South Korea Cloud Security Assurance Program (CSAP)

South Korea

vMSIT Notice No. 2023-4 (31 January 2023), Annexes 1 to 4 (117 criteria)

14 domains

117 controls

Korea's cloud computing service security certification (CSAP) under the Cloud Computing Act and MSIT Notice 2023-4 (in force 31 January 2023), run by KISA: 117 criteria in 14 areas. Administrative (policy and organisation, personnel, assets and risk, service supply chain, incidents, service continuity, compliance), physical (zones, entry, equipment, disposal), technical (virtualisation and hypervisor security, access control and authentication, network security and tenant separation, data ownership, traceability, destruction and encryption, secure development) and, for services to national and public bodies, a security SLA, NIS-verified security products, validated national encryption, support for government security monitoring, prevention of data outflow and separation from the commercial zone, with Korea-only location and physical separation outside the Lower grade. IaaS, SaaS and PaaS types; Upper, Middle and Lower grades, with only Lower (62 criteria) in effect pending separate criteria. Annual surveillance, renewal, partial waiver for ISMS or ISMS-P holders. Announced in 2026: abolition for public-sector use and transfer to an NIS-led verification by the second half of 2027; not yet in force.

Verified

South Korea Cloud Security Assurance Program (CSAP) is a compliance framework from South Korea with 14 domains and 117 controls that map to 30 other frameworks. The largest domains are 13 System development and acquisition security – South Korea Cloud Security Assurance Program (CSAP) (12 controls), 14 Security requirements for national and public bodies – South Korea Cloud Security Assurance Program (CSAP) (11 controls), 2 Personnel security – South Korea Cloud Security Assurance Program (CSAP) (11 controls). Every control below carries what it requires and what an assessor expects to see.

Maintained by Gerard BlokdykVerified against the published standard 31 May 2026Control text last updated 21 May 2026

Framework summaries on this platform are interpretations grounded in the published source, for educational and compliance planning purposes. They do not reproduce or replace the official standards. Refer to the authoritative source for the definitive text. Framework names and trademarks belong to their respective organisations.

Framework Domains (14)

1 Information security policy and organisation – South Korea Cloud Security Assurance Program (CSAP)

5 controls

Controls in the 1 Information security policy and organisation – South Korea Cloud Security Assurance Program (CSAP) domain of South Korea Cloud Security Assurance Program (CSAP): 5 controls
Code	Title	Description
south-korea-cloud-security-assurance-program-csap::1.1.1	Establishing the information security policy	The information security policy is documented, approved by the chief information security officer and made available to...
south-korea-cloud-security-assurance-program-csap::1.1.2	Reviewing and changing the policy	The policy's validity and effect are reviewed at least once a year and additionally on significant events such as legal...
south-korea-cloud-security-assurance-program-csap::1.1.3	Managing policy documents	A version-history procedure covers the policy and its implementing documents, and the current version is maintained.
south-korea-cloud-security-assurance-program-csap::1.2.1	Organisation	A dedicated information security organisation plans, runs and reviews security activity, and a chief information securit...
south-korea-cloud-security-assurance-program-csap::1.2.2	Assigning roles and responsibilities	Security roles and responsibilities of all employees and external parties dealing with information assets are defined cl...

10 Access control – South Korea Cloud Security Assurance Program (CSAP)

9 controls

Controls in the 10 Access control – South Korea Cloud Security Assurance Program (CSAP) domain of South Korea Cloud Security Assurance Program (CSAP): 9 controls
Code	Title	Description
south-korea-cloud-security-assurance-program-csap::10.1.1	Access control policy	An access control policy sets the areas and scope, rules and methods of access control to stop unauthorised access.
south-korea-cloud-security-assurance-program-csap::10.1.2	Managing access records	What is logged is defined, and access records are kept in a form that supports service control, management and accountab...
south-korea-cloud-security-assurance-program-csap::10.2.1	User registration and authorisation	A formal user registration and removal procedure controls access to cloud systems and important information, with access...
south-korea-cloud-security-assurance-program-csap::10.2.2	Administrator and special privileges	Accounts and rights given for administration of cloud systems and important information and for special purposes are ide...
south-korea-cloud-security-assurance-program-csap::10.2.3	Reviewing access rights	The appropriateness of access rights (granting, long-term non-use, changes on leaving, leave of absence, change of dutie...
south-korea-cloud-security-assurance-program-csap::10.3.1	User identification	Each cloud system user gets a unique identifier, guessable identifiers are restricted, and any shared identifier is revi...
south-korea-cloud-security-assurance-program-csap::10.3.2	User authentication	Access to cloud systems is controlled by secure authentication with limits on login attempts and warnings on illegal log...
south-korea-cloud-security-assurance-program-csap::10.3.3	Offering stronger authentication	A way is prepared to provide stronger authentication such as multi-factor authentication when customers request it.
south-korea-cloud-security-assurance-program-csap::10.3.4	Password management	Password procedures for users and customers are set and applied considering legal requirements and external threats (com...

