Page 1

Function Category Subcategory CCS CSC COBIT 5 ISA 62443-2-1

:2009

ISA 62443-3-3

:2013

ISO/IEC 

27001:2013

NIST SP 800-53

Rev. 4

ID AM AM-1 CSC 1

BAI09.01, 

BAI09.02 4.2.3.4 SR 7.8 A.8.1.1, A.8.1.2 CM-8

ID AM AM-2 CSC 2

BAI09.01, 

BAI09.02, 

BAI09.05 4.2.3.4 SR 7.8 A.8.1.1, A.8.1.2 CM-8

ID AM AM-3 CSC 1 DSS05.02 4.2.3.4 A.13.2.1

AC-4, CA-3, CA-9, 

PL-8

ID AM AM-4 APO02.02 A.11.2.6 AC-20, SA-9

ID AM AM-5

APO03.03, 

APO03.04, 

BAI09.02 4.2.3.6 A.8.2.1 CP-2, RA-2, SA-14

ID AM AM-6

APO01.02, 

DSS06.03 4.3.2.3.3 A.6.1.1 CP-2, PS-7, PM-11 

ID BE BE-1

APO08.04, 

APO08.05, 

APO10.03, 

APO10.04, 

APO10.05

A.15.1.3, A.15.2.1, 

A.15.2.2 CP-2, SA-12

ID BE BE-2

APO02.06, 

APO03.01 PM-8

ID BE BE-3

APO02.01, 

APO02.06, 

APO03.01 4.2.2.1, 4.2.3.6 PM-11, SA-14

ID BE BE-4

A.11.2.2, A.11.2.3, 

A.12.1.3

CP-8, PE-9, PE-11, PM-8, 

SA-14

Alternative View: Appendix A - Framework Core Informative References

Appendix A, Framework Core, in the Cybersecurity Framework presents a listing of Functions, Categories, Subcategories and Informative 

References (standards, guidelines, and practices) that describe specific cybersecurity activities. This file provides an alternative presentation of the 

informative references included in Appendix A.
Alternative View: Appendix A - Framework Core Informative References

Page 2

Function Category Subcategory CCS CSC COBIT 5 ISA 62443-2-1

:2009

ISA 62443-3-3

:2013

ISO/IEC 

27001:2013

NIST SP 800-53

Rev. 4

ID BE BE-5 DSS04.02

A.11.1.4, A.17.1.1, 

A.17.1.2, A.17.2.1 CP-2, CP-11, SA-14

ID GV GV-1

APO01.03, 

EDM01.01, 

EDM01.02 4.3.2.6 A.5.1.1 -1 controls from all families 

ID GV GV-2 APO13.12 4.3.2.3.3 A.6.1.1, A.7.2.1 PM-1, PS-7

ID GV GV-3

MEA03.01, 

MEA03.04 4.4.3.7 A.18.1

-1 controls from all families 

(except PM-1)

ID GV GV-4 DSS04.02

4.2.3.1, 4.2.3.3, 

4.2.3.8, 4.2.3.9, 

4.2.3.11, 4.3.2.4.3, 

4.3.2.6.3 PM-9, PM-11

ID RA RA-1 CSC 4

APO12.01, 

APO12.02, 

APO12.03, 

APO12.04

4.2.3, 4.2.3.7, 

4.2.3.9, 4.2.3.12 A.12.6.1, A.18.2.3

CA-2, CA-7, CA-8, RA-3, 

RA-5, SA-5, SA-11, SI-2, 

SI-4, SI-5

ID RA RA-2

4.2.3, 4.2.3.9, 

4.2.3.12 A.6.1.4 PM-15, PM-16, SI-5

ID RA RA-3

APO12.01, 

APO12.02, 

APO12.03, 

APO12.04

4.2.3, 4.2.3.9, 

4.2.3.12 RA-3, SI-5, PM-12, PM-16

ID RA RA-4 DSS04.02

4.2.3, 4.2.3.9, 

4.2.3.12

RA-2, RA-3, PM-9, PM11, SA-14

ID RA RA-5 APO12.02 A.12.6.1 RA-2, RA-3, PM-16

ID RA RA-6

APO12.05, 

APO13.02 PM-4, PM-9

ID RM RM-1

APO12.04, 

APO12.05, 

APO13.02, 

BAI02.03, 

BAI04.02 4.3.4.2
Alternative View: Appendix A - Framework Core Informative References

