Information security in project management

frameworkISO/IEC 27001:2022 sectionA.5 Organizational controls csf 2.0GV.OC-05 ID.AM-08 topics— frameworks1 0 0

Official text · not licensableTitle: Information security in project management. The control text is ISO's copyright; see ISO/IEC 27001:2022.

gap from ISO 27001 → gap to ISO 27001 →

Wrong or missing mapping? Report it

Equivalents of A.5.8 in other frameworks
Framework	Requirement	Title	Link	Source / reason
NIST CSF 2.0	GV.OC-05 ID.AM-08	Outcomes, capabilities, and services that the organization depends on are understood and communicated; Systems, hardware, software, services, and data are managed throughout their life cycles	Loosely related	No mapping. Only shares CSF GV.OC-05, ID.AM-08: related, not a mapping
CIS v8.1	CIS 1.1 CIS 3.5 CIS 1.2 CIS 1.3	Establish and Maintain Detailed Enterprise Asset Inventory; Securely Dispose of Data…	Loosely related	No mapping. Only shares CSF ID.AM-08: related, not a mapping +5 more loosely related (not mappings) CIS 1.4 Use Dynamic Host Configuration Protocol (DHCP) Logging to Update Enterprise Asset Inventory Loosely related Only shares CSF ID.AM-08: related, not a mapping CIS 1.5 Use a Passive Asset Discovery Tool Loosely related Only shares CSF ID.AM-08: related, not a mapping CIS 2.3 Address Unauthorized Software Loosely related Only shares CSF ID.AM-08: related, not a mapping CIS 2.4 Utilize Automated Software Inventory Tools Loosely related Only shares CSF ID.AM-08: related, not a mapping …and 1 more in the downloads
SOC 2	CC3.1 CC6.1	Objectives specified clearly enough to identify risks; Logical access security over information assets	Loosely related	No mapping. Only shares CSF GV.OC-05, ID.AM-08: related, not a mapping
PCI DSS	1.2.3 1.2.4 6.2.1 6.2.2	Accurate network diagram maintained; Accurate account-data flow diagram maintained…	Loosely related	No mapping. Only shares CSF GV.OC-05, ID.AM-08: related, not a mapping +13 more loosely related (not mappings) 6.2.3 Custom code reviewed before release Loosely related Only shares CSF ID.AM-08: related, not a mapping 6.2.3.1 Manual code reviews approved by someone else Loosely related Only shares CSF ID.AM-08: related, not a mapping 6.2.4 Coding techniques prevent common software attacks Loosely related Only shares CSF ID.AM-08: related, not a mapping 6.3.1 Vulnerabilities identified and risk-ranked Loosely related Only shares CSF ID.AM-08: related, not a mapping …and 9 more in the downloads
CMMC	CA.L2-3.12.4 MA.L2-3.7.1 MA.L2-3.7.3 SC.L2-3.13.2	System Security Plan; Perform Maintenance…	Loosely related	No mapping. Only shares CSF ID.AM-08: related, not a mapping
800-53	PL-2 PL-7 PL-8 SA-3 SA-4 SA-9 SA-15	System Security and Privacy Plans; Concept of Operations…	Crosswalk	NIST SP 800-53 → ISO 27001 mapping 15 loosely related (not mappings) SR-5 Acquisition Strategies, Tools, and Methods Loosely related Only shares CSF GV.OC-05, ID.AM-08: related, not a mapping CM-9 Configuration Management Plan Loosely related Only shares CSF ID.AM-08: related, not a mapping CM-13 Data Action Mapping Loosely related Only shares CSF ID.AM-08: related, not a mapping MA-2 Controlled Maintenance Loosely related Only shares CSF ID.AM-08: related, not a mapping MA-6 Timely Maintenance Loosely related Only shares CSF ID.AM-08: related, not a mapping PM-11 Mission and Business Process Definition Loosely related Only shares CSF GV.OC-05: related, not a mapping PM-22 Personally Identifiable Information Quality Management Loosely related Only shares CSF ID.AM-08: related, not a mapping PM-23 Data Governance Body Loosely related Only shares CSF ID.AM-08: related, not a mapping …and 7 more in the downloads
HIPAA	§164.308(b)(4)§164.314(a)§164.314(a)(2)(i)§164.314(a)(2)(iii)	Written Contract or Other Arrangement; Business Associate Contracts or Other Arrangements…	Loosely related	No mapping. Only shares CSF GV.OC-05, ID.AM-08: related, not a mapping +13 more loosely related (not mappings) §164.308(a)(1)(ii)(B) Risk Management Loosely related Only shares CSF ID.AM-08: related, not a mapping §164.308(b)(1) Business Associate Contracts and Other Arrangements Loosely related Only shares CSF GV.OC-05: related, not a mapping §164.310(a)(2)(ii) Facility Security Plan Loosely related Only shares CSF ID.AM-08: related, not a mapping §164.310(a)(2)(iv) Maintenance Records Loosely related Only shares CSF ID.AM-08: related, not a mapping …and 9 more in the downloads
GDPR	Art.30(1)	Records of processing activities	Loosely related	No mapping. Only shares CSF ID.AM-08: related, not a mapping
NIS2	5.1 5.2 6.2 12.4	Supply chain security policy; Directory of suppliers and service providers…	Loosely related	No mapping. Only shares CSF GV.OC-05, ID.AM-08: related, not a mapping +1 more loosely related (not mappings) 13.1 Supporting utilities Loosely related Only shares CSF GV.OC-05: related, not a mapping
Essential Eight	ISM-1807	An automated method of asset discovery is used at least fortnightly to support the…	Loosely related	No mapping. Only shares CSF ID.AM-08: related, not a mapping
DORA	Art.8(1)Art.8(4)Art.8(6)Art.11(5)	Identification; Identification…	Loosely related	No mapping. Only shares CSF GV.OC-05, ID.AM-08: related, not a mapping
CPS 234	Para 20	Classify information assets by criticality and sensitivity	Loosely related	No mapping. Only shares CSF ID.AM-08: related, not a mapping
Cyber Essentials	CE 3	Security Update Management	Loosely related	No mapping. Only shares CSF ID.AM-08: related, not a mapping

Crosswalk a published crosswalk (NIST, ENISA, CIS, PCI SSC) makes the link · Editorial ControlMapping's judgement where no crosswalk exists; the reason is shown · Loosely related only shares a CSF 2.0 outcome: worth checking, not a mapping · No mapping in our data nothing mapped in our data; often new work, but check the coverage notes. How links are sourced.