Frameworks / NIST SP 800-53 Rev 5 / NIST800-RA-2 NIST SP 800-53 Rev 5
RA - Risk Assessment
NIST SP 800-53 Rev 5 NIST800-RA-2: RA-2 Security Categorization a. Categorize the system and information it processes, stores, and transmits; b. Document the security categorization results, including supporting rationale, in the security plan for the system; and c. Verify that the authorizing official or authorizing official designated representative reviews and approves the security categorization decision.
Maintained by Gerard Blokdyk · Verified against the published standard 31 May 2026 · Control text last updated 21 May 2026 What else in your programme already covers this This control maps to 219 controls across 123 other frameworks. If you already hold one of them, the evidence you collected for it is the starting point here rather than new work.
ADMF-3.3 Apply overarching categorisation considerations ADMF-4.1 Establish a data categorisation matrix ADMF-4.2 Assess confidentiality, integrity and availability impact ADMF-4.4 Assign datasets to risk tiers ADMF-5.4 Build a data protection control matrix ADMF-6.3 Review categories assigned to datasets NIST-CSF-GV.OC-04 Critical objectives, capabilities, and services that external stakeholders depend on or expect from the organization are understood and communicated NIST-CSF-GV.RM-02 Risk appetite and risk tolerance statements are established, communicated, and maintained NIST-CSF-GV.RM-07 Strategic opportunities (i.e., positive risks) are characterized and are included in organizational cybersecurity risk discussions NIST-CSF-ID.AM-05 Assets are prioritized based on classification, criticality, resources, and impact on the mission NIST-CSF-ID.RA-04 Potential impacts and likelihoods of threats exploiting vulnerabilities are identified and recorded NIST-CSF-ID.RA-09 The authenticity and integrity of hardware and software are assessed prior to acquisition and use CFR211-G-122 Section 211.122 - Materials Examination and Usage Criteria CFR211-G-125 Section 211.125 - Labeling Issuance CFR211-G-130 Section 211.130 - Packaging and Labeling Operations API1164-02 Risk Management Framework API1164-07 Remote Access API1164-24 Vulnerability assessment for critical systems SEC07-BP01 Understand your data classification scheme SEC07-BP02 Apply data protection controls based on data sensitivity SEC07-BP03 Automate identification and classification ASBv3-DP-1 Discover, classify, and label sensitive data ASBv3-GS-3 Define and implement data protection strategy ASBv3-IR-5 Detection and analysis - prioritize incidents BSI-13 Risk assessment procedures BSI-15 Security categorization BSI-17 Continuous monitoring strategy IEC62443-02 System security categorization IEC62443-07 Personnel risk assessment IEC62443-24 Vulnerability assessment for critical systems ISO23894-6.3 AI Risk Assessment ISO23894-6.3.1 AI Risk Identification ISO23894-6.3.3 AI Risk Evaluation ISO27019-02 System security categorization ISO27019-07 Personnel risk assessment ISO27019-24 Vulnerability assessment for critical systems 29134-1 Scope 29134-3 Terms and definitions 29134-9.1 PIA report structure RMI-DD-2 Supply Chain Information Collection RMI-SEG-2 Environmental Standards RMI-SEG-3 OHS and Governance SSAE18-CC3.1 CC3.1 - COSO Principle 6: Risk Identification SSAE18-CC3.2 CC3.2 - COSO Principle 7: Risk Analysis SSAE18-SOC1-02 Risk Assessment IS.D.OR.205 Information Security Risk Assessment IS.I.OR.205 Information Security Risk Assessment RA-1 Policy and Procedures RA-2 Security Categorization RA-1 Policy and Procedures RA-2 Security Categorization Sapin2-Pillar3-Risk-Mapping Pillar 3 - Corruption Risk Mapping (Cartographie des Risques) Sapin2-Pillar4-ThirdParty-DueDiligence Pillar 4 - Third-Party Due Diligence (Clients, Suppliers, Intermediaries, M&A) ICAO-ANX17-Chap2-ThreatAssessment-RiskManagement-Cyber-GASeP ICAO Annex 17 Chapter 2 - Threat Assessment + Risk Management + Cyber Threats to Critical Aviation Systems (Amendment 17/18) ICAO-ANX17-Chap4-Cargo-Mail-Catering-Stores-Supplies-RegulatedAgent-KnownConsignor ICAO Annex 17 Chapter 4 - Cargo + Mail + Catering + Stores + Supplies Security + Regulated Agent + Known Consignor + Supply Chain 8.2.2 Business impact analysis 8.2.3 Risk assessment ISO27003-6.1 Actions to address risks and opportunities ISO27003-8.2 Information security risk assessment 27557-4.3 Individual impact consideration 27557-6.3 Privacy risk assessment NZISM-1 NZISM Governance, Documentation, and Classification System NZISM-3 Personnel Security, Physical Security, and Cryptography ORSA-S1 Guidance Manual Section 1: Description of the insurer's risk management framework ORSA-S2 Guidance Manual Section 2: Insurer's assessment of risk exposures 2.4.4 Hazard Analysis and Risk Assessment 2.7.2 Food Fraud Plan IM8-DAT.1 Data Classification IM8-SEC.4 Vulnerability Management ISMSP-MS-02 Risk Management ISMSP-SYS-04 Vulnerability Management CH-FADP-21 Data protection impact assessments FADP-7 Data Protection Impact Assessment (Articles 9-10) CRM-1 AML/CFT Compliance CRM-4 Business Risk Assessment UNESCO-AI-PA1 Ethical Impact Assessment UNESCOAI-1 Principles 1-3: Proportionality, Safety, Fairness AMLCTF-PartA-RiskAssess ML/TF Risk Assessment ANSSI-HYG-04 Identify the Most Sensitive