ISO 27001:2022

International

v2022 (third edition, October 2022) + Amd 1:2024

11 domains

123 controls

International standard for establishing, implementing, maintaining and continually improving an information security management system (ISMS)

Verified

ISO 27001:2022 is a compliance framework from International with 11 domains and 123 controls that map to 93 other frameworks. The largest domains are Organizational controls – ISO 27001:2022 (37 controls), Technological controls – ISO 27001:2022 (34 controls), Physical controls – ISO 27001:2022 (14 controls). Every control below carries what it requires and what an assessor expects to see.

Maintained by Gerard BlokdykVerified against the published standard 18 August 2026Control text last updated 25 September 2026

Framework summaries on this platform are interpretations grounded in the published source, for educational and compliance planning purposes. They do not reproduce or replace the official standards. Refer to the authoritative source for the definitive text. Framework names and trademarks belong to their respective organisations.

Framework Domains (11)

Clause 10 – ISO 27001:2022

2 controls

Controls in the Clause 10 – ISO 27001:2022 domain of ISO 27001:2022: 2 controls
Code	Title	Description
iso-27001-2022::clause-10.1	Continual improvement	The organization has to keep making its ISMS more suitable, more adequate and more effective.
iso-27001-2022::clause-10.2	Nonconformity and corrective action	If a nonconformity arises, the organization must respond to it and, as applicable, act to control and correct it and han...

Clause 4 – ISO 27001:2022

4 controls

Controls in the Clause 4 – ISO 27001:2022 domain of ISO 27001:2022: 4 controls
Code	Title	Description
iso-27001-2022::clause-4.1	Understanding the organization and its context	The organization has to identify the internal and external issues that bear on its purpose and that influence whether it...
iso-27001-2022::clause-4.2	Understanding the needs and expectations of interested parties	The organization has to work out which interested parties matter to the ISMS, what those parties require, and which of t...
iso-27001-2022::clause-4.3	Determining the scope of the information security management system	To set the ISMS scope the organization decides its boundaries and where it applies. In doing so it takes into account th...
iso-27001-2022::clause-4.4	Information security management system	The organization must set up, put into operation, keep up and keep improving an ISMS, including the processes it needs a...

Clause 5 – ISO 27001:2022

3 controls

Controls in the Clause 5 – ISO 27001:2022 domain of ISO 27001:2022: 3 controls
Code	Title	Description
iso-27001-2022::clause-5.1	Leadership and commitment	Top management has to show leadership of and commitment to the ISMS by: making sure the security policy and objectives e...
iso-27001-2022::clause-5.2	Policy	Top management must set an information security policy that suits the organization's purpose; states the security object...
iso-27001-2022::clause-5.3	Organizational roles, responsibilities and authorities	Top management must make sure that every role that matters for information security has its responsibilities and authori...

Clause 6 – ISO 27001:2022

5 controls

Controls in the Clause 6 – ISO 27001:2022 domain of ISO 27001:2022: 5 controls
Code	Title	Description
iso-27001-2022::clause-6.1.1	Actions to address risks and opportunities: general	When planning the ISMS the organization considers the 4.1 issues and the 4.2 requirements and identifies the risks and o...
iso-27001-2022::clause-6.1.2	Information security risk assessment	The organization must define and use a risk assessment process that sets and keeps risk criteria, covering both acceptan...
iso-27001-2022::clause-6.1.3	Information security risk treatment	The organization must define and use a risk treatment process to choose suitable treatment options in light of the asses...
iso-27001-2022::clause-6.2	Information security objectives and planning to achieve them	The organization must set security objectives for the functions and levels where they matter. They must agree with the p...
iso-27001-2022::clause-6.3	Planning of changes	Where the organization decides the ISMS needs to change, the change has to be made in a planned way. This clause is new...