Page 3

Function Category Subcategory CCS CSC COBIT 5 ISA 62443-2-1

:2009

ISA 62443-3-3

:2013

ISO/IEC 

27001:2013

NIST SP 800-53

Rev. 4

ID RM RM-2 APO12.06 4.3.2.6.5 PM-9

ID RM RM-3

PM-8, PM-9, PM-11, SA14

PR AC AC-1 CSC 16

DSS05.04, 

DSS06.03 4.3.3.5.1

SR 1.1, SR 1.2, SR 

1.3, SR 1.4, SR 

1.5, SR 1.7, SR 

1.8, SR 1.9

A.9.2.1, A.9.2.2, 

A.9.2.4, A.9.3.1, 

A.9.4.2, A.9.4.3 AC-2, IA Family

PR AC AC-2

DSS01.04, 

DSS05.05 4.3.3.3.2, 4.3.3.3.8

A.11.1.1, A.11.1.2, 

A.11.1.4, A.11.1.6, 

A.11.2.3 

PE-2, PE-3, PE-4, PE-5, PE6, PE-9

PR AC AC-3

APO13.01, 

DSS01.04, 

DSS05.03 4.3.3.6.6 SR 1.13, SR 2.6

A.6.2.2, A.13.1.1, 

A.13.2.1 AC‐17, AC-19, AC-20

PR AC AC-4 CSC 12, 15 4.3.3.7.3 SR 2.1

A.6.1.2, A.9.1.2, 

A.9.2.3, A.9.4.1, 

A.9.4.4

AC-2, AC-3, AC-5, AC-6, 

AC-16

PR AC AC-5 4.3.3.4 SR 3.1, SR 3.8

A.13.1.1, A.13.1.3, 

A.13.2.1 AC-4, SC-7

PR AT AT-1 CSC 9

APO07.03, 

BAI05.07 4.3.2.4.2 A.7.2.2 AT-2, PM-13

PR AT AT-2 CSC 9 

APO07.02, 

DSS06.03 4.3.2.4.2, 4.3.2.4.3 A.6.1.1, A.7.2.2 AT-3, PM-13

PR AT AT-3 CSC 9

APO07.03, 

APO10.04, 

APO10.05 4.3.2.4.2 A.6.1.1, A.7.2.2 PS-7, SA-9

PR AT AT-4 CSC 9 APO07.03 4.3.2.4.2 A.6.1.1, A.7.2.2, AT-3, PM-13

PR AT AT-5 CSC 9 APO07.03 4.3.2.4.2 A.6.1.1, A.7.2.2, AT-3, PM-13

PR DS DS-1 CSC 17

APO01.06, 

BAI02.01, 

BAI06.01, 

DSS06.06 SR 3.4, SR 4.1 A.8.2.3 SC-28
Alternative View: Appendix A - Framework Core Informative References

