NIST SP 800-161 Rev 1 161R1-RA-9: Criticality Analysis

What else in your programme already covers this

This control maps to 35 controls across 22 other frameworks. If you already hold one of them, the evidence you collected for it is the starting point here rather than new work.

APRA CPS 230 Operational Risk Management · 3 controls

CPS230-26 Critical Operations Register, Continuity Plan and Activation
CPS230-40 Mandatory Minimum Classification of Material Service Providers
CPS230-P27 Comprehensive Assessment of the Operational Risk Profile

FedRAMP High · 3 controls

CP-2(8) Contingency Plan | Identify Critical Assets (CP-2(8))
RA-9 Criticality Analysis (RA-9)
SA-15(3) Development Process, Standards, and Tools | Criticality Analysis (SA-15(3))

FedRAMP Moderate · 3 controls

CP-2(8) Contingency Plan | Identify Critical Assets (CP-2(8))
RA-9 Criticality Analysis (RA-9)
SA-15(3) Development Process, Standards, and Tools | Criticality Analysis (SA-15(3))

NIST Cybersecurity Framework 2.0 · 3 controls

NIST-CSF-GV.OC-05 Outcomes, capabilities, and services that the organization depends on are understood and communicated
NIST-CSF-GV.SC-04 Suppliers are known and prioritized by criticality
NIST-CSF-ID.RA-10 Critical suppliers are assessed prior to acquisition

APRA CPS 234 · 2 controls

CPS234-16 Assessment of Related Party and Third Party Capability
CPS234-20 Information Asset Classification

C5 (Germany) · 2 controls

C5-BCM-02 Business impact analysis policies and instructions
C5-SSO-02 Risk assessment of service providers and suppliers

CFTC System Safeguards (17 CFR 37, 38, 39, 49) · 2 controls

CFTC-SS-17 Enterprise Technology Risk Assessment
CFTC-SS-35 Scope of Testing and Assessment

Cloud Security Alliance Cloud Controls Matrix (CCM) v4.0.1 · 2 controls

CCM-BCR-02 Risk Assessment and Impact Analysis
CCM-DCS-05 Assets Classification

SOC 2 · 2 controls

SOC2-CC3.2 CC3.2 Identifying and analysing risks to objectives (COSO principle 7)
SOC2-CC9.1 CC9.1 Mitigating risks of business disruption

ANSSI Guide d'hygiene informatique (42 mesures, v2.0) · 1 control

ANSSI-HYG-04 Identify the Most Sensitive Information and Servers and Maintain a Network Diagram

APEC Cross-Border Privacy Rules (CBPR) System · 1 control

CBPR-PR-28 Safeguards proportional to risk

APRA CPS 220 Risk Management · 1 control

CPS220-P46 Scope of the Comprehensive Review

AWS Well-Architected Security Pillar · 1 control

SEC01-BP07 Identify threats and prioritize mitigations using a threat model

Australia My Health Records Act 2012 · 1 control

MYHR-SEC-5 Security risk assessment

Azure Security Benchmark · 1 control

ASBv3-AM-1 Track asset inventory and their risks

DORA · 1 control

DORA-Art.8 Identification

HIPAA Security Rule · 1 control

164.308(a)(7)(ii)(E) Applications and Data Criticality Analysis (Addressable)

NIST SP 800-172 · 1 control

3.14.3e Include Systems in Scope of Enhanced Requirements or Segregate into Purpose-Specific Networks

NIST SP 800-53 Rev 5 · 1 control

NIST800-RA-9 RA-9 Criticality Analysis

NIST SP 800-66 Rev 2 · 1 control

164.308(a)(7)(ii)(E) Applications and Data Criticality Analysis (Addressable)

Every mapping shown was judged rather than inferred from wording similarity, and the ones that failed review are published too. See the coverage reports and what was rejected.

You are reading one control. How much of NIST SP 800-161 Rev 1 have you already done?

NIST SP 800-161 Rev 1 161R1-RA-9 is one control. If you already hold one of the frameworks below, a reviewed crosswalk already says how much of NIST SP 800-161 Rev 1 your existing evidence covers. Hold C5 (Germany) and 94 of 191 NIST SP 800-161 Rev 1 controls already carry evidence.

If you hold C5 (Germany)49.2% covered · 97 gaps If you hold NIST SP 800-171 Rev 338.2% covered · 118 gaps If you hold Cloud Security Alliance Cloud Controls Matrix (CCM) v4.0.137.2% covered · 120 gaps If you hold NIST SP 800-17221.5% covered · 150 gaps If you hold AWS Well-Architected Security Pillar20.9% covered · 151 gaps If you hold DORA17.3% covered · 158 gaps

Each report names every control your existing framework evidences, every one it does not, the reasoning behind each claim, and the claims that were argued against and rejected. 0 were rejected on the C5 (Germany) pair alone.

See the released pairs, $299 each Browse the graph free