Clause 7 – ISO 27001:2022

7 controls

Controls in the Clause 7 – ISO 27001:2022 domain of ISO 27001:2022: 7 controls
Code	Title	Description
iso-27001-2022::clause-7.1	Resources	The organization has to identify and supply the resources the ISMS needs to be set up, put into operation, maintained an...
iso-27001-2022::clause-7.2	Competence	The organization must decide what competence is needed by people working under its control whose work affects informatio...
iso-27001-2022::clause-7.3	Awareness	People working under the organization's control need to know about the information security policy, the part they play i...
iso-27001-2022::clause-7.4	Communication	The organization must decide what internal and external communication the ISMS needs, covering what is communicated, whe...
iso-27001-2022::clause-7.5.1	Documented information: general	The ISMS has to include both the documented information this standard requires and whatever further documented informati...
iso-27001-2022::clause-7.5.2	Documented information: creating and updating	When documented information is created or updated the organization makes sure it has suitable identification and descrip...
iso-27001-2022::clause-7.5.3	Documented information: control	Documented information that the standard and the ISMS call for must be controlled so that people can get it, in a usable...

Clause 8 – ISO 27001:2022

3 controls

Controls in the Clause 8 – ISO 27001:2022 domain of ISO 27001:2022: 3 controls
Code	Title	Description
iso-27001-2022::clause-8.1	Operational planning and control	The organization must plan, run and keep under control the processes that meeting its requirements depends on and to car...
iso-27001-2022::clause-8.2	Information security risk assessment	Risk assessments must be carried out at planned intervals and whenever significant changes are proposed or happen, using...
iso-27001-2022::clause-8.3	Information security risk treatment	The risk treatment plan must be put into effect, and documented information on the results of risk treatment must be ret...

Clause 9 – ISO 27001:2022

6 controls

Controls in the Clause 9 – ISO 27001:2022 domain of ISO 27001:2022: 6 controls
Code	Title	Description
iso-27001-2022::9.2.1	Internal audit: general	Internal audits must be carried out at planned intervals to give information on whether the ISMS conforms to the organiz...
iso-27001-2022::9.2.2	Internal audit programme	The organization must plan, establish, implement and maintain one or more audit programmes that set out how often and ho...
iso-27001-2022::9.3.1	Management review: general	Top management must review the organization's ISMS at planned intervals to make sure it remains suitable, adequate and e...
iso-27001-2022::9.3.2	Management review inputs	Management review has to take into account: the status of actions from earlier reviews; changes in internal and external...
iso-27001-2022::9.3.3	Management review results	The outputs of management review must include decisions on opportunities for continual improvement and on any need to ch...
iso-27001-2022::clause-9.1	Monitoring, measurement, analysis and evaluation	The organization must determine what is to be monitored and measured, including security processes and controls; which m...

