ISO 37301:2021
Support – ISO 37301:2021

ISO 37301:2021 7.4: Communication

The organization shall determine the internal and external communications relevant to the CMS, including what, when, with whom and how to communicate, and shall take account of diversity and potential barriers when considering communication needs; establish communication processes that take interested parties' views into account, that include its compliance culture, objectives and obligations in the content, and that ensure the compliance information communicated is consistent with and reliable against the information from the CMS; respond to communications related to the CMS; keep documented information that shows its communications, as appropriate; communicate CMS information internally across levels and functions including changes to the CMS; enable personnel to contribute to continual improvement and to raise compliance concerns (8.3) through the communication processes; and communicate externally on the CMS, including its compliance culture, objectives and obligations, through the established processes.

Maintained by Gerard Blokdyk

What else in your programme already covers this

This control maps to 50 controls across 41 other frameworks. If you already hold one of them, the evidence you collected for it is the starting point here rather than new work.

ISO/IEC 23894:2023 · 3 controls

  • 23894-5.5 Communication and Consultation
  • ISO23894-6.1 Communication and Consultation
  • 6.2 Communication and consultation
  • 4.4.3 Communication and Warning
  • SPC1-4.4.3 Communication and Warning

ISO 22320:2018 · 2 controls

  • ISO-22320-6.3 Communication protocols
  • ISO22320-7.2 Communication Systems and Interoperability

ISO/IEC 29147:2018 · 2 controls

  • 29147-7.5 Communication channels
  • 29147-9.3 Communication expectations and timelines

ISO/IEC 42001:2023 · 2 controls

  • 7.4 Communication
  • A.8.4 Communication of incidents

ISO/TS 22318:2021 · 2 controls

  • ISO22318-15 Communication strategy during disruption
  • ISO22318-7.2 Communication and Coordination

NIST SP 800-183 · 2 controls

Brazil AI Framework · 1 control

  • BRAI-A31 Communication of serious security incidents
  • FFIEC-15 Communication and escalation procedures
  • ISAE3402.18 Communication with Service Organisation

ISO 10006:2003 · 1 control

  • 7.6 Communication-related processes

ISO 14001:2015 · 1 control

  • 7.4 Communication

ISO 19011:2018 · 1 control

  • 6.4.4 Communicating during audit

ISO 22000:2018 · 1 control

  • 7.4 Communication

ISO 22301:2019 · 1 control

  • 7.4 Communication

ISO 22316 · 1 control

  • ISO22316-15 Communication strategy during disruption

ISO 26000:2010 · 1 control

  • ISO-26000-7.4 Communication on social responsibility

ISO 27001:2022 · 1 control

  • 7.4 Physical security monitoring

ISO 27005:2022 · 1 control

  • 10.3 Communication and consultation

ISO 27701:2019 · 1 control

  • 7.4 Privacy by design and privacy by default
  • ISO28001-4.8 Communication and consultation

ISO 31000:2018 · 1 control

  • 6.2 Communication and consultation

ISO 37001:2016 · 1 control

  • 7.4 7.4 Communication
  • ISO39001-7.4 Communication and Coordination

ISO 45001:2018 · 1 control

  • 7.4 Communication

ISO 55001:2014 · 1 control

  • 7.4 Communication

ISO 9001:2015 · 1 control

  • 7.4 Communication

ISO/IEC 27004:2016 · 1 control

  • 27004-9.2 Communication and Reporting

ISO/IEC 27031:2011 · 1 control

  • 27031-10.3 Communication During Incidents
  • 27557-6.1 Communication and consultation

ISO/IEC 30111:2019 · 1 control

  • 30111-7.2 Communication management

ISO/IEC 38500:2024 · 1 control

ISO/TS 22317:2021 · 1 control

  • ISO22317-15 Communication strategy during disruption

NIST SP 1800-32 · 1 control

  • DER-RS-03 Communication with External Stakeholders
  • QRMIG-17 Communication and Stakeholder Reporting

OWASP ASVS · 1 control

PCI P2PE · 1 control

  • PCI-P2PE-15 Communication and escalation procedures

PCI PIN Security · 1 control

  • PCI-PIN-15 Communication and escalation procedures

PCI SSF · 1 control

  • PCI-SSF-15 Communication and escalation procedures

UK Bribery Act 2010 · 1 control

  • UKBRIBE-4 Communication, Training, Awareness

Every mapping shown was judged rather than inferred from wording similarity, and the ones that failed review are published too. See the coverage reports and what was rejected.

Other controls in Support – ISO 37301:2021

Query this from an agent

The graph holds this control, the 50 it maps to, and the evidence behind each claim, over MCP and REST.