NIST Cybersecurity Framework 2.0 NIST-CSF-GV.OV-03: Organizational cybersecurity risk management performance is evaluated and reviewed for adjustments needed

What else in your programme already covers this

This control maps to 89 controls across 30 other frameworks. If you already hold one of them, the evidence you collected for it is the starting point here rather than new work.

PCI DSS 4.0 · 9 controls

11.3.1 11.3.1 Quarterly internal vulnerability scans
11.4.2 11.4.2 Internal penetration testing annually and after change
12.1.2 12.1.2 Security policy reviewed annually and updated as needed
12.10.2 12.10.2 Annual review and testing of the incident response plan
12.10.6 12.10.6 Plan evolved from lessons learned and industry developments
12.4.2 12.4.2 Quarterly reviews that personnel follow security procedures
12.4.2.1 12.4.2.1 Documentation of quarterly operational reviews
5.2.3 5.2.3 Periodic evaluation of components not at risk from malware
7.2.4 7.2.4 User accounts and privileges reviewed every six months

ISO 27701:2019 · 7 controls

5.7 Performance evaluation
5.7.1 Monitoring, measurement, analysis and evaluation
5.7.2 Internal audit
5.7.3 Management review
5.8 Improvement
5.8.2 Continual improvement
6.15.2 Information security reviews

NIST SP 800-53 Rev 5 · 7 controls

NIST800-AU-6 AU-6 Audit Record Review, Analysis, and Reporting
NIST800-CA-2 CA-2 Control Assessments
NIST800-CA-7 CA-7 Continuous Monitoring
NIST800-PM-27 PM-27 Privacy Reporting
NIST800-PM-31 PM-31 Continuous Monitoring Strategy
NIST800-PM-6 PM-6 Measures of Performance
NIST800-RA-3 RA-3 Risk Assessment

FedRAMP High · 6 controls

AU-6 Audit Record Review, Analysis, and Reporting
CA-2 Control Assessments
CA-7 Continuous Monitoring
CA-7(4) Continuous Monitoring | Risk Monitoring (CA-7(4))
RA-3 Risk Assessment
SR-6 Supplier Assessments and Reviews (SR-6)

FedRAMP Moderate · 6 controls

AU-6 Audit Record Review, Analysis, and Reporting
CA-2 Control Assessments
CA-7 Continuous Monitoring
CA-7(4) Continuous Monitoring | Risk Monitoring (CA-7(4))
RA-3 Risk Assessment
SR-6 Supplier Assessments and Reviews (SR-6)

ISO 22301:2019 · 6 controls

10.1 Nonconformity and corrective action
8.5 Exercise programme
8.6 Evaluation of business continuity documentation and capabilities
9.1 Monitoring, measurement, analysis and evaluation
9.3 Management review
9.3.2 Management review input

APRA CPS 220 Risk Management · 5 controls

CPS220-11 Annual Audit Review of the Framework
CPS220-16 Management Information System and Data Framework
CPS220-18 Triennial Comprehensive Review of the Framework
CPS220-20 Annual Board Risk Management Declaration
CPS220-P47 Minimum Assessment Required by the Framework Review

Cloud Security Alliance Cloud Controls Matrix (CCM) v4.0.1 · 5 controls

CCM-AIS-03 Application Security Metrics
CCM-GRC-02 Risk Management Program
CCM-SEF-05 Incident Response Metrics
CCM-STA-11 Internal Compliance Testing
CCM-TVM-10 Vulnerability Management Metrics

ISO/IEC 42001:2023 · 5 controls

10.1 Continual improvement
6.1.2 AI risk assessment
9.1 Monitoring, measurement, analysis and evaluation
9.2 Internal audit
9.3 Management review

CIS Controls v8 · 4 controls

CIS-17.8 Conduct Post-Incident Reviews
CIS-18.3 Remediate Penetration Test Findings
CIS-7.7 Remediate Detected Vulnerabilities
CIS-8.11 Conduct Audit Log Reviews

APRA CPS 234 · 3 controls

CPS234-22 Systematic Control Testing Program
CPS234-25 Internal Audit Review of Information Security Controls
CPS234-P31 Annual Review of Testing Program Sufficiency

SOC 2 · 3 controls

SOC2-CC1.2 CC1.2 Board independence and oversight of internal control (COSO principle 2)
SOC2-CC4.1 CC4.1 Ongoing and separate evaluations of control (COSO principle 16)
SOC2-CC4.2 CC4.2 Evaluating and communicating control deficiencies (COSO principle 17)

APRA CPS 230 Operational Risk Management · 2 controls

CPS230-16 Internal Audit Review of the Business Continuity Plan
CPS230-P30 Monitoring, Review and Testing of Control Effectiveness

Australian Information Security Manual · 2 controls

ISM-0724 Cyber security metrics and KPIs
ISM-1918 CISO reporting to audit and risk committee

C5 (Germany) · 2 controls

C5-COM-03 Internal audits of the information security management system
C5-COM-04 Information on information security performance and management assessment of the ISMS

HIPAA Security Rule · 2 controls

164.308(a)(1)(ii)(B) Risk Management (Required)
164.308(a)(8) Evaluation (Standard)

NIST SP 800-66 Rev 2 · 2 controls

164.308(a)(1)(ii)(B) Risk Management (Required)
164.308(a)(8) Evaluation (Standard)

APRA SPS 220 Risk Management (Superannuation) · 1 control

SPS220-P15 Reasonable Assurance of Prudent and Sound Management

ASEAN Data Management Framework · 1 control

ADMF-1.4 Risk management function responsibilities

ASIC Cyber Resilience Good Practices · 1 control

ASIC-CR-GOV-4 End-to-end assurance processes

CFTC System Safeguards (17 CFR 37, 38, 39, 49) · 1 control

CFTC-SS-36 Internal Reporting and Review by Senior Management and the Board

DORA · 1 control

DORA-Art.50 Administrative penalties and remedial measures

GDPR · 1 control

GDPR-Art.24 Responsibility of the controller

ISO 27001:2022 · 1 control

5.35 Independent review of information security

ISO 27002:2022 · 1 control

5.35 Independent review of information security

NIS2 Directive · 1 control

Art.20.1 Management body approves the cybersecurity risk-management measures and oversees their implementation

NIST SP 800-161 Rev 1 · 1 control

161R1-PM-6 Measures of Performance

NIST SP 800-171A - Assessing Security Requirements for Controlled Unclassified Information (CUI) · 1 control

171A-03.12.03 Continuous Monitoring

NIST SP 800-172 · 1 control

3.12.1e Penetration Testing by Independent Agents

NIST SP 800-53A Rev. 5 · 1 control

53A-3.5 Assess Security and Privacy Capabilities

Every mapping shown was judged rather than inferred from wording similarity, and the ones that failed review are published too. See the coverage reports and what was rejected.