Organizational controls – ISO 27001:2022

37 controls

Controls in the Organizational controls – ISO 27001:2022 domain of ISO 27001:2022: 37 controls
Code	Title	Description
iso-27001-2022::5.1	Policies for information security	An overarching information security policy and a set of topic-specific policies are to be written, signed off by managem...
iso-27001-2022::5.10	Acceptable use of information and other associated assets	Rules on how information and other associated assets may acceptably be used, together with procedures for handling them,...
iso-27001-2022::5.11	Return of assets	When their employment, contract or agreement changes or ends, staff and, where relevant, other interested parties are to...
iso-27001-2022::5.12	Classification of information	Information is to be classified according to the organization's security needs, judged on confidentiality, integrity, av...
iso-27001-2022::5.13	Labelling of information	Procedures for labelling information are to be developed and put into effect in line with the classification scheme the...
iso-27001-2022::5.14	Information transfer	Every kind of transfer facility, whether used inside the organization or with outside parties, is to be covered by rules...
iso-27001-2022::5.15	Access control	Rules that govern both physical entry and logical access to information and associated assets are to be set and applied...
iso-27001-2022::5.16	Identity management	Identities are to be managed throughout their whole life cycle. Purpose (stated in ISO/IEC 27002:2022): enables unique i...
iso-27001-2022::5.17	Authentication information	A management process is to control how authentication information is allocated and managed, and it includes telling pers...
iso-27001-2022::5.18	Access rights	Access rights to information and associated assets are to be granted, reviewed, changed and withdrawn in line with the a...
iso-27001-2022::5.19	Information security in supplier relationships	The organization is to define and run processes and procedures that manage the information security risks arising from u...
iso-27001-2022::5.2	Information security roles and responsibilities	The organization is to define the roles and responsibilities it needs for information security and allocate them to peop...
iso-27001-2022::5.20	Addressing information security within supplier agreements	The information security requirements that matter for each supplier are to be set and agreed with that supplier, dependi...
iso-27001-2022::5.21	Managing information security in the information and communication technology (ICT) supply chain	Processes and procedures are to be defined and put in place to manage information security risks in the supply chain for...
iso-27001-2022::5.22	Monitoring, review and change management of supplier services	On a regular basis the organization is to monitor, review and evaluate suppliers' security practices and service deliver...
iso-27001-2022::5.23	Information security for use of cloud services	Processes for buying, using, managing and leaving cloud services are to be set up so that they satisfy what the organiza...
iso-27001-2022::5.24	Information security incident management planning and preparation	The organization is to prepare for handling information security incidents by defining, setting up and communicating how...
iso-27001-2022::5.25	Assessment and decision on information security events	Each information security event is to be assessed and a decision made on whether it counts as an information security in...
iso-27001-2022::5.26	Response to information security incidents	Incidents are to be handled following the documented response procedures. Purpose (stated in ISO/IEC 27002:2022): ensure...
iso-27001-2022::5.27	Learning from information security incidents	What the organization learns from its information security incidents is to be fed back to strengthen and improve its sec...
iso-27001-2022::5.28	Collection of evidence	Procedures are to be set up and followed for identifying, collecting, acquiring and preserving evidence connected with i...
iso-27001-2022::5.29	Information security during disruption	The organization is to plan how it will keep information security at a suitable level while operations are disrupted. Pu...
iso-27001-2022::5.3	Segregation of duties	Duties and areas of responsibility that conflict with each other are to be kept apart. Purpose (stated in ISO/IEC 27002:...
iso-27001-2022::5.30	ICT readiness for business continuity	ICT readiness is to be planned, put in place, kept current and tested so that it meets the continuity objectives of the...
iso-27001-2022::5.31	Legal, statutory, regulatory and contractual requirements	The organization is to identify, record and keep current every requirement bearing on information security, whether it c...
iso-27001-2022::5.32	Intellectual property rights	Suitable procedures are to be put in place to protect intellectual property rights. Purpose (stated in ISO/IEC 27002:202...
iso-27001-2022::5.33	Protection of records	Records are to be safeguarded against being lost, destroyed, falsified, accessed without authorization or released witho...
iso-27001-2022::5.34	Privacy and protection of personal identifiable information (PII)	The organization is to identify, and then satisfy, the requirements for preserving privacy and protecting personally ide...
iso-27001-2022::5.35	Independent review of information security	How the organization manages information security, and how that is carried out through people, processes and technology,...
iso-27001-2022::5.36	Compliance with policies, rules and standards for information security	How well the organization keeps to its security policy and to its topic policies, rules and standards is to be checked r...
iso-27001-2022::5.37	Documented operating procedures	Procedures for operating information processing facilities are to be written down and made available to the staff who ne...
iso-27001-2022::5.4	Management responsibilities	Managers are to insist that everyone working for the organization applies information security as the organization's pol...
iso-27001-2022::5.5	Contact with authorities	The organization is to set up and keep up working contact with the authorities that are relevant to it. Purpose (stated...
iso-27001-2022::5.6	Contact with special interest groups	The organization is to join and stay in touch with special interest groups, specialist security communities and professi...
iso-27001-2022::5.7	Threat intelligence	Information about security threats is to be gathered and examined so that it yields threat intelligence. Purpose (stated...
iso-27001-2022::5.8	Information security in project management	Information security is to be built into the way projects are managed. Purpose (stated in ISO/IEC 27002:2022): ensures s...
iso-27001-2022::5.9	Inventory of information and other associated assets	The organization is to build and keep current an inventory of its information and other associated assets, with their ow...

