NIST Cybersecurity Framework 2.0 NIST-CSF-ID.RA-07: Changes and exceptions are managed, assessed for risk impact, recorded, and tracked

What else in your programme already covers this

This control maps to 76 controls across 29 other frameworks. If you already hold one of them, the evidence you collected for it is the starting point here rather than new work.

ISO 27701:2019 · 7 controls

5.5.5 Documented information
5.6.1 Operational planning and control
5.6.2 Information security risk assessment
6.11.2 Security in development and support processes
6.9.1 Operational procedures and responsibilities
7.2.5 Privacy impact assessment
8.5.8 Change of subcontractor to process PII

PCI DSS 4.0 · 7 controls

1.2.2 1.2.2 Network connection and NSC changes under change control
10.2.1.5 10.2.1.5 Logs capture changes to identification and authentication credentials
12.3.2 12.3.2 Targeted risk analysis for each customized-approach requirement
12.5.3 12.5.3 Scope review after significant organisational change
2.2.5 2.2.5 Insecure services, protocols or daemons secured
6.5.1 6.5.1 Change control procedure for production
6.5.2 6.5.2 Confirm PCI DSS controls after significant change

NIST SP 800-53 Rev 5 · 6 controls

NIST800-CA-5 CA-5 Plan of Action and Milestones
NIST800-CA-7 CA-7 Continuous Monitoring
NIST800-CM-3 CM-3 Configuration Change Control
NIST800-CM-4 CM-4 Impact Analyses
NIST800-CM-5 CM-5 Access Restrictions for Change
NIST800-PM-4 PM-4 Plan of Action and Milestones Process

Cloud Security Alliance Cloud Controls Matrix (CCM) v4.0.1 · 5 controls

CCM-CCC-01 Change Management Policy and Procedures
CCM-CCC-02 Quality Testing
CCM-CCC-03 Change Management Technology
CCM-CCC-08 Exception Management
CCM-GRC-04 Policy Exception Process

FedRAMP High · 5 controls

CA-7(4) Continuous Monitoring | Risk Monitoring (CA-7(4))
CM-3 Configuration Change Control
CM-4 Impact Analyses
CM-4(2) Impact Analyses | Verification of Controls (CM-4(2))
CM-5 Access Restrictions for Change

FedRAMP Moderate · 5 controls

CA-7(4) Continuous Monitoring | Risk Monitoring (CA-7(4))
CM-3 Configuration Change Control
CM-4 Impact Analyses
CM-4(2) Impact Analyses | Verification of Controls (CM-4(2))
CM-5 Access Restrictions for Change

C5 (Germany) · 4 controls

C5-DEV-03 Policies for changes to information systems
C5-DEV-05 Risk assessment, categorisation and prioritisation of changes
C5-DEV-09 Approvals for provision in the production environment
C5-SP-03 Exceptions from Existing Policies and Instructions

APRA CPS 220 Risk Management · 3 controls

CPS220-P33 Risks Arising from Strategic Objectives and the Business Plan
CPS220-P48 Assessment Following Material Change Outside the Review Cycle
CPS220-P54 APRA Notification of Material Changes to the Institution

CMMC 2.0 · 3 controls

CM.L2-3.4.3 System Change Management
CM.L2-3.4.4 Security Impact Analysis
CM.L2-3.4.5 Access Restrictions for Change

NIST SP 800-171 Rev 3 · 3 controls

03.04.02 Configuration Settings
03.04.03 Configuration Change Control
03.04.04 Impact Analyses

AWS Well-Architected Security Pillar · 2 controls

SEC01-BP06 Automate deployment of standard security controls
SEC11-BP06 Deploy software programmatically

Australian Information Security Manual · 2 controls

ISM-0912 Change and configuration management plan
ISM-1211 Administration under change and configuration management

Azure Security Benchmark · 2 controls

AM-2 Use only approved services
ASBv3-PV-4 Audit and enforce secure configurations for compute resources

CIS Controls v8 · 2 controls

CIS-2.2 Ensure Authorized Software is Currently Supported
CIS-2.3 Address Unauthorized Software

ISO 27002:2022 · 2 controls

5.22 Monitoring, review and change management of supplier services
8.32 Change management

ISO/IEC 42001:2023 · 2 controls

6.3 Planning of changes
8.2 AI risk assessment

NIS2 Directive · 2 controls

Art.21.2.e Security in acquisition, development and maintenance, including vulnerability handling and disclosure
Art.21.4 Take corrective measures without undue delay on finding that the measures are not met

NIST SP 800-161 Rev 1 · 2 controls

161R1-CM-3 Configuration Change Control
161R1-CM-4 Impact Analysis

SOC 2 · 2 controls

SOC2-CC3.4 CC3.4 Identifying and assessing significant changes (COSO principle 9)
SOC2-CC8.1 CC8.1 Managing changes to procedures, software, data and infrastructure

APRA CPS 230 Operational Risk Management · 1 control

CPS230-P26 Assessment of Business and Strategic Decisions on the Risk Profile

APRA CPS 234 · 1 control

CPS234-P17 Active Maintenance of Capability Against Change

APRA SPS 220 Risk Management (Superannuation) · 1 control

SPS220-P31 Assessment Following Material Developments Outside the Review Cycle

ASEAN Data Management Framework · 1 control

ADMF-5.5 Manage and accept residual risk

CFTC System Safeguards (17 CFR 37, 38, 39, 49) · 1 control

CFTC-SS-32 Timely Advance Notice of Material Planned Changes

ISO 22301:2019 · 1 control

6.3 Planning changes to the business continuity management system

NIST Cybersecurity Framework 1.0 · 1 control

PR.IP-3 PR.IP-3: Configuration change control processes are in place

NIST Cybersecurity Framework 1.1 · 1 control

PR.IP-3 PR.IP-3: Configuration change control processes are in place

NIST SP 800-218 · 1 control

SP800-218-PW.1.2 Track Security Requirements, Risks, and Decisions

Every mapping shown was judged rather than inferred from wording similarity, and the ones that failed review are published too. See the coverage reports and what was rejected.

You are reading one control. How much of NIST Cybersecurity Framework 2.0 have you already done?

NIST Cybersecurity Framework 2.0 NIST-CSF-ID.RA-07 is one control. If you already hold one of the frameworks below, a reviewed crosswalk already says how much of NIST Cybersecurity Framework 2.0 your existing evidence covers. Hold ISO 27001:2022 and 73 of 106 NIST Cybersecurity Framework 2.0 controls already carry evidence.

If you hold ISO 27001:202268.9% covered · 33 gaps If you hold NIST SP 800-53 Rev 567.9% covered · 34 gaps If you hold C5 (Germany)67% covered · 35 gaps If you hold FedRAMP Moderate63.2% covered · 39 gaps If you hold ISO 27002:202258.5% covered · 44 gaps If you hold CIS Controls v853.8% covered · 49 gaps

Each report names every control your existing framework evidences, every one it does not, the reasoning behind each claim, and the claims that were argued against and rejected. 174 were rejected on the ISO 27001:2022 pair alone.

See the released pairs, $299 each Browse the graph free