11 Network security – South Korea Cloud Security Assurance Program (CSAP)

6 controls

Controls in the 11 Network security – South Korea Cloud Security Assurance Program (CSAP) domain of South Korea Cloud Security Assurance Program (CSAP): 6 controls
Code	Title	Description
south-korea-cloud-security-assurance-program-csap::11.1.1	Network security policy	Security policies and procedures are set for the internal and external networks related to the cloud service.
south-korea-cloud-security-assurance-program-csap::11.1.2	Network monitoring and control	The network is monitored and controlled to prevent service interruption and leakage of important information from DDoS,...
south-korea-cloud-security-assurance-program-csap::11.1.3	Operating network security systems	Security systems such as firewalls, IPS, IDS and VPN are operated to protect internal and external networks related to t...
south-korea-cloud-security-assurance-program-csap::11.1.4	Network encryption	Encrypted communication channels are used where important information moves within the cloud system.
south-korea-cloud-security-assurance-program-csap::11.1.5	Network separation	Network access between the provider's management area and customers' service areas, and between customers' service areas...
south-korea-cloud-security-assurance-program-csap::11.1.6	Wireless access control	Cloud systems are separated from wireless networks and wireless access is controlled; any use of wireless access is revi...

12 Data protection and encryption – South Korea Cloud Security Assurance Program (CSAP)

10 controls

Controls in the 12 Data protection and encryption – South Korea Cloud Security Assurance Program (CSAP) domain of South Korea Cloud Security Assurance Program (CSAP): 10 controls
Code	Title	Description
south-korea-cloud-security-assurance-program-csap::12.1.1	Data classification	Data is classified and managed by type, legal requirements, sensitivity and importance.
south-korea-cloud-security-assurance-program-csap::12.1.2	Data ownership	Ownership of data is established clearly with the customer at the service level agreement stage.
south-korea-cloud-security-assurance-program-csap::12.1.3	Data integrity	Integrity of data on input, output, transmission, exchange and in storage is always verified.
south-korea-cloud-security-assurance-program-csap::12.1.4	Data protection	Protection functions for data processing, such as access control and tamper prevention, are provided to customers.
south-korea-cloud-security-assurance-program-csap::12.1.5	Data traceability	Customers are given a means to trace their data and, on request, specific information such as the names of the countries...
south-korea-cloud-security-assurance-program-csap::12.1.6	Data destruction	When data is destroyed on termination or migration of the service, all data relating to the customer is destroyed with d...
south-korea-cloud-security-assurance-program-csap::12.2.1	Storage media management	Procedures cover disposal and reuse of storage media holding important information (hard disks, storage), and informatio...
south-korea-cloud-security-assurance-program-csap::12.2.2	Removable media management	Procedures cover handling, storage, disposal and reuse of removable media (external drives, USB, CD) to prevent leakage,...
south-korea-cloud-security-assurance-program-csap::12.3.1	Cryptographic policy	A policy on encryption targets, strength, key management and use protects data stored in or transmitted through the clou...
south-korea-cloud-security-assurance-program-csap::12.3.2	Cryptographic key management	Secure procedures govern key generation, use, storage, distribution and destruction, and keys are stored in a separate s...

