Crossfoot
Crossfoot / Controls / Risk assessment and treatment
Draft v0.1.06 of 6 frameworks

Risk assessment and treatment

A repeatable process to identify, rate and treat information security risks, performed at least annually and on significant change.

Where it appears

SOC 2
CC3.1Specifies suitable objectives
CC3.2Identifies and analyzes risk
CC3.3Considers potential for fraud
CC3.4Identifies and assesses significant changes
PCI DSS 4.0
12.3Risks to the cardholder data environment are formally identified, evaluated and managed
12.3.1Targeted risk analysis for requirements with flexible frequency
NIST CSF 2.0
GV.RMRisk management strategy
ID.RARisk assessment
ISO 27001:2022
Clause 6.1.2Information security risk assessment
Clause 6.1.3Information security risk treatment
HIPAA Security Rule
164.308(a)(1)(ii)(A)Risk analysis
164.308(a)(1)(ii)(B)Risk management
NIST 800-53 r5
RA-3Risk assessment
PM-9Risk management strategy

Evidence auditors usually ask for

A typical starting list. Your assessor's request list is the one that counts.

  • Risk assessment methodology document
  • Most recent completed risk assessment and risk register
  • Risk treatment plan with owners and due dates
  • Evidence of management risk acceptance for residual risks
  • For PCI: targeted risk analyses for any flexible-frequency requirements

Crosswalks that include this

SOC 2 to PCI DSS 4.0SOC 2 to NIST CSF 2.0SOC 2 to ISO 27001:2022SOC 2 to HIPAA Security RuleSOC 2 to NIST 800-53 r5PCI DSS 4.0 to SOC 2PCI DSS 4.0 to NIST CSF 2.0PCI DSS 4.0 to ISO 27001:2022PCI DSS 4.0 to HIPAA Security RulePCI DSS 4.0 to NIST 800-53 r5NIST CSF 2.0 to SOC 2NIST CSF 2.0 to PCI DSS 4.0