Comparison
ISO 27001 vs DORA
ISO/IEC 27001:2022 · DORA (Regulation (EU) 2022/2554) · data 2026-10-27
Requirement-level comparison of ISO/IEC 27001:2022 and DORA (Regulation (EU) 2022/2554), in both directions, derived from published crosswalks and ControlMapping's curated topics.
Of 22 DORA (Regulation (EU) 2022/2554) requirements, 21 map to something in ISO 27001, 0 are only loosely related, and 1 have no mapping in our data.
DORA here means the articles that bind financial entities, mapped editorially at paragraph level. The technical standards that add detail, such as Delegated Regulation (EU) 2024/1774, are not mapped, so technical topics they cover show no link.
Likely new work: DORA requirements with no mapping to ISO 27001 (1)
| DORA | Requirement | Match | ISO 27001 | Evidence |
|---|---|---|---|---|
| Chapter II: ICT risk management · 1 | ||||
| Art.7 | ICT systems, protocols and tools | No mapping in our data | — | No mapping to ISO 27001 in our data. |
Mapped (21)
| DORA | Requirement | Match | ISO 27001 | Evidence |
|---|---|---|---|---|
| Chapter II: ICT risk management · 10 | ||||
| Art.5 | Governance and organisation | Editorial | Clause 6.1.1Clause 6.1.3A.5.37+7 | Same topic: Risk Management, Governance Policy (editorial pick) |
| Art.6 | ICT risk management framework | Editorial | Clause 6.1.1Clause 6.1.3A.7.1+14 | Same topic: Risk Management, Physical Security (editorial pick) |
| Art.8 | Identification | Editorial | A.5.9A.5.11A.5.12+8 | Same topic: Asset Management, Data Classification (editorial pick) |
| Art.9 | Protection and prevention | Editorial | A.8.16A.5.14A.8.10+15 | Same topic: Cont. Monitoring, Data Protection (editorial pick) |
| Art.10 | Detection | Editorial | A.8.16A.6.1A.6.4+1 | Same topic: Intrusion Detection, Anomaly Detection, Insider Threat (editorial pick) |
| Art.11 | Response and recovery | Editorial | A.5.29A.5.30A.8.14+5 | Same topic: Business Continuity (editorial pick) |
| Art.12 | Backup policies and procedures, restoration and recovery procedures and methods | Editorial | A.8.13A.5.30A.8.14 | Same topic: Backup & Recovery, Disaster Recovery (editorial pick) |
| Art.13 | Learning and evolving | Editorial | A.5.7A.5.27A.5.28+3 | Same topic: Threat Intelligence, Lessons Learned, Forensics (editorial pick) |
| Art.14 | Communication | Editorial | A.5.6Clause 7.4 | Same topic: Communication (editorial pick) |
| Art.16 | Simplified ICT risk management framework | Editorial | Clause 6.1.1Clause 6.1.3 | Same topic: Risk Management (editorial pick) |
| Chapter III: ICT-related incidents · 3 | ||||
| Art.17 | ICT-related incident management process | Editorial | A.5.24A.5.25A.5.26+2 | Same topic: Incident Response (editorial pick) |
| Art.18 | Classification of ICT-related incidents and cyber threats | Editorial | A.5.5A.5.24A.5.25+2 | Same topic: Reporting, Incident Response (editorial pick) |
| Art.19 | Reporting of major ICT-related incidents and voluntary notification of significant cyber threats | Editorial | A.5.5A.6.8 | Same topic: Reporting (editorial pick) |
| Chapter IV: Resilience testing · 4 | ||||
| Art.24 | General requirements for the performance of digital operational resilience testing | Editorial | Clause 6.1.1Clause 6.1.3 | Same topic: Risk Management (editorial pick) |
