TheArtOfService
Back to Frameworks

ISO 37001:2016

Self-Assess
International
v2016
7 domains
41 controls
Verified

ISO 37001:2016 is a compliance framework from International with 7 domains and 41 controls that map to 99 other frameworks. The largest domains are Operation – ISO 37001:2016 (10 controls), Support – ISO 37001:2016 (9 controls), Leadership – ISO 37001:2016 (7 controls). Every control below carries what it requires and what an assessor expects to see.

Maintained by Gerard Blokdyk

Framework summaries on this platform are AI-assisted interpretations for educational and compliance planning purposes. They do not reproduce or replace the official standards. Refer to the authoritative source for the definitive text. Framework names and trademarks belong to their respective organisations.

Framework Domains (7)

Clause 6 – ISO 37001:2016

2 controls
Controls in the Clause 6 – ISO 37001:2016 domain of ISO 37001:2016 — 2 controls
CodeTitle
iso-37001-2016::6.1Actions to address risks and opportunities
iso-37001-2016::6.2Anti-bribery objectives andISO planning

Context of the organization – ISO 37001:2016

5 controls
Controls in the Context of the organization – ISO 37001:2016 domain of ISO 37001:2016 — 5 controls
CodeTitle
iso-37001-2016::4.1Understanding the organization and its context
iso-37001-2016::4.2Understanding the needs and expectations of stakeholders
iso-37001-2016::4.3Determining the scope of the anti-bribery management system
iso-37001-2016::4.4Anti-bribery management system
iso-37001-2016::4.5Bribery risk assessment

Improvement – ISO 37001:2016

2 controls
Controls in the Improvement – ISO 37001:2016 domain of ISO 37001:2016 — 2 controls
CodeTitle
iso-37001-2016::10.1Nonconformity and corrective action
iso-37001-2016::10.2Continual improvement

Leadership – ISO 37001:2016

7 controls
Controls in the Leadership – ISO 37001:2016 domain of ISO 37001:2016 — 7 controls
CodeTitle
iso-37001-2016::5.1Leadership and commitment
iso-37001-2016::5.1.1Governing body
iso-37001-2016::5.1.2Top management
iso-37001-2016::5.2Anti-bribery policy
iso-37001-2016::5.3Organizational roles, responsibilities and authorities
iso-37001-2016::5.3.1Roles and responsibilities
iso-37001-2016::5.3.2Anti-bribery compliance function

Operation – ISO 37001:2016

10 controls
Controls in the Operation – ISO 37001:2016 domain of ISO 37001:2016 — 10 controls
CodeTitle
iso-37001-2016::8.1Operational planning and control
iso-37001-2016::8.10Investigating and dealing with bribery
iso-37001-2016::8.2Due diligence
iso-37001-2016::8.3Financial controls
iso-37001-2016::8.4Non-financial controls
iso-37001-2016::8.5Implementation of anti-bribery controls by controlled organizations and by
iso-37001-2016::8.6Anti-bribery commitments
iso-37001-2016::8.7Gifts, hospitality, donations and similar benefits
iso-37001-2016::8.8Managing inadequacy of anti-bribery controls
iso-37001-2016::8.9Raising concerns

Performance evaluation – ISO 37001:2016

6 controls
Controls in the Performance evaluation – ISO 37001:2016 domain of ISO 37001:2016 — 6 controls
CodeTitle
iso-37001-2016::9.1Monitoring, measurement, analysis and evaluation
iso-37001-2016::9.2Internal audit
iso-37001-2016::9.3Management review
iso-37001-2016::9.3.1Top management review
iso-37001-2016::9.3.2Governing body review
iso-37001-2016::9.4Review by anti-bribery compliance function

Support – ISO 37001:2016

9 controls
Controls in the Support – ISO 37001:2016 domain of ISO 37001:2016 — 9 controls
CodeTitle
iso-37001-2016::7.2Competence
iso-37001-2016::7.2.1General
iso-37001-2016::7.2.2Employment process
iso-37001-2016::7.3Awareness and training
iso-37001-2016::7.4Communication
iso-37001-2016::7.5Documented information
iso-37001-2016::7.5.1General
iso-37001-2016::7.5.2Creating and updating
iso-37001-2016::7.5.3Control of documented information

Your Compliance Coverage

If you comply with ISO 37001:2016, you already cover:

ISO 37301:2021

83%

34 controls mapped

Compare →

ISO 9001:2015

78%

32 controls mapped

Compare →

ISO 22000:2018

78%

32 controls mapped

Compare →

+ 96 more: ISO 22301:2019 (66%), ISO 45001:2018 (56%)

