APRA CPS 220 Risk Management CPS220-04: Maintenance of a Risk Management Framework

What else in your programme already covers this

This control maps to 24 controls across 13 other frameworks. If you already hold one of them, the evidence you collected for it is the starting point here rather than new work.

NIST SP 800-53 Rev 5 · 4 controls

NIST800-PM-1 PM-1 Information Security Program Plan
NIST800-PM-9 PM-9 Risk Management Strategy
NIST800-RA-3 RA-3 Risk Assessment
NIST800-RA-7 RA-7 Risk Response

NIST Cybersecurity Framework 2.0 · 3 controls

NIST-CSF-GV.RM-01 Risk management objectives are established and agreed to by organizational stakeholders
NIST-CSF-GV.RM-03 Cybersecurity risk management activities and outcomes are included in enterprise risk management processes
NIST-CSF-ID.RA-06 Risk responses are chosen, prioritized, planned, tracked, and communicated

APRA SPS 220 Risk Management (Superannuation) · 2 controls

SPS220-17 Maintenance of a Risk Management Framework
SPS220-18 Framework Coverage of All Material Risks

Cloud Security Alliance Cloud Controls Matrix (CCM) v4.0.1 · 2 controls

CCM-GRC-02 Risk Management Program
CCM-GRC-05 Information Security Program

FedRAMP High · 2 controls

RA-1 Policy and Procedures
RA-3 Risk Assessment

FedRAMP Moderate · 2 controls

RA-1 Policy and Procedures
RA-3 Risk Assessment

NIST SP 800-161 Rev 1 · 2 controls

161R1-PM-28 Risk Framing
161R1-PM-9 Risk Management Strategy

SOC 2 · 2 controls

SOC2-CC3.2 CC3.2 Identifying and analysing risks to objectives (COSO principle 7)
SOC2-CC5.1 CC5.1 Selecting control activities that mitigate risk (COSO principle 10)

Australia Corporations Act 2001 (Cth) · 1 control

s912A-1d-h s 912A(1)(d) and (h) Have adequate resources and adequate risk management systems

C5 (Germany) · 1 control

C5-OIS-06 Risk Management Policy

CMMC 2.0 · 1 control

RA.L2-3.11.1 Risk Assessments

HIPAA Security Rule · 1 control

164.308(a)(1)(i) Security Management Process (Standard)

NIST SP 800-66 Rev 2 · 1 control

164.308(a)(1)(i) Security Management Process (Standard)

Every mapping shown was judged rather than inferred from wording similarity, and the ones that failed review are published too. See the coverage reports and what was rejected.