Page 4

Function Category Subcategory CCS CSC COBIT 5 ISA 62443-2-1

:2009

ISA 62443-3-3

:2013

ISO/IEC 

27001:2013

NIST SP 800-53

Rev. 4

PR DS DS-2 CSC 17

APO01.06, 

DSS06.06

SR 3.1, SR 3.8, SR 

4.1, SR 4.2

A.8.2.3, A.13.1.1, 

A.13.2.1, A.13.2.3, 

A.14.1.2, A.14.1.3 SC-8

PR DS DS-3 BAI09.03

4. 4.3.3.3.9, 

4.3.4.4.1 SR 4.2

A.8.2.3, A.8.3.1, 

A.8.3.2, A.8.3.3, 

A.11.2.7 CM-8, MP-6, PE-16

PR DS DS-4 APO13.01 SR 7.1, SR 7.2 A.12.3.1 AU-4, CP-2, SC-5

PR DS DS-5 CSC 17 APO01.06 SR 5.2

A.6.1.2, A.7.1.1, 

A.7.1.2, A.7.3.1, 

A.8.2.2, A.8.2.3, 

A.9.1.1, A.9.1.2, 

A.9.2.3, A.9.4.1, 

A.9.4.4, A.9.4.5, 

A.13.1.3, A.13.2.1, 

A.13.2.3, A.13.2.4, 

A.14.1.2, A.14.1.3

AC-4, AC-5, AC-6, PE-19, 

PS-3, PS-6, SC-7, SC-8, 

SC-13, SC-31, SI-4

PR DS DS-6

SR 3.1, SR 3.3, SR 

3.4, SR 3.8 A.12.2.1, A.12.5.1, SI-7

PR DS DS-7 BAI07.04 A.12.1.4 CM-2

PR IP IP-1 CSC 3, 10

BAI10.01, 

BAI10.02, 

BAI10.03, 

BAI10.05 4.3.4.3.2, 4.3.4.3.3 SR 7.6 A.12.1.2, A.12.5.1, 

CM-2, CM-3, CM-4, CM5, CM-6, CM-7, CM-9, SA10

PR IP IP-2 APO13.01 4.3.4.3.3

A.6.1.5, A.14.1.1, 

A.14.2.1, A.14.2.5

SA-3, SA-4, SA-8, SA-10, 

SA-11, SA-12, SA-15, SA17, PL-8
Alternative View: Appendix A - Framework Core Informative References

Page 5

Function Category Subcategory CCS CSC COBIT 5 ISA 62443-2-1

:2009

ISA 62443-3-3

:2013

ISO/IEC 

27001:2013

NIST SP 800-53

Rev. 4

PR IP IP-3

BAI06.01, 

BAI01.06 4.3.4.3.2, 4.3.4.3.3 SR 7.6

A.12.1.2, A.12.5.1, 

A.12.6.2, A.14.2.2, 

A.14.2.3, A.14.2.4 CM-3, CM-4, SA-10

PR IP IP-4 APO13.01 4.3.4.3.9 SR 7.3, SR 7.4

A.12.3.1, 

A.17.1.2A.17.1.3, 

A.18.1.3 CP-4, CP-6, CP-9

PR IP IP-5

DSS01.04, 

DSS05.05

4.3.3.3.1 4.3.3.3.2, 

4.3.3.3.3, 4.3.3.3.5, 

4.3.3.3.6

A.11.1.4, A.11.2.1, 

A.11.2.2, A.11.2.3

PE-10, PE-12, PE-13, PE14, PE-15, PE-18

PR IP IP-6 BAI09.03 4.3.4.4.4 SR 4.2

A.8.2.3, A.8.3.1, 

A.8.3.2, A.11.2.7 MP-6

PR IP IP-7

APO11.06, 

DSS04.05

4.4.3.1, 4.4.3.2, 

4.4.3.3, 4.4.3.4, 

4.4.3.5, 4.4.3.6, 

4.4.3.7, 4.4.3.8

CA-2, CA-7, CP-2, IR-8, 

PL-2, PM-6

PR IP IP-8 A.16.1.6 AC-21, CA-7, SI-4

PR IP IP-9 DSS04.03 4.3.2.5.3, 4.3.4.5.1 

A.16.1.1, A.17.1.1, 

A.17.1.2 CP-2, IR-8

PR IP IP-10 4.3.2.5.7, 4.3.4.5.11 SR 3.3 A.17.1.3 CP-4, IR-3, PM-14

PR IP IP-11

APO07.01, 

APO07.02, 

APO07.03, 

APO07.04, 

APO07.05

4.3.3.2.1, 4.3.3.2.2, 

4.3.3.2.3

A.7.1.1, A.7.3.1, 

A.8.1.4 PS Family

PR IP IP-12 A.12.6.1, A.18.2.2 RA-3, RA-5, SI-2
Alternative View: Appendix A - Framework Core Informative References

