ISO 27701:2019 6.5.1: Responsibility for assets

What else in your programme already covers this

This control maps to 61 controls across 18 other frameworks. If you already hold one of them, the evidence you collected for it is the starting point here rather than new work.

CIS Controls v8 · 9 controls

CIS-1.1 Establish and Maintain Detailed Enterprise Asset Inventory
CIS-1.5 Use a Passive Asset Discovery Tool
CIS-16.4 Establish and Manage an Inventory of Third-Party Software Components
CIS-2.1 Establish and Maintain a Software Inventory
CIS-3.2 Establish and Maintain a Data Inventory
CIS-4.6 Securely Manage Enterprise Assets and Software
CIS-5.1 Establish and Maintain an Inventory of Accounts
CIS-5.5 Establish and Maintain an Inventory of Service Accounts
CIS-6.6 Establish and Maintain an Inventory of Authentication and Authorization Systems

NIST Cybersecurity Framework 2.0 · 7 controls

NIST-CSF-GV.OC-04 Critical objectives, capabilities, and services that external stakeholders depend on or expect from the organization are understood and communicated
NIST-CSF-GV.RR-02 Roles, responsibilities, and authorities related to cybersecurity risk management are established, communicated, understood, and enforced
NIST-CSF-GV.SC-03 Cybersecurity supply chain risk management is integrated into cybersecurity and enterprise risk management, risk assessment, and improvement processes
NIST-CSF-ID.AM-01 Inventories of hardware managed by the organization are maintained
NIST-CSF-ID.AM-02 Inventories of software, services, and systems managed by the organization are maintained
NIST-CSF-ID.AM-05 Assets are prioritized based on classification, criticality, resources, and impact on the mission
NIST-CSF-ID.AM-07 Inventories of data and corresponding metadata for designated data types are maintained

PCI DSS 4.0 · 7 controls

1.1.2 1.1.2 Requirement 1 roles and responsibilities assigned
1.2.3 1.2.3 Accurate network diagram of CDE connections
12.5.1 12.5.1 Inventory of in-scope system components
12.8.1 12.8.1 List of third-party service providers
9.4.5 9.4.5 Inventory logs of electronic media
9.4.5.1 9.4.5.1 Annual inventories of electronic media
9.5.1.1 9.5.1.1 Current register of POI devices

Cloud Security Alliance Cloud Controls Matrix (CCM) v4.0.1 · 4 controls

CCM-DCS-06 Assets Cataloguing and Tracking
CCM-DSP-06 Data Ownership and Stewardship
CCM-HRS-02 Acceptable Use of Technology Policy and Procedures
CCM-HRS-05 Asset returns

ISO 27002:2022 · 4 controls

5.11 Return of assets
5.2 Information security roles and responsibilities
5.9 Inventory of information and other associated assets
6.6 Confidentiality or non-disclosure agreements

NIST SP 800-53 Rev 5 · 4 controls

NIST800-CM-8 CM-8 System Component Inventory
NIST800-PE-16 PE-16 Delivery and Removal
NIST800-PE-20 PE-20 Asset Monitoring and Tracking
NIST800-PM-5 PM-5 System Inventory

SOC 2 · 4 controls

SOC2-C1.1 C1.1 Identifying and maintaining confidential information
SOC2-CC1.3 CC1.3 Structures, reporting lines, authorities and responsibilities (COSO principle 3)
SOC2-CC6.4 CC6.4 Restricting physical access to facilities and assets
SOC2-CC6.5 CC6.5 Protecting data on assets until disposal

Azure Security Benchmark · 3 controls

AM-3 Ensure security of asset lifecycle management
ASBv3-AM-1 Track asset inventory and their risks
ASBv3-AM-4 Limit access to asset management

C5 (Germany) · 3 controls

C5-AM-01 Asset Inventory
C5-AM-02 Acceptable Use and Safe Handling of Assets Policy
C5-AM-05 Commitment to Permissible Use, Safe Handling and Return of Assets

FedRAMP High · 3 controls

CM-8 System Component Inventory
PL-4 Rules of Behavior
PS-4 Personnel Termination

FedRAMP Moderate · 3 controls

CM-8 System Component Inventory
PL-4 Rules of Behavior
PS-4 Personnel Termination

ISO 27001:2022 · 3 controls

5.10 Acceptable use of information and other associated assets
5.11 Return of assets
5.9 Inventory of information and other associated assets

Australia Consumer Data Right - Banking (CDR) · 2 controls

AUCDR-IS-3 Securely manage information assets over their lifecycle
AUCDR-IS-STEP2 Step 2 - Define the boundaries of the CDR data environment

CMMC 2.0 · 1 control

CM.L2-3.4.1 System Baselining

ISO/IEC 38500:2024 · 1 control

4.1.3 Responsible stewardship

NIST SP 800-161 Rev 1 · 1 control

161R1-CM-8 System Component Inventory

NIST SP 800-171 Rev 3 · 1 control

03.04.10 System Component Inventory

Every mapping shown was judged rather than inferred from wording similarity, and the ones that failed review are published too. See the coverage reports and what was rejected.

You are reading one control. How much of ISO 27701:2019 have you already done?

ISO 27701:2019 6.5.1 is one control. If you already hold one of the frameworks below, a reviewed crosswalk already says how much of ISO 27701:2019 your existing evidence covers. Hold SOC 2 and 58 of 108 ISO 27701:2019 controls already carry evidence.

If you hold SOC 253.7% covered · 50 gaps If you hold Cloud Security Alliance Cloud Controls Matrix (CCM) v4.0.147.2% covered · 57 gaps If you hold NIST Cybersecurity Framework 2.047.2% covered · 57 gaps If you hold ISO 27001:202243.5% covered · 61 gaps If you hold Australia Consumer Data Right - Banking (CDR)35.2% covered · 70 gaps If you hold C5 (Germany)34.3% covered · 71 gaps

Each report names every control your existing framework evidences, every one it does not, the reasoning behind each claim, and the claims that were argued against and rejected. 289 were rejected on the SOC 2 pair alone.

See the released pairs, $299 each Browse the graph free