ISO 27701:2019 5.5.3: Awareness

What else in your programme already covers this

This control maps to 38 controls across 20 other frameworks. If you already hold one of them, the evidence you collected for it is the starting point here rather than new work.

CIS Controls v8 · 8 controls

CIS-14.1 Establish and Maintain a Security Awareness Program
CIS-14.2 Train Workforce Members to Recognize Social Engineering Attacks
CIS-14.3 Train Workforce Members on Authentication Best Practices
CIS-14.5 Train Workforce Members on Causes of Unintentional Data Exposure
CIS-14.6 Train Workforce Members on Recognizing and Reporting Security Incidents
CIS-14.7 Train Workforce on How to Identify and Report if Their Enterprise Assets are Missing Security Updates
CIS-14.8 Train Workforce on the Dangers of Connecting to and Transmitting Enterprise Data Over Insecure Networks
CIS-14.9 Conduct Role-Specific Security Awareness and Skills Training

PCI DSS 4.0 · 5 controls

12.6.2 12.6.2 Awareness program reviewed annually and updated
12.6.3 12.6.3 Security awareness training on hire and annually with acknowledgment
12.6.3.1 12.6.3.1 Awareness training covers phishing and social engineering
5.1.1 5.1.1 Requirement 5 policies and procedures maintained and communicated
8.3.8 8.3.8 Authentication policies communicated to users

APEC Cross-Border Privacy Rules (CBPR) System · 2 controls

CBPR-PR-29 Employee security awareness
CBPR-PR-44 Employee privacy training

CMMC 2.0 · 2 controls

AT.L2-3.2.1 Role-Based Risk Awareness
AT.L2-3.2.2 Role-Based Training

Cloud Security Alliance Cloud Controls Matrix (CCM) v4.0.1 · 2 controls

CCM-HRS-12 Personal and Sensitive Data Awareness and Training
CCM-HRS-13 Compliance User Responsibility

HIPAA Security Rule · 2 controls

164.308(a)(5)(i) Security Awareness and Training (Standard)
164.308(a)(5)(ii)(A) Security Reminders (Addressable)

ISO 27001:2022 · 2 controls

5.4 Management responsibilities
6.3 Information security awareness, education and training

NIST Cybersecurity Framework 2.0 · 2 controls

NIST-CSF-PR.AT-01 Personnel are provided with awareness and training so that they possess the knowledge and skills to perform general tasks with cybersecurity risks in mind
NIST-CSF-PR.AT-02 Individuals in specialized roles are provided with awareness and training so that they possess the knowledge and skills to perform relevant tasks with cybersecurity risks in mind

NIST SP 800-66 Rev 2 · 2 controls

164.308(a)(5)(i) Security Awareness and Training (Standard)
164.308(a)(5)(ii)(A) Security Reminders (Addressable)

APPI · 1 control

APPI-A24 Supervision of Employees

Australia Consumer Data Right - Banking (CDR) · 1 control

AUCDR-IS-6 Information security training and awareness program

C5 (Germany) · 1 control

C5-HR-03 Security training and awareness programme

FedRAMP High · 1 control

AT-2 Literacy Training and Awareness

GDPR · 1 control

GDPR-Art.39 Tasks of the data protection officer

ISO 27002:2022 · 1 control

6.3 Information security awareness, education and training

NIST SP 800-171 Rev 3 · 1 control

03.02.01 Literacy Training and Awareness

NIST SP 800-53 Rev 5 · 1 control

NIST800-AT-2 AT-2 Literacy Training and Awareness

SOC 2 · 1 control

SOC2-CC2.2 CC2.2 Internal communication of objectives and control responsibilities (COSO principle 14)

Every mapping shown was judged rather than inferred from wording similarity, and the ones that failed review are published too. See the coverage reports and what was rejected.

You are reading one control. How much of ISO 27701:2019 have you already done?

ISO 27701:2019 5.5.3 is one control. If you already hold one of the frameworks below, a reviewed crosswalk already says how much of ISO 27701:2019 your existing evidence covers. Hold SOC 2 and 58 of 108 ISO 27701:2019 controls already carry evidence.

If you hold SOC 253.7% covered · 50 gaps If you hold Cloud Security Alliance Cloud Controls Matrix (CCM) v4.0.147.2% covered · 57 gaps If you hold NIST Cybersecurity Framework 2.047.2% covered · 57 gaps If you hold ISO 27001:202243.5% covered · 61 gaps If you hold Australia Consumer Data Right - Banking (CDR)35.2% covered · 70 gaps If you hold C5 (Germany)34.3% covered · 71 gaps

Each report names every control your existing framework evidences, every one it does not, the reasoning behind each claim, and the claims that were argued against and rejected. 289 were rejected on the SOC 2 pair alone.

See the released pairs, $299 each Browse the graph free