ISO 27701:2019 5.2.3: Determining the scope of the information security management system

What else in your programme already covers this

This control maps to 15 controls across 8 other frameworks. If you already hold one of them, the evidence you collected for it is the starting point here rather than new work.

NIST Cybersecurity Framework 2.0 · 6 controls

NIST-CSF-GV.OC-01 The organizational mission is understood and informs cybersecurity risk management
NIST-CSF-GV.OC-02 Internal and external stakeholders are understood, and their needs and expectations regarding cybersecurity risk management are understood and considered
NIST-CSF-GV.OC-03 Legal, regulatory, and contractual requirements regarding cybersecurity - including privacy and civil liberties obligations - are understood and managed
NIST-CSF-GV.OC-04 Critical objectives, capabilities, and services that external stakeholders depend on or expect from the organization are understood and communicated
NIST-CSF-ID.AM-03 Representations of the organization's authorized network communication and internal and external network data flows are maintained
NIST-CSF-ID.AM-05 Assets are prioritized based on classification, criticality, resources, and impact on the mission

PCI DSS 4.0 · 3 controls

12.5.2 12.5.2 Annual and change-driven scope confirmation
12.5.2.1 12.5.2.1 Six-monthly scope confirmation for service providers
12.5.3 12.5.3 Scope review after significant organisational change

Australia Consumer Data Right - Banking (CDR) · 1 control

AUCDR-IS-STEP2 Step 2 - Define the boundaries of the CDR data environment

CMMC 2.0 · 1 control

CA.L2-3.12.4 System Security Plan

FedRAMP High · 1 control

PL-2 System Security and Privacy Plans

ISO 19011:2018 · 1 control

5.5.2 Defining the objectives, scope and criteria for an individual audit

NIST SP 800-171 Rev 3 · 1 control

03.15.02 System Security Plan

Every mapping shown was judged rather than inferred from wording similarity, and the ones that failed review are published too. See the coverage reports and what was rejected.

You are reading one control. How much of ISO 27701:2019 have you already done?

ISO 27701:2019 5.2.3 is one control. If you already hold one of the frameworks below, a reviewed crosswalk already says how much of ISO 27701:2019 your existing evidence covers. Hold SOC 2 and 58 of 108 ISO 27701:2019 controls already carry evidence.

If you hold SOC 253.7% covered · 50 gaps If you hold Cloud Security Alliance Cloud Controls Matrix (CCM) v4.0.147.2% covered · 57 gaps If you hold NIST Cybersecurity Framework 2.047.2% covered · 57 gaps If you hold ISO 27001:202243.5% covered · 61 gaps If you hold Australia Consumer Data Right - Banking (CDR)35.2% covered · 70 gaps If you hold C5 (Germany)34.3% covered · 71 gaps

Each report names every control your existing framework evidences, every one it does not, the reasoning behind each claim, and the claims that were argued against and rejected. 289 were rejected on the SOC 2 pair alone.

See the released pairs, $299 each Browse the graph free