jing3
Mega Guru

Hi Mike, Thanks for point it out. I checked you are correct, it looks like it is introduced via GRC: Profiles 7.1.4 upgrade. On the other hand, this update is required by NIST CSF and NIST RMF. Looks like this table, along with others, enables NIST CSF and NIST RMF. I agree with you, no documentation makes it confusing. In another posting, one was trying to use "Content Reference" field to put a given risk statement into different risk frameworks. 

How to have a Risk be connected to multiple Frameworks?

I