ISO 27701:2019 6.11.1: Security requirements of information systems

What else in your programme already covers this

This control maps to 65 controls across 20 other frameworks. If you already hold one of them, the evidence you collected for it is the starting point here rather than new work.

NIST SP 800-53 Rev 5 · 16 controls

NIST800-AC-1 AC-1 Policy and Procedures
NIST800-PL-2 PL-2 System Security and Privacy Plans
NIST800-SA-1 SA-1 Policy and Procedures
NIST800-SA-11 SA-11 Developer Testing and Evaluation
NIST800-SA-17 SA-17 Developer Security and Privacy Architecture and Design
NIST800-SA-24 SA-24 Design For Cyber Resiliency
NIST800-SA-4 SA-4 Acquisition Process
NIST800-SA-8 SA-8 Security and Privacy Engineering Principles
NIST800-SC-1 SC-1 Policy and Procedures
NIST800-SC-22 SC-22 Architecture and Provisioning for Name/Address Resolution Service
NIST800-SC-7 SC-7 Boundary Protection
NIST800-SR-2 SR-2 Supply Chain Risk Management Plan
NIST800-SR-5 SR-5 Acquisition Strategies, Tools, and Methods
NIST800-SR-7 SR-7 Supply Chain Operations Security
SP800-53-SA System and Services Acquisition Family
SP800-53-SR Supply Chain Risk Management Family

ISO 27002:2022 · 5 controls

0.2 Information security requirements
8.25 Secure development life cycle
8.26 Application security requirements
8.27 Secure system architecture and engineering principles
8.29 Security testing in development and acceptance

CIS Controls v8 · 4 controls

CIS-16.1 Establish and Maintain a Secure Application Development Process
CIS-16.10 Apply Secure Design Principles in Application Architectures
CIS-16.14 Conduct Threat Modeling
CIS-3.10 Encrypt Sensitive Data in Transit

HIPAA Security Rule · 4 controls

164.308(a)(1)(ii)(A) Risk Analysis (Required)
164.308(a)(1)(ii)(B) Risk Management (Required)
164.312(a)(1) Access Control (Standard)
164.316(a) Policies and Procedures (Standard)

ISO 27001:2022 · 4 controls

8.25 Secure development life cycle
8.26 Application security requirements
8.27 Secure system architecture and engineering principles
8.32 Change management

NIST SP 800-66 Rev 2 · 4 controls

164.308(a)(1)(ii)(A) Risk Analysis (Required)
164.308(a)(1)(ii)(B) Risk Management (Required)
164.312(a)(1) Access Control (Standard)
164.316(a) Policies and Procedures (Standard)

Azure Security Benchmark · 3 controls

ASBv3-DS-1 Conduct threat modeling
ASBv3-NS-6 Deploy web application firewall
DP-3 Encrypt sensitive data in transit

FedRAMP High · 3 controls

SA-4 Acquisition Process
SC-23 Session Authenticity
SC-8(1) Cryptographic Protection

FedRAMP Moderate · 3 controls

SA-4 Acquisition Process
SC-23 Session Authenticity
SC-8(1) Cryptographic Protection

NIST Cybersecurity Framework 2.0 · 3 controls

NIST-CSF-GV.SC-01 A cybersecurity supply chain risk management program, strategy, objectives, policies, and processes are established and agreed to by organizational stakeholders
NIST-CSF-ID.AM-08 Systems, hardware, software, services, and data are managed throughout their life cycles
NIST-CSF-PR.PS-06 Secure software development practices are integrated, and their performance is monitored throughout the software development life cycle

PCI DSS 4.0 · 3 controls

4.2.1 4.2.1 Strong cryptography safeguards PAN over public networks
6.2.1 6.2.1 Secure development of bespoke and custom software
6.2.4 6.2.4 Engineering techniques against common software attacks

C5 (Germany) · 2 controls

C5-CRY-02 Encryption of data for transmission (transport encryption)
C5-DEV-01 Policies for the development/procurement of information systems

Cloud Security Alliance Cloud Controls Matrix (CCM) v4.0.1 · 2 controls

CCM-AIS-02 Application Security Baseline Requirements
CCM-CEK-03 Data Encryption

NIST SP 800-161 Rev 1 · 2 controls

161R1-SA-4 Acquisition Process
161R1-SC-8 Transmission Confidentiality and Integrity

SOC 2 · 2 controls

SOC2-CC5.2 CC5.2 General controls over technology (COSO principle 11)
SOC2-PI1.4 PI1.4 Controls over output delivery

AWS Well-Architected Security Pillar · 1 control

SEC09-BP02 Enforce encryption in transit

Authorised Economic Operator (AEO) Programmes - Global Standards · 1 control

AEO-9 Information Exchange, Access and Confidentiality

CMMC 2.0 · 1 control

SC.L2-3.13.2 Security Engineering

ISO 27017:2015 · 1 control

14.1 Security requirements of information systems

NIST SP 800-171 Rev 3 · 1 control

03.16.01 Security Engineering Principles

Every mapping shown was judged rather than inferred from wording similarity, and the ones that failed review are published too. See the coverage reports and what was rejected.

You are reading one control. How much of ISO 27701:2019 have you already done?

ISO 27701:2019 6.11.1 is one control. If you already hold one of the frameworks below, a reviewed crosswalk already says how much of ISO 27701:2019 your existing evidence covers. Hold SOC 2 and 58 of 108 ISO 27701:2019 controls already carry evidence.

If you hold SOC 253.7% covered · 50 gaps If you hold Cloud Security Alliance Cloud Controls Matrix (CCM) v4.0.147.2% covered · 57 gaps If you hold NIST Cybersecurity Framework 2.047.2% covered · 57 gaps If you hold ISO 27001:202243.5% covered · 61 gaps If you hold Australia Consumer Data Right - Banking (CDR)35.2% covered · 70 gaps If you hold C5 (Germany)34.3% covered · 71 gaps

Each report names every control your existing framework evidences, every one it does not, the reasoning behind each claim, and the claims that were argued against and rejected. 289 were rejected on the SOC 2 pair alone.

See the released pairs, $299 each Browse the graph free