Framework overlap

Does OCC Heightened Standards (12 CFR Part 30, Appendix D) cover NIST Cybersecurity Framework 2.0?

You hold OCC Heightened Standards (12 CFR Part 30, Appendix D) and have been told to do NIST Cybersecurity Framework 2.0. Here is how much overlaps, control by control.

22% of NIST Cybersecurity Framework 2.0 you already have

OCC Heightened Standards (12 CFR Part 30, Appendix D) already covers about 22% of NIST Cybersecurity Framework 2.0, leaving 83 of 106 controls as genuinely new work.

Already covered 0 Likely covered 23 New work 83

No control in OCC Heightened Standards (12 CFR Part 30, Appendix D) maps directly to one in NIST Cybersecurity Framework 2.0. Everything counted as covered is covered because both map to the same third standard, which is what a crosswalk is, but it is an inference rather than a lookup.

What is genuinely new work

Nothing in OCC Heightened Standards (12 CFR Part 30, Appendix D) reaches these. This is the list to scope.

GV.OV-01
Risk management strategy outcomes are reviewed
GV.OV-02
Risk management strategy is reviewed for coverage
GV.OV-03
Risk management performance is evaluated
NIST-CSF-DE.AE-02
Potentially adverse events are analyzed to better understand associated activities
NIST-CSF-DE.AE-03
Information is correlated from multiple sources
NIST-CSF-DE.AE-04
Estimated impact and scope of adverse events are understood
NIST-CSF-DE.AE-06
Information on adverse events is provided to authorized staff
NIST-CSF-DE.CM-01
Networks and network services are monitored to find potentially adverse events
NIST-CSF-DE.CM-02
The physical environment is monitored to find potentially adverse events
NIST-CSF-DE.CM-03
Personnel activity and technology usage are monitored to find potentially adverse events
NIST-CSF-DE.CM-06
External service provider activities are monitored to find potentially adverse events
NIST-CSF-DE.CM-09
Computing hardware and software are monitored to find potentially adverse events
NIST-CSF-GV.OC-02
Internal and external stakeholders are understood
NIST-CSF-GV.OC-03
Legal, regulatory, and contractual requirements are understood
NIST-CSF-GV.OC-04
Critical objectives, capabilities, and services are understood
NIST-CSF-GV.OC-05
Outcomes and dependencies of critical services are understood
NIST-CSF-GV.PO-01
Cybersecurity risk management policy is established based on context and strategy
NIST-CSF-GV.PO-02
Policy is reviewed, updated, communicated, and enforced
NIST-CSF-GV.RM-01
Risk management objectives are established and agreed upon
NIST-CSF-GV.RM-02
Risk appetite and risk tolerance statements are established
NIST-CSF-GV.RM-05
Communication lines for cybersecurity risk management are established
NIST-CSF-GV.RM-06
A standardized method for calculating and expressing cybersecurity risk is established
NIST-CSF-GV.RR-01
Organizational leadership is responsible for cybersecurity risk management
NIST-CSF-GV.RR-02
Roles and responsibilities for cybersecurity risk management are established
NIST-CSF-GV.RR-03
Adequate resources are allocated for cybersecurity risk management
NIST-CSF-GV.RR-04
Cybersecurity is included in human resources practices
NIST-CSF-GV.SC-02
Cybersecurity roles and responsibilities for suppliers are established
NIST-CSF-GV.SC-03
Supply chain risk management is integrated into risk management
NIST-CSF-GV.SC-04
Suppliers are known and prioritized by criticality
NIST-CSF-GV.SC-05
Requirements are established and managed for suppliers
NIST-CSF-GV.SC-06
Planning and due diligence are performed to reduce supply chain risks
NIST-CSF-GV.SC-07
Supply chain risk management is verified throughout supplier relationships
NIST-CSF-GV.SC-08
Relevant suppliers and partners are included in incident planning
NIST-CSF-GV.SC-09
Supply chain security practices are integrated into security program
NIST-CSF-GV.SC-10
Cybersecurity supply chain risk management plans include provisions for post-acquisition activities
NIST-CSF-ID.AM-01
Inventories of hardware managed by the organization are maintained
NIST-CSF-ID.AM-02
Inventories of software, services, and systems managed by the organization are maintained
NIST-CSF-ID.AM-03
Representations of authorized network communication and data flows are maintained
NIST-CSF-ID.AM-05
Assets are prioritized based on classification, criticality, resources, and impact
NIST-CSF-ID.AM-07
Inventories of data and corresponding metadata are maintained
NIST-CSF-ID.AM-08
Systems, hardware, software, and services are managed throughout their life cycles
NIST-CSF-ID.IM-01
Improvements are identified from security test and exercise results
NIST-CSF-ID.IM-02
Improvements are identified from security assessments
NIST-CSF-ID.IM-03
Improvements are identified from operational activities and incidents
NIST-CSF-ID.RA-01
Vulnerabilities in assets are identified, validated, and recorded
NIST-CSF-ID.RA-03
Internal and external threats are identified and recorded
NIST-CSF-ID.RA-04
Potential impacts and likelihoods of threats exploiting vulnerabilities are identified
NIST-CSF-ID.RA-05
Threats, vulnerabilities, likelihoods, and impacts are used to understand inherent risk
NIST-CSF-ID.RA-06
Risk responses are chosen, prioritized, planned, tracked, and communicated
NIST-CSF-ID.RA-07
Changes and exceptions are managed, assessed for risk impact, recorded, and tracked
NIST-CSF-ID.RA-08
Effectiveness of risk responses is assessed
NIST-CSF-PR.AA-03
