To turn KRI data into meaningful insight about patterns, causes, and changes in the organization's risk profile.
Analyze trends, correlations, root causes, and relationships between KRIs and material risks; investigate significant changes; document conclusions and recommended actions.
| FRAMEWORK CODE | FRAMEWORK NAME & DETAILS | FAMILY / CATEGORY | VERSION | ACTION |
|---|---|---|---|---|
| COBIT2019 | COBIT COBIT is an enterprise governance and management f... Clause: 4.2 – Align, Plan and Organize (APO) > APO12 – Managed Risk > APO12.03 – Maintain a risk profile. 4.2 – Align, Plan and Organize (APO) > APO12 – Managed Risk > APO12.04 – Articulate risk. |
COBIT
Governance Framework
|
v2019 | View → |
| DORA | Digital Operational Resilience Act The EU Digital Operational Resilience Act establis... Clause: Article 6(8)(c) – Information security objectives, KPIs and key risk metrics Article 13(4) – Monitoring digital resilience strategy, incident patterns and ICT risk exposure |
EU
Regulation
|
vCurrent | View → |
| IRDAI | IRDAI Information & Cyber Security Guidelines IRDAI information and cyber-security requirements... Clause: §1.8-VI – Continuous Monitoring and review; §1.8-V – Risk Treatment |
India
Guideline
|
vLatest | View → |
| ISO22301 | ISO/IEC 22301 ISO 22301 specifies requirements for a Business Co... Clause: 6.1.1 – Determining risks and opportunities; 6.1.2 – Addressing risks and opportunities; 8.2.3 – Risk assessment |
ISO
Standard
|
v2019 | View → |
| ISO27001 | ISO/IEC 27001 ISO/IEC 27001 specifies auditable requirements for... Clause: 9.1 – Monitoring, measurement, analysis and evaluation |
ISO
Standard
|
v2022 | View → |
| NIS2 | NIS2 Directive The NIS2 Directive establishes EU-wide cybersecuri... Clause: Article 21(2)(a) – Policies on risk analysis and information system security |
EU
Directive
|
vCurrent | View → |
| NIST-CSF | NIST Cybersecurity Framework (CSF) The NIST Cybersecurity Framework provides high-lev... Clause: ID.RA – Risk Assessment | ID.RA-05 – Threats, vulnerabilities, likelihoods, and impacts are used to understand inherent risk and inform risk response prioritization ID.RA – Risk Assessment | ID.RA-04 – Potential impacts and likelihoods of threats exploiting vulnerabilities are identified and recorded GV.RM – Risk Management Strategy | GV.RM-06 – A standardized method for calculating, documenting, categorizing, and prioritizing cybersecurity risks is established and communicated |
NIST
Framework
|
v2 | View → |
| NIST80053 | NIST SP 800-53 NIST SP 800-53 Rev. 5 presents control families, i... Clause: 3.16 – RISK ASSESSMENT; RA-3 – RISK ASSESSMENT |
NIST
Control Catalog
|
vRev. 5 | View → |
| NPCI-ISR | NPCI Information Security Requirements NPCI information-security requirements define cont... Clause: Governance Controls; Policy, Roles and Risk Linkages – Cyber Risk Management programs |
India
Standard
|
vLatest | View → |
| PCI-DSS | PCI DSS PCI DSS is an industry security standard maintaine... Clause: 12.3.1 – For each PCI DSS requirement that specifies; 12.3.2 – A targeted risk analysis is performed for each |
PCI
Standard
|
v4 | View → |
| RBI-CSF | RBI Cyber Security Framework / Master Directions RBI cyber-security requirements and directions set... Clause: Circular §5 – Identification/assessment of inherent cyber risks and controls; 21) Metrics – 21.1 Comprehensive prospective and retrospective metrics including KPIs/KRIs |
India
Regulation
|
vLatest | View → |
| SEBI-CSCRF | SEBI Cyber Security & Cyber Resilience Framework SEBI’s Cybersecurity and Cyber Resilience Framewor... Clause: 1.5 GV.RM: Risk Management |
India
Regulation
|
vLatest | View → |
| SOC2 | SOC 2 Trust Services Criteria SOC 2 is an independent examination and reporting... Clause: CC3.2 – Risk Assessment – COSO Principle 7: The entity identifies risks to the achievement of its objectives across the entity and analyzes risks as a basis for determining how the risks should be managed. CC4.1 – Monitoring of Controls – COSO Principle 16: The entity selects, develops, and performs ongoing and/or separate evaluations to ascertain whether the components of internal control are present and functioning. |
AICPA
Audit Framework
|
vLatest | View → |