ISO 27001:2022 5.10: Acceptable use of information and other associated assets

What else in your programme already covers this

This control maps to 66 controls across 28 other frameworks. If you already hold one of them, the evidence you collected for it is the starting point here rather than new work.

CMMC 2.0 · 7 controls

AC.L2-3.1.19 Encrypt CUI on Mobile
AC.L2-3.1.21 Portable Storage Use
AC.L2-3.1.22 Control Public Information
AC.L2-3.1.9 Privacy & Security Notices
AT.L2-3.2.1 Role-Based Risk Awareness
MP.L2-3.8.7 Removable Media
SC.L2-3.13.12 Collaborative Device Control

FedRAMP High · 6 controls

AC-8 System Use Notification
CM-10 Software Usage Restrictions
MP-7 Media Use
PL-4 Rules of Behavior
PL-4(1) Rules of Behavior | Social Media and External Site/Application Usage Restrictions (PL-4(1))
SC-18 Mobile Code

FedRAMP Moderate · 6 controls

AC-8 System Use Notification
CM-10 Software Usage Restrictions
MP-7 Media Use
PL-4 Rules of Behavior
PL-4(1) Rules of Behavior | Social Media and External Site/Application Usage Restrictions (PL-4(1))
SC-18 Mobile Code

NIST SP 800-53 Rev 5 · 6 controls

NIST800-MP-7 MP-7 Media Use
NIST800-PL-4 PL-4 Rules of Behavior
NIST800-PM-32 PM-32 Purposing
NIST800-SC-18 SC-18 Mobile Code
NIST800-SC-42 SC-42 Sensor Capability and Data
NIST800-SC-43 SC-43 Usage Restrictions

SOC 2 · 5 controls

SOC2-C1.1 C1.1 Identifying and maintaining confidential information
SOC2-C1.2 C1.2 Disposing of confidential information
SOC2-CC6.1 CC6.1 Logical access security over protected information assets
SOC2-CC6.3 CC6.3 Role-based access, least privilege and segregation of duties
SOC2-CC6.7 CC6.7 Restricting and protecting information in transmission, movement and removal

ISO 27701:2019 · 4 controls

6.3.2 Mobile devices and teleworking
6.5.1 Responsibility for assets
6.5.2 Information classification
6.6.3 User responsibilities

CIS Controls v8 · 3 controls

CIS-14.4 Train Workforce on Data Handling Best Practices
CIS-4.12 Separate Enterprise Workspaces on Mobile End-User Devices
CIS-9.1 Ensure Use of Only Fully Supported Browsers and Email Clients

ISO/IEC 42001:2023 · 3 controls

A.9.2 Processes for responsible use of AI systems
A.9.3 Objectives for responsible use of AI system
A.9.4 Intended use of the AI system

Australia My Health Records Act 2012 · 2 controls

MYHR-CUD-3 Use limited to My Health Record purposes
MYHR-SEC-1 Written security and access policy

Azure Security Benchmark · 2 controls

AM-2 Use only approved services
ASBv3-AM-5 Use only approved applications in virtual machine

C5 (Germany) · 2 controls

C5-AM-02 Acceptable Use and Safe Handling of Assets Policy
C5-AM-05 Commitment to Permissible Use, Safe Handling and Return of Assets

ISO 27001:2013 · 2 controls

A.8.1.3 Acceptable use of assets
A.8.2.3 Handling of assets

NIST SP 800-171 Rev 3 · 2 controls

03.08.07 Media Use
03.15.03 Rules of Behavior

PCI DSS 4.0 · 2 controls

12.2.1 12.2.1 Rules for acceptable use of end-user technology
12.6.3.2 12.6.3.2 Awareness training covers acceptable use of end-user technologies

ANSSI Guide d'hygiene informatique (42 mesures, v2.0) · 1 control

ANSSI-HYG-02 Raise User Awareness of Basic Security Practice

AWS Well-Architected Security Pillar · 1 control

SEC07-BP02 Apply data protection controls based on data sensitivity

Australia Consumer Data Right - Banking (CDR) · 1 control

AUCDR-IS-6 Information security training and awareness program

CNIL Guidance on Employee Monitoring and Workplace Video Surveillance · 1 control

NET-1 NET-1 Set and communicate the tolerated personal use of IT tools and control internet and email use only for security and abuse

COBIT 2019 · 1 control

DSS06.06 DSS06.06 Secure information assets

Cloud Security Alliance Cloud Controls Matrix (CCM) v4.0.1 · 1 control

CCM-HRS-02 Acceptable Use of Technology Policy and Procedures

EU AI Act · 1 control

EUAI-Art.26 Obligations of deployers of high-risk AI systems

France Labour Code (Code du travail) - Employee Monitoring and CSE Consultation · 1 control

L1222-10 1 L1222-10 1 Inform teleworkers of any restriction on IT tools and of the sanctions for breaching it

GDPR · 1 control

GDPR-Art.29 Processing under the authority of the controller or processor

HIPAA Security Rule · 1 control

164.310(b) Workstation Use (Standard)

ISO 27002:2022 · 1 control

5.10 Acceptable use of information and other associated assets

NIST Cybersecurity Framework 2.0 · 1 control

NIST-CSF-GV.PO-02 Policy for managing cybersecurity risks is reviewed, updated, communicated, and enforced to reflect changes in requirements, threats, technology, and organizational mission

NIST SP 800-161 Rev 1 · 1 control

161R1-PL-4 Rules of Behavior

NIST SP 800-66 Rev 2 · 1 control

164.310(b) Workstation Use (Standard)

Every mapping shown was judged rather than inferred from wording similarity, and the ones that failed review are published too. See the coverage reports and what was rejected.

You are reading one control. How much of ISO 27001:2022 have you already done?

ISO 27001:2022 5.10 is one control. If you already hold one of the frameworks below, a reviewed crosswalk already says how much of ISO 27001:2022 your existing evidence covers. Hold NIST SP 800-53 Rev 5 and 79 of 93 ISO 27001:2022 controls already carry evidence.

If you hold NIST SP 800-53 Rev 584.9% covered · 14 gaps If you hold ISO 27001:201383.9% covered · 15 gaps If you hold FedRAMP Moderate80.6% covered · 18 gaps If you hold Cloud Security Alliance Cloud Controls Matrix (CCM) v4.0.174.2% covered · 24 gaps If you hold C5 (Germany)69.9% covered · 28 gaps If you hold NIST Cybersecurity Framework 2.063.4% covered · 34 gaps

Each report names every control your existing framework evidences, every one it does not, the reasoning behind each claim, and the claims that were argued against and rejected. 170 were rejected on the NIST SP 800-53 Rev 5 pair alone.

See the released pairs, $299 each Browse the graph free