| Art.25 | Testing of ICT tools and systems | Editorial | A.8.8 | Same topic: Vulnerability Mgmt (editorial pick) |
| Art.26 | Advanced testing of ICT tools, systems and processes based on TLPT | Editorial | A.8.8 | Same topic: Vulnerability Mgmt (editorial pick) |
| Art.27 | Requirements for testers for the carrying out of TLPT | Editorial | A.8.8 | Same topic: Vulnerability Mgmt (editorial pick) |
| Chapter V: ICT third-party risk · 3 | ||||
| Art.28 | General principles | Editorial | A.5.19A.5.21A.5.23 | Same topic: Supply Chain Risk, Cloud Security (editorial pick) |
| Art.29 | Preliminary assessment of ICT concentration risk at entity level | Editorial | A.5.19A.5.21 | Same topic: Supply Chain Risk (editorial pick) |
| Art.30 | Key contractual provisions | Editorial | A.5.19A.5.20A.5.22+2 | Same topic: Vendor Risk Mgmt (editorial pick) |
| Chapter VI: Information sharing · 1 | ||||
| Art.45 | Information-sharing arrangements on cyber threat information and intelligence | Editorial | A.5.7 | Same topic: Threat Intelligence (editorial pick) |
Of 123 ISO/IEC 27001:2022 requirements, 70 map to something in DORA, 36 are only loosely related, and 17 have no mapping in our data.
Likely new work: ISO 27001 requirements with no mapping to DORA (17)
| ISO 27001 | Requirement | Match | DORA | Evidence |
|---|---|---|---|---|
| A.5 Organizational controls · 1 | ||||
| A.5.35 | Independent review of information security | No mapping in our data | — | No mapping to DORA in our data. |
| A.8 Technological controls · 4 | ||||
| A.8.25 | Secure development life cycle | No mapping in our data | — | No mapping to DORA in our data. |
| A.8.28 | Secure coding | No mapping in our data | — | No mapping to DORA in our data. |
| A.8.29 | Security testing in development and acceptance | No mapping in our data | — | No mapping to DORA in our data. |
| A.8.31 | Separation of development, test and production environments | No mapping in our data | — | No mapping to DORA in our data. |
| ISMS clauses 4–10 · 12 | ||||
| Clause 4.3 | Determining the scope of the ISMS | No mapping in our data | — | No mapping to DORA in our data. |
| Clause 4.4 | Information security management system | No mapping in our data | — | No mapping to DORA in our data. |
| Clause 5.1 | Leadership and commitment | No mapping in our data | — | No mapping to DORA in our data. |
| Clause 5.3 | Organizational roles, responsibilities and authorities | No mapping in our data | — | No mapping to DORA in our data. |
| Clause 6.2 | Information security objectives and planning to achieve them | No mapping in our data | — | No mapping to DORA in our data. |
| Clause 6.3 | Planning of changes | No mapping in our data | — | No mapping to DORA in our data. |
| Clause 7.5.1 | General | No mapping in our data | — | No mapping to DORA in our data. |
| Clause 7.5.2 | Creating and updating | No mapping in our data | — | No mapping to DORA in our data. |
| Clause 7.5.3 | Control of documented information | No mapping in our data | — | No mapping to DORA in our data. |
| Clause 9.2.1 | General | No mapping in our data | — | No mapping to DORA in our data. |
