TISAX - Trusted Information Security Assessment Exchange
Technical and Operational Security

TISAX - Trusted Information Security Assessment Exchange TISAX-TECH-03: Operations and Communications Security

Implement operational procedures, change management, capacity management, malware protection, backup, logging, and network security controls.

Maintained by Gerard BlokdykVerified against the published standard Control text last updated

What else in your programme already covers this

This control maps to 216 controls across 54 other frameworks. If you already hold one of them, the evidence you collected for it is the starting point here rather than new work.

ASD Strategies to Mitigate Cyber Security Incidents · 9 controls

  • ASD37-06 Email content filtering (Excellent)
  • ASD37-12 Antivirus software with heuristics (Very Good)
  • ASD37-16 Antivirus software with signatures (Limited)
  • ASD37-20 Multi-factor authentication (Essential)
  • ASD37-22 Network segmentation (Excellent)
  • ASD37-25 Software firewall - inbound (Very Good)
  • ASD37-34 Regular backups (Essential)
  • ASD37-35 Business continuity and disaster recovery plans (Very Good)
  • ASD37-36 System recovery capabilities (Very Good)

API 1164 · 6 controls

  • API1164-12 Incident Response
  • API1164-13 Business Continuity and Recovery
  • API1164-17 Wireless and Field Communications
  • API1164-18 Field Device Security
  • API1164-19 Safety Instrumented Systems Interface
  • API1164-23 Change management procedures

IEC 62443 · 6 controls

  • IEC62443-12 Malware prevention for operational systems
  • IEC62443-13 Network security monitoring
  • IEC62443-16 Incident response plan for operational disruptions
  • IEC62443-17 Recovery plan for critical systems
  • IEC62443-20 Exercises and drills for OT incidents
  • IEC62443-23 Change management procedures

ISO/IEC 27019:2024 · 6 controls

  • ISO27019-12 Malware prevention for operational systems
  • ISO27019-13 Network security monitoring
  • ISO27019-16 Incident response plan for operational disruptions
  • ISO27019-18 Reporting obligations to authorities
  • ISO27019-20 Exercises and drills for OT incidents
  • ISO27019-23 Change management procedures

NIST SP 1800-32 · 6 controls

NIST SP 800-53 Rev 5 · 6 controls

ISO/IEC 27011:2024 · 5 controls

  • 27011-6.3 Awareness and Training
  • 27011-8.2 Network security and segregation
  • 27011-8.4 Logging and monitoring
  • 27011-8.5 Vulnerability and malware management
  • 27011-8.6 Data protection and backup

SSAE 18 - Attestation Standards (SOC Reporting) · 5 controls

  • SSAE18-A1.2 A1.2 - Environmental Protections and Recovery
  • SSAE18-A1.3 A1.3 - Recovery Plan Testing
  • SSAE18-CC3.4 CC3.4 - COSO Principle 9: Change Management
  • SSAE18-CC7.5 CC7.5 - Incident Recovery
  • SSAE18-CC8.1 CC8.1 - Infrastructure and Software Change Management

BSI IT-Grundschutz · 4 controls

  • BSI-24 Configuration change control
  • BSI-28 Audit event logging and storage
  • BSI-29 Audit record review and analysis
  • BSI-31 Audit log protection and retention

ISO/IEC 27043:2015 · 4 controls

  • ISO27043-22 Protection from malware
  • ISO27043-23 Backup and recovery procedures
  • ISO27043-24 Logging and monitoring
  • ISO27043-27 Network security management

ISO/SAE 21434 · 4 controls

  • ISO21434-22 Protection from malware
  • ISO21434-23 Backup and recovery procedures
  • ISO21434-24 Logging and monitoring
  • ISO21434-27 Network security management

NIST SP 800-190 · 4 controls

SANS Incident Handler's Handbook and PICERL Methodology · 4 controls

  • PICERL-C2 System Backup
  • PICERL-E1 Threat Removal
  • PICERL-R1 System Restoration
  • PICERL-R2 Security Verification

South Korea ISMS-P · 4 controls

  • ISMSP-AC-04 Network Access Control
  • ISMSP-PI-06 Personal Information Destruction
  • ISMSP-SYS-03 Security Monitoring and Log Management
  • ISMSP-SYS-06 Business Continuity and Disaster Recovery

AWWA Cybersecurity Guidance for the Water Sector (American Water Works Association) · 3 controls

  • AWWA-3.1 Network Segmentation
  • AWWA-4.1 Malware Protection
  • AWWA-4.4 Audit Logging and Monitoring

ISO/IEC 27031:2011 · 3 controls

  • 27031-8.1 Exercising and Testing
  • 27031-8.2 Maintaining IRBC
  • 27031-9.3 Management Review

NIST Cybersecurity Framework 2.0 · 3 controls

  • NIST-CSF-RC.RP-01 The recovery portion of the incident response plan is executed once initiated from the incident response process
  • NIST-CSF-RC.RP-06 The end of incident recovery is declared based on criteria, and incident-related documentation is completed
  • NIST-CSF-RS.MA-05 The criteria for initiating incident recovery are applied

NIST SP 800-124 Revision 2 - Guidelines for Managing the Security of Mobile Devices · 3 controls

