ISO 37301

International

v2021

15 domains

43 controls

Compliance management systems

Unverified

Framework summaries on this platform are AI-assisted interpretations for educational and compliance planning purposes. They do not reproduce or replace the official standards. Refer to the authoritative source for the definitive text. Framework names and trademarks belong to their respective organisations.

Framework Domains (15)

Context

2 controls

Controls in the Context domain of ISO 37301 — 2 controls
Code	Title	Description
ISO37301-4.1	Understanding the Organization and Context	Determine external and internal issues relevant to the compliance management system and its ability to achieve intended...
ISO37301-4.2	Needs and Expectations of Interested Parties	Identify interested parties, their requirements, and which are addressed via compliance obligations.

ISO 37301: Improvement

3 controls

Continual improvement of quality management system (ISO 37301)

Controls in the ISO 37301: Improvement domain of ISO 37301 — 3 controls
Code	Title	Description
ISO37301-16	Continual improvement methodology	Continual improvement methodology. Control from ISO 37301 framework, domain: ISO 37301: Improvement.
ISO37301-17	Corrective and preventive actions	Corrective and preventive actions. Control from ISO 37301 framework, domain: ISO 37301: Improvement.
ISO37301-18	Innovation and change management	Innovation and change management. Control from ISO 37301 framework, domain: ISO 37301: Improvement.

ISO 37301: Leadership & Planning

6 controls

Quality management leadership and planning (ISO 37301)

Controls in the ISO 37301: Leadership & Planning domain of ISO 37301 — 6 controls
Code	Title	Description
ISO37301-01	Cl. 4.1-4.6 Compliance management policy - compliance obligations, objectives, and applicable compliance requirements	Quality policy and objectives. Control from ISO 37301 framework, domain: ISO 37301: Leadership & Planning.
ISO37301-02	Leadership commitment to quality	Leadership commitment to quality. Control from ISO 37301 framework, domain: ISO 37301: Leadership & Planning.
ISO37301-03	Risk-based thinking and planning	Risk-based thinking and planning. Control from ISO 37301 framework, domain: ISO 37301: Leadership & Planning.
ISO37301-04	Resource management for quality	Resource management for quality. Control from ISO 37301 framework, domain: ISO 37301: Leadership & Planning.
ISO37301-05	Organizational roles and responsibilities	Organizational roles and responsibilities. Control from ISO 37301 framework, domain: ISO 37301: Leadership & Planning.
ISO37301-CL4.4	Cl. 4.4 Compliance obligations - determining and maintaining specific compliance obligations applicable to the organization	-

ISO 37301: Operational Controls

5 controls

Quality controls in operations (ISO 37301)

Controls in the ISO 37301: Operational Controls domain of ISO 37301 — 5 controls
Code	Title	Description
ISO37301-06	Operational planning and control	Operational planning and control. Control from ISO 37301 framework, domain: ISO 37301: Operational Controls.
ISO37301-07	Requirements for products and services	Requirements for products and services. Control from ISO 37301 framework, domain: ISO 37301: Operational Controls.
ISO37301-08	Design and development controls	Design and development controls. Control from ISO 37301 framework, domain: ISO 37301: Operational Controls.
ISO37301-09	Control of externally provided processes	Control of externally provided processes. Control from ISO 37301 framework, domain: ISO 37301: Operational Controls.
ISO37301-10	Production and service provision controls	Production and service provision controls. Control from ISO 37301 framework, domain: ISO 37301: Operational Controls.

ISO 37301: Performance Evaluation

5 controls

Measuring and evaluating quality performance (ISO 37301)

Controls in the ISO 37301: Performance Evaluation domain of ISO 37301 — 5 controls
Code	Title	Description
ISO37301-11	Monitoring, measurement, and analysis	Monitoring, measurement, and analysis. Control from ISO 37301 framework, domain: ISO 37301: Performance Evaluation.
ISO37301-12	Internal audit program	Internal audit program. Control from ISO 37301 framework, domain: ISO 37301: Performance Evaluation.
ISO37301-13	Management review process	Management review process. Control from ISO 37301 framework, domain: ISO 37301: Performance Evaluation.
ISO37301-14	Customer satisfaction measurement	Customer satisfaction measurement. Control from ISO 37301 framework, domain: ISO 37301: Performance Evaluation.
ISO37301-15	Nonconformity and corrective action	Nonconformity and corrective action. Control from ISO 37301 framework, domain: ISO 37301: Performance Evaluation.

