NIST Cybersecurity Framework 2.0 NIST-CSF-ID.RA-04: Potential impacts and likelihoods of threats exploiting vulnerabilities are identified and recorded

What else in your programme already covers this

This control maps to 81 controls across 36 other frameworks. If you already hold one of them, the evidence you collected for it is the starting point here rather than new work.

NIST SP 800-53 Rev 5 · 10 controls

NIST800-CA-8 CA-8 Penetration Testing
NIST800-CM-4 CM-4 Impact Analyses
NIST800-PE-23 PE-23 Facility Location
NIST800-PM-28 PM-28 Risk Framing
NIST800-RA-1 RA-1 Policy and Procedures
NIST800-RA-2 RA-2 Security Categorization
NIST800-RA-3 RA-3 Risk Assessment
NIST800-RA-5 RA-5 Vulnerability Monitoring and Scanning
NIST800-RA-9 RA-9 Criticality Analysis
SP800-53-RA Risk Assessment Family

ISO/IEC 42001:2023 · 7 controls

6.1.2 AI risk assessment
6.1.4 AI system impact assessment
8.2 AI risk assessment
8.4 AI system impact assessment
A.5 Assessing impacts of AI systems
A.5.2 AI system impact assessment process
A.5.4 Assessing AI system impact on individuals or groups of individuals

PCI DSS 4.0 · 6 controls

11.3.1 11.3.1 Quarterly internal vulnerability scans
11.3.1.1 11.3.1.1 Lower-risk vulnerabilities handled per risk analysis
11.3.2 11.3.2 Quarterly ASV external vulnerability scans
12.3.2 12.3.2 Targeted risk analysis for each customized-approach requirement
5.3.2.1 5.3.2.1 Targeted risk analysis sets malware scan frequency
6.3.1 6.3.1 Vulnerability identification and risk ranking

ISO 22301:2019 · 5 controls

6.1.2 Addressing risks and opportunities
8.2 Business impact analysis and risk assessment
8.2.1 General
8.2.2 Business impact analysis
8.2.3 Risk assessment

SOC 2 · 4 controls

SOC2-CC3.1 CC3.1 Objectives specified clearly enough to assess risk (COSO principle 6)
SOC2-CC3.2 CC3.2 Identifying and analysing risks to objectives (COSO principle 7)
SOC2-CC3.3 CC3.3 Considering fraud risk (COSO principle 8)
SOC2-CC9.1 CC9.1 Mitigating risks of business disruption

APRA CPS 230 Operational Risk Management · 3 controls

CPS230-34 Tailoring of the Testing Program
CPS230-P27 Comprehensive Assessment of the Operational Risk Profile
CPS230-P28 Risk Assessment Before Providing a Material Service to Another Party

Australian Information Security Manual · 3 controls

ISM-1163 Continuous monitoring plan
ISM-1633 System boundary, criticality and objectives
ISM-1921 Assessing compromise likelihood for exploited vulnerabilities

Cloud Security Alliance Cloud Controls Matrix (CCM) v4.0.1 · 3 controls

CCM-BCR-02 Risk Assessment and Impact Analysis
CCM-DSP-09 Data Protection Impact Assessment
CCM-GRC-02 Risk Management Program

FedRAMP High · 3 controls

CP-6(3) Alternate Storage Site | Accessibility (CP-6(3))
RA-3 Risk Assessment
RA-7 Risk Response

ISO 27701:2019 · 3 controls

5.6.2 Information security risk assessment
5.6.3 Information security risk treatment
7.2.5 Privacy impact assessment

APRA CPS 220 Risk Management · 2 controls

CPS220-14 Scenario Analysis and Stress Testing Programs
CPS220-P35 Required Content of Risk Management Policies and Procedures

ASEAN Data Management Framework · 2 controls

ADMF-4.2 Assess confidentiality, integrity and availability impact
ADMF-4.3 Assess business impact categories

CMMC 2.0 · 2 controls

CM.L2-3.4.4 Security Impact Analysis
RA.L2-3.11.1 Risk Assessments

FedRAMP Moderate · 2 controls

CP-6(3) Alternate Storage Site | Accessibility (CP-6(3))
RA-3 Risk Assessment

HIPAA Security Rule · 2 controls

164.308(a)(1)(ii)(A) Risk Analysis (Required)
164.308(a)(1)(ii)(B) Risk Management (Required)

ISO 27001:2022 · 2 controls

5.7 Threat intelligence
8.8 Management of technical vulnerabilities

ISO 27002:2022 · 2 controls

5.7 Threat intelligence
8.8 Management of technical vulnerabilities

NIST SP 800-66 Rev 2 · 2 controls

164.308(a)(1)(ii)(A) Risk Analysis (Required)
164.308(a)(1)(ii)(B) Risk Management (Required)

ANSSI Guide d'hygiene informatique (42 mesures, v2.0) · 1 control

ANSSI-HYG-41 Conduct a Formal Risk Analysis

APRA CPS 234 · 1 control

CPS234-20 Information Asset Classification

APRA SPS 220 Risk Management (Superannuation) · 1 control

SPS220-P11 Assessment of the Materiality of Each Risk

AWS Well-Architected Security Pillar · 1 control

SEC01-BP07 Identify threats and prioritize mitigations using a threat model

Azure Security Benchmark · 1 control

ASBv3-DS-1 Conduct threat modeling

C5 (Germany) · 1 control

C5-OIS-07 Application of the Risk Management Policy

CFTC System Safeguards (17 CFR 37, 38, 39, 49) · 1 control

CFTC-SS-17 Enterprise Technology Risk Assessment

CIS Controls v8 · 1 control

CIS-16.6 Establish and Maintain a Severity Rating System and Process for Application Vulnerabilities

GDPR · 1 control

GDPR-Art.35 Data protection impact assessment

NIS2 Directive · 1 control

Art.21.1 Take proportionate all-hazards measures calibrated to the entity's own risk exposure

NIST Cybersecurity Framework 1.0 · 1 control

ID.RA-4 ID.RA-4: Potential business impacts and likelihoods are identified

NIST Cybersecurity Framework 1.1 · 1 control

ID.RA-4 ID.RA-4: Potential business impacts and likelihoods are identified

NIST SP 800-161 Rev 1 · 1 control

161R1-RA-3 Risk Assessment

NIST SP 800-171 Rev 3 · 1 control

03.11.01 Risk Assessment

NIST SP 800-172 · 1 control

3.11.1e Threat-Aware Risk Assessment

NIST SP 800-218 · 1 control

SP800-218-RV.2.1 Assess, Prioritize, and Remediate Vulnerabilities

NIST SP 800-61 Rev. 3 · 1 control

ID.RA-04 ID.RA-04 Impacts and likelihoods recorded to determine risk

SEC Cybersecurity Disclosure Rule · 1 control

SEC-CYB-07 Material Effects of Cybersecurity Threats Disclosure

Every mapping shown was judged rather than inferred from wording similarity, and the ones that failed review are published too. See the coverage reports and what was rejected.