ISO 22301:2019 4.3.2: Scope of the business continuity management system

What else in your programme already covers this

This control maps to 23 controls across 15 other frameworks. If you already hold one of them, the evidence you collected for it is the starting point here rather than new work.

NIST Cybersecurity Framework 2.0 · 4 controls

NIST-CSF-GV.OC-01 The organizational mission is understood and informs cybersecurity risk management
NIST-CSF-GV.OC-03 Legal, regulatory, and contractual requirements regarding cybersecurity - including privacy and civil liberties obligations - are understood and managed
NIST-CSF-GV.OC-04 Critical objectives, capabilities, and services that external stakeholders depend on or expect from the organization are understood and communicated
NIST-CSF-GV.OC-05 Outcomes, capabilities, and services that the organization depends on are understood and communicated

APRA CPS 230 Operational Risk Management · 2 controls

CPS230-17 Mandatory Minimum Classification of Critical Operations
CPS230-26 Critical Operations Register, Continuity Plan and Activation

FedRAMP High · 2 controls

CP-2 Contingency Plan
PL-2 System Security and Privacy Plans

FedRAMP Moderate · 2 controls

CP-2 Contingency Plan
PL-2 System Security and Privacy Plans

NIST SP 800-53 Rev 5 · 2 controls

NIST800-CP-2 CP-2 Contingency Plan
NIST800-PL-2 PL-2 System Security and Privacy Plans

PCI DSS 4.0 · 2 controls

12.5.2 12.5.2 Annual and change-driven scope confirmation
12.5.3 12.5.3 Scope review after significant organisational change

C5 (Germany) · 1 control

C5-BCM-02 Business impact analysis policies and instructions

CFTC System Safeguards (17 CFR 37, 38, 39, 49) · 1 control

CFTC-SS-23 Resources Sufficient to Fulfil Obligations

CIS Controls v8 · 1 control

CIS-1.1 Establish and Maintain Detailed Enterprise Asset Inventory

CMMC 2.0 · 1 control

CA.L2-3.12.4 System Security Plan

COBIT 2019 · 1 control

DSS04.01 DSS04.01 Define the business continuity policy, objectives and scope

ISO 28002:2011 · 1 control

4.3 4.3 Scope of the resilience management policy

ISO/IEC 42001:2023 · 1 control

4.3 Determining the scope of the AI management system

NIST SP 800-161 Rev 1 · 1 control

161R1-PM-5 System Inventory

SOC 2 · 1 control

SOC2-CC3.1 CC3.1 Objectives specified clearly enough to assess risk (COSO principle 6)

Every mapping shown was judged rather than inferred from wording similarity, and the ones that failed review are published too. See the coverage reports and what was rejected.

You are reading one control. How much of ISO 22301:2019 have you already done?

ISO 22301:2019 4.3.2 is one control. If you already hold one of the frameworks below, a reviewed crosswalk already says how much of ISO 22301:2019 your existing evidence covers. Hold APRA CPS 230 Operational Risk Management and 28 of 57 ISO 22301:2019 controls already carry evidence.

If you hold APRA CPS 230 Operational Risk Management49.1% covered · 29 gaps If you hold NIST Cybersecurity Framework 2.047.4% covered · 30 gaps If you hold C5 (Germany)42.1% covered · 33 gaps If you hold CFTC System Safeguards (17 CFR 37, 38, 39, 49)38.6% covered · 35 gaps If you hold NIST SP 800-161 Rev 136.8% covered · 36 gaps If you hold SOC 235.1% covered · 37 gaps

Each report names every control your existing framework evidences, every one it does not, the reasoning behind each claim, and the claims that were argued against and rejected. 0 were rejected on the APRA CPS 230 Operational Risk Management pair alone.

See the released pairs, $299 each Browse the graph free