Improvement

2 controls

Controls in the Improvement domain of ISO 37301 — 2 controls
Code	Title	Description
ISO37301-10.1	Nonconformity and Corrective Action	React to nonconformities including breaches, determine causes, and implement corrective actions.
ISO37301-10.2	Continual Improvement	Continually improve the suitability, adequacy, and effectiveness of the CMS.

Leadership

1 controls

Controls in the Leadership domain of ISO 37301 — 1 controls
Code	Title	Description
ISO37301-5.1	Leadership and Commitment	Top management and governing body demonstrate leadership and commitment to the CMS.

Obligations

1 controls

Controls in the Obligations domain of ISO 37301 — 1 controls
Code	Title	Description
ISO37301-4.5	Compliance Obligations	Identify, document, evaluate, and maintain compliance obligations applicable to the organization.

Operations

4 controls

Controls in the Operations domain of ISO 37301 — 4 controls
Code	Title	Description
ISO37301-8.1	Operational Planning and Control	Establish controls to meet compliance obligations and address risks.
ISO37301-8.2	Establishing Controls and Procedures	Implement controls and procedures proportionate to compliance risk.
ISO37301-8.3	Raising Concerns	Establish, implement, and maintain processes for workers and others to raise concerns confidentially without retaliation...
ISO37301-8.4	Investigation Processes	Investigate reports of suspected or actual non-compliance fairly and consistently.

Performance

4 controls

Controls in the Performance domain of ISO 37301 — 4 controls
Code	Title	Description
ISO37301-9.1.1	Monitoring, Measurement, Analysis, and Evaluation	Monitor and measure compliance performance using defined indicators.
ISO37301-9.1.5	Reporting	Provide reports on compliance performance to relevant interested parties including the governing body.
ISO37301-9.2	Internal Audit	Conduct internal audits of the CMS at planned intervals.
ISO37301-9.3	Management Review	Top management reviews the CMS at planned intervals to ensure suitability, adequacy, and effectiveness.

Planning

2 controls

Controls in the Planning domain of ISO 37301 — 2 controls
Code	Title	Description
ISO37301-6.1	Actions to Address Risks and Opportunities	Plan actions to address compliance risks and opportunities and integrate them into processes.
ISO37301-6.2	Compliance Objectives and Planning	Establish measurable compliance objectives at relevant functions and levels and plan to achieve them.

Policy

1 controls

Controls in the Policy domain of ISO 37301 — 1 controls
Code	Title	Description
ISO37301-5.2	Compliance Policy	Establish, communicate, and maintain a compliance policy appropriate to the organization.

Risk

1 controls

Controls in the Risk domain of ISO 37301 — 1 controls
Code	Title	Description
ISO37301-4.6	Compliance Risk Assessment	Identify and analyze compliance risks linked to obligations and evaluate them.

Roles

2 controls

Controls in the Roles domain of ISO 37301 — 2 controls
Code	Title	Description
ISO37301-5.3.2	Compliance Function	Establish a compliance function with appropriate authority, independence, resources, and access to top management.
ISO37301-5.3.3	Governance Body and Top Management Responsibilities	Governing body and top management have defined accountabilities for the CMS.

Support

4 controls

Controls in the Support domain of ISO 37301 — 4 controls
Code	Title	Description
ISO37301-7.2	Competence	Determine and ensure necessary competence for persons affecting compliance performance.
ISO37301-7.3	Awareness and Training	Workers are aware of compliance policy, their contribution, and consequences of non-compliance.
ISO37301-7.4	Communication	Determine internal and external communications relevant to the CMS.
ISO37301-7.5	Documented Information	Create, update, and control documented information required by the CMS.