13 System development and acquisition security – South Korea Cloud Security Assurance Program (CSAP)

12 controls

Controls in the 13 System development and acquisition security – South Korea Cloud Security Assurance Program (CSAP) domain of South Korea Cloud Security Assurance Program (CSAP): 12 controls
Code	Title	Description
south-korea-cloud-security-assurance-program-csap::13.1.1	Defining security requirements	When new systems are developed or existing ones changed, security requirements are defined clearly and applied, taking a...
south-korea-cloud-security-assurance-program-csap::13.1.2	Authentication and encryption functions	Cloud system design always considers user authentication requirements, and legal requirements where integrity or confide...
south-korea-cloud-security-assurance-program-csap::13.1.3	Security logging functions	Cloud system design ensures audit trails for user authentication, privilege changes and use or leakage of important info...
south-korea-cloud-security-assurance-program-csap::13.1.4	Access right functions	Cloud system design allows access rights to be granted according to the purpose and importance of the work.
south-korea-cloud-security-assurance-program-csap::13.1.5	Time synchronisation	Cloud system clocks are synchronised accurately to official standard time so logs are accurate and admissible as legal e...
south-korea-cloud-security-assurance-program-csap::13.2.1	Implementation and testing	Cloud systems are implemented following secure coding practice and tested to confirm that security requirements from ana...
south-korea-cloud-security-assurance-program-csap::13.2.2	Separating development and operations	Development and test systems are in principle separated from operational systems; where this is hard, the reason and jus...
south-korea-cloud-security-assurance-program-csap::13.2.3	Test data security	Procedures govern creation, use, management, destruction and technical protection of test data to prevent leakage of ope...
south-korea-cloud-security-assurance-program-csap::13.2.4	Source program security	Changes to source programs are managed, access is limited to authorised users, and source is in principle not kept in th...
south-korea-cloud-security-assurance-program-csap::13.3.1	Outsourced development security	Where cloud system development is outsourced, the security requirements to be met from analysis and design through imple...
south-korea-cloud-security-assurance-program-csap::13.4.1	System acquisition planning	Processing speed and capacity of the cloud system are monitored periodically and acquisition plans made to keep it stabl...
south-korea-cloud-security-assurance-program-csap::13.4.2	System acceptance	Acceptance criteria are set for newly acquired systems and tests are done before acceptance.

14 Security requirements for national and public bodies – South Korea Cloud Security Assurance Program (CSAP)

11 controls

Controls in the 14 Security requirements for national and public bodies – South Korea Cloud Security Assurance Program (CSAP) domain of South Korea Cloud Security Assurance Program (CSAP): 11 controls
Code	Title	Description
south-korea-cloud-security-assurance-program-csap::14.1.1	Security service level agreement	A security service level agreement reflecting the security requirements of national and public bodies is concluded, and...
south-korea-cloud-security-assurance-program-csap::14.1.2	Safety of acquired IT equipment	Among IT products with security functions acquired to build the cloud service, those acquired to prevent forgery, altera...
south-korea-cloud-security-assurance-program-csap::14.1.3	Security management level	The cloud service's operating sites and networks are managed to a security level equivalent to that of the public bodies...
south-korea-cloud-security-assurance-program-csap::14.1.4	Incident and outage response	Private providers of cloud services form cooperation arrangements with the national bodies concerned, other agencies and...
south-korea-cloud-security-assurance-program-csap::14.2.1	Physical location and area separation	Cloud systems, backup systems and data, and the staff managing and operating them, are located only within Korea; the ph...
south-korea-cloud-security-assurance-program-csap::14.2.2	Redundancy and backup of key equipment	Providers make key equipment such as network switches and storage redundant and set up a backup arrangement to guarantee...
south-korea-cloud-security-assurance-program-csap::14.3.1	Validated encryption	Where a means to encrypt important data created through the cloud service is provided, validated national standard encry...
south-korea-cloud-security-assurance-program-csap::14.3.2	Supporting security monitoring	Private providers support the environment needed for public bodies' security monitoring of the cloud service and for lin...
south-korea-cloud-security-assurance-program-csap::14.3.3	Preventing data outflow	Functions to choose the data storage location and log information are provided so public data created through the cloud...
south-korea-cloud-security-assurance-program-csap::14.3.4	System isolation	Technical measures, including a regular review and check regime, ensure no abnormal communication paths arise outside th...
south-korea-cloud-security-assurance-program-csap::14.3.5	Area separation	Technical protection separates the public-sector cloud service from the general-customer service so public-sector monito...