People controls – ISO 27001:2022

8 controls

Controls in the People controls – ISO 27001:2022 domain of ISO 27001:2022: 8 controls
Code	Title	Description
iso-27001-2022::6.1	Screening	Every candidate who is to become personnel is to undergo background verification before joining and on a continuing basi...
iso-27001-2022::6.2	Terms and conditions of employment	Employment contracts and agreements are to set out the information security responsibilities of both the individual and...
iso-27001-2022::6.3	Information security awareness, education and training	The organization's personnel and relevant interested parties are to receive information security awareness, education an...
iso-27001-2022::6.4	Disciplinary process	A formal disciplinary process is to be established and made known so that action can be taken against staff and relevant...
iso-27001-2022::6.5	Responsibilities after termination or change of employment	Where information security responsibilities and duties continue after someone leaves or changes job, they are to be defi...
iso-27001-2022::6.6	Confidentiality or non-disclosure agreements	Confidentiality or non-disclosure agreements that match the organization's information protection needs are to be identi...
iso-27001-2022::6.7	Remote working	Where personnel work remotely, security measures are to be applied to protect information that is accessed, processed or...
iso-27001-2022::6.8	Information security event reporting	A mechanism is to be provided so personnel can report information security events they notice or suspect, promptly and t...

Physical controls – ISO 27001:2022

14 controls

Controls in the Physical controls – ISO 27001:2022 domain of ISO 27001:2022: 14 controls
Code	Title	Description
iso-27001-2022::7.1	Physical security perimeters	The organization is to define security perimeters and use them around areas holding information and other associated ass...
iso-27001-2022::7.10	Storage media	Storage media are to be controlled through acquisition, use, transport and disposal in line with how the organization cl...
iso-27001-2022::7.11	Supporting utilities	Information processing facilities are to be protected against power cuts and other disruption caused by failures of supp...
iso-27001-2022::7.12	Cabling security	Cables that carry power, data or supporting information services are to be protected from interception, interference and...
iso-27001-2022::7.13	Equipment maintenance	Equipment is to be properly maintained so that information stays confidential, intact and available. Purpose (stated in...
iso-27001-2022::7.14	Secure disposal or re-use of equipment	Before equipment containing storage media is disposed of or reused, it is to be checked to confirm that sensitive data a...
iso-27001-2022::7.2	Physical entry	Secure areas are to be protected by suitable entry controls and access points. Purpose (stated in ISO/IEC 27002:2022): a...
iso-27001-2022::7.3	Securing offices, rooms and facilities	The organization is to design and implement physical protection for its offices, rooms and facilities. Purpose (stated i...
iso-27001-2022::7.4	Physical security monitoring	Premises are to be watched continuously for unauthorized physical entry. Purpose (stated in ISO/IEC 27002:2022): detects...
iso-27001-2022::7.5	Protecting against physical and environmental threats	The organization is to design and implement protection for its infrastructure against natural disasters and other physic...
iso-27001-2022::7.6	Working in secure areas	Security measures for working inside secure areas are to be designed and put in place. Purpose (stated in ISO/IEC 27002:...
iso-27001-2022::7.7	Clear desk and clear screen	Rules requiring clear desks for papers and removable media and clear screens for processing facilities are to be defined...
iso-27001-2022::7.8	Equipment siting and protection	Equipment is to be positioned securely and protected. Purpose (stated in ISO/IEC 27002:2022): lessens exposure of equipm...
iso-27001-2022::7.9	Security of assets off-premises	Assets taken or located off-site are to be protected. Purpose (stated in ISO/IEC 27002:2022): keeps devices used away fr...