See all 99 mapped frameworks ↓

Maps to 99 other frameworks

41 total controls
ISO 37301:2021
34 source controls mapped|35 target controls covered
83%
ISO 9001:2015
32 source controls mapped|34 target controls covered
78%
ISO 22000:2018
32 source controls mapped|33 target controls covered
78%
ISO 22301:2019
27 source controls mapped|27 target controls covered
66%
ISO 45001:2018
23 source controls mapped|26 target controls covered
56%
ISO 14001:2015
23 source controls mapped|25 target controls covered
56%
ISO 50001:2018 - Energy Management Systems
22 source controls mapped|32 target controls covered
54%
ISO 55001:2014
20 source controls mapped|21 target controls covered
49%
ISO 27701:2019
18 source controls mapped|19 target controls covered
44%
ISO 37001
17 source controls mapped|18 target controls covered
41%
ISO 19011:2018
16 source controls mapped|29 target controls covered
39%
ISO 14004:2016
14 source controls mapped|13 target controls covered
34%
ISO 37301
13 source controls mapped|16 target controls covered
32%
ISO 39001:2012 - Road Traffic Safety Management
13 source controls mapped|23 target controls covered
32%
ISO 55001
12 source controls mapped|15 target controls covered
29%
ISO 41001:2018 - Facility Management Systems
12 source controls mapped|24 target controls covered
29%
ISO 22313:2020 - Guidance on Business Continuity Management Systems
12 source controls mapped|14 target controls covered
29%
ISO/IEC 27003:2017
12 source controls mapped|24 target controls covered
29%
ISO 56002
12 source controls mapped|23 target controls covered
29%
ISO 30401
12 source controls mapped|16 target controls covered
29%
AS9100D - Aerospace Quality Management System
11 source controls mapped|11 target controls covered
27%
ISO 37002:2021 - Whistleblowing Management Systems
11 source controls mapped|20 target controls covered
27%
ISO 9001
11 source controls mapped|14 target controls covered
27%
ISO 22000
10 source controls mapped|10 target controls covered
24%
ISO 45001
9 source controls mapped|9 target controls covered
22%
ISO 27001:2022
8 source controls mapped|8 target controls covered
20%
ISO/IEC 38500:2024
8 source controls mapped|16 target controls covered
20%
ISO 31000:2018
6 source controls mapped|5 target controls covered
15%
AS9100D:2016 - Quality Management Systems for Aviation, Space, and Defence
6 source controls mapped|6 target controls covered
15%
ISO/IEC 23894:2023
5 source controls mapped|11 target controls covered
12%
ASIS SPC.1-2009 - Organizational Resilience Standard
5 source controls mapped|7 target controls covered
12%
ISO 27005:2022
5 source controls mapped|7 target controls covered
12%
ISO/IEC 27031:2011
5 source controls mapped|5 target controls covered
12%
ISO 19011
4 source controls mapped|4 target controls covered
10%
ISO 28001:2007 Supply Chain Security Management
4 source controls mapped|4 target controls covered
10%
ISO 22320:2018
4 source controls mapped|5 target controls covered
10%
ISO 13485:2016
4 source controls mapped|3 target controls covered
10%
ISO/IEC 27557:2022 - Organisational Privacy Risk Management
3 source controls mapped|3 target controls covered
7%
FFIEC IT Examination Handbook
3 source controls mapped|3 target controls covered
7%
PCI SSF
3 source controls mapped|3 target controls covered
7%
PCI PIN Security
3 source controls mapped|3 target controls covered
7%
PCI P2PE
3 source controls mapped|3 target controls covered
7%
ISO/IEC 27701:2019
3 source controls mapped|3 target controls covered
7%
ISO 10006:2003
2 source controls mapped|2 target controls covered
5%
BS 65000:2014 - Guidance on Organizational Resilience
2 source controls mapped|2 target controls covered
5%
Canada's Anti-Spam Legislation (CASL)
2 source controls mapped|2 target controls covered
5%
ISO 26000:2010
2 source controls mapped|2 target controls covered
5%
UK Bribery Act 2010
2 source controls mapped|2 target controls covered
5%
ISO 31000
2 source controls mapped|2 target controls covered
5%
ISO/IEC 42001:2023
2 source controls mapped|2 target controls covered
5%
NIST SP 1800-32
2 source controls mapped|2 target controls covered
5%
ISO/IEC 30111:2019
2 source controls mapped|2 target controls covered
5%
ISO/IEC TR 24028:2020
2 source controls mapped|1 target controls covered
5%
ISO/IEC 27004:2016
2 source controls mapped|2 target controls covered
5%
ISO/IEC 29147:2018
2 source controls mapped|3 target controls covered
5%
CSA STAR (Security, Trust, Assurance, and Risk)
1 source controls mapped|1 target controls covered
2%
ITIL 4
1 source controls mapped|1 target controls covered
2%
APRA CPS 230 Operational Risk Management
1 source controls mapped|1 target controls covered
2%
Regulation (EU) 2023/1115 on deforestation-free supply chains
1 source controls mapped|1 target controls covered
2%
ISO/IEC 17025:2017 - General Requirements for Testing and Calibration
1 source controls mapped|2 target controls covered
2%
ISO/IEC 17025:2017 - General Requirements for Testing and Calibration Laboratories
1 source controls mapped|1 target controls covered
2%
ISO 37000:2021
1 source controls mapped|4 target controls covered
2%
ISO 37000:2021 - Governance of Organizations
1 source controls mapped|1 target controls covered
2%
C5 (Germany)
1 source controls mapped|1 target controls covered
2%
ISO 20400:2017 - Sustainable Procurement
1 source controls mapped|1 target controls covered
2%
NFPA 1600 - Standard on Continuity, Emergency, and Crisis Management
1 source controls mapped|1 target controls covered
2%
NIST SP 800-150
1 source controls mapped|1 target controls covered
2%
APRA CPS 234
1 source controls mapped|1 target controls covered
2%
PCI DSS 4.0
1 source controls mapped|1 target controls covered
2%
NIST SP 800-88 Rev 1
1 source controls mapped|1 target controls covered
2%
ISO 27043
1 source controls mapped|2 target controls covered
2%
ISO 27019
1 source controls mapped|1 target controls covered
2%
ISO/IEC 27010:2015
1 source controls mapped|1 target controls covered
2%
NIST SP 800-128
1 source controls mapped|1 target controls covered
2%
IEC 62443
1 source controls mapped|1 target controls covered
2%
ISO/SAE 21434
1 source controls mapped|1 target controls covered
2%
NIST SP 800-218
1 source controls mapped|1 target controls covered
2%
ISO/IEC 27014:2020
1 source controls mapped|1 target controls covered
2%
ISO/IEC 27050 - Electronic Discovery (Parts 1-4)
1 source controls mapped|1 target controls covered
2%
APRA CPS 220 Risk Management
1 source controls mapped|1 target controls covered
2%
ISO 10007:2017
1 source controls mapped|1 target controls covered
2%
NIST SP 800-183
1 source controls mapped|2 target controls covered
2%
ISO 22318
1 source controls mapped|2 target controls covered
2%
ISO 22316
1 source controls mapped|1 target controls covered
2%
ISAE 3402 - Assurance Reports on Controls at a Service Organisation
1 source controls mapped|1 target controls covered
2%
ISO 22317
1 source controls mapped|1 target controls covered
2%
NSA Guidance for Transition to Quantum-Resistant Cryptography
1 source controls mapped|1 target controls covered
2%
OWASP ASVS
1 source controls mapped|1 target controls covered
2%
Brazil AI Framework
1 source controls mapped|1 target controls covered
2%
ANSSI Guide d'hygiene informatique (42 mesures, v2.0)
1 source controls mapped|1 target controls covered
2%
Angola Personal Data Protection Law (Law No. 22/11)
1 source controls mapped|1 target controls covered
2%
ISO/IEC 27011:2024
1 source controls mapped|1 target controls covered
2%
Belgium CyberFundamentals
1 source controls mapped|1 target controls covered
2%
BSI IT-Grundschutz
1 source controls mapped|1 target controls covered
2%
Australian Energy Sector Cyber Security Framework (AESCSF)
1 source controls mapped|1 target controls covered
2%
NIST SP 800-82 Rev 3
1 source controls mapped|1 target controls covered
2%
Code of Conduct on Data Protection for Research (GDPR Article 40)
1 source controls mapped|1 target controls covered
2%
Cambodia Sub-Decree on Personal Data Protection (Sub-Decree No. 134)
1 source controls mapped|1 target controls covered
2%
Canada ITSG-33 - IT Security Risk Management
1 source controls mapped|1 target controls covered
2%
Compare ISO 37001:2016 with ISO 37301:2021