Page 6

Function Category Subcategory CCS CSC COBIT 5 ISA 62443-2-1

:2009

ISA 62443-3-3

:2013

ISO/IEC 

27001:2013

NIST SP 800-53

Rev. 4

PR MA MA-1 BAI09.03 4.3.3.3.7

A.11.1.2, A.11.2.4, 

A.11.2.5 MA-2, MA-3, MA-5

PR MA MA-2 DSS05.04

4.3.3.6.5, 4.3.3.6.6, 

4.3.3.6.7, 4.4.4.6.8

A.11.2.4, A.15.1.1, 

A.15.2.1 MA-4

PR PT PT-1 CSC 14 APO11.04

4.3.3.3.9, 4.3.3.5.8, 

4.3.4.4.7, 4.4.2.1, 

4.4.2.2, 4.4.2.4

SR 2.8, SR 2.9, SR 

2.10, SR 2.11, SR 

2.12

A.12.4.1, A.12.4.2, 

A.12.4.3, A.12.4.4, 

A.12.7.1 AU Family

PR PT PT-2

DSS05.02, 

APO13.01 SR 2.3

A.8.2.2, A.8.2.3, 

A.8.3.1, A.8.3.3, 

A.11.2.9 MP-2, MP-4, MP-5, MP-7

PR PT PT-3 DSS05.02

4.3.3.5.1, 4.3.3.5.2, 

4.3.3.5.3, 4.3.3.5.4, 

4.3.3.5.5, 4.3.3.5.6, 

4.3.3.5.7, 4.3.3.5.8, 

4.3.3.6.1, 4.3.3.6.2, 

4.3.3.6.3, 4.3.3.6.4, 

4.3.3.6.5, 4.3.3.6.6, 

4.3.3.6.7, 4.3.3.6.8, 

4.3.3.6.9, 4.3.3.7.1, 

4.3.3.7.2, 4.3.3.7.3, 

4.3.3.7.4

SR 1.1, SR 1.2, SR 

1.3, SR 1.4, SR 

1.5, SR 1.6, SR 

1.7, SR 1.8, SR 

1.9, SR 1.10, SR 

1.11, SR 1.12, SR 

1.13, SR 2.1, SR 

2.2, SR 2.3, SR 

2.4, SR 2.5, SR 

2.6, SR 2.7 A.9.1.2 AC-3, CM-7

PR PT PT-4 CSC 7

DSS05.02, 

APO13.01

SR 3.1, SR 3.5, SR 

3.8, SR 4.1, SR 

4.3, SR 5.1, SR 

5.2, SR 5.3, SR 

7.1, SR 7.6 A.13.1.1, A.13.2.1

AC-4, AC-17, AC-18, CP8, SC-7
Alternative View: Appendix A - Framework Core Informative References