Technological controls – ISO 27001:2022

34 controls

Controls in the Technological controls – ISO 27001:2022 domain of ISO 27001:2022: 34 controls
Code	Title	Description
iso-27001-2022::8.1	User end point devices	Information that sits on, is handled by or can be reached through user endpoint devices is to be protected. Purpose (sta...
iso-27001-2022::8.10	Information deletion	Information held in systems, devices or any other storage media is to be deleted once it is no longer needed. Purpose (s...
iso-27001-2022::8.11	Data masking	Data masking is to be applied as directed by the access control policy, related topic policies and what the business nee...
iso-27001-2022::8.12	Data leakage prevention	Every system, network and other device that handles, holds or sends sensitive information is to be covered by measures t...
iso-27001-2022::8.13	Information backup	Backups of information, software and systems are to be kept and tested regularly as the agreed topic-specific backup pol...
iso-27001-2022::8.14	Redundancy of information processing facilities	Information processing facilities are to be built with enough redundancy to satisfy availability requirements. Purpose (...
iso-27001-2022::8.15	Logging	Logs recording activity, exceptions, faults and other events of interest are to be generated, kept, protected and analys...
iso-27001-2022::8.16	Monitoring activities	Networks, systems and applications are to be monitored for anomalous behaviour, with appropriate steps taken to evaluate...
iso-27001-2022::8.17	Clock synchronization	The clocks of the organization's information processing systems are to be kept in step with approved time sources. Purpo...
iso-27001-2022::8.18	Use of privileged utility programs	Utility programs able to override system and application controls are to have their use limited and tightly controlled....
iso-27001-2022::8.19	Installation of software on operational systems	Procedures and measures are to be put in place so that installing software on operational systems is managed securely. P...
iso-27001-2022::8.2	Privileged access rights	The granting and use of privileged access rights are to be limited and managed. Purpose (stated in ISO/IEC 27002:2022):...
iso-27001-2022::8.20	Networks security	Networks and network devices are to be secured, managed and controlled so that information in systems and applications i...
iso-27001-2022::8.21	Security of network services	For each network service, the organization is to identify, put in place and monitor the security mechanisms, the service...
iso-27001-2022::8.22	Segregation of networks	Within its networks the organization is to keep groups of users, information services and information systems apart. Pur...
iso-27001-2022::8.23	Web filtering	The organization is to manage which external websites can be reached, so that exposure to malicious content falls. Purpo...
iso-27001-2022::8.24	Use of cryptography	The organization is to define and apply rules for using cryptography effectively, key management included. Purpose (stat...
iso-27001-2022::8.25	Secure development life cycle	The organization is to set and apply rules for developing software and systems securely. Purpose (stated in ISO/IEC 2700...
iso-27001-2022::8.26	Application security requirements	Information security requirements are to be identified, specified and approved whenever applications are developed or ac...
iso-27001-2022::8.27	Secure system architecture and engineering principles	Principles for engineering secure systems are to be set, written down, kept current and applied to every information sys...
iso-27001-2022::8.28	Secure coding	Software development is to follow secure coding principles. Purpose (stated in ISO/IEC 27002:2022): ensures software is...
iso-27001-2022::8.29	Security testing in development and acceptance	Security testing processes are to be defined and carried out within the development life cycle. Purpose (stated in ISO/I...
iso-27001-2022::8.3	Information access restriction	The organization is to limit who can reach information and associated assets, following its established access control p...
iso-27001-2022::8.30	Outsourced development	When another party develops systems for the organization, the organization is to steer that work, watch it and review it...
iso-27001-2022::8.31	Separation of development, test and production environments	Development, test and production environments are to be kept apart and secured. Purpose (stated in ISO/IEC 27002:2022):...
iso-27001-2022::8.32	Change management	Every change to information systems and processing facilities is to pass through the change management procedures. Purpo...
iso-27001-2022::8.33	Test information	Information used for testing is to be chosen, protected and managed appropriately. Purpose (stated in ISO/IEC 27002:2022...
iso-27001-2022::8.34	Protection of information systems during audit testing	Audit tests and other assurance activities that assess operational systems need a plan agreed in advance by whoever test...
iso-27001-2022::8.4	Access to source code	Who may read or change source code, software libraries and development tools is to be properly managed. Purpose (stated...
iso-27001-2022::8.5	Secure authentication	Secure authentication technologies and procedures are to be put in place, driven by the information access restrictions...
iso-27001-2022::8.6	Capacity management	Resource use is to be monitored and adjusted to fit present and expected capacity needs. Purpose (stated in ISO/IEC 2700...
iso-27001-2022::8.7	Protection against malware	Malware protection is to be implemented and backed by appropriate user awareness. Purpose (stated in ISO/IEC 27002:2022)...
iso-27001-2022::8.8	Management of technical vulnerabilities	The organization is to gather information about technical vulnerabilities in the information systems it uses, assess how...
iso-27001-2022::8.9	Configuration management	The organization is to set, record, apply, watch and review how its hardware, software, services and networks are config...

