ISO 27701:2019 5.8.1: Nonconformity and corrective action

What else in your programme already covers this

This control maps to 61 controls across 37 other frameworks. If you already hold one of them, the evidence you collected for it is the starting point here rather than new work.

CIS Controls v8 · 4 controls

CIS-16.3 Perform Root Cause Analysis on Security Vulnerabilities
CIS-18.3 Remediate Penetration Test Findings
CIS-18.4 Validate Security Measures
CIS-7.2 Establish and Maintain a Remediation Process

ISO 27001:2022 · 4 controls

5.25 Assessment and decision on information security events
5.26 Response to information security incidents
5.35 Independent review of information security
5.36 Compliance with policies, rules and standards for information security

ISO 27002:2022 · 4 controls

5.25 Assessment and decision on information security events
5.27 Learning from information security incidents
5.35 Independent review of information security
5.36 Compliance with policies, rules and standards for information security

NIST Cybersecurity Framework 2.0 · 4 controls

NIST-CSF-DE.AE-08 Incidents are declared when adverse events meet the defined incident criteria
NIST-CSF-ID.IM-03 Improvements are identified from execution of operational processes, procedures, and activities
NIST-CSF-RS.AN-08 An incident's magnitude is estimated and validated
NIST-CSF-RS.MA-02 Incident reports are triaged and validated

NIST SP 800-53 Rev 5 · 4 controls

NIST800-CA-7 CA-7 Continuous Monitoring
NIST800-IR-4 IR-4 Incident Handling
NIST800-PM-4 PM-4 Plan of Action and Milestones Process
NIST800-SI-2 SI-2 Flaw Remediation

ISO 22313:2020 - Guidance on Business Continuity Management Systems · 2 controls

ISO-22313-10.1 Nonconformity and corrective action
ISO22313-10.1 Guidance on nonconformity and corrective action

ISO 30401 · 2 controls

ISO30401-10.1 Nonconformity and corrective action
ISO30401-15 Nonconformity and corrective action

ISO 37002:2021 - Whistleblowing Management Systems · 2 controls

ISO-37002-10.1 Nonconformity and corrective action
ISO37002-10.2 Nonconformity and Corrective Action

ISO 39001:2012 - Road Traffic Safety Management · 2 controls

ISO-39001-10.1 Nonconformity and corrective action
ISO39001-10.1 Nonconformity and Corrective Action

ISO 41001:2018 - Facility Management Systems · 2 controls

ISO-41001-10.1 Nonconformity and corrective action
ISO41001-10.1 Nonconformity and Corrective Action

ISO 50001:2018 - Energy Management Systems · 2 controls

ISO-50001-10.1 Nonconformity and corrective action
10.1 Nonconformity and corrective action

ISO/IEC 27003:2017 · 2 controls

27003-10.1 Nonconformity and Corrective Action
ISO27003-10.2 Continual improvement

PCI DSS 4.0 · 2 controls

10.4.3 10.4.3 Exceptions and anomalies from log review addressed
11.4.4 11.4.4 Correct exploitable findings from penetration tests

SOC 2 · 2 controls

SOC2-CC4.1 CC4.1 Ongoing and separate evaluations of control (COSO principle 16)
SOC2-CC4.2 CC4.2 Evaluating and communicating control deficiencies (COSO principle 17)

APEC Cross-Border Privacy Rules (CBPR) System · 1 control

CBPR-PR-43 Remedial action explained

AS9100D - Aerospace Quality Management System · 1 control

AS9100D-10.2 Nonconformity and Corrective Action

ASIS SPC.1-2009 - Organizational Resilience Standard · 1 control

SPC1-4.5.4 Nonconformity, Corrective and Preventive Action

Australia Consumer Data Right - Banking (CDR) · 1 control

AUCDR-IS-STEP5 Step 5 - Manage and report security incidents

C5 (Germany) · 1 control

C5-COM-03 Internal audits of the information security management system

CMMC 2.0 · 1 control

CA.L2-3.12.2 Plan of Action

CSA STAR (Security, Trust, Assurance, and Risk) · 1 control

STAR-NONCONF-01 Nonconformity and corrective action management

Cloud Security Alliance Cloud Controls Matrix (CCM) v4.0.1 · 1 control

CCM-A&A-06 Remediation

HIPAA Security Rule · 1 control

164.308(a)(1)(i) Security Management Process (Standard)

ISO 14001:2015 · 1 control

10.2 Nonconformity and corrective action

ISO 22000:2018 · 1 control

10.1 Nonconformity and corrective action

ISO 28001:2007 Supply Chain Security Management · 1 control

ISO28001-4.15 Nonconformity, corrective and preventive action

ISO 37001:2016 · 1 control

10.1 10.1 Nonconformity and corrective action

ISO 37301:2021 · 1 control

10.2 Nonconformity and corrective action

ISO 45001:2018 · 1 control

10.2 Incident, nonconformity and corrective action

ISO 55001:2014 · 1 control

10.1 Nonconformity and corrective action

ISO 56002 · 1 control

ISO-56002-10.2 Deviation, nonconformity and corrective action

ISO 9001:2015 · 1 control

10.2 Nonconformity and corrective action

ISO/IEC 42001:2023 · 1 control

10.2 Nonconformity and corrective action

NIST SP 800-171 Rev 3 · 1 control

03.12.02 Plan of Action and Milestones

NIST SP 800-66 Rev 2 · 1 control

164.308(a)(1)(i) Security Management Process (Standard)

Every mapping shown was judged rather than inferred from wording similarity, and the ones that failed review are published too. See the coverage reports and what was rejected.

You are reading one control. How much of ISO 27701:2019 have you already done?

ISO 27701:2019 5.8.1 is one control. If you already hold one of the frameworks below, a reviewed crosswalk already says how much of ISO 27701:2019 your existing evidence covers. Hold SOC 2 and 58 of 108 ISO 27701:2019 controls already carry evidence.

If you hold SOC 253.7% covered · 50 gaps If you hold Cloud Security Alliance Cloud Controls Matrix (CCM) v4.0.147.2% covered · 57 gaps If you hold NIST Cybersecurity Framework 2.047.2% covered · 57 gaps If you hold ISO 27001:202243.5% covered · 61 gaps If you hold Australia Consumer Data Right - Banking (CDR)35.2% covered · 70 gaps If you hold C5 (Germany)34.3% covered · 71 gaps

Each report names every control your existing framework evidences, every one it does not, the reasoning behind each claim, and the claims that were argued against and rejected. 289 were rejected on the SOC 2 pair alone.

See the released pairs, $299 each Browse the graph free