Security of processing

frameworkGDPR sectionRequirements csf 2.0GV.OC-04 PR.AA-01 PR.AA-05 PR.DS-01 PR.DS-02 PR.DS-10 PR.IR-03 RC.RP-04 topicsAccess Control, Data Protection, Business Continuity frameworks0 12 0

Official text · not licensableSee the official text of GDPR.

gap from GDPR → gap to GDPR →

Wrong or missing mapping? Report it

Equivalents of Art.32(1)(b) in other frameworks
Framework	Requirement	Title	Link	Source / reason
NIST CSF 2.0	GV.OC-04 PR.AA-01 PR.AA-05 PR.DS-01 PR.DS-02 PR.DS-10 PR.IR-03 RC.RP-04	Critical objectives, capabilities, and services that external stakeholders depend on or expect from the organization are understood and communicated; Identities and credentials for authorized users, services, and hardware are managed by the organization…	Editorial	Same topic: Business Continuity, Access Control, Data Protection (editorial pick)
ISO 27001	A.5.14 A.5.15 A.5.16 A.5.18 A.5.29 A.5.30 A.8.3 A.8.10 A.8.11 A.8.14	Information transfer; Access control…	Editorial	Same topic: Data Protection, Access Control, Business Continuity (editorial pick) 37 loosely related (not mappings) A.8.2 Privileged access rights Loosely related Only shares CSF PR.AA-01, PR.AA-05, PR.DS-01, PR.DS-02…: related, not a mapping Clause 4.2 Understanding the needs and expectations of interested parties Loosely related Only shares CSF GV.OC-04, PR.DS-01, PR.DS-02, PR.DS-10…: related, not a mapping A.5.3 Segregation of duties Loosely related Only shares CSF PR.AA-05, PR.DS-01, PR.DS-02, PR.DS-10: related, not a mapping A.8.4 Access to source code Loosely related Only shares CSF PR.AA-05, PR.DS-01, PR.DS-02, PR.DS-10: related, not a mapping A.8.17 Clock synchronization Loosely related Only shares CSF PR.DS-01, PR.DS-02, PR.DS-10, PR.IR-03: related, not a mapping A.5.10 Acceptable use of information and other associated assets Loosely related Only shares CSF PR.DS-01, PR.DS-02, PR.DS-10: related, not a mapping A.5.13 Labelling of information Loosely related Only shares CSF PR.DS-01, PR.DS-02, PR.DS-10: related, not a mapping A.6.1 Screening Loosely related Only shares CSF PR.DS-01, PR.DS-02, PR.DS-10: related, not a mapping …and 29 more in the downloads
CIS v8.1	CIS 3.1 CIS 3.3 CIS 3.4 CIS 3.5 CIS 3.11 CIS 3.12 CIS 5.1 CIS 5.2 CIS 5.3 CIS 5.5 CIS 5.6 CIS 6.1 CIS 6.2 CIS 6.6 CIS 6.7 CIS 6.8 CIS 12.5	Establish and Maintain a Data Management Process; Configure Data Access Control Lists…	Editorial	Same topic: Data Protection, Access Control (editorial pick) 17 loosely related (not mappings) CIS 3.13 Deploy a Data Loss Prevention Solution Loosely related Only shares CSF PR.DS-01, PR.DS-02, PR.DS-10: related, not a mapping CIS 3.6 Encrypt Data on End-User Devices Loosely related Only shares CSF PR.DS-01, PR.DS-02: related, not a mapping CIS 3.9 Encrypt Data on Removable Media Loosely related Only shares CSF PR.DS-01, PR.DS-02: related, not a mapping CIS 3.10 Encrypt Sensitive Data in Transit Loosely related Only shares CSF PR.DS-02: related, not a mapping CIS 4.10 Enforce Automatic Device Lockout on Portable End-User Devices Loosely related Only shares CSF PR.AA-05: related, not a mapping CIS 4.11 Enforce Remote Wipe Capability on Portable End-User Devices Loosely related Only shares CSF PR.AA-05: related, not a mapping CIS 4.12 Separate Enterprise Workspaces on Mobile End-User Devices Loosely related Only shares CSF PR.AA-05: related, not a mapping CIS 5.4 Restrict Administrator Privileges to Dedicated Administrator Accounts Loosely related Only shares CSF PR.AA-05: related, not a mapping …and 9 more in the downloads
SOC 2	A1.1 A1.2 C1.2 CC6.1 CC6.2 CC6.3 CC6.5 CC9.1	Capacity management to meet availability commitments; Environmental protections, backups and recovery infrastructure…	Editorial	Same topic: Business Continuity, Data Protection, Access Control (editorial pick) 5 loosely related (not mappings) CC6.7 Restricting transmission, movement and removal of information Loosely related Only shares CSF PR.AA-05, PR.DS-01, PR.DS-02, PR.DS-10: related, not a mapping A1.3 Testing recovery plan procedures Loosely related Only shares CSF PR.IR-03: related, not a mapping CC3.1 Objectives specified clearly enough to identify risks Loosely related Only shares CSF GV.OC-04: related, not a mapping CC6.6 Protection against threats from outside system boundaries Loosely related Only shares CSF PR.AA-05: related, not a mapping CC6.8 Preventing or detecting unauthorized or malicious software Loosely related Only shares CSF PR.DS-02: related, not a mapping
