NIST SP 800-53 Rev 5 LOW
RA Risk Assessment

NIST SP 800-53 Rev 5 LOW RA-3: Risk Assessment

Conduct risk assessment annually (FedRAMP); document; review and update.

What else in your programme already covers this

This control maps to 84 controls across 33 other frameworks. If you already hold one of them, the evidence you collected for it is the starting point here rather than new work.

NIST Cybersecurity Framework 2.0 · 12 controls

  • NIST-CSF-DE.AE-04 The estimated impact and scope of adverse events are understood
  • NIST-CSF-GV.OV-01 Cybersecurity risk management strategy outcomes are reviewed to inform and adjust strategy and direction
  • NIST-CSF-GV.OV-03 Organizational cybersecurity risk management performance is evaluated and reviewed for adjustments needed
  • NIST-CSF-GV.RM-02 Risk appetite and risk tolerance statements are established, communicated, and maintained
  • NIST-CSF-GV.RM-03 Cybersecurity risk management activities and outcomes are included in enterprise risk management processes
  • NIST-CSF-GV.RM-06 A standardized method for calculating, documenting, categorizing, and prioritizing cybersecurity risks is established and communicated
  • NIST-CSF-GV.SC-03 Cybersecurity supply chain risk management is integrated into cybersecurity and enterprise risk management, risk assessment, and improvement processes
  • NIST-CSF-ID.RA-03 Internal and external threats to the organization are identified and recorded
  • NIST-CSF-ID.RA-04 Potential impacts and likelihoods of threats exploiting vulnerabilities are identified and recorded
  • NIST-CSF-ID.RA-05 Threats, vulnerabilities, likelihoods, and impacts are used to understand inherent risk and inform risk response prioritization
  • NIST-CSF-ID.RA-06 Risk responses are chosen, prioritized, planned, tracked, and communicated
  • NIST-CSF-ID.RA-09 The authenticity and integrity of hardware and software are assessed prior to acquisition and use

PCI DSS 4.0 · 7 controls

  • 10.4.2.1 Frequency defined by TRA
  • 12.3.2 TRA for customized approach
  • 12.5.3 Impact analysis on org structure changes (SP)
  • 2.2.5 Insecure services or protocols documented
  • 5.2.3.1 Frequency of periodic evaluations per targeted risk analysis
  • 5.3.2.1 Periodic scan frequency per targeted risk analysis
  • 5.2.3 Any system components that are not at risk for malware are evaluated periodically to include the following: • A documented list of all system components not at risk for malware. • Identification and evaluation

APRA CPS 230 Operational Risk Management · 5 controls

  • CPS230-11 Identification, Assessment and Management of Operational Risk
  • CPS230-9 Management of the Full Range of Operational Risks
  • CPS230-P26 Assessment of Business and Strategic Decisions on the Risk Profile
  • CPS230-P27 Comprehensive Assessment of the Operational Risk Profile
  • CPS230-P28 Risk Assessment Before Providing a Material Service to Another Party

Cloud Security Alliance Cloud Controls Matrix (CCM) v4.0.1 · 5 controls

SOC 2 · 5 controls

  • SOC2-CC3.1 COSO principle 6: Specifies objectives to identify and assess risks
  • SOC2-CC3.2 COSO principle 7: Identifies risks and analyzes to determine how managed
  • SOC2-CC3.4 COSO principle 9: Identifies and assesses changes that could impact internal controls
  • SOC2-CC4.1 COSO principle 16: Selects and develops ongoing and separate evaluations
  • SOC2-CC9.1 Identifies, selects and develops risk mitigation activities

ISO 22301:2019 · 4 controls

  • 6.1 Actions to address risks and opportunities
  • 6.1.1 Determining risks and opportunities
  • 6.1.2 Addressing risks and opportunities
  • 8.2.3 Risk assessment

ISO 27701:2019 · 4 controls

  • 5.2.1 Understanding the organization and its context
  • 5.4.1 Actions to address risks and opportunities
  • 5.6.2 Information security risk assessment
  • 7.2.5 Privacy impact assessment

CFTC System Safeguards (17 CFR 37, 38, 39, 49) · 3 controls

  • CFTC-SS-1 Program of Risk Analysis and Oversight
  • CFTC-SS-17 Enterprise Technology Risk Assessment
  • CFTC-SS-2 Enterprise Risk Management and Governance Category

HIPAA Security Rule · 3 controls

NIST SP 800-53 Rev 5 · 3 controls

  • NIST800-PM-28 Risk Framing. Identify and document: Assumptions affecting risk assessments, risk responses, and risk monitoring; Constraints affecting risk assessments, risk responses, and risk monitoring; Priorities and trade-offs considered by the organization for managing risk; and
  • NIST800-RA-3 Risk assessment
  • SP800-53-RA Risk Assessment Family

APEC Cross-Border Privacy Rules (CBPR) System · 2 controls

  • CBPR-PR-28 Safeguards proportional to risk
  • CBPR-PR-34 Risk assessments and third party certifications

AWS Well-Architected Security Pillar · 2 controls

  • SEC01-BP04 Stay up to date with security threats and recommendations
  • SEC01-BP07 Identify threats and prioritize mitigations using a threat model

Australia Consumer Data Right - Banking (CDR) · 2 controls

  • AUCDR-IS-STEP1 Step 1 - Define and implement security governance for CDR data
  • AUCDR-IS-STEP3 Step 3 - Have and maintain an information security capability

Azure Security Benchmark · 2 controls

ISO 27001:2022 · 2 controls

  • 5.35 Independent review of information security
  • 5.7 Threat intelligence

ISO 27002:2022 · 2 controls

  • 5.35 Independent review of information security
  • 5.7 Threat intelligence

ISO/IEC 23894:2023 · 2 controls

ISO/IEC 42001:2023 · 2 controls

  • 6.1.2 Risk assessment
  • 8.2 AI risk assessment

NIS2 Directive · 2 controls

  • Art.21.1 Take proportionate all-hazards measures calibrated to the entity's own risk exposure
  • Art.21.2.a Policies on risk analysis and on information system security

NIST SP 800-66 Rev 2 · 2 controls

ANSSI Guide d'hygiene informatique (42 mesures, v2.0) · 1 control

APRA CPS 220 Risk Management · 1 control

  • CPS220-04 Maintenance of a Risk Management Framework

APRA CPS 234 · 1 control

  • CPS234-21 Implementation of Information Security Controls

Australia My Health Records Act 2012 · 1 control

C5 (Germany) · 1 control

  • C5-OIS-07 Application of the Risk Management Policy

CMMC 2.0 · 1 control

DORA · 1 control

GDPR · 1 control

ISO 31000:2018 · 1 control

  • 6.4 Risk assessment

NIST SP 800-161 Rev 1 · 1 control

NIST SP 800-171 Rev 3 · 1 control

NIST SP 800-172 · 1 control

  • 3.11.1e Threat-Aware Risk Assessment

NIST SP 800-218 · 1 control

Every mapping shown was judged rather than inferred from wording similarity, and the ones that failed review are published too. See the coverage reports and what was rejected.

Other controls in RA Risk Assessment

Query this from an agent

The graph holds this control, the 84 it maps to, and the evidence behind each claim, over MCP and REST.

MCP endpointAll NIST SP 800-53 Rev 5 LOW controls