RSK

Risk Management

35 controls

Proactively identify, assess, prioritize and treat risks to align Technology Assets, Applications, Services and Data (TAASD)-related decisions with the organization's defined risk appetite and risk tolerance.

SCF #	Control Name	Weight	NIST CSF	Frameworks
RSK-01	Risk Management Policy	10 — Critical	Govern	8
RSK-02	Risk Management Program	10 — Critical	Govern	124
RSK-03	Risk Management Resourcing	8 — High	Protect	7
RSK-04	Risk Culture	4 — Medium	Identify	7
RSK-05	Risk Framing	9 — Critical	Identify	64
RSK-05.1	Risk Tolerance	9 — Critical	Identify	29
RSK-05.2	Risk Threshold	9 — Critical	Identify	17
RSK-05.3	Risk Appetite	9 — Critical	Identify	27
RSK-06	Material Risks	7 — High	Govern	7
RSK-06.1	Executive Leadership Approval For Managing Material Risk	9 — Critical	Govern	5
RSK-06.2	Documented Justification For Material Risk Management Decisions	9 — Critical	Govern	1
RSK-07	Risk-Based Security Categorization	9 — Critical	Identify	65
RSK-07.1	Impact-Level Prioritization	9 — Critical	Identify	22
RSK-08	Business Impact Analysis (BIA)	8 — High	Identify	32
RSK-09	Risk Identification	9 — Critical	Identify	69
RSK-10	Risk Catalog	5 — Medium	Protect	29
RSK-11	Risk Owner	9 — Critical	Identify	5
RSK-12	Risk Assessment Methodology	8 — High	Identify	23
RSK-13	Risk Assessment	10 — Critical	Identify	131
RSK-13.1	Instances Requiring A Risk Assessment	9 — Critical	Identify	11
RSK-13.2	Risk Assessment Update	9 — Critical	Identify	25
RSK-13.3	Risk Assessment Stakeholder Involvement	8 — High	Protect	4
RSK-14	Risk Register	10 — Critical	Identify	48
RSK-15	Risk Ranking	9 — Critical	Identify	25
RSK-16	Risk Response	9 — Critical	Identify	65
RSK-16.1	Risk Treatment Options	9 — Critical	Protect	23
RSK-17	Risk Remediation	10 — Critical	Identify	74
RSK-17.1	Risk Treatment Plan (RTP)	9 — Critical	Protect	24
RSK-17.2	Documented Alternatives	9 — Critical	Govern	1
RSK-18	Compensating Countermeasures	9 — Critical	Respond	70
RSK-19	Data Protection Impact Assessment (DPIA)	9 — Critical	Identify	50
RSK-20	Supply Chain Risk Management (SCRM) Plan	10 — Critical	Identify	66
RSK-20.1	AI & Autonomous Technologies Supply Chain Impacts	8 — High	Protect	1
RSK-21	Supply Chain Risk Assessment (SCRA)	9 — Critical	Identify	55
RSK-22	Risk Monitoring	9 — Critical	Detect	31

The Secure Controls Framework (SCF) is maintained by SCF Council. Use of SCF content is subject to the SCF Terms & Conditions.

Risk Management

Manage SCF Controls in SCF Connect