9% of APRA CPS 220 Risk Management you already have
NIST SP 800-53A Rev. 5 already covers about 9% of APRA CPS 220 Risk Management, leaving
21 of 23 controls as genuinely new work.
Already covered 0
Likely covered 2
New work 21
No control in NIST SP 800-53A Rev. 5
maps directly to one in APRA CPS 220 Risk Management. Everything counted as covered is covered because both
map to the same third standard, which is what a crosswalk is, but it is an inference rather
than a lookup.
What is genuinely new work
Nothing in NIST SP 800-53A Rev. 5 reaches these. This is the list to scope.
CPS220-01Application and Scope
CPS220-02Board Responsibility
CPS220-03Board Risk Committee
CPS220-04Risk Management Framework
CPS220-05Risk Management Strategy
CPS220-06Risk Appetite Statement
CPS220-07Material Risks Coverage
CPS220-08Three Lines of Accountability
CPS220-09Chief Risk Officer
CPS220-10Risk Management Function
CPS220-13New and Material Changes
CPS220-17Group Risk Management
CPS220-19Notification to APRA
CPS220-20Declaration to APRA
CPS220-21Outsourcing and Service Provider Risk
CPS220-22Operational and Non-Financial Risk
CPS220-23Documentation and Records
Show the 2 you already have
CPS220-18Comprehensive Review
How this is calculated
Already covered means a mapping runs from a control in NIST SP 800-53A Rev. 5 to that control. Likely
covered means no direct mapping exists but both frameworks map to the same control in a third
standard. New work means neither. We keep those separate rather than adding them into one
friendlier number, because blending them would present a two-hop inference as a verified
fact.
Coverage is not symmetric.
Run it the other way and you will get a
different number; both are correct.
From 332,959 cross-framework control
mappings across 723 frameworks, 531 of them verified against
their source documents. It does not tell you that you are compliant: a mapped control means
the two standards ask for the same thing, not that you have done it.
Try another pair ยท
Today's edition