Your Compliance Coverage

If you comply with ISO 37301, you already cover:

ICH Q10 - Pharmaceutical Quality System

2 controls mapped

Compare →

IEC 62304:2015 Medical Device Software Lifecycle Processes

2 controls mapped

Compare →

ISO 30401

2 controls mapped

Compare →

+ 72 more: ISO 19011 (5%), ISO 20000-1 (5%)

See all 75 mapped frameworks ↓

Maps to 75 other frameworks

43 total controls

ICH Q10 - Pharmaceutical Quality System

2 source controls mapped|1 target controls covered

IEC 62304:2015 Medical Device Software Lifecycle Processes

2 source controls mapped|4 target controls covered

ISO 30401

2 source controls mapped|2 target controls covered

ISO 19011

2 source controls mapped|2 target controls covered

ISO 20000-1

2 source controls mapped|2 target controls covered

ISO 37001

2 source controls mapped|2 target controls covered

ISO 55001

2 source controls mapped|2 target controls covered

ISO 9001

2 source controls mapped|4 target controls covered

ISO 26262:2018 - Functional Safety for Road Vehicles

1 source controls mapped|1 target controls covered

SASB Standards

1 source controls mapped|1 target controls covered

NRF Cybersecurity and Data Privacy Framework (National Retail Federation)

1 source controls mapped|1 target controls covered

NIST SP 800-82 Revision 3: Guide to Industrial Control Systems (ICS) Security

1 source controls mapped|2 target controls covered

NIST SP 800-146

1 source controls mapped|1 target controls covered

NIST SP 800-145

1 source controls mapped|1 target controls covered

NIST SP 800-144

1 source controls mapped|1 target controls covered

NIST Privacy Framework

1 source controls mapped|1 target controls covered

NIS2 Directive

1 source controls mapped|1 target controls covered

NERC CIP

1 source controls mapped|1 target controls covered

MTCS (Singapore)

1 source controls mapped|1 target controls covered

FTC GLBA Safeguards Rule (16 CFR Part 314)

1 source controls mapped|1 target controls covered

ISO 27017

1 source controls mapped|1 target controls covered

Azure Security Benchmark

1 source controls mapped|1 target controls covered

ISO 27001:2022

1 source controls mapped|2 target controls covered

NIST SP 800-171A - Assessing Security Requirements for Controlled Unclassified Information (CUI)

1 source controls mapped|1 target controls covered

BSI IT-Grundschutz

1 source controls mapped|1 target controls covered

AWS Well-Architected Security Pillar

1 source controls mapped|1 target controls covered

ISO 27019

1 source controls mapped|1 target controls covered

Annex 11 to EU GMP - Computerised Systems

1 source controls mapped|1 target controls covered

IEC 62443

1 source controls mapped|1 target controls covered

API 1164

1 source controls mapped|1 target controls covered

ISO 27018

1 source controls mapped|1 target controls covered

SSAE 18 - Attestation Standards (SOC Reporting)

1 source controls mapped|2 target controls covered

ITIL 4

1 source controls mapped|1 target controls covered

NIST SP 800-53 Rev 5

1 source controls mapped|1 target controls covered

SOC 2

1 source controls mapped|1 target controls covered

NIST SP 800-190

1 source controls mapped|1 target controls covered

NIST SP 1800-32

1 source controls mapped|1 target controls covered

ISO 31000

1 source controls mapped|1 target controls covered

UK FCA/PRA Operational Resilience Framework

1 source controls mapped|1 target controls covered

TISAX - Trusted Information Security Assessment Exchange

1 source controls mapped|1 target controls covered

SA8000:2014 - Social Accountability Standard

1 source controls mapped|1 target controls covered

PIC/S Guide to Good Manufacturing Practice for Medicinal Products

1 source controls mapped|1 target controls covered

NIST SP 800-39

1 source controls mapped|1 target controls covered

NIST SP 800-37

1 source controls mapped|1 target controls covered

NIST SP 800-30

1 source controls mapped|1 target controls covered

ITAR - International Traffic in Arms Regulations

1 source controls mapped|1 target controls covered

German Supply Chain Due Diligence Act (LkSG)