What is ISO 37001:2016 and who does it apply to?

ISO 37001:2016 is a compliance framework from International with 7 domains and 41 controls. It is used by organisations to establish and maintain compliance with industry standards and regulatory requirements.

What does ISO 37001:2016 actually require?

ISO 37001:2016 has 41 controls organised across 7 domains. The largest domains are Operation – ISO 37001:2016 (10 controls), Support – ISO 37001:2016 (9 controls), Leadership – ISO 37001:2016 (7 controls). Each control defines specific requirements that organisations must implement to achieve compliance.

If I already comply with another framework, how much of ISO 37001:2016 do I already cover?

ISO 37001:2016 maps to 99 other compliance frameworks. The top mapping partners are ISO 37301:2021 (83% coverage), ISO 9001:2015 (78% coverage), ISO 22000:2018 (78% coverage). Use our comparison tool to explore control-level mappings between frameworks.

How do I implement ISO 37001:2016?

Start your ISO 37001:2016 compliance journey by running a self-assessment on our platform to identify your current compliance posture. Our AI advisory can answer specific questions about ISO 37001:2016 requirements, and cross-framework mapping helps you leverage existing controls from other frameworks you may already comply with. Create a free account to access all 41 controls and track your progress.

Start Your Compliance Journey

Create a free account to run self-assessments, get AI advisory, and track your compliance progress across 686 frameworks.

Get Started Free →

Free forever — no credit card required