ISO 22301:2019 6.1.2: Addressing risks and opportunities

What else in your programme already covers this

This control maps to 95 controls across 45 other frameworks. If you already hold one of them, the evidence you collected for it is the starting point here rather than new work.

NIST SP 800-53 Rev 5 · 15 controls

NIST800-CM-1 CM-1 Policy and Procedures
NIST800-PE-23 PE-23 Facility Location
NIST800-PL-11 PL-11 Baseline Tailoring
NIST800-PM-11 PM-11 Mission and Business Process Definition
NIST800-PM-31 PM-31 Continuous Monitoring Strategy
NIST800-PM-8 PM-8 Critical Infrastructure Plan
NIST800-PM-9 PM-9 Risk Management Strategy
NIST800-RA-1 RA-1 Policy and Procedures
NIST800-RA-3 RA-3 Risk Assessment
NIST800-RA-7 RA-7 Risk Response
NIST800-SR-1 SR-1 Policy and Procedures
SP800-53-CA Assessment, Authorization, and Monitoring Family
SP800-53-IR Incident Response Family
SP800-53-PL Planning Family
SP800-53-RA Risk Assessment Family

NIST Cybersecurity Framework 2.0 · 9 controls

NIST-CSF-GV.OV-02 The cybersecurity risk management strategy is reviewed and adjusted to ensure coverage of organizational requirements and risks
NIST-CSF-GV.RM-02 Risk appetite and risk tolerance statements are established, communicated, and maintained
NIST-CSF-GV.RM-03 Cybersecurity risk management activities and outcomes are included in enterprise risk management processes
NIST-CSF-GV.RM-07 Strategic opportunities (i.e., positive risks) are characterized and are included in organizational cybersecurity risk discussions
NIST-CSF-GV.SC-03 Cybersecurity supply chain risk management is integrated into cybersecurity and enterprise risk management, risk assessment, and improvement processes
NIST-CSF-GV.SC-06 Planning and due diligence are performed to reduce risks before entering into formal supplier or other third-party relationships
NIST-CSF-ID.RA-03 Internal and external threats to the organization are identified and recorded
NIST-CSF-ID.RA-04 Potential impacts and likelihoods of threats exploiting vulnerabilities are identified and recorded
NIST-CSF-ID.RA-05 Threats, vulnerabilities, likelihoods, and impacts are used to understand inherent risk and inform risk response prioritization

HIPAA Security Rule · 5 controls

164.306 Security Standards: General Rules
164.308(a)(1)(i) Security Management Process (Standard)
164.308(a)(1)(ii)(A) Risk Analysis (Required)
164.308(a)(1)(ii)(B) Risk Management (Required)
164.308(a)(6)(i) Security Incident Procedures (Standard)

ISO 27002:2022 · 5 controls

5.21 Managing information security in the ICT supply chain
5.29 Information security during disruption
5.35 Independent review of information security
5.7 Threat intelligence
8.16 Monitoring activities

CIS Controls v8 · 4 controls

CIS-15.3 Classify Service Providers
CIS-15.5 Assess Service Providers
CIS-7.1 Establish and Maintain a Vulnerability Management Process
CIS-7.2 Establish and Maintain a Remediation Process

NIST SP 800-66 Rev 2 · 4 controls

164.308(a)(1)(i) Security Management Process (Standard)
164.308(a)(1)(ii)(A) Risk Analysis (Required)
164.308(a)(1)(ii)(B) Risk Management (Required)
164.308(a)(6)(i) Security Incident Procedures (Standard)

PCI DSS 4.0 · 4 controls

12.3.2 12.3.2 Targeted risk analysis for each customized-approach requirement
12.8.5 12.8.5 Responsibility allocation between entity and TPSPs
5.2.3.1 5.2.3.1 Targeted risk analysis sets evaluation frequency
5.3.2.1 5.3.2.1 Targeted risk analysis sets malware scan frequency

SOC 2 · 4 controls

SOC2-CC3.2 CC3.2 Identifying and analysing risks to objectives (COSO principle 7)
SOC2-CC3.4 CC3.4 Identifying and assessing significant changes (COSO principle 9)
SOC2-CC9.1 CC9.1 Mitigating risks of business disruption
SOC2-CC9.2 CC9.2 Assessing and managing vendor and business partner risk

