RSK-01 · Risk and Decisions
Risk assessment performed and repeated
Risks to objectives are identified and assessed on a defined cadence and on material change.
7frameworks fully address it
1partially
0leave it out
SOC 2 ISO 27001 NIST CSF PCI DSS HIPAA GDPR EU AI Act NIST AI RMF
1Where each framework asks for it
- SOC 2FullCC3.2
- ISO 27001Full6.1.2
- NIST CSFFullID.RA-01
- PCI DSSFull12.3.1
- HIPAAFull164.308(a)(1)(ii)(A)
- GDPRPartialArt. 32(1) Risk to rights and freedoms of individuals, not to the organization.
- EU AI ActFullArt. 9
- NIST AI RMFFullMAP 1.1
Build the control once against this objective and cite the clause each auditor asks about. A partial mapping says what the framework leaves out; an absence is a finding about the framework, not a gap in your program.
2What usually proves it
Assessment method, dated assessments, register entries.
?Why it exists
A one-off assessment describes a company that no longer exists.
For a smaller organizationOne workshop a year plus a re-look after any big change.