NIST SP 800-53 Rev 5
RA - Risk Assessment

NIST SP 800-53 Rev 5 NIST800-RA-3: RA-3 Risk Assessment

a. Conduct a risk assessment, including: 1. Identifying threats to and vulnerabilities in the system; 2. Determining the likelihood and magnitude of harm from unauthorized access, use, disclosure, disruption, modification, or destruction of the system, the information it processes, stores, or transmits, and any related information; and 3. Determining the likelihood and impact of adverse effects on individuals arising from the processing of personally identifiable information; b. Integrate risk assessment results and risk management decisions from the organization and mission or business process perspectives with system-level risk assessments; c. Document risk assessment results in [Selection: security and privacy plans; risk assessment report; [Assignment: organization-defined document]]; d. Review risk assessment results [Assignment: organization-defined frequency]; e. Disseminate risk assessment results to [Assignment: organization-defined personnel or roles]; and f. Update the risk assessment [Assignment: organization-defined frequency] or when there are significant changes to the system, its environment of operation, or other conditions that may impact the security or privacy state of the system.

Maintained by Gerard BlokdykVerified against the published standard Control text last updated

What else in your programme already covers this

This control maps to 126 controls across 50 other frameworks. If you already hold one of them, the evidence you collected for it is the starting point here rather than new work.

NIST Cybersecurity Framework 2.0 · 18 controls

  • NIST-CSF-DE.AE-04 The estimated impact and scope of adverse events are understood
  • NIST-CSF-GV.OC-01 The organizational mission is understood and informs cybersecurity risk management
  • NIST-CSF-GV.OV-02 The cybersecurity risk management strategy is reviewed and adjusted to ensure coverage of organizational requirements and risks
  • NIST-CSF-GV.OV-03 Organizational cybersecurity risk management performance is evaluated and reviewed for adjustments needed
  • NIST-CSF-GV.PO-01 Policy for managing cybersecurity risks is established based on organizational context, cybersecurity strategy, and priorities and is communicated and enforced
  • NIST-CSF-GV.RM-01 Risk management objectives are established and agreed to by organizational stakeholders
  • NIST-CSF-GV.RM-02 Risk appetite and risk tolerance statements are established, communicated, and maintained
  • NIST-CSF-GV.RM-03 Cybersecurity risk management activities and outcomes are included in enterprise risk management processes
  • NIST-CSF-GV.RM-05 Lines of communication across the organization are established for cybersecurity risks, including risks from suppliers and other third parties
  • NIST-CSF-GV.RM-06 A standardized method for calculating, documenting, categorizing, and prioritizing cybersecurity risks is established and communicated
  • NIST-CSF-GV.RM-07 Strategic opportunities (i.e., positive risks) are characterized and are included in organizational cybersecurity risk discussions
  • NIST-CSF-GV.SC-03 Cybersecurity supply chain risk management is integrated into cybersecurity and enterprise risk management, risk assessment, and improvement processes
  • NIST-CSF-ID.IM-02 Improvements are identified from security tests and exercises, including those done in coordination with suppliers and relevant third parties
  • NIST-CSF-ID.RA-03 Internal and external threats to the organization are identified and recorded
  • NIST-CSF-ID.RA-04 Potential impacts and likelihoods of threats exploiting vulnerabilities are identified and recorded
  • NIST-CSF-ID.RA-05 Threats, vulnerabilities, likelihoods, and impacts are used to understand inherent risk and inform risk response prioritization
  • NIST-CSF-ID.RA-06 Risk responses are chosen, prioritized, planned, tracked, and communicated
  • NIST-CSF-ID.RA-09 The authenticity and integrity of hardware and software are assessed prior to acquisition and use

PCI DSS 4.0 · 9 controls

  • 10.4.2.1 10.4.2.1 Periodic log review frequency set by targeted risk analysis
  • 11.3.1 11.3.1 Quarterly internal vulnerability scans
  • 11.3.1.1 11.3.1.1 Lower-risk vulnerabilities handled per risk analysis
  • 11.4.1 11.4.1 Penetration testing methodology defined and implemented
  • 12.3.2 12.3.2 Targeted risk analysis for each customized-approach requirement
  • 12.5.2 12.5.2 Annual and change-driven scope confirmation
  • 5.2.3.1 5.2.3.1 Targeted risk analysis sets evaluation frequency
  • 5.3.2.1 5.3.2.1 Targeted risk analysis sets malware scan frequency
  • 5.2.3 5.2.3 Periodic evaluation of components not at risk from malware

