ISO 27001:2022 5.36: Compliance with policies, rules and standards for information security

What else in your programme already covers this

This control maps to 159 controls across 37 other frameworks. If you already hold one of them, the evidence you collected for it is the starting point here rather than new work.

PCI DSS 4.0 · 16 controls

10.4.1 10.4.1 Daily review of security-relevant logs
10.7.2 10.7.2 Detect and alert on critical security control failures
11.3.1 11.3.1 Quarterly internal vulnerability scans
11.4.4 11.4.4 Correct exploitable findings from penetration tests
12.4.2 12.4.2 Quarterly reviews that personnel follow security procedures
12.4.2.1 12.4.2.1 Documentation of quarterly operational reviews
2.1.1 2.1.1 Requirement 2 policies and procedures governed
2.2.1 2.2.1 System configuration standards maintained
2.2.5 2.2.5 Insecure services, protocols or daemons secured
4.1.1 4.1.1 Requirement 4 policies and procedures maintained and communicated
5.1.1 5.1.1 Requirement 5 policies and procedures maintained and communicated
6.1.1 6.1.1 Requirement 6 policies and procedures maintained and communicated
7.1.1 7.1.1 Requirement 7 policies and procedures maintained
9.1.1 9.1.1 Requirement 9 policies and procedures maintained
3.1.1 3.1.1 Requirement 3 policies and procedures maintained and in use
7.2.4 7.2.4 User accounts and privileges reviewed every six months

ISO 27701:2019 · 15 controls

5.1 General
5.8 Improvement
5.8.1 Nonconformity and corrective action
6.15 Compliance
6.15.2 Information security reviews
6.3 Organization of information security
6.3.1 Internal organization
6.4.2 During employment
6.5.2 Information classification
6.6.3 User responsibilities
7.2.8 Records related to processing PII
7.3.1 Determining and fulfilling obligations to PII principals
7.3.9 Handling requests
8.2.4 Infringing instruction
8.3 Obligations to PII principals

NIST SP 800-53 Rev 5 · 13 controls

NIST800-AC-1 AC-1 Policy and Procedures
NIST800-AU-1 AU-1 Policy and Procedures
NIST800-AU-6 AU-6 Audit Record Review, Analysis, and Reporting
NIST800-CA-2 CA-2 Control Assessments
NIST800-CA-5 CA-5 Plan of Action and Milestones
NIST800-CA-7 CA-7 Continuous Monitoring
NIST800-IR-4 IR-4 Incident Handling
NIST800-PL-4 PL-4 Rules of Behavior
NIST800-PM-27 PM-27 Privacy Reporting
NIST800-PM-31 PM-31 Continuous Monitoring Strategy
NIST800-PM-32 PM-32 Purposing
NIST800-PM-4 PM-4 Plan of Action and Milestones Process
NIST800-PT-1 PT-1 Policy and Procedures

ISO 22301:2019 · 9 controls

10.1 Nonconformity and corrective action
10.2 Continual improvement
4.4 Business continuity management system
6.1 Actions to address risks and opportunities
8.5 Exercise programme
8.6 Evaluation of business continuity documentation and capabilities
9.1 Monitoring, measurement, analysis and evaluation
9.2 Internal audit
9.2.2 Audit programme(s)

SOC 2 · 9 controls

SOC2-CC1.1 CC1.1 Commitment to integrity and ethical values (COSO principle 1)
SOC2-CC1.5 CC1.5 Accountability for internal control responsibilities (COSO principle 5)
SOC2-CC4.1 CC4.1 Ongoing and separate evaluations of control (COSO principle 16)
SOC2-CC4.2 CC4.2 Evaluating and communicating control deficiencies (COSO principle 17)
SOC2-CC5.3 CC5.3 Deploying controls through policies and procedures (COSO principle 12)
SOC2-CC7.1 CC7.1 Detecting configuration changes and new vulnerabilities
SOC2-P8.1 P8.1 Inquiries, complaints, disputes and compliance monitoring
SOC2-PI1.2 PI1.2 Controls over system inputs
SOC2-PI1.3 PI1.3 Controls over system processing

CIS Controls v8 · 7 controls

CIS-14.1 Establish and Maintain a Security Awareness Program
CIS-16.7 Use Standard Hardening Configuration Templates for Application Infrastructure
CIS-17.4 Establish and Maintain an Incident Response Process
CIS-18.3 Remediate Penetration Test Findings
CIS-18.4 Validate Security Measures
CIS-2.3 Address Unauthorized Software
CIS-8.11 Conduct Audit Log Reviews

CMMC 2.0 · 6 controls

AC.L2-3.1.22 Control Public Information
AU.L2-3.3.3 Event Review
CA.L2-3.12.1 Security Control Assessment
CA.L2-3.12.2 Plan of Action
CA.L2-3.12.3 Security Control Monitoring
SI.L2-3.14.1 Flaw Remediation

FedRAMP High · 6 controls

CA-2 Control Assessments
CA-5 Plan of Action and Milestones
CA-7 Continuous Monitoring
MA-3 Maintenance Tools (MA-3)
PL-2 System Security and Privacy Plans
SI-6 Security and Privacy Function Verification (SI-6)

FedRAMP Moderate · 6 controls

CA-2 Control Assessments
CA-5 Plan of Action and Milestones
CA-7 Continuous Monitoring
MA-3 Maintenance Tools (MA-3)
PL-2 System Security and Privacy Plans
SI-6 Security and Privacy Function Verification (SI-6)

ISO/IEC 42001:2023 · 6 controls

4.4 AI management system
7.5.3 Control of documented information
9.1 Monitoring, measurement, analysis and evaluation
9.3 Management review
A.6 AI system life cycle
A.9.4 Intended use of the AI system

