Policies for information security

frameworkISO/IEC 27001:2022 sectionA.5 Organizational controls csf 2.0GV.OV-01 GV.OV-02 GV.OV-03 GV.PO-01 GV.PO-02 GV.RM-01 GV.RM-02 GV.RM-03 GV.RM-04 GV.RM-05 GV.RM-06 GV.SC-01 GV.SC-03 PR.AA-05 PR.DS-01 topicsGovernance Policy frameworks5 4 0

Official text · not licensableTitle: Policies for information security. The control text is ISO's copyright; see ISO/IEC 27001:2022.

gap from ISO 27001 → gap to ISO 27001 →

Wrong or missing mapping? Report it

Equivalents of A.5.1 in other frameworks
Framework	Requirement	Title	Link	Source / reason
NIST CSF 2.0	GV.PO-01 GV.PO-02	Policy for managing cybersecurity risks is established based on organizational context, cybersecurity strategy, and priorities and is communicated and enforced; Policy for managing cybersecurity risks is reviewed, updated, communicated, and enforced to reflect changes in requirements, threats, technology, and organizational mission	Crosswalk	Same topic: Governance Policy 13 loosely related (not mappings) GV.OV-01 Cybersecurity risk management strategy outcomes are reviewed to inform and adjust strategy and direction Loosely related Only shares CSF GV.OV-01: related, not a mapping GV.OV-02 The cybersecurity risk management strategy is reviewed and adjusted to ensure coverage of organizational requirements and risks Loosely related Only shares CSF GV.OV-02: related, not a mapping GV.OV-03 Organizational cybersecurity risk management performance is evaluated and reviewed for adjustments needed Loosely related Only shares CSF GV.OV-03: related, not a mapping GV.RM-01 Risk management objectives are established and agreed to by organizational stakeholders Loosely related Only shares CSF GV.RM-01: related, not a mapping GV.RM-02 Risk appetite and risk tolerance statements are established, communicated, and maintained Loosely related Only shares CSF GV.RM-02: related, not a mapping GV.RM-03 Cybersecurity risk management activities and outcomes are included in enterprise risk management processes Loosely related Only shares CSF GV.RM-03: related, not a mapping GV.RM-04 Strategic direction that describes appropriate risk response options is established and communicated Loosely related Only shares CSF GV.RM-04: related, not a mapping GV.RM-05 Lines of communication across the organization are established for cybersecurity risks, including risks from suppliers and other third parties Loosely related Only shares CSF GV.RM-05: related, not a mapping …and 5 more in the downloads
CIS v8.1	CIS 3.3 CIS 3.11 CIS 5.1 CIS 6.8	Configure Data Access Control Lists; Encrypt Sensitive Data at Rest…	Loosely related	No mapping. Only shares CSF PR.AA-05, PR.DS-01: related, not a mapping +22 more loosely related (not mappings) CIS 15.2 Establish and Maintain a Service Provider Management Policy Loosely related Only shares CSF GV.SC-01: related, not a mapping CIS 3.1 Establish and Maintain a Data Management Process Loosely related Only shares CSF PR.DS-01: related, not a mapping CIS 3.4 Enforce Data Retention Loosely related Only shares CSF PR.DS-01: related, not a mapping CIS 3.5 Securely Dispose of Data Loosely related Only shares CSF PR.DS-01: related, not a mapping …and 18 more in the downloads
SOC 2	CC1.1 CC5.3 CC2.2	Commitment to integrity and ethical values; Control activities deployed through policies and procedures…	Editorial	Same topic: Governance Policy (editorial pick) ControlMapping editorial: Internal communication of objectives and responsibilities: communication (7.4), awareness (7.3) and communicating policies (A.5.1). 