ID.RA-05 ID · Identify · ID.RA Risk Assessment

ID.RA-05 — Risk prioritization from threats, vulnerabilities, impacts

Threats, vulnerabilities, likelihoods, and impacts are used to understand inherent risk and inform risk response prioritization.

Also written as ID-RA-05, ID.RA-5, CSF 2.0 ID.RA-05, NIST CSF ID.RA.

Written by Jett N. · Last reviewed

What NIST CSF ID.RA-05 means

ID.RA-05 is one of 21 subcategories in the Identify (ID) function, under the Risk Assessment category (ID.RA). The Core states: “Threats, vulnerabilities, likelihoods, and impacts are used to understand inherent risk and inform risk response prioritization.” Identify outcomes are prerequisites rather than protections — if the underlying inventory or risk analysis is incomplete, every downstream Protect and Detect outcome inherits that gap.

Evidence that supports ID.RA-05

To demonstrate this outcome in an assessment or audit, gather artefacts such as:

  • Prioritized risk register informed by threats and vulnerabilities
  • Risk ranking methodology
  • Risk response prioritization decisions

ISO 27001 mapping

ID.RA-05 corresponds to the following ISO 27001:2022 Annex A control(s): A.5.8, A.8.26. Evidence collected for one framework typically supports the other.

Map ID.RA-05 to ISO 27001 & SOC 2 →
Crosswalk this subcategory in the Control Mapper & Gap Assessment.
Document the risk →
Record treatment for gaps against ID.RA-05 in the Risk Register.

Other Risk Assessment subcategories

ID.RA-01 Vulnerability identification ID.RA-02 Threat intelligence received ID.RA-03 Internal and external threats identified ID.RA-04 Threat impact and likelihood ID.RA-06 Risk responses chosen and tracked ID.RA-07 Changes and exceptions risk-assessed ID.RA-08 Vulnerability disclosure handling ID.RA-09 Hardware and software integrity verified pre-use ID.RA-10 Critical supplier assessment

All 21 Identify subcategories →

Frequently asked questions

Is NIST CSF ID.RA-05 mandatory?

No. CSF 2.0 is a voluntary framework of outcomes rather than a set of requirements, and there is no certification against it. ID.RA-05 becomes binding only when something else makes it so — a contract, a regulator that references CSF, or your own Target Profile. That is the practical difference between CSF and an auditable standard like ISO 27001 or SOC 2.

How is ID.RA-05 assessed?

Through profiles rather than pass/fail testing. You record how fully the outcome is achieved today in a Current Profile, state where it needs to be in a Target Profile, and the gap between them becomes your action plan. Implementation Tiers (Partial, Risk Informed, Repeatable, Adaptive) describe how rigorous your governance around the outcome is, not whether you have met it.

Who owns ID.RA-05?

The Identify function is normally owned by the security or IT function, but ID.RA-05 still needs a specific named owner. Assessors treat an outcome with no owner as not achieved regardless of the tooling behind it, so record ownership in your profile alongside the assessment.

Does NIST CSF ID.RA-05 map to ISO 27001?

Yes — ID.RA-05 corresponds to ISO 27001:2022 Annex A control(s) A.5.8, A.8.26. Evidence collected for one framework typically supports the other, so a single control library can serve both.