Remote working

frameworkISO/IEC 27001:2022 sectionA.6 People controls csf 2.0GV.PO-01 GV.RR-04 PR.AA-05 PR.PS-01 topicsMobile Security frameworks1 6 0

Official text · not licensableTitle: Remote working. The control text is ISO's copyright; see ISO/IEC 27001:2022.

gap from ISO 27001 → gap to ISO 27001 →

Wrong or missing mapping? Report it

Equivalents of A.6.7 in other frameworks
Framework	Requirement	Title	Link	Source / reason
NIST CSF 2.0	PR.AA-05 PR.PS-01	Access permissions, entitlements, and authorizations are defined in a policy, managed, enforced, and reviewed, and incorporate the principles of least privilege and separation of duties; Configuration management practices are established and applied	Editorial	Same topic: Mobile Security (editorial pick) 2 loosely related (not mappings) GV.PO-01 Policy for managing cybersecurity risks is established based on organizational context, cybersecurity strategy, and priorities and is communicated and enforced Loosely related Only shares CSF GV.PO-01: related, not a mapping GV.RR-04 Cybersecurity is included in human resources practices Loosely related Only shares CSF GV.RR-04: related, not a mapping
CIS v8.1	CIS 4.10 CIS 4.11 CIS 4.12	Enforce Automatic Device Lockout on Portable End-User Devices; Enforce Remote Wipe Capability on Portable End-User Devices…	Editorial	Same topic: Mobile Security (editorial pick) 21 loosely related (not mappings) CIS 6.1 Establish an Access Granting Process Loosely related Only shares CSF GV.RR-04, PR.AA-05: related, not a mapping CIS 6.2 Establish an Access Revoking Process Loosely related Only shares CSF GV.RR-04, PR.AA-05: related, not a mapping CIS 3.3 Configure Data Access Control Lists Loosely related Only shares CSF PR.AA-05: related, not a mapping CIS 4.1 Establish and Maintain a Secure Configuration Process Loosely related Only shares CSF PR.PS-01: related, not a mapping CIS 4.2 Establish and Maintain a Secure Configuration Process for Network Infrastructure Loosely related Only shares CSF PR.PS-01: related, not a mapping CIS 4.3 Configure Automatic Session Locking on Enterprise Assets Loosely related Only shares CSF PR.PS-01: related, not a mapping CIS 4.6 Securely Manage Enterprise Assets and Software Loosely related Only shares CSF PR.PS-01: related, not a mapping CIS 4.7 Manage Default Accounts on Enterprise Assets and Software Loosely related Only shares CSF PR.PS-01: related, not a mapping …and 13 more in the downloads
SOC 2	CC6.7	Restricting transmission, movement and removal of information	Editorial	Same topic: Mobile Security (editorial pick) 9 loosely related (not mappings) CC1.1 Commitment to integrity and ethical values Loosely related Only shares CSF GV.PO-01: related, not a mapping CC5.2 General controls over technology Loosely related Only shares CSF PR.PS-01: related, not a mapping CC5.3 Control activities deployed through policies and procedures Loosely related Only shares CSF GV.PO-01: related, not a mapping CC6.1 Logical access security over information assets Loosely related Only shares CSF PR.AA-05: related, not a mapping CC6.2 User registration, authorization and removal Loosely related Only shares CSF PR.AA-05: related, not a mapping CC6.3 Role-based access, least privilege and segregation of duties Loosely related Only shares CSF PR.AA-05: related, not a mapping CC6.6 Protection against threats from outside system boundaries Loosely related Only shares CSF PR.AA-05: related, not a mapping CC7.1 Detecting configuration changes and new vulnerabilities Loosely related Only shares CSF PR.PS-01: related, not a mapping …and 1 more in the downloads
PCI DSS	7.2.2 12.1.3 8.2.5 9.3.1.1	Access assigned by job function and least privilege; Security roles and responsibilities defined…	Loosely related	No mapping. Only shares CSF GV.RR-04, PR.AA-05, GV.PO-01: related, not a mapping +14 more loosely related (not mappings) 12.1.1 Information security policy established and published Loosely related Only shares CSF GV.PO-01: related, not a mapping 12.1.2 Security policy reviewed at least annually Loosely related Only shares CSF GV.PO-01: related, not a mapping 12.1.4 Executive responsibility for information security assigned Loosely related Only shares CSF GV.PO-01: related, not a mapping 12.6.1 Formal security awareness programme Loosely related Only shares CSF GV.PO-01: related, not a mapping …and 10 more in the downloads