SOC 2 · 3 controls

  • SOC2-A1.2 A1.2 Environmental protection, backup and recovery infrastructure
  • SOC2-A1.3 A1.3 Testing recovery plan procedures
  • SOC2-CC8.1 CC8.1 Managing changes to procedures, software, data and infrastructure

Singapore Government Instruction Manual on ICT&SS Management (IM8) · 3 controls

  • IM8-RES.2 Disaster Recovery
  • IM8-RES.4 Resilience Testing
  • IM8-SEC.3 Network Security

Annex 11 to EU GMP - Computerised Systems · 2 controls

CISA Cross-Sector Cybersecurity Performance Goals (CPG) 2.0 · 2 controls

  • CPG-1.D Revoking Credentials for Departing Employees
  • CPG-8.A Network Segmentation

FFIEC Cybersecurity Assessment Tool (CAT) · 2 controls

  • CAT-D3-1 Preventative controls
  • CAT-D3-2 Detective controls

FFIEC IT Examination Handbook · 2 controls

  • FFIEC-06 Network security and segmentation
  • FFIEC-12 Disaster recovery procedures

IEC 62304:2015 Medical Device Software Lifecycle Processes · 2 controls

  • IEC62304-8.2 Change Control
  • IEC62304-9.4 Use Change Control Process

ISO 22316 · 2 controls

  • ISO22316-08 Recovery time and point objectives
  • ISO22316-12 Recovery strategy for critical activities

ISO/IEC 27010:2015 · 2 controls

  • 27010-12.2 Protection from malware
  • 27010-13.1 Communications Security

ISO/TS 22317:2021 · 2 controls

  • ISO22317-08 Recovery time and point objectives
  • ISO22317-12 Recovery strategy for critical activities

ISO/TS 22318:2021 · 2 controls

  • ISO22318-08 Recovery time and point objectives
  • ISO22318-12 Recovery strategy for critical activities

NFPA 1600 - Standard on Continuity, Emergency, and Crisis Management · 2 controls

  • NFPA1600-5.3 Resource Needs Assessment
  • NFPA1600-6.4 Continuity and Recovery

PCI P2PE · 2 controls

  • PCI-P2PE-06 Network security and segmentation
  • PCI-P2PE-12 Disaster recovery procedures

PCI PIN Security · 2 controls

  • PCI-PIN-06 Network security and segmentation
  • PCI-PIN-12 Disaster recovery procedures

PCI SSF · 2 controls

  • PCI-SSF-06 Network security and segmentation
  • PCI-SSF-12 Disaster recovery procedures

SOC for Cybersecurity - Cybersecurity Risk Management Examination · 2 controls

  • SOC-CY-A2 Disaster Recovery
  • SOC-CY-S3 Change Management

ASIS SPC.1-2009 - Organizational Resilience Standard · 1 control

  • 4.4.8 Business Continuity and Recovery

DAMA-DMBOK2 - Data Management Body of Knowledge (2nd Edition) · 1 control

  • DIQ-1 Data Integration and Interoperability

FBI CJIS Security Policy · 1 control

  • CJIS-10 System and Information Integrity

FedRAMP Rev 5 · 1 control

  • FEDRAMP-CP-9 System Backup

IEC 62351 - Power Systems Communication Security · 1 control

  • 62351-14 Cyber security event logging

ISO 22320:2018 · 1 control

  • ISO-22320-5.2 Incident management process

ISO 26262:2018 - Functional Safety for Road Vehicles · 1 control

  • ISO-26262-8-8 Change management

ISO 27799:2025 · 1 control

  • ISO27799-05 Audit trail for ePHI access

ISO 28001:2007 Supply Chain Security Management · 1 control

  • ISO28001-PS-01 Facility Security

ISO 30401 · 1 control

  • ISO30401-18 Innovation and change management

ISO/IEC 20000-1:2018 · 1 control

  • ISO20000-06 Change management processes

ISO/IEC 25012:2008 - Data Quality Model · 1 control

  • ISO-25012-4.11 Traceability

ITIL 4 · 1 control

  • ITIL4-06 Change management processes

NRC 10 CFR 73.54 - Nuclear Facility Cybersecurity · 1 control

SASB Standards · 1 control

  • SASB-BMI-5 Physical Impacts of Climate Change

Sigstore - Software Artifact Signing and Verification · 1 control

UK Defence Standard 05-138 - Cyber Security for Defence Suppliers · 1 control

  • D.3 Backup and Recovery

UK Security and Emergency Measures Direction (SEMD) - Water Industry · 1 control

  • SEMD-CS-3 Cyber Resilience

US Consumer Product Safety Act (CPSC) Manufacturer and Importer Duties · 1 control

  • CPSC-CS.1 Network Security for Connected Products

US Maritime Transportation Security Act (MTSA) and USCG Cybersecurity Requirements · 1 control

  • CYB-5 Cyber Incident Response Plan

Every mapping shown was judged rather than inferred from wording similarity, and the ones that failed review are published too. See the coverage reports and what was rejected.

Other controls in Technical and Operational Security

Query this from an agent

The graph holds this control, the 216 it maps to, and the evidence behind each claim, over MCP and REST.

MCP endpointAll TISAX - Trusted Information Security Assessment Exchange controls