ASIS SPC.1-2009 - Organizational Resilience Standard · 2 controls

4.3.1 Risk Assessment and Impact Analysis
SPC1-4.3.1 Risk Assessment and Impact Analysis

AWWA Cybersecurity Guidance for the Water Sector (American Water Works Association) · 2 controls

AWWA-1.2 Risk Assessment
AWWA-G430-3 Risk Assessment for Water Systems

CMMC 2.0 · 2 controls

CA.L2-3.12.2 Plan of Action
RA.L2-3.11.1 Risk Assessments

Cloud Security Alliance Cloud Controls Matrix (CCM) v4.0.1 · 2 controls

CCM-BCR-02 Risk Assessment and Impact Analysis
CCM-GRC-02 Risk Management Program

ISO/IEC 23894:2023 · 2 controls

ISO23894-6.3 AI Risk Assessment
6.4 Risk assessment

ISO/IEC 42001:2023 · 2 controls

6.1.2 AI risk assessment
6.1.3 AI risk treatment

NFPA 1600 - Standard on Continuity, Emergency, and Crisis Management · 2 controls

NFPA1600-04 Risk Assessment
NFPA1600-5.1 Risk Assessment

NIST SP 800-171 · 2 controls

171-RA-1 Risk Assessment
A.03.11.01 Risk Assessment Process

AICPA SOC 3 · 1 control

SOC3-RISK-ASSESS Risk Assessment Process

AML/CTF Act 2006 (Australia) · 1 control

AMLCTF-PartA-RiskAssess ML/TF Risk Assessment

APRA CPS 230 Operational Risk Management · 1 control

CPS230-24 Design and Embedding of Internal Controls

BSI IT-Grundschutz · 1 control

BSI-13 Risk assessment procedures

Belgium CyberFundamentals · 1 control

BE-CF-13 Risk assessment procedures

Bermuda Monetary Authority (BMA) Cyber Risk Management Code of Conduct · 1 control

BMA-6 Risk Assessment Process

C-TPAT - Customs-Trade Partnership Against Terrorism · 1 control

CTPAT-MSC-2 Risk Assessment

C5 (Germany) · 1 control

C5-OIS-07 Application of the Risk Management Policy

Canada ITSG-33 - IT Security Risk Management · 1 control

ITSG33-RA Risk Assessment (RA)

Digital Services Act (DSA) - Regulation (EU) 2022/2065 · 1 control

DSA-Art.34 Risk assessment

FBI CJIS Security Policy · 1 control

CJIS-17 Risk Assessment

FedRAMP High · 1 control

RA-3 Risk Assessment

FedRAMP Moderate · 1 control

RA-3 Risk Assessment

ISAE 3402 - Assurance Reports on Controls at a Service Organisation · 1 control

ISAE3402.11 Risk Assessment by Service Auditor

ISO 14001:2015 · 1 control

6.1.2 Environmental aspects

ISO 27001:2022 · 1 control

5.34 Privacy and protection of personal identifiable information (PII)

ISO 31000:2018 · 1 control

6.4 Risk assessment

ISO/IEC 27003:2017 · 1 control

27003-8.2 Risk Assessment Performance

ISO/IEC 27031:2011 · 1 control

27031-6.3 Risk Assessment for ICT Continuity

ISO/SAE 21434 · 1 control

21434-8 Risk Assessment Methods

NIST SP 800-161 Rev 1 · 1 control

161R1-RA-7 Risk Response

NIST SP 800-171 Rev 3 · 1 control

03.11.01 Risk Assessment

NY DFS 23 NYCRR 500 · 1 control

§500.9 Risk Assessment

Regulation (EU) 2023/1115 on deforestation-free supply chains · 1 control

EUDRDF-2 Risk Assessment and Risk Mitigation

SANS Incident Handler's Handbook and PICERL Methodology · 1 control

PICERL-P2 Risk Assessment

SOC 1 (SSAE 18 / ISAE 3402) · 1 control

CO-Other-1 Risk Assessment for ICFR

SSAE 18 - Attestation Standards (SOC Reporting) · 1 control

SSAE18-SOC1-02 Risk Assessment

UK Modern Slavery Act 2015 · 1 control

UKMSA-2 Risk Assessment and Due Diligence

US OFAC Sanctions Compliance Framework · 1 control

USOFAC-2 Risk Assessment

Every mapping shown was judged rather than inferred from wording similarity, and the ones that failed review are published too. See the coverage reports and what was rejected.