Security measures for working inside secure areas are to be designed and put in place. Purpose: stop the people who work in secure areas from damaging or tampering with the information and assets held there. Guidance: the measures apply to all personnel and to every activity in the secure area. Consider telling people that a secure area exists, or what happens in it, only when they need to know; avoiding unsupervised work there, for safety and to reduce the opportunity for malicious acts; locking vacant secure areas and inspecting them periodically; banning photographic, video, audio and other recording equipment, including cameras on user devices, unless authorized; controlling how user endpoint devices are brought in and used; and displaying emergency procedures where they can be seen or easily reached.
This control maps to 37 controls across 16 other frameworks. If you already hold one of them, the evidence you collected for it is the starting point here rather than new work.
Every mapping shown was judged rather than inferred from wording similarity, and the ones that failed review are published too. See the coverage reports and what was rejected.
ISO 27002:2022 7.6 is one control. If you already hold one of the frameworks below, a reviewed crosswalk already says how much of ISO 27002:2022 your existing evidence covers. Hold NIST SP 800-53 Rev 5 and 79 of 93 ISO 27002:2022 controls already carry evidence.
Each report names every control your existing framework evidences, every one it does not, the reasoning behind each claim, and the claims that were argued against and rejected. 180 were rejected on the NIST SP 800-53 Rev 5 pair alone.
The graph holds this control, the 37 it maps to, and the evidence behind each claim, over MCP and REST.