APRA CPS 220 Risk Management · 6 controls

  • CPS220-04 Maintenance of a Risk Management Framework
  • CPS220-07 Material Risk Categories the Framework Must Address
  • CPS220-14 Scenario Analysis and Stress Testing Programs
  • CPS220-P33 Risks Arising from Strategic Objectives and the Business Plan
  • CPS220-P35 Required Content of Risk Management Policies and Procedures
  • CPS220-P48 Assessment Following Material Change Outside the Review Cycle

CIS Controls v8 · 6 controls

  • CIS-13.3 Deploy a Network Intrusion Detection Solution
  • CIS-15.3 Classify Service Providers
  • CIS-16.14 Conduct Threat Modeling
  • CIS-16.6 Establish and Maintain a Severity Rating System and Process for Application Vulnerabilities
  • CIS-18.1 Establish and Maintain a Penetration Testing Program
  • CIS-7.1 Establish and Maintain a Vulnerability Management Process

APRA CPS 230 Operational Risk Management · 5 controls

  • CPS230-11 Identification, Assessment and Management of Operational Risk
  • CPS230-9 Management of the Full Range of Operational Risks
  • CPS230-P26 Assessment of Business and Strategic Decisions on the Risk Profile
  • CPS230-P27 Comprehensive Assessment of the Operational Risk Profile
  • CPS230-P28 Risk Assessment Before Providing a Material Service to Another Party

ASEAN Data Management Framework · 4 controls

  • ADMF-1.5 Executive direction and risk appetite
  • ADMF-4.3 Assess business impact categories
  • ADMF-5.1 Implement risk-based protection controls
  • ADMF-5.5 Manage and accept residual risk

Cloud Security Alliance Cloud Controls Matrix (CCM) v4.0.1 · 4 controls

FedRAMP High · 4 controls

  • RA-3 Risk Assessment
  • RA-3(1) Risk Assessment | Supply Chain Risk Assessment (RA-3(1))
  • RA-7 Risk Response
  • SA-9(1) External System Services | Risk Assessments and Organizational Approvals (SA-9(1))

HIPAA Security Rule · 4 controls

ISO 22301:2019 · 4 controls

  • 6.1 Actions to address risks and opportunities
  • 6.1.2 Addressing risks and opportunities
  • 8.2 Business impact analysis and risk assessment
  • 8.2.3 Risk assessment

SOC 2 · 4 controls

  • SOC2-CC3.1 CC3.1 Objectives specified clearly enough to assess risk (COSO principle 6)
  • SOC2-CC3.2 CC3.2 Identifying and analysing risks to objectives (COSO principle 7)
  • SOC2-CC3.3 CC3.3 Considering fraud risk (COSO principle 8)
  • SOC2-CC3.4 CC3.4 Identifying and assessing significant changes (COSO principle 9)

EU AI Act · 3 controls

  • EUAI-Art.27 Fundamental rights impact assessment for high-risk AI systems
  • EUAI-Art.55 Obligations of providers of GPAI models with systemic risk
  • EUAI-Art.9 Risk management system

FedRAMP Moderate · 3 controls

  • RA-3 Risk Assessment
  • RA-3(1) Risk Assessment | Supply Chain Risk Assessment (RA-3(1))
  • SA-9(1) External System Services | Risk Assessments and Organizational Approvals (SA-9(1))

ISO 27001:2022 · 3 controls

  • 5.25 Assessment and decision on information security events
  • 5.35 Independent review of information security
  • 5.7 Threat intelligence

ISO/IEC 42001:2023 · 3 controls

  • 6.1 Actions to address risks and opportunities
  • 6.1.2 AI risk assessment
  • 8.2 AI risk assessment

NIST SP 800-66 Rev 2 · 3 controls

AWS Well-Architected Security Pillar · 2 controls

  • SEC01-BP04 Stay up to date with security threats and recommendations
  • SEC01-BP07 Identify threats and prioritize mitigations using a threat model

