ISO/IEC 27014:2020

International

v2020

14 domains

39 controls

Information security, cybersecurity and privacy protection - Governance of information security. Provides guidance on concepts, objectives, and processes for the governance of information security. Intended for governing bodies and top management of organizations. Applicable to all types and sizes of organizations.

Unverified

ISO/IEC 27014:2020 is a compliance framework from International with 14 domains and 39 controls that map to 52 other frameworks. The largest domains are Clause 1-4: Introduction and Context (6 controls), Clause 5: Guiding Principles (6 controls), Clause 7: Governance Objectives and Processes (6 controls). Every control below carries what it requires and what an assessor expects to see.

Maintained by Gerard BlokdykControl text last updated 21 May 2026

Framework summaries on this platform are AI-assisted interpretations for educational and compliance planning purposes. They do not reproduce or replace the official standards. Refer to the authoritative source for the definitive text. Framework names and trademarks belong to their respective organisations.

Framework Domains (14)

Assure

1 controls

Controls in the Assure domain of ISO/IEC 27014:2020 — 1 controls
Code	Title	Description
27014-6.5	Assure Process	Governing body commissions independent assurance activities to verify that information security governance is operating...

Clause 1-4: Introduction and Context

6 controls

Controls in the Clause 1-4: Introduction and Context domain of ISO/IEC 27014:2020 — 2 controls
Code	Title	Description
27014-4	Concepts	Fundamental concepts of information security governance and its relationship to organizational governance
29134-4	General overview	General overview of PIA process, its purpose, and relationship to other privacy management activities

Clause 5: Guiding Principles

6 controls

Controls in the Clause 5: Guiding Principles domain of ISO/IEC 27014:2020 — 6 controls
Code	Title	Description
27014-5.1	Governance Objectives	Define and document objectives for the governance of information security aligned with organisational strategy and stake...
27014-5.2	Governance Principles	Apply the six principles of information security governance covering organisation-wide approach, risk-based decisions, i...
27014-5.3	Effectiveness	Ensuring information security governance produces effective outcomes
27014-5.4	Efficiency	Delivering information security governance in a resource-efficient manner
27014-5.5	Alignment	Aligning information security governance with business strategy and objectives
27014-5.6	Continuous improvement	Continually improving information security governance based on changing business needs

Clause 6: Governance Relationships

3 controls

Controls in the Clause 6: Governance Relationships domain of ISO/IEC 27014:2020 — 3 controls
Code	Title	Description
27014-6.1	Evaluate Process	Governing body evaluates the current and forecast performance of information security against objectives, risk appetite...
27014-6.2	Direct Process	Governing body provides direction by approving the information security strategy, policy, resourcing and risk treatment...
27014-6.3	Monitor Process	Governing body monitors achievement of strategic security objectives, conformance with policy and effectiveness of risk...

Clause 7.3: Governance Processes

5 controls

Controls in the Clause 7.3: Governance Processes domain of ISO/IEC 27014:2020 — 5 controls
Code	Title	Description
27014-7.3.1	Evaluate	Governance process that considers current and forecast achievement of objectives based on current processes and planned...
27014-7.3.2	Direct	Governance process by which the governing body provides direction on objectives, strategy, resource allocation, and poli...
27014-7.3.3	Monitor	Governance process that enables the governing body to assess the achievement of its strategic objectives
27014-7.3.4	Communicate	Governance process ensuring clear messaging on security priorities throughout the organization
27014-7.3.5	Assure	Governance process confirming that security efforts deliver value and remain aligned with business needs

Clause 7: Governance Objectives and Processes

6 controls

Controls in the Clause 7: Governance Objectives and Processes domain of ISO/IEC 27014:2020 — 6 controls
Code	Title	Description
27014-7.2.1	Objective 1: Establish comprehensive information security	Establish integrated comprehensive entity-wide information security
27014-7.2.2	Objective 2: Risk-based decision making	Make decisions using a risk-based approach to information security
27014-7.2.3	Objective 3: Set direction of acquisition	Set the direction for investment in information security
27014-7.2.4	Objective 4: Ensure conformance	Ensure conformance with internal and external requirements
27014-7.2.5	Objective 5: Foster security-positive culture	Foster a security-positive environment across the organization
27014-7.2.6	Objective 6: Performance relative to business outcomes	Ensure information security performance is related to business outcomes

Communicate

3 controls

Controls in the Communicate domain of ISO/IEC 27014:2020 — 3 controls
Code	Title	Description
27014-6.4	Communicate Process	Bi-directional communication between governing body, executive management, internal and external stakeholders on securit...
27014-9.1	Stakeholder Engagement	Identify, classify and engage internal and external stakeholders with interest in or influence on information security g...
27014-9.2	Reporting to External Parties	Provide accurate and timely information security disclosures to regulators, customers, investors and the public as requi...

Conformance

1 controls

Controls in the Conformance domain of ISO/IEC 27014:2020 — 1 controls
Code	Title	Description
27014-8.5	Conformance and Compliance	Ensure information security governance demonstrates conformance with internal policy and compliance with external legal...

Improvement

1 controls

Controls in the Improvement domain of ISO/IEC 27014:2020 — 1 controls
Code	Title	Description
27014-10.1	Continual Improvement of Governance	Continually improve information security governance through review of effectiveness, lessons learned and adaptation to c...

Integration

1 controls

Controls in the Integration domain of ISO/IEC 27014:2020 — 1 controls
Code	Title	Description
27014-8.1	Alignment with Enterprise Governance	Information security governance integrates with broader enterprise governance frameworks and risk management.

Monitor

1 controls

Controls in the Monitor domain of ISO/IEC 27014:2020 — 1 controls
Code	Title	Description
27014-8.4	Performance Measurement	Define and use measurements that demonstrate whether information security governance objectives are being achieved.

Resources

1 controls

Controls in the Resources domain of ISO/IEC 27014:2020 — 1 controls
Code	Title	Description
27014-8.3	Resource Optimisation	Allocate resources to information security in proportion to risk and strategic priority, with periodic review of return...

Risk

1 controls

Controls in the Risk domain of ISO/IEC 27014:2020 — 1 controls
Code	Title	Description
27014-8.2	Risk Appetite and Tolerance	Governing body defines and communicates information security risk appetite and tolerance levels that guide all downstrea...

Roles

3 controls

Controls in the Roles domain of ISO/IEC 27014:2020 — 3 controls
Code	Title	Description
27014-7.1	Roles and Responsibilities of Governing Body	Define explicit responsibilities of the governing body for setting direction, accountability and oversight of informatio...
27014-7.2	Roles of Executive Management	Executive management implements direction from the governing body, operates the information security management system a...
27014-7.3	Relationship Between Governing Body and Management	Establish a clear separation and working relationship between governance (direction setting) and management (execution)...

Your Compliance Coverage

If you comply with ISO/IEC 27014:2020, you already cover:

ISO 37001:2016

1 controls mapped

Compare →

ISO/IEC 38500:2024

1 controls mapped

Compare →

SQF Code Edition 9 - Safe Quality Food

1 controls mapped

Compare →

+ 49 more: Voluntary Principles on Security and Human Rights (VPs) (3%), UK FCA/PRA Operational Resilience Framework (3%)

See all 52 mapped frameworks ↓