NIST SP 800-66 Rev 2 164.308(a)(2): Assigned Security Responsibility (Standard)

What else in your programme already covers this

This control maps to 45 controls across 26 other frameworks. If you already hold one of them, the evidence you collected for it is the starting point here rather than new work.

PCI DSS 4.0 · 6 controls

12.1.4 12.1.4 Executive ownership of information security formally assigned
2.1.2 2.1.2 Requirement 2 roles and responsibilities assigned
4.1.2 4.1.2 Requirement 4 roles and responsibilities assigned
9.1.2 9.1.2 Requirement 9 roles and responsibilities assigned
3.1.2 3.1.2 Assigned duties for Requirement 3 activities
8.1.2 8.1.2 Requirement 8 roles and responsibilities assigned

C5 (Germany) · 3 controls

C5-BCM-01 Top management responsibility
C5-OIS-01 Information Security Management System (ISMS)
C5-OIS-02 Information Security Policy

Cloud Security Alliance Cloud Controls Matrix (CCM) v4.0.1 · 3 controls

CCM-CEK-02 CEK Roles and Responsibilities
CCM-GRC-06 Governance Responsibility Model
CCM-HRS-09 Personnel Roles and Responsibilities

ISO 27701:2019 · 3 controls

5.3.3 Organizational roles, responsibilities and authorities
6.3 Organization of information security
6.9.1 Operational procedures and responsibilities

APRA CPS 220 Risk Management · 2 controls

CPS220-09 Designation of a Chief Risk Officer
CPS220-10 Designated Risk Management Function

APRA CPS 234 · 2 controls

CPS234-13 Board Responsibility for Information Security
CPS234-14 Definition of Information Security Roles and Responsibilities

CFTC System Safeguards (17 CFR 37, 38, 39, 49) · 2 controls

CFTC-SS-2 Enterprise Risk Management and Governance Category
CFTC-SS-36 Internal Reporting and Review by Senior Management and the Board

FedRAMP High · 2 controls

PL-1 Policy and Procedures
PS-9 Position Descriptions (PS-9)

FedRAMP Moderate · 2 controls

PL-1 Policy and Procedures
PS-9 Position Descriptions (PS-9)

ISO/IEC 42001:2023 · 2 controls

5.3 Roles, responsibilities and authorities
A.3.2 AI roles and responsibilities

NIST Cybersecurity Framework 2.0 · 2 controls

NIST-CSF-GV.RR-01 Organizational leadership is responsible and accountable for cybersecurity risk and fosters a culture that is risk-aware, ethical, and continually improving
NIST-CSF-GV.RR-02 Roles, responsibilities, and authorities related to cybersecurity risk management are established, communicated, understood, and enforced

NIST SP 800-181 · 2 controls

NICE-OG-WRL-007 Executive Cybersecurity Leadership
NICE-OG-WRL-014 Systems Security Management

ANSSI Guide d'hygiene informatique (42 mesures, v2.0) · 1 control

ANSSI-HYG-39 Designate an Information System Security Officer and Make the Role Known

APEC Cross-Border Privacy Rules (CBPR) System · 1 control

CBPR-PR-40 Responsible individual appointed

APRA CPS 230 Operational Risk Management · 1 control

CPS230-14 Board Setting of Senior Manager Roles and Responsibilities

AWS Well-Architected Security Pillar · 1 control

SEC10-BP01 Identify key personnel and external resources

Australia Consumer Data Right - Banking (CDR) · 1 control

AUCDR-IS-STEP1 Step 1 - Define and implement security governance for CDR data

Australia My Health Records Act 2012 · 1 control

MYHR-SEC-1 Written security and access policy

Azure Security Benchmark · 1 control

GS-1 Align organization roles, responsibilities and accountabilities

CIS Controls v8 · 1 control

CIS-17.1 Designate Personnel to Manage Incident Handling

ISO 22301:2019 · 1 control

5.3 Roles, responsibilities and authorities

ISO 27001:2022 · 1 control

5.2 Information security roles and responsibilities

ISO 27002:2022 · 1 control

5.2 Information security roles and responsibilities

NIST SP 800-161 Rev 1 · 1 control

161R1-PM-2 Information Security Program Leadership Role

NIST SP 800-53 Rev 5 · 1 control

NIST800-PM-2 PM-2 Information Security Program Leadership Role

SOC 2 · 1 control

SOC2-CC1.3 CC1.3 Structures, reporting lines, authorities and responsibilities (COSO principle 3)

Every mapping shown was judged rather than inferred from wording similarity, and the ones that failed review are published too. See the coverage reports and what was rejected.