Back to Frameworks

ISO 37301:2021

International
v2021
7 domains
42 controls
Verified

ISO 37301:2021 is a compliance framework from International with 7 domains and 42 controls that map to 69 other frameworks. The largest domains are Performance evaluation – ISO 37301:2021 (10 controls), Support – ISO 37301:2021 (9 controls), Leadership – ISO 37301:2021 (8 controls). Every control below carries what it requires and what an assessor expects to see.

Maintained by Gerard Blokdyk

Framework summaries on this platform are interpretations grounded in the published source, for educational and compliance planning purposes. They do not reproduce or replace the official standards. Refer to the authoritative source for the definitive text. Framework names and trademarks belong to their respective organisations.

Framework Domains (7)

Context of the organization – ISO 37301:2021

6 controls
Controls in the Context of the organization – ISO 37301:2021 domain of ISO 37301:2021: 6 controls
CodeTitle
iso-37301-2021::4.1Understanding the organization and its context
iso-37301-2021::4.2Understanding the needs and expectations of interested parties
iso-37301-2021::4.3Determining the scope of the compliance management system
iso-37301-2021::4.4Compliance management system
iso-37301-2021::4.5Compliance obligations
iso-37301-2021::4.6Compliance risk assessment

Improvement – ISO 37301:2021

2 controls
Controls in the Improvement – ISO 37301:2021 domain of ISO 37301:2021: 2 controls
CodeTitle
iso-37301-2021::10.1Continual improvement
iso-37301-2021::10.2Nonconformity and corrective action

Leadership – ISO 37301:2021

8 controls
Controls in the Leadership – ISO 37301:2021 domain of ISO 37301:2021: 8 controls
CodeTitle
iso-37301-2021::5.1.1Governing body and top management
iso-37301-2021::5.1.2Compliance culture
iso-37301-2021::5.1.3Compliance governance
iso-37301-2021::5.2Compliance policy
iso-37301-2021::5.3.1Roles, responsibilities and authorities: governing body and top management
iso-37301-2021::5.3.2Compliance function
iso-37301-2021::5.3.3Management
iso-37301-2021::5.3.4Personnel

Operation – ISO 37301:2021

4 controls
Controls in the Operation – ISO 37301:2021 domain of ISO 37301:2021: 4 controls
CodeTitle
iso-37301-2021::8.1Operational planning and control
iso-37301-2021::8.2Establishing controls and procedures
iso-37301-2021::8.3Raising concerns
iso-37301-2021::8.4Investigation processes

Performance evaluation – ISO 37301:2021

10 controls
Controls in the Performance evaluation – ISO 37301:2021 domain of ISO 37301:2021: 10 controls
CodeTitle
iso-37301-2021::9.1.1Monitoring, measurement, analysis and evaluation: general
iso-37301-2021::9.1.2Sources of feedback on compliance performance
iso-37301-2021::9.1.3Development of indicators
iso-37301-2021::9.1.4Compliance reporting
iso-37301-2021::9.1.5Record-keeping
iso-37301-2021::9.2.1Internal audit: general
iso-37301-2021::9.2.2Internal audit programme
iso-37301-2021::9.3.1Management review: general
iso-37301-2021::9.3.2Management review inputs
iso-37301-2021::9.3.3Management review results

Planning – ISO 37301:2021

3 controls
Controls in the Planning – ISO 37301:2021 domain of ISO 37301:2021: 3 controls
CodeTitle
iso-37301-2021::6.1Actions to address risks and opportunities
iso-37301-2021::6.2Compliance objectives and planning to achieve them
iso-37301-2021::6.3Planning of changes

Support – ISO 37301:2021

9 controls
Controls in the Support – ISO 37301:2021 domain of ISO 37301:2021: 9 controls
CodeTitle
iso-37301-2021::7.1Resources
iso-37301-2021::7.2.1Competence: general
iso-37301-2021::7.2.2Employment process
iso-37301-2021::7.2.3Training
iso-37301-2021::7.3Awareness
iso-37301-2021::7.4Communication
iso-37301-2021::7.5.1Documented information: general
iso-37301-2021::7.5.2Creating and updating documented information
iso-37301-2021::7.5.3Control of documented information