| Clause 9.2.2 | Internal audit programme | No mapping in our data | — | No mapping to DORA in our data. |
| Clause 10.2 | Nonconformity and corrective action | No mapping in our data | — | No mapping to DORA in our data. |
Check these: only loosely related (a shared CSF outcome, not a mapping) (36)
| ISO 27001 | Requirement | Match | DORA | Evidence |
|---|---|---|---|---|
| A.5 Organizational controls · 7 | ||||
| A.5.3 | Segregation of duties | Art.9(2)Art.9(3)(c)Art.9(3)(d)+5 | Only shares CSF PR.DS-01, PR.DS-02, PR.DS-10: related, not a mapping | |
| A.5.8 | Information security in project management | Art.8(1)Art.8(4)Art.8(6)+1 | Only shares CSF GV.OC-05, ID.AM-08: related, not a mapping | |
| A.5.10 | Acceptable use of information and other associated assets | Art.9(2)Art.9(3)(c)Art.9(3)(d)+2 | Only shares CSF PR.DS-01, PR.DS-02, PR.DS-10: related, not a mapping | |
| A.5.17 | Authentication information | Art.9(4)(c)Art.9(4)(d) | Only shares CSF PR.AA-05, PR.AA-03: related, not a mapping | |
| A.5.32 | Intellectual property rights | Art.5(2)(b)Art.6(5)Art.9(4)(a) | Only shares CSF GV.PO-02: related, not a mapping | |
| A.5.33 | Protection of records | Art.9(2)Art.9(3)(a)Art.9(3)(c)+2 | Only shares CSF PR.DS-01: related, not a mapping | |
| A.5.34 | Privacy and protection of PII | Art.5(2)(b)Art.6(5)Art.9(4)(a) | Only shares CSF GV.PO-02: related, not a mapping | |
| A.6 People controls · 4 | ||||
| A.6.2 | Terms and conditions of employment | Art.9(2)Art.9(3)(c)Art.9(3)(d)+5 | Only shares CSF PR.DS-01, PR.DS-02, PR.DS-10: related, not a mapping | |
| A.6.5 | Responsibilities after termination or change of employment | Art.9(2)Art.9(3)(c)Art.9(3)(d)+5 | Only shares CSF PR.DS-01, PR.DS-02, PR.DS-10: related, not a mapping | |
| A.6.6 | Confidentiality or non-disclosure agreements | Art.5(2)(c)Art.5(3)Art.6(4)+1 | Only shares CSF GV.RR-03: related, not a mapping | |
| A.6.7 | Remote working | Art.5(2)(b)Art.6(5)Art.9(4)(a)+4 | Only shares CSF GV.PO-01: related, not a mapping | |
| A.7 Physical controls · 4 | ||||
| A.7.7 | Clear desk and clear screen | Art.6(2)Art.9(2)Art.9(3)(a)+4 | Only shares CSF PR.IR-02, PR.DS-01: related, not a mapping | |
| A.7.9 | Security of assets off-premises | Art.9(2)Art.9(3)(a)Art.9(3)(c)+2 | Only shares CSF PR.DS-01: related, not a mapping | |
| A.7.10 | Storage media | Art.8(1)Art.8(4)Art.8(6)+5 | Only shares CSF ID.AM-08: related, not a mapping | |
| A.7.13 | Equipment maintenance | Art.6(2)Art.8(1)Art.8(4)+2 | Only shares CSF PR.IR-02, ID.AM-08: related, not a mapping | |
| A.8 Technological controls · 13 | ||||
| A.8.1 | User endpoint devices | Art.9(1)Art.10(1)Art.10(3) | Only shares CSF DE.CM-09: related, not a mapping | |
| A.8.4 | Access to source code | Art.9(2)Art.9(3)(c)Art.9(3)(d)+3 | Only shares CSF PR.DS-01, PR.DS-02, PR.DS-10: related, not a mapping | |
| A.8.6 | Capacity management | Art.9(1)Art.10(1)Art.10(3) | Only shares CSF DE.CM-09: related, not a mapping | |
| A.8.7 | Protection against malware | Art.9(1)Art.9(2)Art.9(3)(a)+5 | Only shares CSF DE.CM-09, PR.DS-01: related, not a mapping | |
| A.8.9 | Configuration management | Art.28(8)Art.30(2) | Only shares CSF PR.PS-01: related, not a mapping | |
