ISO/IEC 42001:2023 8.3: AI risk treatment

What else in your programme already covers this

This control maps to 57 controls across 20 other frameworks. If you already hold one of them, the evidence you collected for it is the starting point here rather than new work.

NIST SP 800-53 Rev 5 · 12 controls

NIST800-CA-5 CA-5 Plan of Action and Milestones
NIST800-CA-7 CA-7 Continuous Monitoring
NIST800-CM-3 CM-3 Configuration Change Control
NIST800-PL-7 PL-7 Concept of Operations
NIST800-PM-14 PM-14 Testing, Training, and Monitoring
NIST800-RA-5 RA-5 Vulnerability Monitoring and Scanning
NIST800-RA-7 RA-7 Risk Response
NIST800-SA-15 SA-15 Development Process, Standards, and Tools
NIST800-SA-16 SA-16 Developer-provided Training
NIST800-SA-17 SA-17 Developer Security and Privacy Architecture and Design
NIST800-SA-24 SA-24 Design For Cyber Resiliency
NIST800-SA-3 SA-3 System Development Life Cycle

PCI DSS 4.0 · 6 controls

10.7.3 10.7.3 Respond promptly to critical security control failures
11.4.4 11.4.4 Correct exploitable findings from penetration tests
6.5.1 6.5.1 Change control procedure for production
6.5.2 6.5.2 Confirm PCI DSS controls after significant change
6.5.3 6.5.3 Separate pre-production from production
6.5.4 6.5.4 Separate roles between production and pre-production

ISO 27001:2022 · 5 controls

5.37 Documented operating procedures
8.25 Secure development life cycle
8.27 Secure system architecture and engineering principles
8.31 Separation of development, test and production environments
8.32 Change management

ISO 27002:2022 · 5 controls

5.8 Information security in project management
8.25 Secure development life cycle
8.27 Secure system architecture and engineering principles
8.31 Separation of development, test and production environments
8.32 Change management

SOC 2 · 5 controls

SOC2-CC3.4 CC3.4 Identifying and assessing significant changes (COSO principle 9)
SOC2-CC4.1 CC4.1 Ongoing and separate evaluations of control (COSO principle 16)
SOC2-CC5.1 CC5.1 Selecting control activities that mitigate risk (COSO principle 10)
SOC2-CC8.1 CC8.1 Managing changes to procedures, software, data and infrastructure
SOC2-CC9.1 CC9.1 Mitigating risks of business disruption

NIST SP 800-218 · 4 controls

SP800-218-PS.1.1 Protect All Forms of Code from Unauthorized Modification
SP800-218-PW.4.1 Reuse Trusted Software Components
SP800-218-PW.4.2 Maintain Well-Secured In-House Components
SP800-218-RV.3.3 Review SDLC to Prevent Recurrence

CIS Controls v8 · 3 controls

CIS-16.1 Establish and Maintain a Secure Application Development Process
CIS-16.10 Apply Secure Design Principles in Application Architectures
CIS-16.5 Use Up-to-Date and Trusted Third-Party Software Components

NIST Cybersecurity Framework 2.0 · 3 controls

NIST-CSF-GV.RM-07 Strategic opportunities (i.e., positive risks) are characterized and are included in organizational cybersecurity risk discussions
NIST-CSF-ID.AM-08 Systems, hardware, software, services, and data are managed throughout their life cycles
NIST-CSF-ID.RA-06 Risk responses are chosen, prioritized, planned, tracked, and communicated

CMMC 2.0 · 2 controls

CA.L2-3.12.2 Plan of Action
SI.L2-3.14.1 Flaw Remediation

FedRAMP Moderate · 2 controls

CA-5 Plan of Action and Milestones
RA-7 Risk Response

FedRAMP High · 1 control

CA-5 Plan of Action and Milestones

HIPAA Security Rule · 1 control

164.308(a)(1)(ii)(B) Risk Management (Required)

ISO 22301:2019 · 1 control

8.3 Business continuity strategies and solutions

ISO 50001:2018 - Energy Management Systems · 1 control

8.3 Procurement

ISO 9001:2015 · 1 control

8.3 Design and development of products and services

NIST SP 800-66 Rev 2 · 1 control

164.308(a)(1)(ii)(B) Risk Management (Required)

Every mapping shown was judged rather than inferred from wording similarity, and the ones that failed review are published too. See the coverage reports and what was rejected.

You are reading one control. How much of ISO/IEC 42001:2023 have you already done?

ISO/IEC 42001:2023 8.3 is one control. If you already hold one of the frameworks below, a reviewed crosswalk already says how much of ISO/IEC 42001:2023 your existing evidence covers. Hold NIST AI Risk Management Framework (AI RMF 1.0) and 30 of 38 ISO/IEC 42001:2023 controls already carry evidence.

If you hold NIST AI Risk Management Framework (AI RMF 1.0)78.9% covered · 8 gaps If you hold EU AI Act57.9% covered · 16 gaps

Each report names every control your existing framework evidences, every one it does not, the reasoning behind each claim, and the claims that were argued against and rejected. 0 were rejected on the NIST AI Risk Management Framework (AI RMF 1.0) pair alone.

See the released pairs, $299 each Browse the graph free