Frameworks / NIST Cybersecurity Framework 2.0 / NIST-CSF-ID.RA-09 What else in your programme already covers this This control maps to 189 controls across 100 other frameworks. If you already hold one of them, the evidence you collected for it is the starting point here rather than new work.
AU-6 Audit Record Review, Analysis, and Reporting CA-2(1) Independent Assessors CA-2(3) Control Assessments | Leveraging Results from External Organizations (CA-2(3)) CA-7(4) Continuous Monitoring | Risk Monitoring (CA-7(4)) RA-1 Policy and Procedures RA-3 Risk Assessment AU-6 Audit Record Review, Analysis, and Reporting CA-2(1) Independent Assessors CA-2(3) Control Assessments | Leveraging Results from External Organizations (CA-2(3)) CA-7(4) Continuous Monitoring | Risk Monitoring (CA-7(4)) RA-1 Policy and Procedures RA-3 Risk Assessment SOC2-CC2.1 CC2.1 Relevant, quality information to support internal control (COSO principle 13) SOC2-CC3.1 CC3.1 Objectives specified clearly enough to assess risk (COSO principle 6) SOC2-CC3.2 CC3.2 Identifying and analysing risks to objectives (COSO principle 7) SOC2-CC3.4 CC3.4 Identifying and assessing significant changes (COSO principle 9) SOC2-CC4.1 CC4.1 Ongoing and separate evaluations of control (COSO principle 16) SOC2-CC4.2 CC4.2 Evaluating and communicating control deficiencies (COSO principle 17) 5.6.2 Information security risk assessment 5.7.1 Monitoring, measurement, analysis and evaluation 5.7.2 Internal audit 6.9.4 Logging and monitoring 7.4.3 Accuracy and quality BSI-13 Risk assessment procedures BSI-15 Security categorization BSI-17 Continuous monitoring strategy ISO23894-6.3 AI Risk Assessment ISO23894-6.3.1 AI Risk Identification ISO23894-6.3.3 AI Risk Evaluation 29134-1 Scope 29134-3 Terms and definitions 29134-9.1 PIA report structure NISTSP30-3 Threat Source and Threat Event Identification NISTSP30-4 Vulnerability and Predisposing Condition Identification NISTSP30-6 Risk Determination, Uncertainty, and Sensitivity Analysis RMI-DD-2 Supply Chain Information Collection RMI-SEG-2 Environmental Standards RMI-SEG-3 OHS and Governance SSAE18-CC3.1 CC3.1 - COSO Principle 6: Risk Identification SSAE18-CC3.2 CC3.2 - COSO Principle 7: Risk Analysis SSAE18-SOC1-02 Risk Assessment API1164-07 Remote Access API1164-24 Vulnerability assessment for critical systems CPS220-16 Management Information System and Data Framework CPS220-P35 Required Content of Risk Management Policies and Procedures IS.D.OR.205 Information Security Risk Assessment IS.I.OR.205 Information Security Risk Assessment Sapin2-Pillar3-Risk-Mapping Pillar 3 - Corruption Risk Mapping (Cartographie des Risques) Sapin2-Pillar4-ThirdParty-DueDiligence Pillar 4 - Third-Party Due Diligence (Clients, Suppliers, Intermediaries, M&A) ICAO-ANX17-Chap2-ThreatAssessment-RiskManagement-Cyber-GASeP ICAO Annex 17 Chapter 2 - Threat Assessment + Risk Management + Cyber Threats to Critical Aviation Systems (Amendment 17/18) ICAO-ANX17-Chap4-Cargo-Mail-Catering-Stores-Supplies-RegulatedAgent-KnownConsignor ICAO Annex 17 Chapter 4 - Cargo + Mail + Catering + Stores + Supplies Security + Regulated Agent + Known Consignor + Supply Chain IEC62443-07 Personnel risk assessment IEC62443-24 Vulnerability assessment for critical systems ISO27003-6.1 Actions to address risks and opportunities ISO27003-8.2 Information security risk assessment ISO27019-07 Personnel risk assessment ISO27019-24 Vulnerability assessment for critical systems 27557-4.3 Individual impact consideration 27557-6.3 Privacy risk assessment NISTSP37-2 RMF Categorize Step: Information and System Categorisation NISTSP37-3 RMF Select Step: Security and Privacy Control Selection NZISM-1 NZISM Governance, Documentation, and Classification System NZISM-3 Personnel Security, Physical Security, and Cryptography ORSA-S1 Guidance Manual Section 1: Description of the insurer's risk management framework ORSA-S2 Guidance Manual Section 2: Insurer's assessment of risk exposures 2.4.4 Hazard Analysis and Risk Assessment 2.7.2 Food Fraud Plan ISMSP-MS-02 Risk Management ISMSP-SYS-04 Vulnerability Management CH-FADP-21 Data protection impact assessments FADP-7 Data Protection Impact Assessment (Articles 9-10) CRM-1 AML/CFT Compliance CRM-4 Business Risk Assessment UNESCO-AI-PA1 Ethical Impact Assessment UNESCOAI-1 Principles 1-3: Proportionality, Safety, Fairness AMLCTF-PartA-RiskAssess ML/TF Risk Assessment CPS230-11 Identification, Assessment and Management of Operational