 编辑说明 在 SOC 2, GDPR, DORA 和 CPS 234 中经编辑映射。 本站数据中无映射 本站数据中 CIS v8.1, Essential Eight 和 Cyber Essentials 无映射。
| 框架 | 要求 | 标题 | 链接 | 来源 / 原因 |
|---|---|---|---|---|
| NIST CSF 2.0 | ID.RA-03ID.RA-04ID.RA-05ID.RA-06 | Internal and external threats to the organization are identified and recorded; Potential impacts and likelihoods of threats exploiting vulnerabilities are identified and recorded; Threats, vulnerabilities, likelihoods, and impacts are used to understand inherent risk and inform risk response prioritization… | 主题定义 | ID.RA-03 ID.RA-04 ID.RA-05 ID.RA-06 |
| ISO 27001 | Clause 6.1.2Clause 6.1.3 | Information security risk assessment; Information security risk treatment | 对照映射 | Clause 6.1.2: via ID.RA-03; ID.RA-04; ID.RA-05; NIST 800-53 map: RA-3 Clause 6.1.3: via ID.RA-03; ID.RA-04; ID.RA-05; ID.RA-06; NIST 800-53 map: RA-7 |
| CIS v8.1 | — | 无要求 | 本站数据中无映射 | 本站数据中没有 CIS v8.1 要求映射到此主题。 |
| SOC 2 | CC3.2CC3.4CC3.3 | Risk identification and analysis; Identifying and assessing significant changes; Considering the potential for fraud | 编辑说明 | AICPA's TSC mappings are not openly licensed; ControlMapping editorial mapping (criterion summaries are ours, not AICPA text). |
| PCI DSS | 12.3.1 | Targeted risk analysis for flexible-frequency requirements | 对照映射 | 12.3.1: via ID.RA-03; ID.RA-04; ID.RA-05 |
| CMMC | RA.L2-3.11.1 | Risk Assessments | 对照映射 | RA.L2-3.11.1: via 800-171r3 03.11.01 ↔ ID.RA-03, ID.RA-04, ID.RA-05 → RA-3; 800-171r2 Appendix D → RA-3 |
| 800-53 | RA-3RA-7 | Risk Assessment; Risk Response | 对照映射 | RA-3: via ID.RA-03; ID.RA-04; ID.RA-05 RA-7: via ID.RA-05; ID.RA-06 |
| HIPAA | §164.308(a)(1)(ii)(A) | Risk Analysis | 对照映射 | §164.308(a)(1)(ii)(A): via NIST HIPAA map: RA-3 |
| GDPR | Art.35(1)Art.35(7) | Data protection impact assessment; Data protection impact assessment | 编辑说明 | No official crosswalk exists for GDPR; ControlMapping editorial mapping. |
| NIS2 | 2.1 | Risk management framework | 对照映射 | 2.1: via ID.RA-03; ID.RA-04; ID.RA-05; ID.RA-06; ENISA ISO map: Clause 6.1.2, Clause 6.1.3 |
| Essential Eight | — | 无要求 | 本站数据中无映射 | 本站数据中没有 Essential Eight 要求映射到此主题。 |
| DORA | Art.8(2)Art.8(3)Art.8(7) | Identification; Identification; Identification | 编辑说明 | Art.8(2): Continuously identify sources of ICT risk and assess cyber threats and vulnerabilities; review risk scenarios at least yearly. Art.8(3): Perform a risk assessment on each major change to infrastructure, processes or procedures. Art.8(7): Assess the ICT risk of legacy systems at least yearly. |
| CPS 234 | Para 21Para 17 | Timely controls commensurate with risk and asset life-cycle; Keep capability current as threats and vulnerabilities change | 编辑说明 | Para 21: Controls must be commensurate with vulnerabilities, threats, criticality and potential consequences: a risk-based basis. Para 17: Keep the security capability current as vulnerabilities and threats change. |
| Cyber Essentials | — | 无要求 | 本站数据中无映射 | 本站数据中没有 Cyber Essentials 要求映射到此主题。 |
主题定义 定义本主题的 CSF 2.0 结果 · 对照映射 至少一项选择有已发布对照表作为依据 · 编辑说明 ControlMapping 的判断及理由 · 未映射，仅与该主题的 CSF 成果相同 · 本站数据中无映射 我们的数据中未映射任何内容；通常为新工作，但请查看覆盖范围说明. 方法说明.
要求编号和标题均按各框架官方发布的英文原文显示。
映射有误或缺失？ 报告
关于风险评估
风险评估对组织资产和运营所面临的威胁、脆弱性及潜在影响进行结构化评价。从业人员通常采用定性或定量方法对风险进行评分，并借助漏洞扫描器、渗透测试和威胁建模等工具收集数据。ISO 27001要求在计划的时间间隔内以及发生重大变更后开展风险评估（8.2），HIPAA要求进行准确、全面且持续更新的风险分析；评估发现应跟踪至风险处置环节。