2 Personnel security – South Korea Cloud Security Assurance Program (CSAP)

11 controls

Controls in the 2 Personnel security – South Korea Cloud Security Assurance Program (CSAP) domain of South Korea Cloud Security Assurance Program (CSAP): 11 controls
Code	Title	Description
south-korea-cloud-security-assurance-program-csap::2.1.1	Employment contracts	Employment contracts carry clauses requiring compliance with the security policy and relevant laws, signed by new or joi...
south-korea-cloud-security-assurance-program-csap::2.1.2	Designating and supervising key personnel	Staff involved in operating and developing the cloud system and in information security are designated as key personnel...
south-korea-cloud-security-assurance-program-csap::2.1.3	Segregation of duties	Criteria for segregation of duties are set and applied to reduce the threat of deliberate insider misuse such as abuse o...
south-korea-cloud-security-assurance-program-csap::2.1.4	Confidentiality agreements	Confidentiality agreements define what is needed for information security and personal information protection and are re...
south-korea-cloud-security-assurance-program-csap::2.1.5	Leaving and changing roles	Responsibilities on termination or change of role are defined and carried out, and the associated access rights are remo...
south-korea-cloud-security-assurance-program-csap::2.2.1	External personnel contracts	Security requirements concerning access to information assets by external personnel, including maintenance staff and con...
south-korea-cloud-security-assurance-program-csap::2.2.2	Managing external personnel compliance	Compliance of external personnel with contractual security requirements is checked periodically, and violations or incid...
south-korea-cloud-security-assurance-program-csap::2.2.3	Security at contract end	At the end of an external personnel contract, return of assets, removal of access, destruction of important information...
south-korea-cloud-security-assurance-program-csap::2.3.1	Security training programme	An annual information security training programme is set covering all employees and external parties.
south-korea-cloud-security-assurance-program-csap::2.3.2	Delivering training	Security training is given to all employees and external parties at least once a year, with additional training when pol...
south-korea-cloud-security-assurance-program-csap::2.3.3	Evaluating and improving training	Records of training delivery are kept and results evaluated to improve the programme.

3 Asset management and risk management – South Korea Cloud Security Assurance Program (CSAP)

10 controls

Controls in the 3 Asset management and risk management – South Korea Cloud Security Assurance Program (CSAP) domain of South Korea Cloud Security Assurance Program (CSAP): 10 controls
Code	Title	Description
south-korea-cloud-security-assurance-program-csap::3.1.1	Asset identification	Classification criteria are set for information assets used in the cloud service (information systems, security systems,...
south-korea-cloud-security-assurance-program-csap::3.1.2	Assigning asset responsibility	An owner and a custodian are designated for every identified asset.
south-korea-cloud-security-assurance-program-csap::3.1.3	Security grading and handling	Assets are given a security grade considering confidentiality, integrity, availability and legal requirements, and handl...
south-korea-cloud-security-assurance-program-csap::3.2.1	Change management	Changes to assets used in the cloud service (facilities, equipment, software) are managed through security impact assess...
south-korea-cloud-security-assurance-program-csap::3.2.2	Change detection and monitoring	Changes to cloud service assets are monitored continuously to detect unauthorised change and the change history is kept...
south-korea-cloud-security-assurance-program-csap::3.2.3	Post-change verification	After a change to cloud service assets, the work is verified for security and compatibility.
south-korea-cloud-security-assurance-program-csap::3.3.1	Risk management planning	A risk management method and plan are set in advance so risks can be identified and assessed across all security areas:...
south-korea-cloud-security-assurance-program-csap::3.3.2	Vulnerability assessment	Technical vulnerabilities (wired and wireless networks, operating systems and infrastructure, applications) are checked...
south-korea-cloud-security-assurance-program-csap::3.3.3	Risk analysis and assessment	Risks across all security areas are identified and assessed at least once a year under the method and plan, and an accep...
south-korea-cloud-security-assurance-program-csap::3.3.4	Risk treatment	Controls are selected and applied according to the assessment results, taking into account legal and contractual require...

4 Service supply chain management – South Korea Cloud Security Assurance Program (CSAP)

4 controls

Controls in the 4 Service supply chain management – South Korea Cloud Security Assurance Program (CSAP) domain of South Korea Cloud Security Assurance Program (CSAP): 4 controls
Code	Title	Description
south-korea-cloud-security-assurance-program-csap::4.1.1	Supply chain management policy	A policy defines supply chain security requirements to identify and minimise risks that could impair access to or contin...
south-korea-cloud-security-assurance-program-csap::4.1.2	Supply chain contracts	Supply chain contracts cover the scope of the cloud service and security requirements; in multi-party arrangements each...
south-korea-cloud-security-assurance-program-csap::4.2.1	Supply chain change management	Where security policies, procedures or controls need changing, risks arising in the service supply chain are reviewed to...
south-korea-cloud-security-assurance-program-csap::4.2.2	Supply chain monitoring and review	Records and reports arising in the cloud service supply chain are monitored and reviewed regularly.