| A.8.12 | Data leakage prevention | Art.9(2)Art.9(3)(a)Art.9(3)(c)+2 | Only shares CSF PR.DS-01: related, not a mapping | |
| A.8.19 | Installation of software on operational systems | Art.9(2)Art.9(3)(a)Art.9(3)(c)+2 | Only shares CSF PR.DS-01: related, not a mapping | |
| A.8.23 | Web filtering | Art.9(4)(b)Art.28(8)Art.30(2) | Only shares CSF PR.IR-01: related, not a mapping | |
| A.8.26 | Application security requirements | Art.9(2)Art.9(3)(c)Art.9(3)(d)+2 | Only shares CSF PR.DS-01, PR.DS-02, PR.DS-10: related, not a mapping | |
| A.8.27 | Secure system architecture and engineering principles | Art.11(1)Art.11(4)Art.11(6)+1 | Only shares CSF PR.IR-03: related, not a mapping | |
| A.8.30 | Outsourced development | Art.5(2)(f)Art.6(6)Art.6(7) | Only shares CSF GV.OV-03: related, not a mapping | |
| A.8.33 | Test information | Art.9(2)Art.9(3)(a)Art.9(3)(c)+2 | Only shares CSF PR.DS-01: related, not a mapping | |
| A.8.34 | Protection of information systems during audit testing | Art.5(2)(f)Art.6(6)Art.6(7) | Only shares CSF GV.OV-03: related, not a mapping | |
| ISMS clauses 4–10 · 8 | ||||
| Clause 7.1 | Resources | Art.5(2)(c)Art.5(3)Art.6(4) | Only shares CSF GV.RR-03: related, not a mapping | |
| Clause 7.2 | Competence | Art.5(2)(c)Art.5(3)Art.6(4) | Only shares CSF GV.RR-01, GV.RR-02, GV.RR-03: related, not a mapping | |
| Clause 8.1 | Operational planning and control | Art.28(2)Art.29(1)Art.29(2)+5 | Only shares CSF GV.SC-01, GV.SC-03: related, not a mapping | |
| Clause 8.2 | Information security risk assessment | Art.8(1)Art.11(5) | Only shares CSF GV.OC-01: related, not a mapping | |
| Clause 8.3 | Information security risk treatment | Art.8(1)Art.11(5) | Only shares CSF GV.OC-01: related, not a mapping | |
| Clause 9.3.1 | General | Art.28(8)Art.30(2) | Only shares CSF PR.PS-01: related, not a mapping | |
| Clause 9.3.2 | Management review inputs | Art.28(8)Art.30(2) | Only shares CSF PR.PS-01: related, not a mapping | |
| Clause 9.3.3 | Management review results | Art.28(8)Art.30(2) | Only shares CSF PR.PS-01: related, not a mapping | |
Mapped (70)
| ISO 27001 | Requirement | Match | DORA | Evidence |
|---|---|---|---|---|
| A.5 Organizational controls · 29 | ||||
| A.5.1 | Policies for information security | Editorial | Art.5(2)(b)Art.6(5)Art.9(4)(a) | Same topic: Governance Policy (editorial pick) |
| A.5.2 | Information security roles and responsibilities | Editorial | Art.5(2)(c)Art.5(3)Art.6(4) | Same topic: Roles & Responsibilities (editorial pick) |
| A.5.4 | Management responsibilities | Editorial | Art.5(2)(c)Art.5(3)Art.6(4) | Same topic: Roles & Responsibilities (editorial pick) |
| A.5.5 | Contact with authorities | Editorial | Art.18(1)Art.19(1)Art.19(3)+1 | Same topic: Reporting (editorial pick) |
| A.5.6 | Contact with special interest groups | Editorial | Art.14(1)Art.14(2)Art.17(3)(d) | Same topic: Communication (editorial pick) |
| A.5.7 | Threat intelligence | Editorial | Art.8(2)Art.13(1)Art.45(1) | Same topic: Threat Intelligence (editorial pick) |
| A.5.9 | Inventory of information and other associated assets | Editorial | Art.8(1)Art.8(4)Art.8(6) | Same topic: Asset Management (editorial pick) |
| A.5.11 | Return of assets | Editorial | Art.8(1)Art.8(4)Art.8(6)+1 | Same topic: Asset Management (editorial pick) |