Page 7

Function Category Subcategory CCS CSC COBIT 5 ISA 62443-2-1

:2009

ISA 62443-3-3

:2013

ISO/IEC 

27001:2013

NIST SP 800-53

Rev. 4

DE AE AE-1 DSS03.01 4.4.3.3 AC-4, CA-3, CM-2, SI-4

DE AE AE-2

4.3.4.5.6, 4.3.4.5.7, 

4.3.4.5.8

SR 2.8, SR 2.9, SR 

2.10, SR 2.11, SR 

2.12, SR 3.9, SR 

6.1, SR 6.2 A.16.1.1, A.16.1.4 AU-6, CA-7, IR-4, SI-4

DE AE AE-3 SR 6.1

AU-6, CA-7, IR-4, IR-5, IR8, SI-4

DE AE AE-4 APO12.06 CP-2, IR-4, RA-3, SI -4

DE AE AE-5 APO12.06 4.2.3.10 IR-4, IR-5, IR-8

DE CM CM-1 CSC 14, 16 DSS05.07 SR 6.2

AC-2, AU-12, CA-7, CM3, SC-5, SC-7, SI-4

DE CM CM-2 4.3.3.3.8 CA-7, PE-3, PE-6, PE-20

DE CM CM-3 SR 6.2 A.12.4.1

AC-2, AU-12, AU-13, CA7, CM-10, CM-11

DE CM CM-4 CSC 5 DSS05.01 4.3.4.3.8 SR 3.2 A.12.2.1 SI-3

DE CM CM-5 SR 2.4 A.12.5.1 SC-18, SI-4. SC-44

DE CM CM-6 APO07.06 A.14.2.7, A.15.2.1

CA-7, PS-7, SA-4, SA-9, 

SI-4

DE CM CM-7

AU-12, CA-7, CM-3, CM8, PE-3, PE-6, PE-20, SI-4

DE CM CM-8 BAI03.10 4.2.3.1, 4.2.3.7 A.12.6.1 RA-5

DE DP DP-1 CSC 5 DSS05.01 4.4.3.1 A.6.1.1 CA-2, CA-7, PM-14

DE DP DP-2 4.4.3.2 A.18.1.4 CA-2, CA-7, PM-14, SI-4

DE DP DP-3 APO13.02 4.4.3.2 SR 3.3 A.14.2.8

CA-2, CA-7, PE-3, PM-14, 

SI-3, SI-4

DE DP DP-4 APO12.06 4.3.4.5.9 SR 6.1 A.16.1.2

AU-6, CA-2, CA-7, RA-5, 

SI-4

DE DP DP-5

APO11.06, 

DSS04.05 4.4.3.4 A.16.1.6

CA-2, CA-7, PL-2, RA-5, 

SI-4, PM-14
Alternative View: Appendix A - Framework Core Informative References

Page 8

Function Category Subcategory CCS CSC COBIT 5 ISA 62443-2-1

:2009

ISA 62443-3-3

:2013

ISO/IEC 

27001:2013

NIST SP 800-53

Rev. 4

RS RP RP-1 CSC 18 BAI01.10 4.3.4.5.1 A.16.1.5 CP-2, CP-10, IR-4, IR-8 

RS CO CO-1

4.3.4.5.2, 4.3.4.5.3, 

4.3.4.5.4 A.6.1.1, A.16.1.1 CP-2, CP-3, IR-3, IR-8

RS CO CO-2 4.3.4.5.5 A.6.1.3, A.16.1.2 AU-6, IR-6, IR-8

RS CO CO-3 4.3.4.5.2 A.16.1.2

CA-2, CA-7, CP-2, IR-4, 

IR-8, PE-6, RA-5, SI-4 

RS CO CO-4 4.3.4.5.5 CP-2, IR-4, IR-8

RS CO CO-5 PM-15, SI-5

RS AN AN-1 DSS02.07

4.3.4.5.6, 4.3.4.5.7, 

4.3.4.5.8 SR 6.1

A.12.4.1, A.12.4.3, 

A.16.1.5

AU-6, CA-7, IR-4, IR-5, 

PE-6, SI-4 

RS AN AN-2

4.3.4.5.6, 4.3.4.5.7, 

4.3.4.5.8 A.16.1.6 CP-2, IR-4

RS AN AN-3

SR 2.8, SR 2.9, SR 

2.10, SR 2.11, SR 

2.12, SR 3.9, SR 

6.1 A.16.1.7 AU-7, IR-4

RS AN AN-4 4.3.4.5.6 A.16.1.4 CP-2, IR-4, IR-5, IR-8

RS MI MI-1 4.3.4.5.6

SR 5.1, SR 5.2, SR 

5.4 A.16.1.5 IR-4

RS MI MI-2 4.3.4.5.6, 4.3.4.5.10 A.12.2.1, A.16.1.5 IR-4

RS MI MI-3 A.12.6.1 CA-7, RA-3, RA-5

RS IM IM-1 BAI01.13 4.3.4.5.10, 4.4.3.4 A.16.1.6 CP-2, IR-4, IR-8

RS IM IM-2 CP-2, IR-4, IR-8

RC RP RP-1 CSC 8

DSS02.05, 

DSS03.04 A.16.1.5 CP-10, IR-4, IR-8

RC IM IM-1 BAI05.07 4.4.3.4 CP-2, IR-4, IR-8

RC IM IM-2 BAI07.08 CP-2, IR-4, IR-8

RC CO CO-1 EDM03.02

RC CO CO-2 MEA03.02

RC CO CO-3 CP-2, IR-4