Your Compliance Coverage

If you comply with ISO 37301:2021, you already cover:

Maps to 69 other frameworks

42 total controls
ISO 37001:2016
27 source controls mapped|28 target controls covered
64%
ISO 9001:2015
24 source controls mapped|25 target controls covered
57%
ISO 22000:2018
22 source controls mapped|22 target controls covered
52%
ISO 22301:2019
22 source controls mapped|21 target controls covered
52%
ISO 50001:2018 - Energy Management Systems
21 source controls mapped|27 target controls covered
50%
ISO 14001:2015
21 source controls mapped|21 target controls covered
50%
ISO 45001:2018
19 source controls mapped|19 target controls covered
45%
ISO 19011:2018
16 source controls mapped|27 target controls covered
38%
ISO 55001:2014
15 source controls mapped|15 target controls covered
36%
ISO 27701:2019
15 source controls mapped|15 target controls covered
36%
ISO/IEC TR 24028:2020
13 source controls mapped|2 target controls covered
31%
ISO 14004:2016
12 source controls mapped|7 target controls covered
29%
ISO 41001:2018 - Facility Management Systems
11 source controls mapped|18 target controls covered
26%
ISO 39001:2012 - Road Traffic Safety Management
10 source controls mapped|16 target controls covered
24%
AS9100D - Aerospace Quality Management System
9 source controls mapped|8 target controls covered
21%
ISO 56002
9 source controls mapped|15 target controls covered
21%
ISO 22313:2020 - Guidance on Business Continuity Management Systems
9 source controls mapped|10 target controls covered
21%
ISO/IEC 27003:2017
9 source controls mapped|14 target controls covered
21%
ISO 37002:2021 - Whistleblowing Management Systems
8 source controls mapped|12 target controls covered
19%
ISO/IEC 25012:2008 - Data Quality Model
8 source controls mapped|2 target controls covered
19%
ISO/IEC 27010:2015
8 source controls mapped|1 target controls covered
19%
ISO 27001:2022
7 source controls mapped|7 target controls covered
17%
ISO 30401
7 source controls mapped|8 target controls covered
17%
ASIS SPC.1-2009 - Organizational Resilience Standard
6 source controls mapped|7 target controls covered
14%
ISO 13485:2016
6 source controls mapped|2 target controls covered
14%
ISO 28001:2007 Supply Chain Security Management
5 source controls mapped|4 target controls covered
12%
ISO/IEC 27031:2011
5 source controls mapped|4 target controls covered
12%
ISO 27005:2022
4 source controls mapped|3 target controls covered
10%
ISO/IEC 38500:2024
4 source controls mapped|16 target controls covered
10%
ISO 31000:2018
3 source controls mapped|3 target controls covered
7%
ISO/IEC 23894:2023
3 source controls mapped|6 target controls covered
7%
ISO/IEC 27557:2022 - Organisational Privacy Risk Management
2 source controls mapped|2 target controls covered
5%
ISO 22320:2018
2 source controls mapped|3 target controls covered
5%
EU Digital Markets Act
2 source controls mapped|1 target controls covered
5%
ISO 20400:2017 - Sustainable Procurement
1 source controls mapped|1 target controls covered
2%
ISO/IEC 17025:2017 - General Requirements for Testing and Calibration
1 source controls mapped|2 target controls covered
2%
CSA STAR (Security, Trust, Assurance, and Risk)
1 source controls mapped|1 target controls covered
2%
ITIL 4
1 source controls mapped|1 target controls covered
2%
BS 65000:2014 - Guidance on Organizational Resilience
1 source controls mapped|1 target controls covered
2%
Digital Services Act (DSA) - Regulation (EU) 2022/2065
1 source controls mapped|1 target controls covered
2%
ISO/IEC 27050-3:2020
1 source controls mapped|1 target controls covered
2%
NIST SP 800-128
1 source controls mapped|1 target controls covered
2%
APRA CPS 220 Risk Management
1 source controls mapped|1 target controls covered
2%
AML/CTF Act 2006 (Australia)
1 source controls mapped|1 target controls covered
2%
Canada's Anti-Spam Legislation (CASL)
1 source controls mapped|1 target controls covered
2%
EU AI Act
1 source controls mapped|1 target controls covered
2%
EASA Part-IS - Information Security in Aviation
1 source controls mapped|1 target controls covered
2%
Union Customs Code (UCC) - Regulation (EU) No 952/2013
1 source controls mapped|1 target controls covered
2%
EU Directive (EU) 2018/1673 on combating money laundering by criminal law
1 source controls mapped|1 target controls covered
2%
ISO/IEC 42001:2023
1 source controls mapped|1 target controls covered
2%
ISAE 3402 - Assurance Reports on Controls at a Service Organisation
1 source controls mapped|1 target controls covered
2%
ISO/IEC 29147:2018
1 source controls mapped|2 target controls covered
2%
ISO/TS 22318:2021
1 source controls mapped|2 target controls covered
2%
FFIEC IT Examination Handbook
1 source controls mapped|1 target controls covered
2%
NIST SP 800-183
1 source controls mapped|2 target controls covered
2%
PCI P2PE
1 source controls mapped|1 target controls covered
2%
ISO/TS 22317:2021
1 source controls mapped|1 target controls covered
2%
NSA Guidance for Transition to Quantum-Resistant Cryptography
1 source controls mapped|1 target controls covered
2%
PCI SSF
1 source controls mapped|1 target controls covered
2%
UK Bribery Act 2010
1 source controls mapped|1 target controls covered
2%
ISO 22316
1 source controls mapped|1 target controls covered
2%
NIST SP 1800-32
1 source controls mapped|1 target controls covered
2%
ISO/IEC 30111:2019
1 source controls mapped|1 target controls covered
2%
ISO 26000:2010
1 source controls mapped|1 target controls covered
2%
Brazil AI Framework
1 source controls mapped|1 target controls covered
2%
PCI PIN Security
1 source controls mapped|1 target controls covered
2%
ISO/IEC 27004:2016
1 source controls mapped|1 target controls covered
2%
OWASP ASVS
1 source controls mapped|1 target controls covered
2%

