SASB Standards
Leadership and Governance

SASB Standards SASB-LG-5: Systemic Risk Management

Management of risks and contribution to or mitigation of systemic risks resulting from large-scale weakening or collapse of systems.

What else in your programme already covers this

This control maps to 124 controls across 52 other frameworks. If you already hold one of them, the evidence you collected for it is the starting point here rather than new work.

ISO/IEC 27557:2022 - Organisational Privacy Risk Management · 5 controls

APRA CPS 230 Operational Risk Management · 3 controls

  • CPS230-16 Internal Audit Review of the Business Continuity Plan
  • CPS230-37 Service Provider Management Policy
  • CPS230-46 Ongoing Risk Management of Each Material Arrangement

EASA Part-IS - Information Security in Aviation · 3 controls

FFIEC IT Examination Handbook · 3 controls

  • FFIEC-03 Risk appetite and tolerance for IT risk
  • FFIEC-18 Ongoing monitoring and assessment
  • FFIEC-20 Exit strategy and transition planning

IEC 60601-1 - Medical Electrical Equipment Safety · 3 controls

IEC 62304:2015 Medical Device Software Lifecycle Processes · 3 controls

ISO 27005 · 3 controls

ISO 31000 · 3 controls

ISO/IEC 23894:2023 · 3 controls

NIST Cybersecurity Framework 2.0 · 3 controls

  • NIST-CSF-GV.RM-03 Cybersecurity risk management activities and outcomes are included in enterprise risk management processes
  • NIST-CSF-GV.RM-04 Strategic direction that describes appropriate risk response options is established and communicated
  • NIST-CSF-GV.SC-01 A cybersecurity supply chain risk management program, strategy, objectives, policies, and processes are established and agreed to by organizational stakeholders

NIST SP 800-53 Rev 5 · 3 controls

PCI P2PE · 3 controls

PCI PIN Security · 3 controls

PCI SSF · 3 controls

SOC for Cybersecurity - Cybersecurity Risk Management Examination · 3 controls

Security of Critical Infrastructure Act 2018 (SOCI) · 3 controls

Solvency II · 3 controls

APRA CPS 234 · 2 controls

  • CPS234-16 Assessment of Related Party and Third Party Capability
  • CPS234-20 Information Asset Classification

BS 65000:2014 - Guidance on Organizational Resilience · 2 controls

FFIEC Cybersecurity Assessment Tool (CAT) · 2 controls

IAIS Insurance Core Principles (ICPs) · 2 controls

  • ICP-16 Enterprise Risk Management for Solvency Purposes
  • ICP-8 Risk Management and Internal Controls

ISO 37000:2021 - Governance of Organizations · 2 controls

ISO/IEC 23837 - Security Requirements for Quantum Key Distribution · 2 controls

ISO/IEC 27003:2017 · 2 controls

NIST SP 800-171A Rev 3 - Assessing CUI Security Requirements · 2 controls

  • 3.16 System and Services Acquisition
  • 3.17 Supply Chain Risk Management

TISAX - Trusted Information Security Assessment Exchange · 2 controls

AML/CTF Act 2006 (Australia) · 1 control

API 1164 · 1 control

  • API1164-21 TSA Pipeline Security Directive Alignment

APRA SPS 220 Risk Management (Superannuation) · 1 control

  • SPS220-28 Annual Board Risk Management Declaration

AS9100D - Aerospace Quality Management System · 1 control

Aged Care Quality Standards 2019 (repealed edition) · 1 control

Annex 11 to EU GMP - Computerised Systems · 1 control

Authorised Economic Operator (AEO) Programmes - Global Standards · 1 control

  • P1-S2 Risk-Management Systems

FBI CJIS Security Policy · 1 control

  • CJIS-19 Supply Chain Risk Management

ICAO Annex 17 - Aviation Security (AVSEC) · 1 control

IEC 62443 · 1 control

  • IEC62443-21 Supply chain risk management for critical components

ISO 15189:2022 - Medical Laboratories Requirements for Quality and Competence · 1 control

ISO 20400:2017 - Sustainable Procurement · 1 control

ISO 22320:2018 · 1 control

ISO 27019 · 1 control

  • ISO27019-21 Supply chain risk management for critical components

ISO 28001:2007 Supply Chain Security Management · 1 control

ISO/IEC 38500:2024 - Governance of IT · 1 control

Kuwait National Cybersecurity Framework · 1 control

NIST SP 1800-32 · 1 control

SEC Climate Disclosure Rule · 1 control

  • SECCLIM-2 Risk Management: Identification, Assessment, Integration

SSAE 18 - Attestation Standards (SOC Reporting) · 1 control

  • SSAE18-CC9.2 CC9.2 - Vendor and Business Partner Risk Management

Singapore AI Governance Framework · 1 control

  • AIGF-1.1 Risk Management and Internal Controls

Singapore Government Instruction Manual on ICT&SS Management (IM8) · 1 control

South Korea ISMS-P · 1 control

Telecommunications Sector Security Reforms (TSSR) · 1 control

UAE Virtual Asset Regulatory Authority (VARA) Regulations · 1 control

  • CRM-3 Risk Management Framework

UK AI Regulation Framework · 1 control

  • UKAI-1 Risk-Based Approach and Pro-Innovation Principles

Every mapping shown was judged rather than inferred from wording similarity, and the ones that failed review are published too. See the coverage reports and what was rejected.

Other controls in Leadership and Governance

Query this from an agent

The graph holds this control, the 124 it maps to, and the evidence behind each claim, over MCP and REST.

MCP endpointAll SASB Standards controls