NIST Cybersecurity Framework 2.0 · 6 controls

NIST-CSF-DE.CM-03 Personnel activity and technology usage are monitored to find potentially adverse events
NIST-CSF-GV.OC-04 Critical objectives, capabilities, and services that external stakeholders depend on or expect from the organization are understood and communicated
NIST-CSF-GV.OV-01 Cybersecurity risk management strategy outcomes are reviewed to inform and adjust strategy and direction
NIST-CSF-GV.PO-02 Policy for managing cybersecurity risks is reviewed, updated, communicated, and enforced to reflect changes in requirements, threats, technology, and organizational mission
NIST-CSF-ID.IM-02 Improvements are identified from security tests and exercises, including those done in coordination with suppliers and relevant third parties
NIST-CSF-ID.RA-08 Processes for receiving, analyzing, and responding to vulnerability disclosures are established

Cloud Security Alliance Cloud Controls Matrix (CCM) v4.0.1 · 5 controls

CCM-A&A-04 Requirements Compliance
CCM-A&A-06 Remediation
CCM-GRC-04 Policy Exception Process
CCM-HRS-13 Compliance User Responsibility
CCM-STA-11 Internal Compliance Testing

ISO 27002:2022 · 5 controls

5.35 Independent review of information security
5.36 Compliance with policies, rules and standards for information security
5.4 Management responsibilities
6.8 Information security event reporting
8.16 Monitoring activities

APRA CPS 230 Operational Risk Management · 4 controls

CPS230-11 Identification, Assessment and Management of Operational Risk
CPS230-24 Design and Embedding of Internal Controls
CPS230-8 Board Oversight, Approval of the BCP, Tolerance Levels and Service Provider Policy
CPS230-P30 Monitoring, Review and Testing of Control Effectiveness

APRA CPS 234 · 4 controls

CPS234-21 Implementation of Information Security Controls
CPS234-22 Systematic Control Testing Program
CPS234-25 Internal Audit Review of Information Security Controls
CPS234-28 Escalation of Unremediated Testing Deficiencies

AWS Well-Architected Security Pillar · 3 controls

SEC01-BP03 Identify and validate control objectives
SEC04-BP04 Initiate remediation for non-compliant resources
SEC08-BP03 Automate data at rest protection

Azure Security Benchmark · 3 controls

ASBv3-GS-5 Define and implement security posture management strategy
ASBv3-PV-4 Audit and enforce secure configurations for compute resources
PV-2 Audit and enforce secure configurations

C5 (Germany) · 3 controls

C5-COM-03 Internal audits of the information security management system
C5-COM-04 Information on information security performance and management assessment of the ISMS
C5-SP-03 Exceptions from Existing Policies and Instructions

COBIT 2019 · 3 controls

APO01.09 APO01.09 Define and communicate policies and procedures
MEA02.01 MEA02.01 Monitor internal controls
MEA02.02 MEA02.02 Review effectiveness of business process controls

HIPAA Security Rule · 3 controls

164.308(a)(1)(i) Security Management Process (Standard)
164.308(a)(8) Evaluation (Standard)
164.316(a) Policies and Procedures (Standard)

NIST SP 800-66 Rev 2 · 3 controls

164.308(a)(1)(i) Security Management Process (Standard)
164.308(a)(8) Evaluation (Standard)
164.316(a) Policies and Procedures (Standard)

ANSSI Guide d'hygiene informatique (42 mesures, v2.0) · 2 controls

ANSSI-HYG-38 Carry Out Regular Security Checks and Audits and Apply the Corrective Actions
ANSSI-HYG-41 Conduct a Formal Risk Analysis

Australia My Health Records Act 2012 · 2 controls

MYHR-ENF-2 Civil penalty compliance
MYHR-REG-3 Conditions of registration and participation

DORA · 2 controls

DORA-Art.50 Administrative penalties and remedial measures
DORA-Art.6 ICT risk management framework

ISO 27001:2013 · 2 controls

A.18.2.2 Compliance with security policies and standards
A.18.2.3 Technical compliance review

ISO/IEC 25012:2008 - Data Quality Model · 2 controls

25012-Compliance Compliance
ISO-25012-4.7 Compliance

NIS2 Directive · 2 controls

Art.21.2.f Policies and procedures to assess the effectiveness of the cybersecurity risk-management measures
Art.21.4 Take corrective measures without undue delay on finding that the measures are not met

NIST SP 800-171 Rev 3 · 2 controls

03.12.01 Security Assessment
03.12.02 Plan of Action and Milestones

NIST SP 800-171A - Assessing Security Requirements for Controlled Unclassified Information (CUI) · 2 controls

171A-03.12.01 Security Assessment
171A-03.12.03 Continuous Monitoring

Australia Consumer Data Right - Banking (CDR) · 1 control

AUCDR-IS-STEP4 Step 4 - Implement a formal controls assessment program

Authorised Economic Operator (AEO) Programmes - Global Standards · 1 control

AEO-13 Measurement, Analyses and Improvement

CFTC System Safeguards (17 CFR 37, 38, 39, 49) · 1 control

CFTC-SS-15 Controls Testing

EU AI Act · 1 control

EUAI-Art.17 Quality management system

GDPR · 1 control

GDPR-Art.24 Responsibility of the controller

ISO/IEC 27010:2015 · 1 control

27010-17.1 Compliance

ISO/IEC TR 24028:2020 · 1 control

9.11.1 Compliance

NIST SP 800-161 Rev 1 · 1 control

161R1-CA-7 Continuous Monitoring

Every mapping shown was judged rather than inferred from wording similarity, and the ones that failed review are published too. See the coverage reports and what was rejected.