Home
Browse frameworks
Contact us
SAMMY premium
Sign in
Cybersecurity Fundamentals 2.0
Browse Cybersecurity...
AIMA
ASPICE Cybersecurity
ASVS
BSIMM 15
CIS Critical Security Controls
Cloud Controls Matrix
CRA Framework
Cybersecurity Fundamentals
Cybersecurity Fundamentals 2.0
DSOMM
NIS2
NIST 800-171 Rev 2
NIST 800-171 Rev 3
NIST 800-34
NIST 800-53 v5
NIST CSF 2.0
NIST SSDF
OpenSAMM1.5
PCI DSS 4.0.1
SAMM
Secure Controls Framework
GOVERN
Organizational Context
Risk Management Strategy
Roles, Responsibilities, and Authorities
Policies, Processes, and Procedures
Oversight
Supply Chain Risk Management
IDENTIFY
Asset Management
Risk Assessment
Improvement
PROTECT
Identity Management, Authentication, and Access Control
Awareness and Training
Data Security
Platform Security
Technology Infrastructure Resilience
DETECT
Continuous Monitoring
Adverse Event Analysis
RESPOND
Incident Management
Incident Analysis
Incident Response Reporting and Communication
Incident Mitigation
RECOVER
Incident Recovery Plan Execution
Incident Recovery Communication
ID.RA-01
ID.RA-02
ID.RA-03
ID.RA-05
ID.RA-06
ID.RA-08
ID.RA-06.1: Risk responses shall be identified, prioritised, planned, tracked and communicated.
Risk responses shall be identified, prioritised, planned, tracked and communicated.
✕
Not applicable - Not applicable in the selected scope.
Level 1 - Initial - No Process documentation or not formally approved by management.
Level 2 - Repeatable - Formally approved Process documentation exists but not reviewed in the previous 2 years.
Level 3 - Defined - Formally approved Process documentation exists, and exceptions are documented and approved. Documented and approved exceptions < 5% of the time.
Level 4 - Managed - Formally approved Process documentation exists, and exceptions are documented and approved. Documented and approved exceptions < 3% of the time.
Level 5 - Optimizing - Formally approved Process documentation exists, and exceptions are documented and approved. Documented and approved exceptions < 0,5% of the time.
Not applicable
Level 1 - Initial
Level 2 - Repeatable
Level 3 - Defined
Level 4 - Managed
Level 5 - Optimizing
✕
Not applicable - Not applicable in the selected scope.
Level 1 - Initial - Standard process does not exist.
Level 2 - Repeatable - Ad-hoc process exists and is done informally.
Level 3 - Defined - Formal process exists and is implemented. Evidence available for most activities. Less than 10% process exceptions.
Level 4 - Managed - Formal process exists and is implemented. Evidence available for all activities. Detailed metrics of the process are captured and reported. Minimal target for metrics has been established. Less than 5% of process exceptions.
Level 5 - Optimizing - Formal process exists and is implemented. Evidence available for all activities. Detailed metrics of the process are captured and reported. Minimal target for metrics has been established and continually improving. Less than 1% of process exceptions.
Not applicable
Level 1 - Initial
Level 2 - Repeatable
Level 3 - Defined
Level 4 - Managed
Level 5 - Optimizing
Description
Risk responses shall be identified, prioritised, planned, tracked and communicated.
✕