SSAE 18 - Attestation Standards (SOC Reporting)
SOC 2 - Security (Common Criteria)

SSAE 18 - Attestation Standards (SOC Reporting) CC3.2: CC3.2 - COSO Principle 7: Risk Analysis

The entity identifies risks to the achievement of its objectives across the entity and analyzes risks as a basis for determining how to manage them.

Maintained by Gerard BlokdykControl text last updated

What else in your programme already covers this

This control maps to 133 controls across 71 other frameworks. If you already hold one of them, the evidence you collected for it is the starting point here rather than new work.

BSI IT-Grundschutz · 3 controls

  • BSI-13 Risk assessment procedures
  • BSI-15 Security categorization
  • BSI-17 Continuous monitoring strategy

ISO 27005 · 3 controls

ISO 31000 · 3 controls

ISO/IEC 23894:2023 · 3 controls

ISO/IEC 29134:2023 · 3 controls

NIST SP 800-53 Rev 5 · 3 controls

Responsible Minerals Initiative (RMI) - Responsible Minerals Assurance Process · 3 controls

API 1164 · 2 controls

EASA Part-IS - Information Security in Aviation · 2 controls

ICAO Annex 17 - Aviation Security (AVSEC) · 2 controls

IEC 62443 · 2 controls

ISO 27019 · 2 controls

ISO/IEC 27003:2017 · 2 controls

ISO/IEC 27014:2020 · 2 controls

ISO/IEC 27557:2022 - Organisational Privacy Risk Management · 2 controls

NIST Cybersecurity Framework 2.0 · 2 controls

  • NIST-CSF-GV.RM-07 Strategic opportunities (i.e., positive risks) are characterized and are included in organizational cybersecurity risk discussions
  • NIST-CSF-ID.RA-09 The authenticity and integrity of hardware and software are assessed prior to acquisition and use

NIST SP 1800-32 · 2 controls

SQF Code Edition 9 - Safe Quality Food · 2 controls

  • 2.4.4 Hazard Analysis and Risk Assessment
  • 2.7.2 Food Fraud Plan

South Korea ISMS-P · 2 controls

Switzerland New Federal Act on Data Protection (nFADP/nDSG, 2023) · 2 controls

  • CH-FADP-21 Data protection impact assessments
  • FADP-7 Data Protection Impact Assessment (Articles 9-10)

UAE Virtual Asset Regulatory Authority (VARA) Regulations · 2 controls

  • CRM-1 AML/CFT Compliance
  • CRM-4 Business Risk Assessment

UNESCO Recommendation on the Ethics of AI · 2 controls

AICPA Privacy Management Framework (PMF) · 1 control

AML/CTF Act 2006 (Australia) · 1 control

APRA CPS 230 Operational Risk Management · 1 control

  • CPS230-11 Identification, Assessment and Management of Operational Risk

APRA SPS 220 Risk Management (Superannuation) · 1 control

  • SPS220-22 Framework Enabling Strategies, Policies, Procedures and Controls

ASIS SPC.1-2009 - Organizational Resilience Standard · 1 control

  • 4.3.1 Risk Assessment and Impact Analysis

AWWA Cybersecurity Guidance for the Water Sector (American Water Works Association) · 1 control

Annex 11 to EU GMP - Computerised Systems · 1 control

Authorised Economic Operator (AEO) Programmes - Global Standards · 1 control

  • P1-S1 Advance Electronic Information

Bahrain PDPL · 1 control

Barbados Data Protection Act 2019 · 1 control

  • BB-DPA-20 Sections 50-60 - Registration and Responsibilities

FBI CJIS Security Policy · 1 control

FedRAMP High · 1 control

  • RA-1 Policy and Procedures

FedRAMP Moderate · 1 control

  • RA-1 Policy and Procedures

Federal Decree-Law No. 45 of 2021 on the Protection of Personal Data (UAE PDPL) · 1 control

GDPR · 1 control

ISO 13485 · 1 control

  • ISO13485-06 Security management process and risk analysis

ISO 22000 · 1 control

ISO 22313:2020 - Guidance on Business Continuity Management Systems · 1 control

ISO 26262:2018 - Functional Safety for Road Vehicles · 1 control

ISO 27017 · 1 control

ISO 27018 · 1 control

ISO 27799 · 1 control

  • ISO27799-06 Security management process and risk analysis

ISO 45001 · 1 control

ISO/IEC 27031:2011 · 1 control

ISO/IEC 29147:2018 · 1 control

  • 29147-5.11 Researcher Safe Harbour and Legal Posture

Kuwait National Cybersecurity Framework · 1 control

NFPA 1600 - Standard on Continuity, Emergency, and Crisis Management · 1 control

NIST SP 800-171A Rev 3 - Assessing CUI Security Requirements · 1 control

  • 3.11 Encrypt Sensitive Data at Rest

NIST SP 800-190 · 1 control

NIST SP 800-53 Rev 5 LOW · 1 control

  • RA-1 Policy and Procedures

NIST SP 800-53 Rev 5 MODERATE · 1 control

  • RA-1 Policy and Procedures

NIST SP 800-53 Revision 5.1 HIGH · 1 control

  • RA-1 Policy and Procedures

SANS Incident Handler's Handbook and PICERL Methodology · 1 control

SOC for Cybersecurity - Cybersecurity Risk Management Examination · 1 control

Saudi Arabia PDPL · 1 control

Security of Critical Infrastructure Act 2018 (SOCI) · 1 control

Singapore Cybersecurity Act 2018 · 1 control

Singapore Government Instruction Manual on ICT&SS Management (IM8) · 1 control

Taiwan PDPA · 1 control

Texas Data Privacy Act · 1 control

UK AI Regulation Framework · 1 control

  • UKAI-1 Risk-Based Approach and Pro-Innovation Principles

UK Age Appropriate Design Code (Children's Code) · 1 control

UK FCA/PRA Operational Resilience Framework · 1 control

  • UKOPRES-3 Self-Assessment and Board Engagement

UK GDPR (UK General Data Protection Regulation) · 1 control

UK Modern Slavery Act 2015 · 1 control

  • s.54(5) Statement Content Requirements

UK Security and Emergency Measures Direction (SEMD) - Water Industry · 1 control

US Consumer Product Safety Commission (CPSC) - Connected Product Safety · 1 control

Uruguay DPL · 1 control

  • URUGUAY-5 Database Registration with AGESIC URCDP

Virginia CDPA · 1 control

Every mapping shown was judged rather than inferred from wording similarity, and the ones that failed review are published too. See the coverage reports and what was rejected.

Other controls in SOC 2 - Security (Common Criteria)

Query this from an agent

The graph holds this control, the 133 it maps to, and the evidence behind each claim, over MCP and REST.

MCP endpointAll SSAE 18 - Attestation Standards (SOC Reporting) controls