NIST SP 800-53 Rev 5 LOW
RA Risk Assessment

NIST SP 800-53 Rev 5 LOW RA-7: Risk Response

Requires the organisation to respond to findings from security and privacy assessments, monitoring and audits, so identified risk is treated rather than only recorded.

What else in your programme already covers this

This control maps to 22 controls across 11 other frameworks. If you already hold one of them, the evidence you collected for it is the starting point here rather than new work.

NIST Cybersecurity Framework 2.0 · 6 controls

  • NIST-CSF-GV.OC-04 Critical objectives, capabilities, and services that external stakeholders depend on or expect from the organization are understood and communicated
  • NIST-CSF-GV.RM-06 A standardized method for calculating, documenting, categorizing, and prioritizing cybersecurity risks is established and communicated
  • NIST-CSF-GV.RM-07 Strategic opportunities (i.e., positive risks) are characterized and are included in organizational cybersecurity risk discussions
  • NIST-CSF-ID.RA-04 Potential impacts and likelihoods of threats exploiting vulnerabilities are identified and recorded
  • NIST-CSF-ID.RA-05 Threats, vulnerabilities, likelihoods, and impacts are used to understand inherent risk and inform risk response prioritization
  • NIST-CSF-ID.RA-06 Risk responses are chosen, prioritized, planned, tracked, and communicated

NIST SP 800-53 Rev 5 · 4 controls

  • NIST800-CA-7 Continuous monitoring
  • NIST800-PM-28 Risk Framing. Identify and document: Assumptions affecting risk assessments, risk responses, and risk monitoring; Constraints affecting risk assessments, risk responses, and risk monitoring; Priorities and trade-offs considered by the organization for managing risk; and
  • NIST800-RA-3 Risk assessment
  • NIST800-RA-5 Vulnerability monitoring and scanning

SOC 2 · 4 controls

  • SOC2-CC3.1 COSO principle 6: Specifies objectives to identify and assess risks
  • SOC2-CC3.2 COSO principle 7: Identifies risks and analyzes to determine how managed
  • SOC2-CC3.4 COSO principle 9: Identifies and assesses changes that could impact internal controls
  • SOC2-CC9.1 Identifies, selects and develops risk mitigation activities

CMMC 2.0 · 1 control

Cloud Security Alliance Cloud Controls Matrix (CCM) v4.0.1 · 1 control

HIPAA Security Rule · 1 control

ISO 22301:2019 · 1 control

ISO 27001:2022 · 1 control

  • 5.7 Threat intelligence

ISO 27002:2022 · 1 control

  • 5.7 Threat intelligence

NIST SP 800-66 Rev 2 · 1 control

PCI DSS 4.0 · 1 control

  • 12.3.2 TRA for customized approach

Every mapping shown was judged rather than inferred from wording similarity, and the ones that failed review are published too. See the coverage reports and what was rejected.

Other controls in RA Risk Assessment

Query this from an agent

The graph holds this control, the 22 it maps to, and the evidence behind each claim, over MCP and REST.

MCP endpointAll NIST SP 800-53 Rev 5 LOW controls