Frameworks / ISO 27001:2022 / 8.1 What else in your programme already covers this This control maps to 100 controls across 28 other frameworks. If you already hold one of them, the evidence you collected for it is the starting point here rather than new work.
CIS-3.6 Encrypt Data on End-User Devices CIS-4.10 Enforce Automatic Device Lockout on Portable End-User Devices CIS-4.11 Enforce Remote Wipe Capability on Portable End-User Devices CIS-4.12 Separate Enterprise Workspaces on Mobile End-User Devices CIS-4.5 Implement and Manage a Firewall on End-User Devices CIS-4.8 Uninstall or Disable Unnecessary Services on Enterprise Assets and Software CIS-9.1 Ensure Use of Only Fully Supported Browsers and Email Clients CIS-9.4 Restrict Unnecessary or Unauthorized Browser and Email Client Extensions AC-11 Device Lock AC-19 Access Control for Mobile Devices AC-19(5) Full Device or Container-Based Encryption CM-2(7) Configure Systems and Components for High-Risk Areas CM-7 Least Functionality SC-28 Protection of Information at Rest SC-7(12) Boundary Protection | Host-based Protection. Implement [Assignment: organization-defined host-based boundary protection mechanisms] at [Assignment: organization-defined system components] AC-11 Device Lock AC-19 Access Control for Mobile Devices AC-19(5) Full Device or Container-Based Encryption CM-2(7) Configure Systems and Components for High-Risk Areas CM-7 Least Functionality SC-28 Protection of Information at Rest SC-7(12) Boundary Protection | Host-based Protection. Implement [Assignment: organization-defined host-based boundary protection mechanisms] at [Assignment: organization-defined system components] 1.5.1 Security controls on dual-connected computing devices 12.2.1 Acceptable use policies for end-user technologies 8.2.8 Session idle timeout 9.5.1 POI device protection 9.5.1.2 POI tamper inspection 5.2.1 An anti-malware solution(s) is deployed on all system components, except for those system components identified in periodic evaluations per Requirement 5.2.3 that concludes the system components are not at risk from malware 8.1.1 All security policies and operational procedures that are identified in Requirement 8 are: • Documented. • Kept up to date. • In use. • Known to all affected parties AC-11 Device Lock AC-19 Access Control for Mobile Devices AC-19(5) Full Device or Container-Based Encryption CM-2(7) Configure Systems and Components for High-Risk Areas CM-7 Least Functionality SC-28 Protection of Information at Rest AC-11 Device Lock AC-19 Access Control for Mobile Devices AC-19(5) Full Device or Container-Based Encryption CM-2(7) Configure Systems and Components for High-Risk Areas CM-7 Least Functionality SC-28 Protection of Information at Rest ANSSI-HYG-07 Authorise Network Connection Only for Managed Equipment ANSSI-HYG-14 Apply a Minimum Security Level Across the Whole Estate ANSSI-HYG-17 Enable and Configure the Local Firewall on Workstations ANSSI-HYG-29 Limit Administration Rights on Workstations to Operational Need ANSSI-HYG-33 Adopt Security Policies Dedicated to Mobile Terminals SOC2-C1.1 Confidential information is identified and protected during receipt, processing, storage SOC2-C1.2 Confidential information is disposed of securely SOC2-CC6.1 Implements logical access security software, infrastructure and architectures over protected information assets SOC2-CC6.3 Role-based access and least privilege are enforced SOC2-CC6.8 Controls to prevent or detect unauthorized or malicious software ASD37-04 User application hardening (Essential) ASD37-13 Control removable storage media (Very Good) ASD37-25 Software firewall - inbound (Very Good) ASD37-30 Endpoint detection and response (Very Good) CE-FW.6 Host-Based Firewall for Remote Workers CE-MP.1 Anti-Malware Software Deployed CE-SC.1 Remove or Disable Unused Software CE-SC.9 Device Unlocking Credentials and Brute-Force Protection ASBv3-GS-9 Define and implement endpoint security strategy ASBv3-PA-6 Use privileged access workstations ES-2 Use modern anti-malware software 6.3.2 Mobile devices and teleworking 6.8.2 Equipment AC-19 Access Control for Mobile Devices CM-7 Least Functionality E8-UAH-ML2 User Application Hardening - Maturity Level 2 AUCDR-IS-2 Secure the network and systems within the data environment C5-AM-02 Acceptable Use and Safe Handling of Assets Policy 8.1 User endpoint devices Art.21.2.g Basic cyber hygiene practices and cybersecurity training 3.1.2e Restrict Access to Organization-Owned, Provisioned, or Issued Information Resources Every mapping shown was judged rather than inferred from wording similarity, and the ones that failed review are published too. See the coverage reports and what was rejected .
Other controls in Technological controls – ISO 27001:2022 You are reading one control. How much of ISO 27001:2022 have you already done? ISO 27001:2022 8.1 is one control. If you already hold one of the frameworks below, a reviewed crosswalk already says how much of ISO 27001:2022 your existing evidence covers. Hold NIST SP 800-53 Rev 5 and 79 of 93 ISO 27001:2022 controls already carry evidence.
Each report names every control your existing framework evidences, every one it does not, the reasoning behind each claim, and the claims that were argued against and rejected. 170 were rejected on the NIST SP 800-53 Rev 5 pair alone.
Query this from an agent The graph holds this control, the 100 it maps to, and the evidence behind each claim, over MCP and REST.