5 Incident management – South Korea Cloud Security Assurance Program (CSAP)

7 controls

Controls in the 5 Incident management – South Korea Cloud Security Assurance Program (CSAP) domain of South Korea Cloud Security Assurance Program (CSAP): 7 controls
Code	Title	Description
south-korea-cloud-security-assurance-program-csap::5.1.1	Incident response procedure	An incident response procedure covers reporting, what must not be disclosed and incident handling, and sets out the resp...
south-korea-cloud-security-assurance-program-csap::5.1.2	Incident response structure	A security monitoring system and team collect, analyse and respond to incident information, and reporting and cooperatio...
south-korea-cloud-security-assurance-program-csap::5.1.3	Incident response training and checks	Staff with incident response roles are trained and incident response capability is checked periodically.
south-korea-cloud-security-assurance-program-csap::5.2.1	Incident reporting	When an incident occurs, legal notification and reporting duties are met under the procedure, and customers are told pro...
south-korea-cloud-security-assurance-program-csap::5.2.2	Incident handling and recovery	Incidents are handled and recovered from promptly under the procedure.
south-korea-cloud-security-assurance-program-csap::5.3.1	Incident analysis and sharing	After an incident is closed, its cause is analysed and the result given to customers, and incident information and vulne...
south-korea-cloud-security-assurance-program-csap::5.3.2	Preventing recurrence	Incident information is used to set measures preventing similar incidents, and the response structure is changed where n...

6 Service continuity management – South Korea Cloud Security Assurance Program (CSAP)

7 controls

Controls in the 6 Service continuity management – South Korea Cloud Security Assurance Program (CSAP) domain of South Korea Cloud Security Assurance Program (CSAP): 7 controls
Code	Title	Description
south-korea-cloud-security-assurance-program-csap::6.1.1	Outage response procedure	An outage response procedure, including backup and recovery, ensures business continuity against the interruptions of cl...
south-korea-cloud-security-assurance-program-csap::6.1.2	Outage reporting	When the cloud service is interrupted or harmed, legal notification and reporting duties are met under the procedure and...
south-korea-cloud-security-assurance-program-csap::6.1.3	Outage handling and recovery	Outages are handled and service restored under the procedure within the time stated in the service level agreement.
south-korea-cloud-security-assurance-program-csap::6.1.4	Preventing repeat outages	Outage information is used to set measures preventing similar interruptions, with the response procedure changed where n...
south-korea-cloud-security-assurance-program-csap::6.2.1	Performance and capacity management	Performance and capacity requirements are defined to guarantee availability, with a monitoring method or procedure for m...
south-korea-cloud-security-assurance-program-csap::6.2.2	Redundancy and backup	Information processing equipment (physical servers, storage, network devices, cables, access lines) is made redundant so...
south-korea-cloud-security-assurance-program-csap::6.2.3	Service availability checks	The impact on service availability is assessed periodically.

7 Compliance – South Korea Cloud Security Assurance Program (CSAP)

4 controls

Controls in the 7 Compliance – South Korea Cloud Security Assurance Program (CSAP) domain of South Korea Cloud Security Assurance Program (CSAP): 4 controls
Code	Title	Description
south-korea-cloud-security-assurance-program-csap::7.1.1	Legal compliance	Legal requirements relating to information security are identified and complied with.
south-korea-cloud-security-assurance-program-csap::7.1.2	Policy compliance	Security requirements in the security policy and the service level agreement are identified and complied with, and evide...
south-korea-cloud-security-assurance-program-csap::7.2.1	Independent security audit	An independent security audit plan is set and carried out to assure compliance with legal requirements and the security...
south-korea-cloud-security-assurance-program-csap::7.2.2	Audit records and monitoring	Security audit trails (logs) are recorded in an identifiable form, monitored and protected against unauthorised access a...