| A.5.12 | Classification of information | Editorial | Art.8(1) | Same topic: Data Classification (editorial pick) |
| A.5.13 | Labelling of information | Editorial | Art.8(1) | Same topic: Data Classification (editorial pick) |
| A.5.14 | Information transfer | Editorial | Art.9(2)Art.9(3)(c)Art.9(3)(d) | Same topic: Data Protection (editorial pick) |
| A.5.15 | Access control | Editorial | Art.9(4)(c) | Same topic: Access Control (editorial pick) |
| A.5.16 | Identity management | Editorial | Art.9(4)(c) | Same topic: Access Control (editorial pick) |
| A.5.18 | Access rights | Editorial | Art.9(4)(c) | Same topic: Access Control (editorial pick) |
| A.5.19 | Information security in supplier relationships | Editorial | Art.28(2)Art.28(3)Art.28(4)+6 | Same topic: Supply Chain Risk, Vendor Risk Mgmt (editorial pick) |
| A.5.20 | Addressing information security within supplier agreements | Editorial | Art.28(3)Art.28(4)Art.28(5)+3 | Same topic: Vendor Risk Mgmt (editorial pick) |
| A.5.21 | Managing information security in the ICT supply chain | Editorial | Art.28(2)Art.29(1)Art.29(2) | Same topic: Supply Chain Risk (editorial pick) |
| A.5.22 | Monitoring, review and change management of supplier services | Editorial | Art.28(3)Art.28(4)Art.28(5)+3 | Same topic: Vendor Risk Mgmt (editorial pick) |
| A.5.23 | Information security for use of cloud services | Editorial | Art.28(8)Art.30(2) | Same topic: Cloud Security (editorial pick) |
| A.5.24 | Information security incident management planning and preparation | Editorial | Art.11(2)(b)Art.17(1)Art.17(3)+1 | Same topic: Incident Response (editorial pick) |
| A.5.25 | Assessment and decision on information security events | Editorial | Art.10(2)Art.10(3)Art.11(2)(b)+3 | Same topic: SIEM / SOC, Incident Response (editorial pick) |
| A.5.26 | Response to information security incidents | Editorial | Art.11(2)(b)Art.11(2)(c)Art.11(2)(e)+5 | Same topic: Incident Response, Mitigation, Comms & Restore (editorial pick) |
| A.5.27 | Learning from information security incidents | Editorial | Art.13(2)Art.13(3) | Same topic: Lessons Learned (editorial pick) |
| A.5.28 | Collection of evidence | Editorial | Art.13(2)Art.17(2) | Same topic: Forensics (editorial pick) |
| A.5.29 | Information security during disruption | Editorial | Art.11(1)Art.11(3)Art.11(4)+2 | Same topic: Business Continuity, Recovery Planning (editorial pick) |
| A.5.30 | ICT readiness for business continuity | Editorial | Art.11(1)Art.11(3)Art.11(4)+3 | Same topic: Business Continuity, Recovery Planning (editorial pick) |
| A.5.31 | Legal, statutory, regulatory and contractual requirements | Editorial | Art.5(2)(f)Art.6(6)Art.6(7) | Same topic: Compliance (editorial pick) |
| A.5.36 | Compliance with policies, rules and standards for information security | Editorial | Art.5(2)(f)Art.6(6)Art.6(7) | Same topic: Compliance (editorial pick) |
| A.5.37 | Documented operating procedures | Editorial | Art.5(2)(b)Art.6(5)Art.9(4)(a) | Same topic: Governance Policy (editorial pick) |
| A.6 People controls · 4 | ||||
| A.6.1 | Screening | Editorial | Art.10(3) | Same topic: Insider Threat (editorial pick) |
