Responsible Minerals Initiative (RMI) - Responsible Minerals Assurance Process RMI-SEG-2: Environmental Standards

What else in your programme already covers this

This control maps to 138 controls across 75 other frameworks. If you already hold one of them, the evidence you collected for it is the starting point here rather than new work.

BSI IT-Grundschutz · 3 controls

BSI-13 Risk assessment procedures
BSI-15 Security categorization
BSI-17 Continuous monitoring strategy

ISO 27005 · 3 controls

ISO27005-06 Risk identification methods
ISO27005-08 Risk criteria and thresholds
ISO27005-10 Risk interdependency analysis

ISO 31000 · 3 controls

ISO31000-07 Risk analysis and evaluation
ISO31000-09 Risk scenario development
ISO31000-10 Risk interdependency analysis

ISO/IEC 23894:2023 · 3 controls

ISO23894-6.3 AI Risk Assessment
ISO23894-6.3.1 AI Risk Identification
ISO23894-6.3.3 AI Risk Evaluation

ISO/IEC 29134:2023 · 3 controls

29134-1 Scope
29134-3 Terms and definitions
29134-9.1 PIA report structure

NIST SP 800-53 Rev 5 · 3 controls

NIST800-RA-1 Policy and procedures for risk assessment
NIST800-RA-2 Security categorization
NIST800-RA-5 Vulnerability monitoring and scanning

SSAE 18 - Attestation Standards (SOC Reporting) · 3 controls

SSAE18-CC3.1 CC3.1 - COSO Principle 6: Risk Identification
SSAE18-CC3.2 CC3.2 - COSO Principle 7: Risk Analysis
SSAE18-SOC1-02 Risk Assessment

API 1164 · 2 controls

API1164-07 Remote Access
API1164-24 Vulnerability assessment for critical systems

EASA Part-IS - Information Security in Aviation · 2 controls

IS.D.OR.205 Information Security Risk Assessment
IS.I.OR.205 Information Security Risk Assessment

French Sapin II Law (Law No. 2016-1691) · 2 controls

Sapin2-Pillar3-Risk-Mapping Pillar 3 - Corruption Risk Mapping (Cartographie des Risques)
Sapin2-Pillar4-ThirdParty-DueDiligence Pillar 4 - Third-Party Due Diligence (Clients, Suppliers, Intermediaries, M&A)

ICAO Annex 17 - Aviation Security (AVSEC) · 2 controls

ICAO-ANX17-Chap2-ThreatAssessment-RiskManagement-Cyber-GASeP ICAO Annex 17 Chapter 2 - Threat Assessment + Risk Management + Cyber Threats to Critical Aviation Systems (Amendment 17/18)
ICAO-ANX17-Chap4-Cargo-Mail-Catering-Stores-Supplies-RegulatedAgent-KnownConsignor ICAO Annex 17 Chapter 4 - Cargo + Mail + Catering + Stores + Supplies Security + Regulated Agent + Known Consignor + Supply Chain

IEC 62443 · 2 controls

IEC62443-07 Personnel risk assessment
IEC62443-24 Vulnerability assessment for critical systems

ISO 27019 · 2 controls

ISO27019-07 Personnel risk assessment
ISO27019-24 Vulnerability assessment for critical systems

ISO/IEC 27003:2017 · 2 controls

ISO27003-6.1 Actions to Address Risks and Opportunities
ISO27003-8.2 Information Security Risk Assessment

ISO/IEC 27014:2020 · 2 controls

29134-1 Scope
29134-3 Terms and definitions

ISO/IEC 27557:2022 - Organisational Privacy Risk Management · 2 controls

27557-4.3 Individual impact consideration
27557-6.3 Privacy risk assessment

NIST Cybersecurity Framework 2.0 · 2 controls

NIST-CSF-GV.RM-07 Strategic opportunities (i.e., positive risks) are characterized and are included in organizational cybersecurity risk discussions
NIST-CSF-ID.RA-09 The authenticity and integrity of hardware and software are assessed prior to acquisition and use

NIST SP 1800-32 · 2 controls

NIST1800-32-07 Personnel risk assessment
NIST1800-32-24 Vulnerability assessment for critical systems

SQF Code Edition 9 - Safe Quality Food · 2 controls

2.4.4 Hazard Analysis and Risk Assessment
2.7.2 Food Fraud Plan

South Korea ISMS-P · 2 controls

ISMSP-MS-02 Risk Management
ISMSP-SYS-04 Vulnerability Management

Switzerland New Federal Act on Data Protection (nFADP/nDSG, 2023) · 2 controls

CH-FADP-21 Data protection impact assessments
FADP-7 Data Protection Impact Assessment (Articles 9-10)

UAE Virtual Asset Regulatory Authority (VARA) Regulations · 2 controls

CRM-1 AML/CFT Compliance
CRM-4 Business Risk Assessment

UNESCO Recommendation on the Ethics of AI · 2 controls

UNESCO-AI-PA1 Ethical Impact Assessment
UNESCOAI-1 Principles 1-3: Proportionality, Safety, Fairness

AICPA Privacy Management Framework (PMF) · 1 control

PMF-M.3 Privacy Risk Assessment

AML/CTF Act 2006 (Australia) · 1 control

AMLCTF-PartA-RiskAssess ML/TF Risk Assessment

APRA CPS 230 Operational Risk Management · 1 control

CPS230-11 Identification, Assessment and Management of Operational Risk

APRA SPS 220 Risk Management (Superannuation) · 1 control

SPS220-22 Framework Enabling Strategies, Policies, Procedures and Controls

ASIS SPC.1-2009 - Organizational Resilience Standard · 1 control

4.3.1 Risk Assessment and Impact Analysis

AWWA Cybersecurity Guidance for the Water Sector (American Water Works Association) · 1 control