Azure Security Benchmark · 2 controls

ISO/IEC 23894:2023 · 2 controls

  • ISO23894-6.3 AI Risk Assessment
  • 6.4 Risk assessment

NIS2 Directive · 2 controls

  • Art.21.1 Take proportionate all-hazards measures calibrated to the entity's own risk exposure
  • Art.21.2.a Policies on risk analysis and on information system security

NIST SP 800-160 · 2 controls

NIST SP 800-172 · 2 controls

ANSSI Guide d'hygiene informatique (42 mesures, v2.0) · 1 control

API 1164 · 1 control

  • API1164-02 Risk Management Framework

APRA CPS 234 · 1 control

  • CPS234-21 Implementation of Information Security Controls

ASIC Cyber Resilience Good Practices · 1 control

Aged Care Quality Standards 2019 (repealed edition) · 1 control

  • ACQS-8-4 Risk Management

Annex 11 to EU GMP - Computerised Systems · 1 control

Australia My Health Records Act 2012 · 1 control

Australian Energy Sector Cyber Security Framework (AESCSF) · 1 control

  • AESCSF-RM-2 Identify and assess cyber risks

C5 (Germany) · 1 control

  • C5-OIS-07 Application of the Risk Management Policy

CFTC System Safeguards (17 CFR 37, 38, 39, 49) · 1 control

CISA Industrial Control Systems (ICS) Security Guidance · 1 control

CMMC 2.0 · 1 control

Cloud Security Alliance Cloud Controls Matrix (CCM) v4.1 · 1 control

  • TVM-04 Threat Analysis and Modelling

DORA · 1 control

GDPR · 1 control

ISO 27002:2022 · 1 control

  • 5.36 Compliance with policies, rules and standards for information security

ISO 27701:2019 · 1 control

  • 5.6.2 Information security risk assessment

ISO 31000:2018 · 1 control

  • 6.4 Risk assessment

NIST SP 800-161 · 1 control

NIST SP 800-161 Rev 1 · 1 control

NIST SP 800-171 · 1 control

NIST SP 800-171 Rev 3 · 1 control

NIST SP 800-207 · 1 control

NIST SP 800-218 · 1 control

NIST SP 800-53 Rev 5 HIGH · 1 control

  • RA-3 RA-3 Risk Assessment

NIST SP 800-53 Rev 5 LOW · 1 control

  • RA-3 RA-3 Risk Assessment

NIST SP 800-53 Rev 5 MODERATE · 1 control

  • RA-3 RA-3 Risk Assessment

PTES · 1 control

  • PTES-3.2 Require a consistent, repeatable threat model tied to the organisation's assets

Every mapping shown was judged rather than inferred from wording similarity, and the ones that failed review are published too. See the coverage reports and what was rejected.

Other controls in RA - Risk Assessment

You are reading one control. How much of NIST SP 800-53 Rev 5 have you already done?

NIST SP 800-53 Rev 5 NIST800-RA-3 is one control. If you already hold one of the frameworks below, a reviewed crosswalk already says how much of NIST SP 800-53 Rev 5 your existing evidence covers. Hold ISO 27001:2022 and 163 of 1014 NIST SP 800-53 Rev 5 controls already carry evidence.

If you hold ISO 27001:202216.1% covered · 851 gapsIf you hold ISO 27002:202210.8% covered · 904 gapsIf you hold Cloud Security Alliance Cloud Controls Matrix (CCM) v4.0.110.2% covered · 911 gapsIf you hold CIS Controls v810.1% covered · 912 gapsIf you hold NIST SP 800-171 Rev 310.1% covered · 912 gapsIf you hold C5 (Germany)9.6% covered · 917 gaps

Each report names every control your existing framework evidences, every one it does not, the reasoning behind each claim, and the claims that were argued against and rejected. 342 were rejected on the ISO 27001:2022 pair alone.

See the released pairs, $299 eachBrowse the graph free

Query this from an agent

The graph holds this control, the 126 it maps to, and the evidence behind each claim, over MCP and REST.

MCP endpointAll NIST SP 800-53 Rev 5 controls