| A.6.3 | Information security awareness, education and training | Editorial | Art.5(4)Art.13(6) | Same topic: Awareness & Training (editorial pick) |
| A.6.4 | Disciplinary process | Editorial | Art.10(3) | Same topic: Insider Threat (editorial pick) |
| A.6.8 | Information security event reporting | Editorial | Art.18(1)Art.19(1)Art.19(3)+1 | Same topic: Reporting (editorial pick) |
| A.7 Physical controls · 10 | ||||
| A.7.1 | Physical security perimeters | Editorial | Art.6(2)Art.9(4)(c) | Same topic: Physical Security (editorial pick) |
| A.7.2 | Physical entry | Editorial | Art.6(2)Art.9(4)(c) | Same topic: Physical Security (editorial pick) |
| A.7.3 | Securing offices, rooms and facilities | Editorial | Art.6(2)Art.9(4)(c) | Same topic: Physical Security (editorial pick) |
| A.7.4 | Physical security monitoring | Editorial | Art.6(2)Art.9(4)(c) | Same topic: Physical Security (editorial pick) |
| A.7.5 | Protecting against physical and environmental threats | Editorial | Art.6(2)Art.9(4)(c) | Same topic: Physical Security (editorial pick) |
| A.7.6 | Working in secure areas | Editorial | Art.6(2)Art.9(4)(c) | Same topic: Physical Security (editorial pick) |
| A.7.8 | Equipment siting and protection | Editorial | Art.6(2)Art.9(4)(c) | Same topic: Physical Security (editorial pick) |
| A.7.11 | Supporting utilities | Editorial | Art.6(2)Art.9(4)(c) | Same topic: Physical Security (editorial pick) |
| A.7.12 | Cabling security | Editorial | Art.6(2)Art.9(4)(c) | Same topic: Physical Security (editorial pick) |
| A.7.14 | Secure disposal or re-use of equipment | Editorial | Art.8(1)Art.8(4)Art.8(6) | Same topic: Asset Management (editorial pick) |
| A.8 Technological controls · 17 | ||||
| A.8.2 | Privileged access rights | Editorial | Art.9(4)(c) | Same topic: Privileged Access (editorial pick) |
| A.8.3 | Information access restriction | Editorial | Art.9(4)(c) | Same topic: Access Control (editorial pick) |
| A.8.5 | Secure authentication | Editorial | Art.9(4)(d) | Same topic: Multi-Factor Auth (editorial pick) |
| A.8.8 | Management of technical vulnerabilities | Editorial | Art.8(2)Art.9(4)(f)Art.25(1)+2 | Same topic: Vulnerability Mgmt, Patch Management (editorial pick) |
| A.8.10 | Information deletion | Editorial | Art.9(2)Art.9(3)(c)Art.9(3)(d) | Same topic: Data Protection (editorial pick) |
| A.8.11 | Data masking | Editorial | Art.9(2)Art.9(3)(c)Art.9(3)(d) | Same topic: Data Protection (editorial pick) |
| A.8.13 | Information backup | Editorial | Art.12(1)Art.12(2)Art.12(3) | Same topic: Backup & Recovery (editorial pick) |
| A.8.14 | Redundancy of information processing facilities | Editorial | Art.11(1)Art.11(4)Art.11(6)+1 | Same topic: Business Continuity, Disaster Recovery (editorial pick) |
| A.8.15 | Logging | Editorial | Art.10(3) | Same topic: Logging & Audit (editorial pick) |
| A.8.16 | Monitoring activities | Editorial | Art.9(1)Art.10(1)Art.10(2)+1 | Same topic: Cont. Monitoring, Intrusion Detection, Anomaly Detection, SIEM / SOC (editorial pick) |
| A.8.17 | Clock synchronization | Editorial | Art.10(3) | Same topic: Logging & Audit (editorial pick) |
| A.8.18 | Use of privileged utility programs | Editorial | Art.9(4)(c) | Same topic: Privileged Access (editorial pick) |
