RSK-01Risk and Decisions
Risk assessment performed and repeated
Risks to objectives are identified and assessed on a defined cadence and on material change.
Why it exists
A one-off assessment describes a company that no longer exists.
What usually proves it
Assessment method, dated assessments, register entries.
Smaller organizations
One workshop a year plus a re-look after any big change.
Mapped to
- Fully addressedSOC 2 Trust Services Criteria · CC3.2
- Fully addressedISO/IEC 27001 Annex A · 6.1.2
- Fully addressedNIST Cybersecurity Framework · ID.RA-01
- Fully addressedPCI DSS · 12.3.1
- Fully addressedHIPAA Security Rule · 164.308(a)(1)(ii)(A)
- Partially addressedGDPR · Art. 32(1) — Risk to rights and freedoms of individuals, not to the organization.
- Fully addressedEU AI Act · Art. 9
- Fully addressedNIST AI Risk Management Framework · MAP 1.1