ISO/IEC 42001:2023 A.7.3: Acquisition of data

What else in your programme already covers this

This control maps to 24 controls across 8 other frameworks. If you already hold one of them, the evidence you collected for it is the starting point here rather than new work.

SOC 2 · 6 controls

SOC2-CC2.1 CC2.1 Relevant, quality information to support internal control (COSO principle 13)
SOC2-P2.1 P2.1 Choice and consent
SOC2-P3.1 P3.1 Collecting personal information consistent with objectives
SOC2-P6.4 P6.4 Privacy commitments from vendors and third parties
SOC2-P7.1 P7.1 Quality of personal information
SOC2-PI1.1 PI1.1 Quality information about processing objectives, data definitions and specifications

EU AI Act · 4 controls

EUAI-Art.10 Data and data governance
EUAI-Art.53 Obligations for providers of general-purpose AI models
EUAI-Art.59 Further processing of personal data for developing certain AI systems in the public interest in the AI regulatory sandbox
EUAI-Art.61 Informed consent to participate in testing in real world conditions outside AI regulatory sandboxes

ISO 27001:2022 · 4 controls

5.19 Information security in supplier relationships
5.31 Legal, statutory, regulatory and contractual requirements
5.34 Privacy and protection of personal identifiable information (PII)
8.25 Secure development life cycle

ISO 27002:2022 · 4 controls

5.20 Addressing information security within supplier agreements
5.31 Legal, statutory, regulatory and contractual requirements
5.34 Privacy and protection of PII
8.11 Data masking

NIST AI Risk Management Framework (AI RMF 1.0) · 2 controls

AIRMF-MP-2.3 Scientific integrity and TEVV considerations are identified and documented, including those related to experimental design, data collection and selection, system trustworthiness, and construct validation
AIRMF-MS-2.10 Privacy risk of the AI system as identified in the MAP function is examined and documented

NIST SP 800-53 Rev 5 · 2 controls

NIST800-PT-4 PT-4 Consent
NIST800-SR-4 SR-4 Provenance

APPI · 1 control

APPI-A20 Proper Acquisition and Special Care Required Personal Information

ISO/IEC TR 24028:2020 · 1 control

8.3.2 Data acquisition

Every mapping shown was judged rather than inferred from wording similarity, and the ones that failed review are published too. See the coverage reports and what was rejected.

You are reading one control. How much of ISO/IEC 42001:2023 have you already done?

ISO/IEC 42001:2023 A.7.3 is one control. If you already hold one of the frameworks below, a reviewed crosswalk already says how much of ISO/IEC 42001:2023 your existing evidence covers. Hold NIST AI Risk Management Framework (AI RMF 1.0) and 30 of 38 ISO/IEC 42001:2023 controls already carry evidence.

If you hold NIST AI Risk Management Framework (AI RMF 1.0)78.9% covered · 8 gaps If you hold EU AI Act57.9% covered · 16 gaps

Each report names every control your existing framework evidences, every one it does not, the reasoning behind each claim, and the claims that were argued against and rejected. 0 were rejected on the NIST AI Risk Management Framework (AI RMF 1.0) pair alone.

See the released pairs, $299 each Browse the graph free