APRA CPS 220 Risk Management CPS220-P33: Risks Arising from Strategic Objectives and the Business Plan

What else in your programme already covers this

This control maps to 12 controls across 6 other frameworks. If you already hold one of them, the evidence you collected for it is the starting point here rather than new work.

NIST Cybersecurity Framework 2.0 · 5 controls

NIST-CSF-GV.OC-01 The organizational mission is understood and informs cybersecurity risk management
NIST-CSF-GV.RM-01 Risk management objectives are established and agreed to by organizational stakeholders
NIST-CSF-GV.RM-07 Strategic opportunities (i.e., positive risks) are characterized and are included in organizational cybersecurity risk discussions
NIST-CSF-ID.RA-05 Threats, vulnerabilities, likelihoods, and impacts are used to understand inherent risk and inform risk response prioritization
NIST-CSF-ID.RA-07 Changes and exceptions are managed, assessed for risk impact, recorded, and tracked

NIST SP 800-53 Rev 5 · 2 controls

NIST800-PM-11 PM-11 Mission and Business Process Definition
NIST800-RA-3 RA-3 Risk Assessment

SOC 2 · 2 controls

SOC2-CC3.1 CC3.1 Objectives specified clearly enough to assess risk (COSO principle 6)
SOC2-CC3.4 CC3.4 Identifying and assessing significant changes (COSO principle 9)

APRA CPS 230 Operational Risk Management · 1 control

25 Para 25 Assess the operational risk impact of business and strategic decisions

CMMC 2.0 · 1 control

RA.L2-3.11.1 Risk Assessments

NIST SP 800-161 Rev 1 · 1 control

161R1-PM-11 Mission and Business Process Definition

Every mapping shown was judged rather than inferred from wording similarity, and the ones that failed review are published too. See the coverage reports and what was rejected.