PCI DSS	3.2.1 3.3.1 3.4.1 7.2.1 7.2.2 7.2.4 8.2.1 12.10.1	Account data storage minimised, with retention and disposal; Sensitive authentication data not kept after authorisation…	Editorial	Same topic: Data Protection, Access Control, Business Continuity (editorial pick) 33 loosely related (not mappings) 3.4.2 PAN copying prevented over remote-access technologies Loosely related Only shares CSF PR.DS-01, PR.DS-02, PR.DS-10: related, not a mapping 12.5.1 Inventory of in-scope system components Loosely related Only shares CSF GV.OC-04, PR.AA-01, RC.RP-04: related, not a mapping 3.6.1 Procedures protect keys that secure stored account data Loosely related Only shares CSF PR.AA-01, PR.DS-01: related, not a mapping 3.6.1.1 Service providers document their cryptographic architecture Loosely related Only shares CSF PR.AA-01, PR.DS-01: related, not a mapping 3.6.1.2 Secret and private keys stored in approved forms Loosely related Only shares CSF PR.AA-01, PR.DS-01: related, not a mapping 3.6.1.3 Cleartext key components accessible to fewest custodians Loosely related Only shares CSF PR.AA-01, PR.DS-01: related, not a mapping 3.6.1.4 Keys stored in the fewest possible locations Loosely related Only shares CSF PR.AA-01, PR.DS-01: related, not a mapping 3.7.1 Key management: strong key generation Loosely related Only shares CSF PR.DS-01, PR.DS-02: related, not a mapping …and 25 more in the downloads
CMMC	AC.L2-3.1.1 AC.L2-3.1.2 MP.L2-3.8.3 SC.L2-3.13.16	Authorized Access Control; Transaction & Function Control…	Editorial	Same topic: Access Control, Data Protection (editorial pick) 45 loosely related (not mappings) SC.L2-3.13.2 Security Engineering Loosely related Only shares CSF PR.DS-01, PR.DS-02, PR.DS-10, PR.IR-03: related, not a mapping AC.L2-3.1.13 Remote Access Confidentiality Loosely related Only shares CSF PR.AA-05, PR.DS-01, PR.DS-02: related, not a mapping AC.L2-3.1.19 Encrypt CUI on Mobile Loosely related Only shares CSF PR.AA-05, PR.DS-01, PR.DS-02: related, not a mapping MP.L2-3.8.6 Portable Storage Encryption Loosely related Only shares CSF PR.AA-05, PR.DS-01, PR.DS-02: related, not a mapping SC.L2-3.13.1 Boundary Protection Loosely related Only shares CSF PR.DS-01, PR.DS-02, PR.DS-10: related, not a mapping SC.L2-3.13.3 Role Separation Loosely related Only shares CSF PR.AA-01, PR.AA-05, PR.DS-10: related, not a mapping SC.L2-3.13.4 Shared Resource Control Loosely related Only shares CSF PR.DS-01, PR.DS-02, PR.DS-10: related, not a mapping SC.L2-3.13.5 Public-Access System Separation Loosely related Only shares CSF PR.DS-01, PR.DS-02, PR.DS-10: related, not a mapping …and 37 more in the downloads
800-53	AC-2 AC-3 CP-2(8)CP-7 SC-8 SC-28 SI-7	Account Management; Access Enforcement…	Editorial	Same topic: Access Control, Business Continuity, Data Protection (editorial pick) 58 loosely related (not mappings) CA-3 Information Exchange Loosely related Only shares CSF PR.DS-01, PR.DS-02, PR.DS-10: related, not a mapping SC-4 Information in Shared System Resources Loosely related Only shares CSF PR.DS-01, PR.DS-02, PR.DS-10: related, not a mapping SC-7 Boundary Protection Loosely related Only shares CSF PR.DS-01, PR.DS-02, PR.DS-10: related, not a mapping SC-7(10) Prevent Exfiltration Loosely related Only shares CSF PR.DS-01, PR.DS-02, PR.DS-10: related, not a mapping SC-13 Cryptographic Protection Loosely related Only shares CSF PR.DS-01, PR.DS-02, PR.DS-10: related, not a mapping SC-39 Process Isolation Loosely related Only shares CSF PR.DS-01, PR.DS-10, PR.IR-03: related, not a mapping SC-43 Usage Restrictions Loosely related Only shares CSF PR.DS-01, PR.DS-02, PR.DS-10: related, not a mapping SI-3 Malicious Code Protection Loosely related Only shares CSF PR.DS-01, PR.DS-02, PR.DS-10: related, not a mapping …and 50 more in the downloads
