Azure Security Benchmark ASBv3-DS-1: Conduct threat modeling

What else in your programme already covers this

This control maps to 45 controls across 22 other frameworks. If you already hold one of them, the evidence you collected for it is the starting point here rather than new work.

Cloud Security Alliance Cloud Controls Matrix (CCM) v4.0.1 · 4 controls

CCM-AIS-02 Application Security Baseline Requirements
CCM-AIS-04 Secure Application Design and Development
CCM-BCR-02 Risk Assessment and Impact Analysis
CCM-DSP-07 Data Protection by Design and Default

FedRAMP High · 4 controls

RA-3 Risk Assessment
SA-11(2) Developer Testing and Evaluation | Threat Modeling and Vulnerability Analyses (SA-11(2))
SA-15(3) Development Process, Standards, and Tools | Criticality Analysis (SA-15(3))
SA-8 Security and Privacy Engineering Principles

FedRAMP Moderate · 4 controls

RA-3 Risk Assessment
SA-11(2) Developer Testing and Evaluation | Threat Modeling and Vulnerability Analyses (SA-11(2))
SA-15(3) Development Process, Standards, and Tools | Criticality Analysis (SA-15(3))
SA-8 Security and Privacy Engineering Principles

ISO 27001:2022 · 3 controls

5.8 Information security in project management
8.26 Application security requirements
8.27 Secure system architecture and engineering principles

ISO 27002:2022 · 3 controls

5.8 Information security in project management
8.26 Application security requirements
8.27 Secure system architecture and engineering principles

NIST Cybersecurity Framework 2.0 · 3 controls

NIST-CSF-ID.RA-03 Internal and external threats to the organization are identified and recorded
NIST-CSF-ID.RA-04 Potential impacts and likelihoods of threats exploiting vulnerabilities are identified and recorded
NIST-CSF-ID.RA-05 Threats, vulnerabilities, likelihoods, and impacts are used to understand inherent risk and inform risk response prioritization

C5 (Germany) · 2 controls

C5-DEV-05 Risk assessment, categorisation and prioritisation of changes
C5-OIS-06 Risk Management Policy

CIS Controls v8 · 2 controls

CIS-16.10 Apply Secure Design Principles in Application Architectures
CIS-16.14 Conduct Threat Modeling

CMMC 2.0 · 2 controls

RA.L2-3.11.1 Risk Assessments
SC.L2-3.13.2 Security Engineering

ISO 27701:2019 · 2 controls

6.11.1 Security requirements of information systems
7.2.5 Privacy impact assessment

NIST SP 800-161 Rev 1 · 2 controls

161R1-PM-16 Threat Awareness Program
161R1-RA-3 Risk Assessment

NIST SP 800-171 Rev 3 · 2 controls

03.11.01 Risk Assessment
03.16.01 Security Engineering Principles

NIST SP 800-218 · 2 controls

SP800-218-PW.1.1 Design Software to Meet Security Requirements
SP800-218-PW.1.2 Track Security Requirements, Risks, and Decisions

NIST SP 800-53 Rev 5 · 2 controls

NIST800-RA-3 RA-3 Risk Assessment
NIST800-SA-8 SA-8 Security and Privacy Engineering Principles

ANSSI Guide d'hygiene informatique (42 mesures, v2.0) · 1 control

ANSSI-HYG-41 Conduct a Formal Risk Analysis

APEC Cross-Border Privacy Rules (CBPR) System · 1 control

CBPR-PR-34 Risk assessments and third party certifications

AWS Well-Architected Security Pillar · 1 control

SEC01-BP07 Identify threats and prioritize mitigations using a threat model

Australia My Health Records Act 2012 · 1 control

MYHR-SEC-5 Security risk assessment

HIPAA Security Rule · 1 control

164.308(a)(1)(ii)(A) Risk Analysis (Required)

NIST SP 800-66 Rev 2 · 1 control

164.308(a)(1)(ii)(A) Risk Analysis (Required)

SOC 2 · 1 control

SOC2-CC3.2 CC3.2 Identifying and analysing risks to objectives (COSO principle 7)

Every mapping shown was judged rather than inferred from wording similarity, and the ones that failed review are published too. See the coverage reports and what was rejected.

You are reading one control. How much of Azure Security Benchmark have you already done?

Azure Security Benchmark ASBv3-DS-1 is one control. If you already hold one of the frameworks below, a reviewed crosswalk already says how much of Azure Security Benchmark your existing evidence covers. Hold NIST SP 800-53 Rev 5 and 71 of 85 Azure Security Benchmark controls already carry evidence.

If you hold NIST SP 800-53 Rev 583.5% covered · 14 gaps If you hold FedRAMP Moderate78.8% covered · 18 gaps If you hold Cloud Security Alliance Cloud Controls Matrix (CCM) v4.0.172.9% covered · 23 gaps If you hold ISO 27002:202269.4% covered · 26 gaps If you hold C5 (Germany)65.9% covered · 29 gaps If you hold ISO 27001:202261.2% covered · 33 gaps

Each report names every control your existing framework evidences, every one it does not, the reasoning behind each claim, and the claims that were argued against and rejected. 0 were rejected on the NIST SP 800-53 Rev 5 pair alone.

See the released pairs, $299 each Browse the graph free