NIST Cybersecurity Framework 2.0 NIST-CSF-ID.AM-05: Assets are prioritized based on classification, criticality, resources, and impact on the mission

What else in your programme already covers this

This control maps to 73 controls across 34 other frameworks. If you already hold one of them, the evidence you collected for it is the starting point here rather than new work.

NIST SP 800-53 Rev 5 · 8 controls

NIST800-AC-16 AC-16 Security and Privacy Attributes
NIST800-CM-12 CM-12 Information Location
NIST800-CM-8 CM-8 System Component Inventory
NIST800-MP-3 MP-3 Media Marking
NIST800-PE-22 PE-22 Component Marking
NIST800-PM-5 PM-5 System Inventory
NIST800-RA-2 RA-2 Security Categorization
NIST800-RA-9 RA-9 Criticality Analysis

SOC 2 · 5 controls

SOC2-C1.1 C1.1 Identifying and maintaining confidential information
SOC2-CC3.1 CC3.1 Objectives specified clearly enough to assess risk (COSO principle 6)
SOC2-CC3.2 CC3.2 Identifying and analysing risks to objectives (COSO principle 7)
SOC2-CC6.1 CC6.1 Logical access security over protected information assets
SOC2-CC9.1 CC9.1 Mitigating risks of business disruption

ASEAN Data Management Framework · 4 controls

ADMF-3.3 Apply overarching categorisation considerations
ADMF-4.1 Establish a data categorisation matrix
ADMF-4.4 Assign datasets to risk tiers
ADMF-6.3 Review categories assigned to datasets

FedRAMP High · 4 controls

CP-2(8) Contingency Plan | Identify Critical Assets (CP-2(8))
RA-2 Security Categorization
RA-9 Criticality Analysis (RA-9)
SA-15(3) Development Process, Standards, and Tools | Criticality Analysis (SA-15(3))

FedRAMP Moderate · 4 controls

CP-2(8) Contingency Plan | Identify Critical Assets (CP-2(8))
RA-2 Security Categorization
RA-9 Criticality Analysis (RA-9)
SA-15(3) Development Process, Standards, and Tools | Criticality Analysis (SA-15(3))

ISO 27701:2019 · 4 controls

5.2.3 Determining the scope of the information security management system
6.5 Asset management
6.5.1 Responsibility for assets
6.5.2 Information classification

Australian Information Security Manual · 3 controls

ISM-0293 Classifying IT equipment
ISM-0323 Classifying media by data held
ISM-1633 System boundary, criticality and objectives

Azure Security Benchmark · 3 controls

ASBv3-AM-1 Track asset inventory and their risks
ASBv3-DP-1 Discover, classify, and label sensitive data
ASBv3-IM-2 Protect identity and authentication systems

ISO 27001:2022 · 3 controls

5.12 Classification of information
5.13 Labelling of information
5.9 Inventory of information and other associated assets

ISO 27002:2022 · 3 controls

5.12 Classification of information
5.13 Labelling of information
5.9 Inventory of information and other associated assets

ANSSI Guide d'hygiene informatique (42 mesures, v2.0) · 2 controls

ANSSI-HYG-04 Identify the Most Sensitive Information and Servers and Maintain a Network Diagram
ANSSI-HYG-09 Assign the Correct Rights on Sensitive Resources

APRA CPS 230 Operational Risk Management · 2 controls

CPS230-17 Mandatory Minimum Classification of Critical Operations
CPS230-26 Critical Operations Register, Continuity Plan and Activation

APRA CPS 234 · 2 controls

CPS234-20 Information Asset Classification
CPS234-21 Implementation of Information Security Controls

AWS Well-Architected Security Pillar · 2 controls

SEC07-BP01 Understand your data classification scheme
SEC07-BP02 Apply data protection controls based on data sensitivity

CFTC System Safeguards (17 CFR 37, 38, 39, 49) · 2 controls

CFTC-SS-17 Enterprise Technology Risk Assessment
CFTC-SS-35 Scope of Testing and Assessment

CIS Controls v8 · 2 controls

CIS-3.12 Segment Data Processing and Storage Based on Sensitivity
CIS-3.7 Establish and Maintain a Data Classification Scheme

Cloud Security Alliance Cloud Controls Matrix (CCM) v4.0.1 · 2 controls

CCM-DCS-05 Assets Classification
CCM-DSP-04 Data Classification

PCI DSS 4.0 · 2 controls

9.4.2 9.4.2 Classification of media by data sensitivity
7.3.1 7.3.1 Need-to-know access control system covers all components

Australia Consumer Data Right - Banking (CDR) · 1 control

AUCDR-IS-STEP2 Step 2 - Define the boundaries of the CDR data environment

Belgium CyberFundamentals · 1 control

BE-CF-15 Security categorization

C5 (Germany) · 1 control

C5-AM-06 Asset Classification and Labelling

CMMC 2.0 · 1 control

MP.L2-3.8.4 Media Markings

DORA · 1 control

DORA-Art.8 Identification

HIPAA Security Rule · 1 control

164.308(a)(7)(ii)(E) Applications and Data Criticality Analysis (Addressable)

ISO 22301:2019 · 1 control

8.2.2 Business impact analysis

ISO/IEC 42001:2023 · 1 control

A.4 Resources for AI systems

NIS2 Directive · 1 control

Art.21.2.i Human resources security, access control policies and asset management

NIST Cybersecurity Framework 1.0 · 1 control

ID.AM-5 ID.AM-5: Resources (e.g., hardware, devices, data, and software) are prioritized based on their classification, criticality, and business value

NIST Cybersecurity Framework 1.1 · 1 control

ID.AM-5 ID.AM-5: Resources (e.g., hardware, devices, data, time, personnel, and software) are prioritized based on their classification, criticality, and business value

NIST SP 800-161 Rev 1 · 1 control

161R1-RA-2 Security Categorization

NIST SP 800-171 Rev 3 · 1 control

03.08.04 Media Marking

NIST SP 800-61 Rev. 3 · 1 control

ID.AM-05 ID.AM-05 Asset priorities and dependencies direct protection, detection, response and recovery

NIST SP 800-66 Rev 2 · 1 control

164.308(a)(7)(ii)(E) Applications and Data Criticality Analysis (Addressable)

US Executive Order 14144 - Strengthening and Promoting Innovation in the Nation's Cybersecurity · 1 control

3(c)(vi) Sec. 3(c)(vi) (now 3(a)(vi)) Tell CISA which systems need extra controls or non-disruption periods

Every mapping shown was judged rather than inferred from wording similarity, and the ones that failed review are published too. See the coverage reports and what was rejected.