ID.RA-6 Risk responses identified and prioritized

NIST Cybersecurity Framework (1.1, legacy) · 1.1

What the standard requires

Risk responses are identified and prioritized

Quoted verbatim from NIST Cybersecurity Framework (CSF) 1.1, which is in the public domain.

Maps to 8 controls in 7 other frameworks

Framework	Control
CMMC Level 2	CA.L2-3.12.2 Plan of action
	RA.L2-3.11.3 Vulnerability remediation
CMMC Level 3	RA.L3-3.11.4e Document security solution rationale in the SSP
FedRAMP Moderate	CA-5 Plan of action and milestones
HIPAA Security Rule	164.308(a)(1)(ii)(B) Risk management (R)
HITRUST CSF v11	03.c.01 Risk treatment plans are approved and monitored to completion
NIST Cybersecurity Framework 2.0	ID.RA-06 Risk responses are chosen, prioritized, planned, tracked, and communicated
SOC 2 Type II	CC5.1 COSO Principle 10: Selects and develops control activities

Mappings are CMDash’s own, seeded with the product and shown on both frameworks they connect. In the product they mean evidence you attach here also counts against the controls listed above.

Integrations that carry evidence for this family

CrowdStrike Falcon

Endpoint inventory

These connectors produce data relevant to NIST Cybersecurity Framework (1.1, legacy)’s Identify (ID) family, which is the granularity CMDash publishes — there is no pre-built per-control mapping, and claiming one would be inventing it. You decide which evidence answers which control.

Track ID.RA-6 with evidence behind it

In CMDash this control is a row with an owner, a status, uploaded evidence kept with its full history, and an export an assessor can read.

Start free trial All NIST Cybersecurity Framework (1.1, legacy) controls