13 loosely related (not mappings) CC3.1 Objectives specified clearly enough to identify risks Loosely related Only shares CSF GV.RM-01, GV.RM-02, GV.RM-03, GV.RM-06: related, not a mapping CC5.1 Control activities that mitigate risks Loosely related Only shares CSF GV.RM-01, GV.RM-02, GV.RM-03, GV.RM-06: related, not a mapping CC9.1 Mitigating risks from business disruptions Loosely related Only shares CSF GV.RM-01, GV.RM-02, GV.RM-03, GV.RM-06: related, not a mapping CC6.1 Logical access security over information assets Loosely related Only shares CSF PR.AA-05, PR.DS-01: related, not a mapping CC6.7 Restricting transmission, movement and removal of information Loosely related Only shares CSF PR.AA-05, PR.DS-01: related, not a mapping CC9.2 Managing vendor and business partner risk Loosely related Only shares CSF GV.SC-01, GV.SC-03: related, not a mapping C1.2 Disposing of confidential information Loosely related Only shares CSF PR.DS-01: related, not a mapping CC4.1 Ongoing and/or separate evaluations of controls Loosely related Only shares CSF GV.OV-03: related, not a mapping …and 5 more in the downloads
PCI DSS	12.1.1 12.1.2	Information security policy established and published; Security policy reviewed at least annually	Crosswalk	Same topic: Governance Policy 71 loosely related (not mappings) 12.3.4 Hardware and software technologies reviewed annually Loosely related Only shares CSF GV.OV-02, GV.OV-03, GV.RM-03, GV.RM-06…: related, not a mapping 6.3.1 Vulnerabilities identified and risk-ranked Loosely related Only shares CSF GV.RM-03, GV.RM-06, GV.SC-01, GV.SC-03: related, not a mapping 7.2.5.1 System and application account access periodically reviewed Loosely related Only shares CSF GV.OV-03, GV.RM-03, GV.RM-06, PR.AA-05: related, not a mapping 10.7.2 Critical security control failures detected and reported Loosely related Only shares CSF GV.OV-01, GV.OV-02, GV.OV-03, GV.RM-05: related, not a mapping 11.6.1 Payment page changes and tampering detected Loosely related Only shares CSF GV.RM-03, GV.RM-06, GV.SC-01, GV.SC-03: related, not a mapping 12.8.3 Due diligence before engaging service providers Loosely related Only shares CSF GV.RM-03, GV.RM-06, GV.SC-01, GV.SC-03: related, not a mapping 10.7.1 Service providers detect security control failures Loosely related Only shares CSF GV.OV-01, GV.OV-02, GV.RM-05: related, not a mapping 12.1.4 Executive responsibility for information security assigned Loosely related Only shares CSF GV.PO-01, GV.RM-01, GV.SC-01: related, not a mapping …and 63 more in the downloads
CMMC	RA.L2-3.11.1 AC.L2-3.1.13 AC.L2-3.1.19 MP.L2-3.8.6	Risk Assessments; Remote Access Confidentiality…	Loosely related	No mapping. Only shares CSF GV.OV-01, GV.OV-02, GV.OV-03, GV.RM-06…: related, not a mapping +33 more loosely related (not mappings) SC.L2-3.13.8 Data in Transit Loosely related Only shares CSF PR.AA-05, PR.DS-01: related, not a mapping SC.L2-3.13.16 Data at Rest Loosely related Only shares CSF PR.AA-05, PR.DS-01: related, not a mapping AC.L2-3.1.1 Authorized Access Control Loosely related Only shares CSF PR.AA-05: related, not a mapping AC.L2-3.1.2 Transaction & Function Control Loosely related Only shares CSF PR.AA-05: related, not a mapping …and 29 more in the downloads
800-53	PL-1 PM-1 AC-1 AT-1 AU-1 CA-1 CM-1 CP-1 IA-1 IR-1 MA-1 MP-1 PE-1 PS-1 RA-1 SA-1 SC-1 SI-1 SR-1	Policy and Procedures; Information Security Program Plan…	Crosswalk	Same topic: Governance Policy NIST SP 800-53 → ISO 27001 mapping 46 loosely related (not mappings) PM-9 Risk Management Strategy Loosely related Only shares CSF GV.OV-01, GV.OV-02, GV.RM-01, GV.RM-02…: related, not a mapping PM-30 Supply Chain Risk Management Strategy Loosely related Only shares CSF GV.OV-01, GV.OV-02, GV.RM-03, GV.RM-04…: related, not a mapping RA-7 Risk Response Loosely related Only shares CSF GV.OV-01, GV.OV-02, GV.OV-03, GV.RM-01…: related, not a mapping SR-2 Supply Chain Risk Management Plan Loosely related Only shares CSF GV.RM-01, GV.RM-03, GV.RM-04, GV.SC-01…: related, not a mapping PT-1 Policy and Procedures Loosely related Only shares CSF GV.OV-01, GV.PO-01, GV.PO-02, GV.SC-03: related, not a mapping PM-18 Privacy Program Plan Loosely related Only shares CSF GV.OV-01, GV.RM-06, GV.SC-03: related, not a mapping PM-31 Continuous Monitoring Strategy Loosely related Only shares CSF GV.OV-01, GV.OV-02, GV.SC-03: related, not a mapping SR-6 Supplier Assessments and Reviews Loosely related Only shares CSF GV.OV-01, GV.OV-02, GV.OV-03: related, not a mapping …and 38 more in the downloads