Your Compliance Coverage

If you comply with ISO 27001:2022, you already cover:

NIST SP 800-53 Rev 5

100%

93 controls mapped

Compare →

ISO 27002:2022

100%

93 controls mapped

Compare →

SOC 2

99%

92 controls mapped

Compare →

+ 90 more: ISO 27001:2013 (98%), C5 (Germany) (97%)

See all 93 mapped frameworks ↓

Maps to 93 other frameworks

93 total controls

NIST SP 800-53 Rev 5

93 source controls mapped|253 target controls covered

100%

ISO 27002:2022

93 source controls mapped|93 target controls covered

100%

SOC 2

92 source controls mapped|60 target controls covered

99%

ISO 27001:2013

91 source controls mapped|114 target controls covered

98%

C5 (Germany)

90 source controls mapped|117 target controls covered

97%

FedRAMP Moderate

90 source controls mapped|293 target controls covered

97%

FedRAMP High

90 source controls mapped|293 target controls covered

97%

Cloud Security Alliance Cloud Controls Matrix (CCM) v4.0.1

90 source controls mapped|180 target controls covered

97%

NIST Cybersecurity Framework 2.0

90 source controls mapped|103 target controls covered

97%

PCI DSS 4.0

88 source controls mapped|246 target controls covered

95%

ISO 27701:2019

82 source controls mapped|100 target controls covered

88%

CIS Controls v8

77 source controls mapped|153 target controls covered

83%

NIST SP 800-161 Rev 1

77 source controls mapped|96 target controls covered

83%

CMMC 2.0

76 source controls mapped|108 target controls covered

82%

NIST SP 800-171 Rev 3

74 source controls mapped|96 target controls covered

80%

HIPAA Security Rule

72 source controls mapped|67 target controls covered

77%

NIST SP 800-66 Rev 2

72 source controls mapped|55 target controls covered

77%

COBIT 2019

63 source controls mapped|78 target controls covered

68%

NIS2 Directive

62 source controls mapped|26 target controls covered

67%

AWS Well-Architected Security Pillar

61 source controls mapped|63 target controls covered

66%

Azure Security Benchmark

60 source controls mapped|84 target controls covered

65%

CFTC System Safeguards (17 CFR 37, 38, 39, 49)

59 source controls mapped|23 target controls covered

63%

Australia Consumer Data Right - Banking (CDR)

54 source controls mapped|15 target controls covered

58%

DORA

53 source controls mapped|25 target controls covered

57%

ANSSI Guide d'hygiene informatique (42 mesures, v2.0)