Risk SPS220-22 Framework Enabling Strategies, Policies, Procedures and Controls 4.3.1 Risk Assessment and Impact Analysis ISM-1967 ASD assessment of TOP SECRET systems P1-S1 Advance Electronic Information BB-DPA-20 Sections 50-60 - Registration and Responsibilities UAE-PDPL-Art.18_19_20_21 Security measures, controller/processor relationship, DPIA (UAE PDPL Articles 18-21) ISO-22313-8.2 Business impact analysis and risk assessment ISO-26262-3-7 Hazard analysis and risk assessment (HARA) 5.35 Independent review of information security 5.35 Independent review of information security ISO27799-06 Security management process and risk analysis 27031-7.2 Resource Requirements 29147-5.11 Researcher Safe Harbour and Legal Posture NFPA1600-5.1 Risk Assessment Art.21.2.f Policies and procedures to assess the effectiveness of the cybersecurity risk-management measures PR.DS-8 PR.DS-8: Integrity checking mechanisms are used to verify hardware integrity NISTPF-8 Protect-P Information Protection Processes (PR.PO-P) NISTSP122-8 Continuous Monitoring, Training, and Privacy Programme Governance NISTSP144-1 Cloud Governance, Risk Assessment, and Provider Trust Evaluation NISTSP145-7 Cloud Procurement Standards Aligned to NIST SP 800-145 Definition NISTSP146-1 Cloud Adoption Strategy, Workload Suitability, and Decision Framework NISTSP39-3 Risk Assessing: Organisation, Mission, and System Level Assessments NISTSP66-1 Security Management Process: Risk Analysis and Risk Management for ePHI NISTSP82-2 OT Risk Assessment and Threat/Vulnerability Identification NRFCS-2 Risk Assessment, Customer Data Inventory, Classification, and Retail Threat Model NJDPA-7 Data Protection Assessments and Processor Contracts NGOB-1 Open Banking Registry Participation, Tiered Categorisation, and KYP OECDAI-3 Robustness, Security, Safety, and Adversarial Attack Protection OECDMNE-5 Environment, Climate, and Biodiversity OREGONCPA-5 Data Protection Assessments, Privacy by Design, Security Practices PDPASG-4 Children's Data, DPIA, and Privacy by Design PDPATH-4 DPIA, Privacy by Design, Children's Data POPIASA-4 Special Personal Information, Children, Information Quality, Documentation NORWAY-4 DPIA, Privacy by Design, Records of Processing NZPRV-6 IPP 13 Unique Identifiers, Privacy Impact Assessment, Privacy by Design QATAR-7 DPO, Records, Retention, Marketing, Training PICERL-P2 Risk Assessment SECCLIM-2 Risk Management: Identification, Assessment, Integration SOC-CY-DC5 Risk Assessment Process SA-PDPL-21 Data protection impact assessments SOCI-S30CU Vulnerability assessments SCA-S10 Annual Risk Assessment IM8-SEC.4 Vulnerability Management PIPA-CPO-DPO-Privacy-Officer-PIA-Personal-Information-Impact-Assessment-Articles-31-33 Korea PIPA CPO + DPO + Privacy Officer + PIA + Personal Information Impact Assessment + Articles 31-33 TSAPIPE-1 Cybersecurity Implementation Plan and Coordinator TAIWAN-3 Data Subject Rights TEXASTDPSA-3 Sensitive Data, Children, Sale Notice UKAI-1 Risk-Based Approach and Pro-Innovation Principles Standard 2 Data Protection Impact Assessments UKOPRES-3 Self-Assessment and Board Engagement UKGDPRREG-3 Controller and Processor (Articles 24-43) s.54(5) Statement Content Requirements SEMD-SP-2 Risk Identification and Assessment UNICEFAI-4 Transparency, Explanation, Adult Capacity CPSC-RA.3 Lifecycle Risk Assessment URUGUAY-5 Database Registration with AGESIC URCDP VIETNAMPDP-3 Data Subject Rights VIRGINIAVCDPA-3 Sensitive Data Consent and Children Every mapping shown was judged rather than inferred from wording similarity, and the ones that failed review are published too. See the coverage reports and what was rejected .
Other controls in ID - Identify You are reading one control. How much of NIST Cybersecurity Framework 2.0 have you already done? NIST Cybersecurity Framework 2.0 NIST-CSF-ID.RA-09 is one control. If you already hold one of the frameworks below, a reviewed crosswalk already says how much of NIST Cybersecurity Framework 2.0 your existing evidence covers. Hold ISO 27001:2022 and 73 of 106 NIST Cybersecurity Framework 2.0 controls already carry evidence.
Each report names every control your existing framework evidences, every one it does not, the reasoning behind each claim, and the claims that were argued against and rejected. 174 were rejected on the ISO 27001:2022 pair alone.
Query this from an agent The graph holds this control, the 189 it maps to, and the evidence behind each claim, over MCP and REST.