8 Physical security – South Korea Cloud Security Assurance Program (CSAP)

11 controls

Controls in the 8 Physical security – South Korea Cloud Security Assurance Program (CSAP) domain of South Korea Cloud Security Assurance Program (CSAP): 11 controls
Code	Title	Description
south-korea-cloud-security-assurance-program-csap::8.1.1	Designating physical protection zones	Physical security zones (key processing facilities and system areas, offices, visitor rooms and so on) are designated to...
south-korea-cloud-security-assurance-program-csap::8.1.2	Physical entry control	Facilities such as guards and entry control systems allow only authorised people into security zones, and entry and acce...
south-korea-cloud-security-assurance-program-csap::8.1.3	Working in protection zones	A procedure governs work such as maintenance inside zones housing key processing equipment and systems, and work records...
south-korea-cloud-security-assurance-program-csap::8.1.4	Protecting offices and equipment spaces	Physical protection is planned and applied for offices and equipment spaces.
south-korea-cloud-security-assurance-program-csap::8.1.5	Carrying mobile devices in and out	A procedure controls employees and external personnel bringing mobile devices such as laptops into and out of protection...
south-korea-cloud-security-assurance-program-csap::8.2.1	Siting processing facilities	Equipment within processing facilities is located and arranged to minimise damage from physical and environmental hazard...
south-korea-cloud-security-assurance-program-csap::8.2.2	Protective equipment	According to each zone's importance, equipment such as fire detectors and suppression, leak detectors, temperature and h...
south-korea-cloud-security-assurance-program-csap::8.2.3	Cable protection	Communication and power cables are protected against damage and interception.
south-korea-cloud-security-assurance-program-csap::8.2.4	Facility and equipment maintenance	Processing facilities are maintained to keep availability and integrity.
south-korea-cloud-security-assurance-program-csap::8.2.5	Carrying equipment in and out	A procedure governs staff and external parties moving equipment into and out of security zones, with records kept, to pr...
south-korea-cloud-security-assurance-program-csap::8.2.6	Disposal and reuse of equipment	All equipment in processing facilities, including storage media, is identified; equipment holding sensitive data is made...

9 Virtualisation security – South Korea Cloud Security Assurance Program (CSAP)

10 controls

Controls in the 9 Virtualisation security – South Korea Cloud Security Assurance Program (CSAP) domain of South Korea Cloud Security Assurance Program (CSAP): 10 controls
Code	Title	Description
south-korea-cloud-security-assurance-program-csap::9.1.1	Managing virtual resources	A management approach covers creation, change and reclamation of virtual resources (virtual machines, storage, software)...
south-korea-cloud-security-assurance-program-csap::9.1.2	Reclaiming virtual resources	When a customer contract ends, virtual resources are deleted from every cloud system, backups included, under the reclam...
south-korea-cloud-security-assurance-program-csap::9.1.3	Monitoring virtual resources	Integrity of virtual resources is protected, changes to them (modification, movement, deletion, copying) are monitored,...
south-korea-cloud-security-assurance-program-csap::9.1.4	Hypervisor security	Access to hypervisor functions and interfaces is controlled, and hypervisor software updates and security patches are ke...
south-korea-cloud-security-assurance-program-csap::9.1.5	Public server security	Physical and technical protection is set for websites that provide virtual resources and public servers that distribute...
south-korea-cloud-security-assurance-program-csap::9.1.6	Interoperability and portability	The provider improves interoperability and portability between cloud services using standardised virtualisation formats,...
south-korea-cloud-security-assurance-program-csap::9.2.1	Malware control	Security technology for detecting and blocking malware (viruses, worms, trojans) is provided to protect customers' virtu...
south-korea-cloud-security-assurance-program-csap::9.2.2	Interface and API security	Security vulnerabilities in interfaces and APIs used to access virtual environments are analysed periodically and protec...
south-korea-cloud-security-assurance-program-csap::9.2.3	Data migration	Technical measures such as encryption are provided so customers can move data safely from existing systems into the clou...
south-korea-cloud-security-assurance-program-csap::9.2.4	Virtual software security	The provider supplies virtual environments built from software whose origin, distribution path and producer are clear.

Your Compliance Coverage

If you comply with South Korea Cloud Security Assurance Program (CSAP), you already cover:

HKMA SPM

1 controls mapped

Compare →

ASIS SPC.1-2009 - Organizational Resilience Standard

1 controls mapped

Compare →

ISO/IEC 27007:2020

1 controls mapped

Compare →

+ 27 more: BS 65000:2014 - Guidance on Organizational Resilience (1%), ASD Strategies to Mitigate Cyber Security Incidents (1%)

See all 30 mapped frameworks ↓