HIPAA	§164.316(a)§164.316(b)(2)(iii)	Policies and Procedures; Updates	Crosswalk	Same topic: Governance Policy 40 loosely related (not mappings) §164.308(a)(1)(ii)(B) Risk Management Loosely related Only shares CSF GV.RM-01, GV.RM-02, GV.RM-03, GV.RM-06…: related, not a mapping §164.308(a)(3) Workforce Security Loosely related Only shares CSF GV.OV-01, GV.PO-01, GV.PO-02, GV.SC-03…: related, not a mapping §164.308(a)(3)(ii)(A) Authorization and/or Supervision Loosely related Only shares CSF GV.OV-01, GV.PO-01, GV.PO-02, GV.SC-03…: related, not a mapping §164.308(a)(3)(ii)(B) Workforce Clearance Procedure Loosely related Only shares CSF GV.OV-01, GV.PO-01, GV.PO-02, GV.SC-03…: related, not a mapping §164.308(a)(4) Information Access Management Loosely related Only shares CSF GV.OV-01, GV.PO-01, GV.PO-02, GV.SC-03…: related, not a mapping §164.308(a)(4)(ii)(B) Access Authorization Loosely related Only shares CSF GV.OV-01, GV.PO-01, GV.PO-02, GV.SC-03…: related, not a mapping §164.308(a)(4)(ii)(C) Access Establishment and Modification Loosely related Only shares CSF GV.OV-01, GV.PO-01, GV.PO-02, GV.SC-03…: related, not a mapping §164.308(a)(8) Evaluation Loosely related Only shares CSF GV.OV-01, GV.OV-03, GV.PO-01, GV.PO-02…: related, not a mapping …and 32 more in the downloads
GDPR	Art.24(2)	Responsibility of the controller	Editorial	Same topic: Governance Policy (editorial pick) 10 loosely related (not mappings) Art.24(1) Responsibility of the controller Loosely related Only shares CSF GV.RM-01, GV.RM-02, GV.RM-03, GV.RM-06: related, not a mapping Art.32(2) Security of processing Loosely related Only shares CSF GV.RM-01, GV.RM-02, GV.RM-03, GV.RM-06: related, not a mapping Art.28(1) Processor Loosely related Only shares CSF GV.SC-01, GV.SC-03: related, not a mapping Art.32(1)(b) Security of processing Loosely related Only shares CSF PR.AA-05, PR.DS-01: related, not a mapping Art.5(1)(e) Principles relating to processing of personal data Loosely related Only shares CSF PR.DS-01: related, not a mapping Art.5(1)(f) Principles relating to processing of personal data Loosely related Only shares CSF PR.DS-01: related, not a mapping Art.5(2) Principles relating to processing of personal data Loosely related Only shares CSF GV.OV-03: related, not a mapping Art.25(2) Data protection by design and by default Loosely related Only shares CSF PR.AA-05: related, not a mapping …and 2 more in the downloads
NIS2	1.1	Policy on the security of network and information systems	Crosswalk	Same topic: Governance Policy 13 loosely related (not mappings) 2.1 Risk management framework Loosely related Only shares CSF GV.RM-01, GV.RM-03, GV.RM-06: related, not a mapping 2.3 Independent review of information and network security Loosely related Only shares CSF GV.OV-02, GV.OV-03: related, not a mapping 2.2 Compliance monitoring Loosely related Only shares CSF GV.OV-02: related, not a mapping 5.1 Supply chain security policy Loosely related Only shares CSF GV.SC-01: related, not a mapping 6.1 Security in acquisition of ICT services, ICT systems or ICT products Loosely related Only shares CSF GV.PO-02: related, not a mapping 7.1 Policies and procedures to assess the effectiveness of cybersecurity risk-management measures Loosely related Only shares CSF GV.RM-06: related, not a mapping 9.1 Cryptography Loosely related Only shares CSF PR.DS-01: related, not a mapping 11.1 Access control policy Loosely related Only shares CSF PR.AA-05: related, not a mapping …and 5 more in the downloads
