ISO 27701:2019 5.6.2: Information security risk assessment

What else in your programme already covers this

This control maps to 57 controls across 25 other frameworks. If you already hold one of them, the evidence you collected for it is the starting point here rather than new work.

NIST Cybersecurity Framework 2.0 · 10 controls

NIST-CSF-DE.AE-04 The estimated impact and scope of adverse events are understood
NIST-CSF-GV.RM-03 Cybersecurity risk management activities and outcomes are included in enterprise risk management processes
NIST-CSF-GV.RM-06 A standardized method for calculating, documenting, categorizing, and prioritizing cybersecurity risks is established and communicated
NIST-CSF-GV.RM-07 Strategic opportunities (i.e., positive risks) are characterized and are included in organizational cybersecurity risk discussions
NIST-CSF-GV.SC-03 Cybersecurity supply chain risk management is integrated into cybersecurity and enterprise risk management, risk assessment, and improvement processes
NIST-CSF-ID.RA-03 Internal and external threats to the organization are identified and recorded
NIST-CSF-ID.RA-04 Potential impacts and likelihoods of threats exploiting vulnerabilities are identified and recorded
NIST-CSF-ID.RA-05 Threats, vulnerabilities, likelihoods, and impacts are used to understand inherent risk and inform risk response prioritization
NIST-CSF-ID.RA-07 Changes and exceptions are managed, assessed for risk impact, recorded, and tracked
NIST-CSF-ID.RA-09 The authenticity and integrity of hardware and software are assessed prior to acquisition and use

NIST SP 800-53 Rev 5 · 9 controls

NIST800-CA-7 CA-7 Continuous Monitoring
NIST800-PM-14 PM-14 Testing, Training, and Monitoring
NIST800-PM-28 PM-28 Risk Framing
NIST800-PM-9 PM-9 Risk Management Strategy
NIST800-RA-1 RA-1 Policy and Procedures
NIST800-RA-3 RA-3 Risk Assessment
NIST800-RA-9 RA-9 Criticality Analysis
SP800-53-CA Assessment, Authorization, and Monitoring Family
SP800-53-RA Risk Assessment Family

SOC 2 · 6 controls

SOC2-CC3.1 CC3.1 Objectives specified clearly enough to assess risk (COSO principle 6)
SOC2-CC3.2 CC3.2 Identifying and analysing risks to objectives (COSO principle 7)
SOC2-CC3.4 CC3.4 Identifying and assessing significant changes (COSO principle 9)
SOC2-CC4.1 CC4.1 Ongoing and separate evaluations of control (COSO principle 16)
SOC2-CC9.1 CC9.1 Mitigating risks of business disruption
SOC2-PI1.3 PI1.3 Controls over system processing

EASA Part-IS - Information Security in Aviation · 3 controls

IS.D.OR.205 Information Security Risk Assessment
IS.I.OR.205 Information Security Risk Assessment
IS.OR.205 Information Security Risk Assessment

HIPAA Security Rule · 3 controls

164.308(a)(1)(i) Security Management Process (Standard)
164.308(a)(1)(ii)(A) Risk Analysis (Required)
164.308(a)(1)(ii)(B) Risk Management (Required)

NIST SP 800-66 Rev 2 · 3 controls

164.308(a)(1)(i) Security Management Process (Standard)
164.308(a)(1)(ii)(A) Risk Analysis (Required)
164.308(a)(1)(ii)(B) Risk Management (Required)

PCI DSS 4.0 · 3 controls

10.4.2.1 10.4.2.1 Periodic log review frequency set by targeted risk analysis
12.3.2 12.3.2 Targeted risk analysis for each customized-approach requirement
12.5.3 12.5.3 Scope review after significant organisational change

ISO/IEC 27003:2017 · 2 controls

27003-6.1.2 Information Security Risk Assessment
ISO27003-8.2 Information security risk assessment

ISO/IEC 29100:2024 · 2 controls

29100-6.10 Information security
ISO29100-5.10.10 Information Security

APEC Cross-Border Privacy Rules (CBPR) System · 1 control

CBPR-PR-34 Risk assessments and third party certifications

AWS Well-Architected Security Pillar · 1 control

SEC01-BP07 Identify threats and prioritize mitigations using a threat model

Australia Consumer Data Right - Banking (CDR) · 1 control

AUCDR-IS-STEP3 Step 3 - Have and maintain an information security capability

Australia My Health Records Act 2012 · 1 control

MYHR-SEC-5 Security risk assessment

C5 (Germany) · 1 control

C5-OIS-07 Application of the Risk Management Policy

CCPA/CPRA · 1 control

§1798.185(a)(15) Risk Assessments for High-Risk Processing

CFTC System Safeguards (17 CFR 37, 38, 39, 49) · 1 control

CFTC-SS-3 Information Security Category

CMMC 2.0 · 1 control

RA.L2-3.11.1 Risk Assessments

Cloud Security Alliance Cloud Controls Matrix (CCM) v4.0.1 · 1 control

CCM-GRC-02 Risk Management Program

FedRAMP High · 1 control

RA-3 Risk Assessment

GDPR · 1 control

GDPR-Art.35 Data protection impact assessment

ISO 27001:2022 · 1 control

5.25 Assessment and decision on information security events

ISO 28001:2007 Supply Chain Security Management · 1 control

ISO28001-4.3 Security risk assessment

NIST SP 800-171 Rev 3 · 1 control

03.11.01 Risk Assessment

Every mapping shown was judged rather than inferred from wording similarity, and the ones that failed review are published too. See the coverage reports and what was rejected.

You are reading one control. How much of ISO 27701:2019 have you already done?

ISO 27701:2019 5.6.2 is one control. If you already hold one of the frameworks below, a reviewed crosswalk already says how much of ISO 27701:2019 your existing evidence covers. Hold SOC 2 and 58 of 108 ISO 27701:2019 controls already carry evidence.

If you hold SOC 253.7% covered · 50 gaps If you hold Cloud Security Alliance Cloud Controls Matrix (CCM) v4.0.147.2% covered · 57 gaps If you hold NIST Cybersecurity Framework 2.047.2% covered · 57 gaps If you hold ISO 27001:202243.5% covered · 61 gaps If you hold Australia Consumer Data Right - Banking (CDR)35.2% covered · 70 gaps If you hold C5 (Germany)34.3% covered · 71 gaps

Each report names every control your existing framework evidences, every one it does not, the reasoning behind each claim, and the claims that were argued against and rejected. 289 were rejected on the SOC 2 pair alone.

See the released pairs, $299 each Browse the graph free