AWWA-1.2 Risk Assessment

Annex 11 to EU GMP - Computerised Systems · 1 control

Clause 1 Risk management

Authorised Economic Operator (AEO) Programmes - Global Standards · 1 control

P1-S1 Advance Electronic Information

Bahrain PDPL · 1 control

BH-PDPL-21 Data protection impact assessments

Barbados Data Protection Act 2019 · 1 control

BB-DPA-20 Sections 50-60 - Registration and Responsibilities

FBI CJIS Security Policy · 1 control

CJIS-17 Risk Assessment

FedRAMP High · 1 control

RA-1 Policy and Procedures

FedRAMP Moderate · 1 control

RA-1 Policy and Procedures

Federal Decree-Law No. 45 of 2021 on the Protection of Personal Data (UAE PDPL) · 1 control

UAE-PDPL-Art.18_19_20_21 Security measures, controller/processor relationship, DPIA (UAE PDPL Articles 18-21)

GDPR · 1 control

GDPR-Art.35 Data protection impact assessment

ISO 13485 · 1 control

ISO13485-06 Security management process and risk analysis

ISO 22000 · 1 control

ISO22000-02 Hazard identification and risk assessment

ISO 22313:2020 - Guidance on Business Continuity Management Systems · 1 control

ISO-22313-8.2 Business impact analysis and risk assessment

ISO 26262:2018 - Functional Safety for Road Vehicles · 1 control

ISO-26262-3-7 Hazard analysis and risk assessment (HARA)

ISO 27017 · 1 control

ISO27017-03 Cloud risk assessment

ISO 27018 · 1 control

ISO27018-03 Cloud risk assessment

ISO 27799 · 1 control

ISO27799-06 Security management process and risk analysis

ISO 45001 · 1 control

ISO45001-02 Hazard identification and risk assessment

ISO/IEC 27031:2011 · 1 control

27031-7.2 Resource Requirements

ISO/IEC 29147:2018 · 1 control

29147-5.11 Researcher Safe Harbour and Legal Posture

Kuwait National Cybersecurity Framework · 1 control

KUWAIT-GOV-03 Risk Management Framework

NFPA 1600 - Standard on Continuity, Emergency, and Crisis Management · 1 control

NFPA1600-5.1 Risk Assessment

NIST SP 800-171A Rev 3 - Assessing CUI Security Requirements · 1 control

3.11 Encrypt Sensitive Data at Rest

NIST SP 800-190 · 1 control

NIST190-03 Cloud risk assessment

NIST SP 800-53 Rev 5 LOW · 1 control

RA-1 Policy and Procedures

NIST SP 800-53 Rev 5 MODERATE · 1 control

RA-1 Policy and Procedures

NIST SP 800-53 Revision 5.1 HIGH · 1 control

RA-1 Policy and Procedures

SANS Incident Handler's Handbook and PICERL Methodology · 1 control

PICERL-P2 Risk Assessment

SEC Climate Disclosure Rule · 1 control

SECCLIM-2 Risk Management: Identification, Assessment, Integration

SOC for Cybersecurity - Cybersecurity Risk Management Examination · 1 control

SOC-CY-DC5 Risk Assessment Process

Saudi Arabia PDPL · 1 control

SA-PDPL-21 Data protection impact assessments

Security of Critical Infrastructure Act 2018 (SOCI) · 1 control

SOCI-S30CU Vulnerability assessments

Singapore Cybersecurity Act 2018 · 1 control

SCA-S10 Annual Risk Assessment

Singapore Government Instruction Manual on ICT&SS Management (IM8) · 1 control

IM8-SEC.4 Vulnerability Management

TSA Pipeline Cybersecurity Directives · 1 control

TSAPIPE-1 Cybersecurity Implementation Plan and Coordinator

Taiwan PDPA · 1 control

TAIWAN-3 Data Subject Rights

Texas Data Privacy Act · 1 control

TEXASTDPSA-3 Sensitive Data, Children, Sale Notice

UK AI Regulation Framework · 1 control

UKAI-1 Risk-Based Approach and Pro-Innovation Principles

UK Age Appropriate Design Code (Children's Code) · 1 control

Standard 2 Data Protection Impact Assessments

UK FCA/PRA Operational Resilience Framework · 1 control

UKOPRES-3 Self-Assessment and Board Engagement

UK GDPR (UK General Data Protection Regulation) · 1 control

UKGDPRREG-3 Controller and Processor (Articles 24-43)

UK Modern Slavery Act 2015 · 1 control

s.54(5) Statement Content Requirements

UK Security and Emergency Measures Direction (SEMD) - Water Industry · 1 control

SEMD-SP-2 Risk Identification and Assessment

UNICEF Policy Guidance on AI for Children (2021) · 1 control

UNICEFAI-4 Transparency, Explanation, Adult Capacity

US Consumer Product Safety Commission (CPSC) - Connected Product Safety · 1 control

CPSC-RA.3 Lifecycle Risk Assessment

Uruguay DPL · 1 control

URUGUAY-5 Database Registration with AGESIC URCDP

Virginia CDPA · 1 control

VIRGINIAVCDPA-3 Sensitive Data Consent and Children

Every mapping shown was judged rather than inferred from wording similarity, and the ones that failed review are published too. See the coverage reports and what was rejected.