SIG (Shared Assessments) SHAREASSESS-3: Network Security, Endpoint, Data Protection

What else in your programme already covers this

This control maps to 91 controls across 48 other frameworks. If you already hold one of them, the evidence you collected for it is the starting point here rather than new work.

ISO 27043 · 4 controls

ISO27043-17 Encryption of data at rest
ISO27043-18 Encryption of data in transit
ISO27043-19 Certificate management
ISO27043-20 Key lifecycle management

ISO/SAE 21434 · 4 controls

ISO21434-16 Cryptographic policy and key management
ISO21434-17 Encryption of data at rest
ISO21434-18 Encryption of data in transit
ISO21434-19 Certificate management

CISA Cross-Sector Cybersecurity Performance Goals (CPG) 2.0 · 3 controls

CPG-3.A Log Collection
CPG-3.B Secure Log Storage
CPG-8.C Encrypted DNS

ISO/IEC 23837 - Security Requirements for Quantum Key Distribution · 3 controls

23837-1.2 Normative references
23837-1.5.2 Cryptographic module requirements
23837-1.5.3 Network device testing requirements

NIST SP 800-124 Revision 2 - Guidelines for Managing the Security of Mobile Devices · 3 controls

MD124-CTL-02 Device Encryption
MD124-POL-03 Mobile Data Protection Policy
MD124-TECH-05 VPN and Secure Communication

NIST SP 800-171A Rev 3 - Assessing CUI Security Requirements · 3 controls

FEDRAMP-SC-13 Cryptographic Protection
FEDRAMP-SC-28 Protection of Information at Rest
FEDRAMP-SC-8 Transmission Confidentiality and Integrity

NIST SP 800-53 Rev 5 · 3 controls

NIST800-IA-7 Cryptographic module authentication
NIST800-SC-12 Cryptographic key establishment and management
NIST800-SC-13 Cryptographic protection

NSA Guidance for Transition to Quantum-Resistant Cryptography · 3 controls

QRCM-1.2 Quantum-Vulnerable Identification
QRCM-3.1 Hybrid Solution Deployment (2025-2030)
QRCM-4.2 TLS 1.3 Adoption

AWWA Cybersecurity Guidance for the Water Sector (American Water Works Association) · 2 controls

AWWA-3.2 Remote Access Security
AWWA-3.4 Encryption and Data Protection

FBI CJIS Security Policy · 2 controls

CJIS-8 Media Protection
CJIS-9 System and Communications Protection

ISO 13485 · 2 controls

ISO13485-02 ePHI encryption at rest and in transit
ISO13485-16 Transmission security and encryption

ISO 15189:2022 - Medical Laboratories Requirements for Quality and Competence · 2 controls

6.6 Confidentiality or non-disclosure agreements
6.7 Conducting Audit Follow-up

ISO 19011 · 2 controls

6.6 Confidentiality or non-disclosure agreements
6.7 Conducting Audit Follow-up

ISO 27799 · 2 controls

ISO27799-02 ePHI encryption at rest and in transit
ISO27799-16 Transmission security and encryption

ISO 31000:2018 · 2 controls

6.6 Confidentiality or non-disclosure agreements
6.7 Conducting Audit Follow-up

UK Open Banking Standard · 2 controls

OB-SEC.2 Transport Layer Security
OB-SEC.4 Certificate Management

APPI · 1 control

APPI-A34 Request for Correction, Addition or Deletion

AS9100D:2016 - Quality Management Systems for Aviation, Space, and Defence · 1 control

9.1 Risk communication and consultation

ASD Strategies to Mitigate Cyber Security Incidents · 1 control

ASD37-17 TLS encryption between email servers (Limited)

BSI IT-Grundschutz · 1 control

BSI-08 Cryptographic protection of data

Bahrain PDPL · 1 control

BH-PDPL-13 Encryption of personal data

FFIEC IT Examination Handbook · 1 control

FFIEC-09 Encryption and key management

FTC GLBA Safeguards Rule (16 CFR Part 314) · 1 control

FTC-Safeguards-9-Elements 9 Safeguard Elements - Access, Inventory, Encryption, Secure-Dev, MFA, Disposal, Change-Mgmt, Monitoring, Pen-Test (16 CFR 314.4(c))

Federal Decree-Law No. 45 of 2021 on the Protection of Personal Data (UAE PDPL) · 1 control

UAE-PDPL-Art.4_5 Lawful basis and principles for processing personal data (UAE PDPL Articles 4-5)

IEC 62351 - Power Systems Communication Security · 1 control

62351-9 Cyber security key management

ISO 20000-1 · 1 control

9.1 Risk communication and consultation

ISO 22739:2024 - Blockchain and Distributed Ledger Technologies Vocabulary · 1 control

ISO-22739-3.2.4 Hash function

ISO 27005 · 1 control

9.1 Risk communication and consultation

ISO 27017 · 1 control

ISO27017-12 Encryption of cloud-stored data

ISO 27018 · 1 control

ISO27018-12 Encryption of cloud-stored data

ISO/IEC 27010:2015 · 1 control

27010-10.1 Cryptographic Protection

ISO/IEC 27011:2024 · 1 control

27011-8.3 Cryptography and key management

ISO/IEC 27400:2022 · 1 control

27400-6.2 Device Identity and Authentication

ISO/IEC 27557:2022 - Organisational Privacy Risk Management · 1 control

23837-1.2 Normative references

ISO/IEC 29115:2023 - Entity Authentication Assurance Framework · 1 control

29115-7.4 Level of Assurance 4 (LoA4)

MARS-E - Minimum Acceptable Risk Standards for Exchanges · 1 control

MARSE-SC-02 Federal Tax Information Protection

NATO STANAG 4774 (Confidentiality Metadata Labels) and STANAG 4778 (Metadata Binding) · 1 control

STANAG-2 STANAG 4778 Metadata Binding Mechanism and Cryptographic Binding

NIST SP 800-190 · 1 control

NIST190-12 Encryption of cloud-stored data

PCI P2PE · 1 control

PCI-P2PE-09 Encryption and key management

PCI PIN Security · 1 control

PCI-PIN-09 Encryption and key management

PCI SSF · 1 control

PCI-SSF-09 Encryption and key management

Saudi Arabia PDPL · 1 control

SA-PDPL-13 Encryption of personal data

Secure by Design: A Guide for Manufacturers (CISA) · 1 control

SBD-DEV-04 Phishing-Resistant Authentication

Singapore Government Instruction Manual on ICT&SS Management (IM8) · 1 control

IM8-CLD.2 Cloud Security Controls

South Korea ISMS-P · 1 control

ISMSP-SYS-02 Encryption Implementation

Switzerland New Federal Act on Data Protection (nFADP/nDSG, 2023) · 1 control

CH-FADP-13 Right to object and request blocking

Turkey KVKK · 1 control

TURKEYKVKK-2 Information Notice and Data Subject Rights

Vietnam PDPD · 1 control

VIETNAMPDP-2 Consent and Notice

Every mapping shown was judged rather than inferred from wording similarity, and the ones that failed review are published too. See the coverage reports and what was rejected.