ISO 27701:2019 6.4.2: During employment

What else in your programme already covers this

This control maps to 62 controls across 21 other frameworks. If you already hold one of them, the evidence you collected for it is the starting point here rather than new work.

NIST SP 800-53 Rev 5 · 8 controls

NIST800-AC-2 AC-2 Account Management
NIST800-AT-3 AT-3 Role-based Training
NIST800-PL-4 PL-4 Rules of Behavior
NIST800-PM-13 PM-13 Security and Privacy Workforce
NIST800-PS-1 PS-1 Policy and Procedures
NIST800-PS-2 PS-2 Position Risk Designation
NIST800-PS-6 PS-6 Access Agreements
SP800-53-PS Personnel Security Family

CIS Controls v8 · 5 controls

CIS-14.1 Establish and Maintain a Security Awareness Program
CIS-14.2 Train Workforce Members to Recognize Social Engineering Attacks
CIS-14.4 Train Workforce on Data Handling Best Practices
CIS-14.8 Train Workforce on the Dangers of Connecting to and Transmitting Enterprise Data Over Insecure Networks
CIS-14.9 Conduct Role-Specific Security Awareness and Skills Training

ISO 27001:2022 · 5 controls

5.36 Compliance with policies, rules and standards for information security
6.2 Terms and conditions of employment
6.3 Information security awareness, education and training
6.4 Disciplinary process
6.7 Remote working

ISO 27002:2022 · 5 controls

5.10 Acceptable use of information and other associated assets
5.15 Access control
6.2 Terms and conditions of employment
6.3 Information security awareness, education and training
6.6 Confidentiality or non-disclosure agreements

PCI DSS 4.0 · 5 controls

12.2.1 12.2.1 Rules for acceptable use of end-user technology
12.6.1 12.6.1 Formal security awareness program
12.6.3 12.6.3 Security awareness training on hire and annually with acknowledgment
12.6.3.2 12.6.3.2 Awareness training covers acceptable use of end-user technologies
9.5.1.3 9.5.1.3 Training for personnel in POI environments

HIPAA Security Rule · 4 controls

164.306 Security Standards: General Rules
164.308(a)(1)(ii)(C) Sanction Policy (Required)
164.308(a)(3)(i) Workforce Security (Standard)
164.308(a)(3)(ii)(A) Authorization and Supervision (Addressable)

SOC 2 · 4 controls

SOC2-CC1.4 CC1.4 Attracting, developing and retaining competent people (COSO principle 4)
SOC2-CC1.5 CC1.5 Accountability for internal control responsibilities (COSO principle 5)
SOC2-CC6.3 CC6.3 Role-based access, least privilege and segregation of duties
SOC2-P5.1 P5.1 Data subject access

CMMC 2.0 · 3 controls

AT.L2-3.2.1 Role-Based Risk Awareness
AT.L2-3.2.2 Role-Based Training
AT.L2-3.2.3 Insider Threat Awareness

NIST SP 800-66 Rev 2 · 3 controls

164.308(a)(1)(ii)(C) Sanction Policy (Required)
164.308(a)(3)(i) Workforce Security (Standard)
164.308(a)(3)(ii)(A) Authorization and Supervision (Addressable)

C5 (Germany) · 2 controls

C5-HR-03 Security training and awareness programme
C5-HR-04 Disciplinary measures

Cloud Security Alliance Cloud Controls Matrix (CCM) v4.0.1 · 2 controls

CCM-HRS-11 Security Awareness Training
CCM-HRS-12 Personal and Sensitive Data Awareness and Training

FedRAMP High · 2 controls

AT-2 Literacy Training and Awareness
PS-8 Personnel Sanctions

FedRAMP Moderate · 2 controls

AT-2 Literacy Training and Awareness
PS-8 Personnel Sanctions

ISO 19011:2018 · 2 controls

6.4.10 Conducting closing meeting
6.5.2 Distributing audit report

NIST Cybersecurity Framework 2.0 · 2 controls

NIST-CSF-GV.RR-04 Cybersecurity is included in human resources practices
NIST-CSF-PR.AT-01 Personnel are provided with awareness and training so that they possess the knowledge and skills to perform general tasks with cybersecurity risks in mind

NIST SP 800-161 Rev 1 · 2 controls

161R1-AT-2 Literacy Training and Awareness
161R1-PL-4 Rules of Behavior

NIST SP 800-171 Rev 3 · 2 controls

03.02.01 Literacy Training and Awareness
03.02.02 Role-Based Training

APPI · 1 control

APPI-A24 Supervision of Employees

AWS Well-Architected Security Pillar · 1 control

SEC11-BP01 Train for application security

Australia Consumer Data Right - Banking (CDR) · 1 control

AUCDR-IS-6 Information security training and awareness program

ISO 27017:2015 · 1 control

7.2 During employment

Every mapping shown was judged rather than inferred from wording similarity, and the ones that failed review are published too. See the coverage reports and what was rejected.

You are reading one control. How much of ISO 27701:2019 have you already done?

ISO 27701:2019 6.4.2 is one control. If you already hold one of the frameworks below, a reviewed crosswalk already says how much of ISO 27701:2019 your existing evidence covers. Hold SOC 2 and 58 of 108 ISO 27701:2019 controls already carry evidence.

If you hold SOC 253.7% covered · 50 gaps If you hold Cloud Security Alliance Cloud Controls Matrix (CCM) v4.0.147.2% covered · 57 gaps If you hold NIST Cybersecurity Framework 2.047.2% covered · 57 gaps If you hold ISO 27001:202243.5% covered · 61 gaps If you hold Australia Consumer Data Right - Banking (CDR)35.2% covered · 70 gaps If you hold C5 (Germany)34.3% covered · 71 gaps

Each report names every control your existing framework evidences, every one it does not, the reasoning behind each claim, and the claims that were argued against and rejected. 289 were rejected on the SOC 2 pair alone.

See the released pairs, $299 each Browse the graph free