| A.8.20 | Networks security | Editorial | Art.9(4)(b) | Same topic: Firewall / Net Seg (editorial pick) |
| A.8.21 | Security of network services | Editorial | Art.9(4)(b) | Same topic: Firewall / Net Seg (editorial pick) |
| A.8.22 | Segregation of networks | Editorial | Art.9(4)(b) | Same topic: Firewall / Net Seg (editorial pick) |
| A.8.24 | Use of cryptography | Editorial | Art.9(3)(a)Art.9(4)(d) | Same topic: Encryption (editorial pick) |
| A.8.32 | Change management | Editorial | Art.9(4)(e) | ControlMapping editorial: All three require documented, risk-based change management in which changes are recorded, tested, approved and verified. |
| ISMS clauses 4–10 · 10 | ||||
| Clause 4.1 | Understanding the organization and its context | Editorial | Art.8(1)Art.11(5) | Same topic: Business Environment (editorial pick) |
| Clause 4.2 | Understanding the needs and expectations of interested parties | Editorial | Art.8(1)Art.11(5) | Same topic: Business Environment (editorial pick) |
| Clause 5.2 | Policy | Editorial | Art.5(2)(b)Art.6(5)Art.9(4)(a) | Same topic: Governance Policy (editorial pick) |
| Clause 6.1.1 | General | Editorial | Art.5(2)(a)Art.6(1)Art.6(8)+2 | Same topic: Risk Management (editorial pick) |
| Clause 6.1.2 | Information security risk assessment | Editorial | Art.8(2)Art.8(3)Art.8(7) | Same topic: Risk Assessment (editorial pick) |
| Clause 6.1.3 | Information security risk treatment | Editorial | Art.5(2)(a)Art.6(1)Art.6(8)+5 | Same topic: Risk Management (editorial pick) |
| Clause 7.3 | Awareness | Editorial | Art.5(4)Art.13(6) | Same topic: Awareness & Training (editorial pick) |
| Clause 7.4 | Communication | Editorial | Art.11(2)(e)Art.11(7)Art.14(1)+2 | Same topic: Comms & Restore, Communication (editorial pick) |
| Clause 9.1 | Monitoring, measurement, analysis and evaluation | Editorial | Art.5(2)(f)Art.6(6)Art.6(7) | Same topic: Compliance (editorial pick) |
| Clause 10.1 | Continual improvement | Editorial | Art.13(2)Art.13(3) | Same topic: Lessons Learned (editorial pick) |
By topic
Both cover (39):
Governance PolicyAwareness & TrainingRisk ManagementSupply Chain RiskRoles & ResponsibilitiesComplianceAsset ManagementRisk AssessmentBusiness EnvironmentData ClassificationVulnerability MgmtThreat IntelligenceAccess ControlMulti-Factor AuthEncryptionData ProtectionBackup & RecoveryPrivileged AccessFirewall / Net SegPatch ManagementCloud SecurityCont. MonitoringLogging & AuditIntrusion DetectionAnomaly DetectionSIEM / SOCIncident ResponseForensicsCommunicationMitigationReportingRecovery PlanningBusiness ContinuityLessons LearnedComms & RestoreDisaster RecoveryInsider ThreatVendor Risk MgmtPhysical Security
Only ISO 27001 (11):
Crosswalk a published crosswalk (NIST, ENISA, CIS, PCI SSC) makes the link · Editorial ControlMapping's judgement where no crosswalk exists; the reason is shown · only shares a CSF 2.0 outcome: worth checking, not a mapping · No mapping in our data nothing mapped in our data; often new work, but check the coverage notes. Mapped = curated together in a ControlMapping topic, or linked directly. Crosswalks don't prove compliance. Methodology · Download the data · Report a mistake.