Coverage is not the same as your position

This page shows what ISO 37301:2021 overlaps with in general. Where your organisation actually stands, against the standard you are going for and the certifications you already hold, is a different question. Same graph and the same recorded refutations, scoped to you rather than to a pair.

The Compliance Position Diagnostic, $5,000 fixed, ten business days

What is ISO 37301:2021 and who does it apply to?

ISO 37301:2021 is a compliance framework from International with 7 domains and 42 controls. It is used by organisations to establish and maintain compliance with industry standards and regulatory requirements.

What does ISO 37301:2021 actually require?

ISO 37301:2021 has 42 controls organised across 7 domains. The largest domains are Performance evaluation – ISO 37301:2021 (10 controls), Support – ISO 37301:2021 (9 controls), Leadership – ISO 37301:2021 (8 controls). Each control defines specific requirements that organisations must implement to achieve compliance.

If I already comply with another framework, how much of ISO 37301:2021 do I already cover?

ISO 37301:2021 maps to 69 other compliance frameworks. The top mapping partners are ISO 37001:2016 (64% coverage), ISO 9001:2015 (57% coverage), ISO 22000:2018 (52% coverage). Use our comparison tool to explore control-level mappings between frameworks.

How do I implement ISO 37301:2021?

Start your ISO 37301:2021 compliance journey by running a self-assessment on our platform to identify your current compliance posture. Our AI advisory can answer specific questions about ISO 37301:2021 requirements, and cross-framework mapping helps you leverage existing controls from other frameworks you may already comply with. Create a free account to access all 42 controls and track your progress.

Start Your Compliance Journey

Create a free account to run self-assessments, get AI advisory, and track your compliance progress across 1,120 frameworks.

Get Started Free →

Free forever, no credit card required