Information and Servers and Maintain a Network Diagram CPS230-11 Identification, Assessment and Management of Operational Risk SPS220-22 Framework Enabling Strategies, Policies, Procedures and Controls 4.3.1 Risk Assessment and Impact Analysis AUCDR-IS-STEP2 Step 2 - Define the boundaries of the CDR data environment P1-S1 Advance Electronic Information BB-DPA-20 Sections 50-60 - Registration and Responsibilities C5-AM-06 Asset Classification and Labelling CIS-3.7 Establish and Maintain a Data Classification Scheme ITSG33-RMP-3 Security Categorization EUAI-Art.6 Classification rules for high-risk AI systems QMSR-820.45 Device labelling and packaging controls (§820.45) UAE-PDPL-Art.18_19_20_21 Security measures, controller/processor relationship, DPIA (UAE PDPL Articles 18-21) 60601-1.7.1 Equipment identification and marking ISO-14064-1-5.4 Categorization of indirect GHG emissions ISO-22313-8.2 Business impact analysis and risk assessment ISO-26262-3-7 Hazard analysis and risk assessment (HARA) 5.12 Classification of information 5.12 Classification of information ISO27799-06 Security management process and risk analysis 27010-8.2 Membership Termination 27031-7.2 Resource Requirements ISO27043-08 Information classification and labeling 29147-5.11 Researcher Safe Harbour and Legal Posture 4.3 Determining the scope of the AI management system ISO21434-08 Information classification and labeling NFPA1600-5.1 Risk Assessment RA-2 RA-2 Security Categorization RA-2 RA-2 Security Categorization RA-2 RA-2 Security Categorization NISTSP82-2 OT Risk Assessment and Threat/Vulnerability Identification NISTSP88-1 Media Sanitization Policy, Roles, and Decision Framework NISTSP92-7 Privacy in Logs, Sensitive Content Handling, Cloud and SaaS Log Considerations NRFCS-2 Risk Assessment, Customer Data Inventory, Classification, and Retail Threat Model QRCM-1.3 Data Classification for Migration NJDPA-7 Data Protection Assessments and Processor Contracts NGOB-1 Open Banking Registry Participation, Tiered Categorisation, and KYP OECDAI-3 Robustness, Security, Safety, and Adversarial Attack Protection OECDMNE-5 Environment, Climate, and Biodiversity OWASPSAMM-2 Design: Threat Assessment, Security Requirements, Security Architecture OMANCS-4 Data Protection, Cryptography, and Privacy Alignment OSSFSC-2 Dependency Management, Pinning, Updates, Vulnerability Tracking OREGONCPA-5 Data Protection Assessments, Privacy by Design, Security Practices PASONE-1 Security Triage Process, Asset Sensitivity Classification, and Threat Assessment 9.4.2 9.4.2 Classification of media by data sensitivity PDPASG-4 Children's Data, DPIA, and Privacy by Design PDPATH-4 DPIA, Privacy by Design, Children's Data POPIASA-4 Special Personal Information, Children, Information Quality, Documentation PTESPHASE-1 Pre-Engagement Interactions and Scoping NORWAY-4 DPIA, Privacy by Design, Records of Processing NZPRV-6 IPP 13 Unique Identifiers, Privacy Impact Assessment, Privacy by Design QATAR-7 DPO, Records, Retention, Marketing, Training PICERL-P2 Risk Assessment SASB-SOC-7 Selling Practices and Product Labeling SECCLIM-2 Risk Management: Identification, Assessment, Integration SHAREASSESS-2 Access Control, Identity, Authentication SUPCHAIN-1 Build Integrity - Source, Build, Provenance SOC2-C1.1 C1.1 Identifying and maintaining confidential information SOC-CY-DC5 Risk Assessment Process SA-PDPL-21 Data protection impact assessments SOCI-S30CU Vulnerability assessments SCA-S10 Annual Risk Assessment PIPA-CPO-DPO-Privacy-Officer-PIA-Personal-Information-Impact-Assessment-Articles-31-33 Korea PIPA CPO + DPO + Privacy Officer + PIA + Personal Information Impact Assessment + Articles 31-33 TSAPIPE-1 Cybersecurity Implementation Plan and Coordinator TAIWAN-3 Data Subject Rights TEXASTDPSA-3 Sensitive Data, Children, Sale Notice UKAI-1 Risk-Based Approach and Pro-Innovation Principles Standard 2 Data Protection Impact Assessments UKOPRES-3 Self-Assessment and Board Engagement UKGDPRREG-3 Controller and Processor (Articles 24-43) s.54(5) Statement Content Requirements SEMD-SP-2 Risk Identification and Assessment UNICEFAI-4 Transparency, Explanation, Adult Capacity CPSC-RA.3 Lifecycle Risk Assessment URUGUAY-5 Database Registration with AGESIC URCDP VIETNAMPDP-3 Data Subject Rights VIRGINIAVCDPA-3 Sensitive Data Consent and Children Every mapping shown was judged rather than inferred from wording similarity, and the ones that failed review are published too. See the coverage reports and what was rejected .
Other controls in RA - Risk Assessment You are reading one control. How much of NIST SP 800-53 Rev 5 have you already done? NIST SP 800-53 Rev 5 NIST800-RA-2 is one control. If you already hold one of the frameworks below, a reviewed crosswalk already says how much of NIST SP 800-53 Rev 5 your existing evidence covers. Hold ISO 27001:2022 and 163 of 1014 NIST SP 800-53 Rev 5 controls already carry evidence.
Each report names every control your existing framework evidences, every one it does not, the reasoning behind each claim, and the claims that were argued against and rejected. 342 were rejected on the ISO 27001:2022 pair alone.
Query this from an agent The graph holds this control, the 219 it maps to, and the evidence behind each claim, over MCP and REST.