Users, services, and hardware are authenticated
NIST-CSF-PR.AA-04
Identity assertions are protected, conveyed, and verified
NIST-CSF-PR.AA-06
Physical access to assets is managed, monitored, and enforced
NIST-CSF-PR.AT-01
Personnel are provided awareness and training to perform cybersecurity duties
NIST-CSF-PR.AT-02
Individuals in specialized roles are provided awareness and training
NIST-CSF-PR.DS-01
The confidentiality, integrity, and availability of data-at-rest are protected
NIST-CSF-PR.DS-02
The confidentiality, integrity, and availability of data-in-transit are protected
NIST-CSF-PR.DS-11
Backups of data are created, protected, maintained, and tested
NIST-CSF-PR.IR-01
Networks and environments are protected from unauthorized access
NIST-CSF-PR.IR-02
The organization's technology assets are protected from environmental threats
NIST-CSF-PR.PS-02
Software is maintained, replaced, and removed commensurate with risk
NIST-CSF-PR.PS-03
Hardware is maintained, replaced, and removed commensurate with risk
NIST-CSF-PR.PS-04
Log records are generated and made available for continuous monitoring
NIST-CSF-PR.PS-05
Installation and execution of unauthorized software is prevented
NIST-CSF-PR.PS-06
Secure software development practices are integrated throughout the SDLC
NIST-CSF-RC.CO-03
Recovery activities and progress are communicated to stakeholders
NIST-CSF-RC.CO-04
Public updates on incident recovery are shared using approved methods
NIST-CSF-RC.RP-02
Recovery actions are selected, scoped, and prioritized
NIST-CSF-RC.RP-03
The integrity of backups is verified before use in restoration
NIST-CSF-RC.RP-04
Critical functions and services are restored to operational capability
NIST-CSF-RC.RP-05
Integrity of restored assets is verified
NIST-CSF-RS.AN-03
Analysis is performed to determine what has taken place during an incident
NIST-CSF-RS.AN-06
Actions performed during an investigation are recorded
NIST-CSF-RS.AN-07
Incident data and metadata are collected and their integrity preserved
NIST-CSF-RS.AN-08
Incidents are analyzed to determine root cause
NIST-CSF-RS.CO-02
Internal and external stakeholders are notified of incidents
NIST-CSF-RS.CO-03
Information is shared with designated internal and external stakeholders
NIST-CSF-RS.MA-02
Incident reports are triaged and validated
NIST-CSF-RS.MA-03
Incidents are categorized and prioritized
NIST-CSF-RS.MA-04
Incidents are escalated or elevated as needed
NIST-CSF-RS.MI-01
Incidents are contained
NIST-CSF-RS.MI-02
Incidents are eradicated
Show the 23 you already have
NIST-CSF-DE.AE-07
Cyber threat intelligence and contextual information are integrated into analysis
NIST-CSF-DE.AE-08
Incidents are declared when adverse events meet defined criteria
NIST-CSF-GV.OC-01
Organizational context for cybersecurity risk management is understood
NIST-CSF-GV.RM-03
Cybersecurity risk management activities and outcomes are included in enterprise risk
NIST-CSF-GV.RM-04
Strategic direction for cybersecurity risk management is established
NIST-CSF-GV.RM-07
Opportunities for improvements are identified from risk assessments
NIST-CSF-GV.SC-01
Cybersecurity supply chain risk management program is established
NIST-CSF-ID.AM-04
Inventories of services provided by suppliers are maintained
NIST-CSF-ID.IM-04
Incident response plans and other cybersecurity plans are established and maintained
NIST-CSF-ID.RA-02
Cyber threat intelligence is received from information sharing forums
NIST-CSF-ID.RA-09
Integrity and accuracy of risk assessment results are verified
NIST-CSF-ID.RA-10
Critical suppliers are assessed on the basis of their risk
NIST-CSF-PR.AA-01
Identities and credentials for authorized users, services, and hardware are managed
NIST-CSF-PR.AA-02
Identities are proofed and bound to credentials based on the context of interactions
NIST-CSF-PR.AA-05
Access permissions, entitlements, and authorizations are defined and managed
NIST-CSF-PR.DS-10
The confidentiality, integrity, and availability of data-in-use are protected
NIST-CSF-PR.IR-03
Mechanisms are implemented to achieve resilience requirements in normal and adverse situations
NIST-CSF-PR.IR-04
Adequate resource capacity to ensure availability is maintained
NIST-CSF-PR.PS-01
Configuration management practices are established and applied
NIST-CSF-RC.RP-01
The recovery portion of the incident response plan is executed
NIST-CSF-RC.RP-06
End-of-recovery is declared based on criteria and documentation
NIST-CSF-RS.MA-01
The incident response plan is executed in coordination with relevant third parties
NIST-CSF-RS.MA-05
Criteria for initiating incident recovery are applied

How this is calculated

Already covered means a mapping runs from a control in OCC Heightened Standards (12 CFR Part 30, Appendix D) to that control. Likely covered means no direct mapping exists but both frameworks map to the same control in a third standard. New work means neither. We keep those separate rather than adding them into one friendlier number, because blending them would present a two-hop inference as a verified fact.

Coverage is not symmetric. Run it the other way and you will get a different number; both are correct.

From 332,959 cross-framework control mappings across 723 frameworks, 531 of them verified against their source documents. It does not tell you that you are compliant: a mapped control means the two standards ask for the same thing, not that you have done it.

Try another pair ยท Today's edition