1 source controls mapped|1 target controls covered

NIST SP 800-171A Rev 3 - Assessing CUI Security Requirements

1 source controls mapped|1 target controls covered

BRCGS Global Standard for Food Safety Issue 9

1 source controls mapped|2 target controls covered

DAMA-DMBOK2 - Data Management Body of Knowledge (2nd Edition)

1 source controls mapped|1 target controls covered

ISO 27005

1 source controls mapped|2 target controls covered

ISO/IEC 17025:2017 - General Requirements for Testing and Calibration Laboratories

1 source controls mapped|3 target controls covered

ISO 15189:2022 - Medical Laboratories Requirements for Quality and Competence

1 source controls mapped|3 target controls covered

ISO 14064 - Greenhouse Gas Accounting and Verification (Parts 1-3)

1 source controls mapped|1 target controls covered

AS9100D - Aerospace Quality Management System

1 source controls mapped|3 target controls covered

ISO/IEC 27003:2017

1 source controls mapped|3 target controls covered

AS9100D:2016 - Quality Management Systems for Aviation, Space, and Defence

1 source controls mapped|1 target controls covered

ISO 14001

1 source controls mapped|1 target controls covered

ISO 45001:2018

1 source controls mapped|1 target controls covered

ISO 14001:2015

1 source controls mapped|1 target controls covered

ISO 9001:2015

1 source controls mapped|1 target controls covered

ISO 22000

1 source controls mapped|1 target controls covered

EASA Part-IS - Information Security in Aviation

1 source controls mapped|1 target controls covered

ISO 20400:2017 - Sustainable Procurement

1 source controls mapped|1 target controls covered

Aged Care Quality Standards (Australia)

1 source controls mapped|1 target controls covered

ISO/IEC 27014:2020

1 source controls mapped|1 target controls covered

ISO 56002

1 source controls mapped|3 target controls covered

ISO 41001:2018 - Facility Management Systems

1 source controls mapped|3 target controls covered

ISO 39001:2012 - Road Traffic Safety Management

1 source controls mapped|3 target controls covered

ISO 37002:2021 - Whistleblowing Management Systems

1 source controls mapped|3 target controls covered

ISO 50001:2018 - Energy Management Systems

1 source controls mapped|3 target controls covered

ISO 22313:2020 - Guidance on Business Continuity Management Systems

1 source controls mapped|3 target controls covered

NFPA 1600 - Standard on Continuity, Emergency, and Crisis Management

1 source controls mapped|2 target controls covered

AICPA Privacy Management Framework (PMF)

1 source controls mapped|1 target controls covered

ISO 45001

1 source controls mapped|1 target controls covered

Compare ISO 37301 with ICH Q10 - Pharmaceutical Quality System

Frequently Asked Questions

What is ISO 37301?

ISO 37301 is a compliance framework from International with 15 domains and 43 controls. Compliance management systems It is used by organisations to establish and maintain compliance with industry standards and regulatory requirements.

How many controls does ISO 37301 have?

ISO 37301 has 43 controls organised across 15 domains. The largest domains are ISO 37301: Leadership & Planning (6 controls), ISO 37301: Operational Controls (5 controls), ISO 37301: Performance Evaluation (5 controls). Each control defines specific requirements that organisations must implement to achieve compliance.

What frameworks does ISO 37301 map to?

ISO 37301 maps to 75 other compliance frameworks. The top mapping partners are ICH Q10 - Pharmaceutical Quality System (5% coverage), IEC 62304:2015 Medical Device Software Lifecycle Processes (5% coverage), ISO 30401 (5% coverage). Use our comparison tool to explore control-level mappings between frameworks.

How do I get started with ISO 37301 compliance?

Start your ISO 37301 compliance journey by running a self-assessment on our platform to identify your current compliance posture. Our AI advisory can answer specific questions about ISO 37301 requirements, and cross-framework mapping helps you leverage existing controls from other frameworks you may already comply with. Create a free account to access all 43 controls and track your progress.

Start Your Compliance Journey

Create a free account to run self-assessments, get AI advisory, and track your compliance progress across 700 frameworks.

Get Started Free →

Free forever — no credit card required