HIPAA	§164.308(a)(4)§164.308(a)(7)(ii)(C)§164.310(d)(2)(i)§164.312(a)§164.312(a)(2)(i)§164.312(c)§164.312(d)	Information Access Management; Emergency Mode Operation Plan…	Editorial	Same topic: Access Control, Business Continuity, Data Protection (editorial pick) 29 loosely related (not mappings) §164.308(a)(4)(ii)(A) Isolating Health care Clearinghouse Function Loosely related Only shares CSF PR.AA-05, PR.DS-01, PR.DS-02, PR.DS-10: related, not a mapping §164.312(a)(2)(ii) Emergency Access Procedure Loosely related Only shares CSF GV.OC-04, PR.AA-01, PR.AA-05, PR.DS-10: related, not a mapping §164.308(a)(1)(ii)(D) Information System Activity Review Loosely related Only shares CSF PR.DS-01, PR.DS-02, PR.DS-10: related, not a mapping §164.308(a)(3) Workforce Security Loosely related Only shares CSF PR.AA-01, PR.AA-05, PR.DS-10: related, not a mapping §164.308(a)(3)(ii)(A) Authorization and/or Supervision Loosely related Only shares CSF PR.AA-01, PR.AA-05, PR.DS-10: related, not a mapping §164.308(a)(3)(ii)(B) Workforce Clearance Procedure Loosely related Only shares CSF PR.AA-01, PR.AA-05, PR.DS-10: related, not a mapping §164.308(a)(4)(ii)(B) Access Authorization Loosely related Only shares CSF PR.AA-01, PR.AA-05, PR.DS-10: related, not a mapping §164.308(a)(4)(ii)(C) Access Establishment and Modification Loosely related Only shares CSF PR.AA-01, PR.AA-05, PR.DS-10: related, not a mapping …and 21 more in the downloads
NIS2	4.1 4.3 11.1 11.2 11.5 12.2 12.3	Business continuity and disaster recovery plan; Crisis management…	Editorial	Same topic: Business Continuity, Access Control, Data Protection (editorial pick) 3 loosely related (not mappings) 9.1 Cryptography Loosely related Only shares CSF PR.DS-01, PR.DS-02: related, not a mapping 11.4 Administration systems Loosely related Only shares CSF PR.AA-05: related, not a mapping 11.6 Authentication Loosely related Only shares CSF PR.AA-05: related, not a mapping
Essential Eight	ISM-0445 ISM-1175 ISM-1380 ISM-1387	Privileged human users are assigned a dedicated privileged user account to be used…; Privileged user accounts (excluding those explicitly authorised to access online……	Loosely related	No mapping. Only shares CSF PR.AA-05: related, not a mapping +18 more loosely related (not mappings) ISM-1488 Microsoft Office macros in files originating from the internet are blocked Loosely related Only shares CSF PR.DS-02: related, not a mapping ISM-1507 Requests for privileged access to systems and their resources are validated when first… Loosely related Only shares CSF PR.AA-05: related, not a mapping ISM-1508 Privileged access to systems and their resources is limited to only what is required… Loosely related Only shares CSF PR.AA-05: related, not a mapping ISM-1509 Privileged access events are centrally logged Loosely related Only shares CSF PR.AA-05: related, not a mapping …and 14 more in the downloads
DORA	Art.9(2)Art.9(3)(c)Art.9(3)(d)Art.9(4)(c)Art.11(1)Art.11(4)Art.11(6)	Protection and prevention; Protection and prevention…	Editorial	Same topic: Data Protection, Access Control, Business Continuity (editorial pick) 5 loosely related (not mappings) Art.9(3)(a) Protection and prevention Loosely related Only shares CSF PR.DS-01, PR.DS-02: related, not a mapping Art.9(4)(d) Protection and prevention Loosely related Only shares CSF PR.DS-01, PR.DS-02: related, not a mapping Art.8(1) Identification Loosely related Only shares CSF GV.OC-04: related, not a mapping Art.11(5) Response and recovery Loosely related Only shares CSF GV.OC-04: related, not a mapping Art.12(4) Backup policies and procedures, restoration and recovery procedures and methods Loosely related Only shares CSF PR.IR-03: related, not a mapping
CPS 234	Para 21	Timely controls commensurate with risk and asset life-cycle	Editorial	Same topic: Data Protection (editorial pick)
Cyber Essentials	CE 4	User Access Control	Editorial	Same topic: Access Control (editorial pick) 1 loosely related (not mappings) CE 2 Secure Configuration Loosely related Only shares CSF PR.AA-05: related, not a mapping

Crosswalk a published crosswalk (NIST, ENISA, CIS, PCI SSC) makes the link · Editorial ControlMapping's judgement where no crosswalk exists; the reason is shown · Loosely related only shares a CSF 2.0 outcome: worth checking, not a mapping · No mapping in our data nothing mapped in our data; often new work, but check the coverage notes. How links are sourced.