Essential Eight	ISM-0445 ISM-1175 ISM-1380 ISM-1387	Privileged human users are assigned a dedicated privileged user account to be used…; Privileged user accounts (excluding those explicitly authorised to access online……	Loosely related	No mapping. Only shares CSF PR.AA-05: related, not a mapping +16 more loosely related (not mappings) ISM-1507 Requests for privileged access to systems and their resources are validated when first… Loosely related Only shares CSF PR.AA-05: related, not a mapping ISM-1508 Privileged access to systems and their resources is limited to only what is required… Loosely related Only shares CSF PR.AA-05: related, not a mapping ISM-1509 Privileged access events are centrally logged Loosely related Only shares CSF PR.AA-05: related, not a mapping ISM-1647 Privileged access to systems and their resources are disabled after 12 months unless… Loosely related Only shares CSF PR.AA-05: related, not a mapping …and 12 more in the downloads
DORA	Art.5(2)(b)Art.6(5)Art.9(4)(a)	Governance and organisation; ICT risk management framework…	Editorial	Same topic: Governance Policy (editorial pick) 17 loosely related (not mappings) Art.5(2)(a) Governance and organisation Loosely related Only shares CSF GV.RM-01, GV.RM-02, GV.RM-03, GV.RM-06: related, not a mapping Art.6(1) ICT risk management framework Loosely related Only shares CSF GV.RM-01, GV.RM-02, GV.RM-03, GV.RM-06: related, not a mapping Art.6(8) ICT risk management framework Loosely related Only shares CSF GV.RM-01, GV.RM-02, GV.RM-03, GV.RM-06: related, not a mapping Art.16(1) Simplified ICT risk management framework Loosely related Only shares CSF GV.RM-01, GV.RM-02, GV.RM-03, GV.RM-06: related, not a mapping Art.24(1) General requirements for the performance of digital operational resilience testing Loosely related Only shares CSF GV.RM-01, GV.RM-02, GV.RM-03, GV.RM-06: related, not a mapping Art.28(2) General principles Loosely related Only shares CSF GV.SC-01, GV.SC-03: related, not a mapping Art.29(1) Preliminary assessment of ICT concentration risk at entity level Loosely related Only shares CSF GV.SC-01, GV.SC-03: related, not a mapping Art.29(2) Preliminary assessment of ICT concentration risk at entity level Loosely related Only shares CSF GV.SC-01, GV.SC-03: related, not a mapping …and 9 more in the downloads
CPS 234	Para 18 Para 19	Maintain an information security policy framework; Policies direct everyone with security obligations	Editorial	Same topic: Governance Policy (editorial pick) 10 loosely related (not mappings) Para 13 Board ultimately responsible for information security Loosely related Only shares CSF GV.RM-01, GV.RM-02, GV.RM-03, GV.RM-06: related, not a mapping Para 15 Maintain a capability commensurate with threats Loosely related Only shares CSF GV.RM-01, GV.RM-02, GV.RM-03, GV.RM-06: related, not a mapping Para 27 Systematic testing programme for control effectiveness Loosely related Only shares CSF GV.RM-01, GV.RM-02, GV.RM-03, GV.RM-06: related, not a mapping Para 31 Review the testing programme at least annually Loosely related Only shares CSF GV.RM-01, GV.RM-02, GV.RM-03, GV.RM-06: related, not a mapping Para 16 Assess third parties' information security capability Loosely related Only shares CSF GV.SC-01, GV.SC-03: related, not a mapping Para 22 Evaluate the design of third parties' controls Loosely related Only shares CSF GV.SC-01, GV.SC-03: related, not a mapping Para 21 Timely controls commensurate with risk and asset life-cycle Loosely related Only shares CSF PR.DS-01: related, not a mapping Para 32 Internal audit reviews control design and effectiveness Loosely related Only shares CSF GV.OV-03: related, not a mapping …and 2 more in the downloads
Cyber Essentials	CE 2 CE 4	Secure Configuration; User Access Control	Loosely related	No mapping. Only shares CSF PR.AA-05: related, not a mapping

Crosswalk a published crosswalk (NIST, ENISA, CIS, PCI SSC) makes the link · Editorial ControlMapping's judgement where no crosswalk exists; the reason is shown · Loosely related only shares a CSF 2.0 outcome: worth checking, not a mapping · No mapping in our data nothing mapped in our data; often new work, but check the coverage notes. How links are sourced.