50 source controls mapped|42 target controls covered

54%

NIST SP 800-172

48 source controls mapped|31 target controls covered

52%

EU AI Act

45 source controls mapped|33 target controls covered

48%

ISO 22301:2019

39 source controls mapped|48 target controls covered

42%

ASD Strategies to Mitigate Cyber Security Incidents

36 source controls mapped|37 target controls covered

39%

Australia My Health Records Act 2012

32 source controls mapped|21 target controls covered

34%

ISO/IEC 42001:2023

32 source controls mapped|33 target controls covered

34%

ACSC Essential Eight

31 source controls mapped|20 target controls covered

33%

NIST SP 800-218

29 source controls mapped|42 target controls covered

31%

APRA CPS 230 Operational Risk Management

29 source controls mapped|35 target controls covered

31%

GDPR

27 source controls mapped|12 target controls covered

29%

APRA CPS 234

27 source controls mapped|24 target controls covered

29%

UK Cyber Essentials

21 source controls mapped|31 target controls covered

23%

APPI

20 source controls mapped|18 target controls covered

22%

Authorised Economic Operator (AEO) Programmes - Global Standards

20 source controls mapped|11 target controls covered

22%

ISO/IEC 29100:2024

8 source controls mapped|2 target controls covered

ISO 37301:2021

7 source controls mapped|7 target controls covered

ISO 22000:2018

7 source controls mapped|7 target controls covered

ISO 9001:2015

7 source controls mapped|7 target controls covered

ISO 50001:2018 - Energy Management Systems

7 source controls mapped|7 target controls covered

ISO 45001:2018

7 source controls mapped|7 target controls covered

ISO 55001:2014

6 source controls mapped|6 target controls covered

ISO 14001:2015

6 source controls mapped|6 target controls covered

ISO 37001:2016

5 source controls mapped|5 target controls covered

ISO 27018:2019

5 source controls mapped|5 target controls covered

Turkey Cybersecurity Law (Law No. 7545)

5 source controls mapped|6 target controls covered

Italy Personal Data Protection Code (Legislative Decree No. 196/2003, amended 2018)

4 source controls mapped|5 target controls covered

CNIL Guidance on Employee Monitoring and Workplace Video Surveillance

4 source controls mapped|5 target controls covered

NIST SP 800-171A - Assessing Security Requirements for Controlled Unclassified Information (CUI)

3 source controls mapped|2 target controls covered

NIST SP 800-181

3 source controls mapped|6 target controls covered

CCSDS 350.0-G-3 - Space Communications Security (Consultative Committee for Space Data Systems)

3 source controls mapped|3 target controls covered

Italy Workers' Statute (Law 300/1970)

3 source controls mapped|5 target controls covered

ISO/IEC 27011:2024

3 source controls mapped|3 target controls covered

ISO/IEC 27010:2015

3 source controls mapped|3 target controls covered

API 1164

3 source controls mapped|2 target controls covered

NIST SP 800-53A Rev. 5

2 source controls mapped|5 target controls covered

UK Investigatory Powers (Interception by Businesses etc. for Monitoring and Record-keeping Purposes) Regulations 2018

2 source controls mapped|3 target controls covered

ISO/IEC 25012:2008 - Data Quality Model

2 source controls mapped|4 target controls covered

Netherlands Works Councils Act (WOR)

2 source controls mapped|2 target controls covered

Australian Energy Sector Cyber Security Framework (AESCSF)

2 source controls mapped|2 target controls covered

Protective Security Policy Framework (PSPF) Release 2026

2 source controls mapped|1 target controls covered

CISA Industrial Control Systems (ICS) Security Guidance

2 source controls mapped|1 target controls covered

C-TPAT - Customs-Trade Partnership Against Terrorism

2 source controls mapped|1 target controls covered

EBA Guidelines on ICT and Security Risk Management (EBA/GL/2019/04)

2 source controls mapped|1 target controls covered

EIOPA Guidelines on ICT Security and Governance (EIOPA-BoS-20/600)

2 source controls mapped|1 target controls covered

Digital Services Act (DSA) - Regulation (EU) 2022/2065