CMMC	AC.L2-3.1.18 AC.L2-3.1.19	Mobile Device Connection; Encrypt CUI on Mobile	Editorial	Same topic: Mobile Security (editorial pick) 29 loosely related (not mappings) CM.L2-3.4.9 User-Installed Software Loosely related Only shares CSF PR.AA-05, PR.PS-01: related, not a mapping SC.L2-3.13.7 Split Tunneling Loosely related Only shares CSF PR.AA-05, PR.PS-01: related, not a mapping AC.L2-3.1.1 Authorized Access Control Loosely related Only shares CSF PR.AA-05: related, not a mapping AC.L2-3.1.2 Transaction & Function Control Loosely related Only shares CSF PR.AA-05: related, not a mapping AC.L2-3.1.4 Separation of Duties Loosely related Only shares CSF PR.AA-05: related, not a mapping AC.L2-3.1.5 Least Privilege Loosely related Only shares CSF PR.AA-05: related, not a mapping AC.L2-3.1.6 Non-Privileged Account Use Loosely related Only shares CSF PR.AA-05: related, not a mapping AC.L2-3.1.7 Privileged Functions Loosely related Only shares CSF PR.AA-05: related, not a mapping …and 21 more in the downloads
800-53	AC-19 AC-19(5)AC-17 PE-17	Access Control for Mobile Devices; Full Device or Container-based Encryption…	Crosswalk	Same topic: Mobile Security (editorial pick) NIST SP 800-53 → ISO 27001 mapping 46 loosely related (not mappings) AC-1 Policy and Procedures Loosely related Only shares CSF GV.PO-01, PR.AA-05: related, not a mapping CM-1 Policy and Procedures Loosely related Only shares CSF GV.PO-01, PR.PS-01: related, not a mapping PS-1 Policy and Procedures Loosely related Only shares CSF GV.PO-01, GV.RR-04: related, not a mapping AT-1 Policy and Procedures Loosely related Only shares CSF GV.PO-01: related, not a mapping AU-1 Policy and Procedures Loosely related Only shares CSF GV.PO-01: related, not a mapping CA-1 Policy and Procedures Loosely related Only shares CSF GV.PO-01: related, not a mapping CP-1 Policy and Procedures Loosely related Only shares CSF GV.PO-01: related, not a mapping IA-1 Policy and Procedures Loosely related Only shares CSF GV.PO-01: related, not a mapping …and 38 more in the downloads
HIPAA	§164.310(d)	Device and Media Controls	Editorial	Same topic: Mobile Security (editorial pick) 34 loosely related (not mappings) §164.316(b)(2)(ii) Availability Loosely related Only shares CSF GV.PO-01, GV.RR-04, PR.AA-05, PR.PS-01: related, not a mapping §164.316(b)(2)(iii) Updates Loosely related Only shares CSF GV.PO-01, GV.RR-04, PR.AA-05, PR.PS-01: related, not a mapping §164.308(a)(3)(ii)(A) Authorization and/or Supervision Loosely related Only shares CSF GV.PO-01, GV.RR-04, PR.AA-05: related, not a mapping §164.308(a)(3)(ii)(B) Workforce Clearance Procedure Loosely related Only shares CSF GV.PO-01, GV.RR-04, PR.AA-05: related, not a mapping §164.308(a)(4)(ii)(B) Access Authorization Loosely related Only shares CSF GV.PO-01, GV.RR-04, PR.AA-05: related, not a mapping §164.308(a)(3) Workforce Security Loosely related Only shares CSF GV.PO-01, PR.AA-05: related, not a mapping §164.308(a)(3)(ii)(C) Termination Procedures Loosely related Only shares CSF GV.PO-01, GV.RR-04: related, not a mapping §164.308(a)(4) Information Access Management Loosely related Only shares CSF GV.PO-01, PR.AA-05: related, not a mapping …and 26 more in the downloads
GDPR	Art.24(2)Art.25(2)Art.28(1)Art.29	Responsibility of the controller; Data protection by design and by default…	Loosely related	No mapping. Only shares CSF GV.PO-01, PR.AA-05, PR.PS-01, GV.RR-04: related, not a mapping +2 more loosely related (not mappings) Art.32(1)(b) Security of processing Loosely related Only shares CSF PR.AA-05: related, not a mapping Art.32(4) Security of processing Loosely related Only shares CSF GV.RR-04: related, not a mapping
NIS2	1.1 10.1 10.2 10.3	Policy on the security of network and information systems; Human resources security…	Loosely related	No mapping. Only shares CSF GV.PO-01, GV.RR-04: related, not a mapping +6 more loosely related (not mappings) 6.3 Configuration management Loosely related Only shares CSF PR.PS-01: related, not a mapping 11.1 Access control policy Loosely related Only shares CSF PR.AA-05: related, not a mapping 11.2 Management of access rights Loosely related Only shares CSF PR.AA-05: related, not a mapping 11.4 Administration systems Loosely related Only shares CSF PR.AA-05: related, not a mapping …and 2 more in the downloads
Essential Eight	ISM-0445 ISM-1175 ISM-1380 ISM-1387	Privileged human users are assigned a dedicated privileged user account to be used…; Privileged user accounts (excluding those explicitly authorised to access online……	Loosely related	No mapping. Only shares CSF PR.AA-05: related, not a mapping +47 more loosely related (not mappings) ISM-1412 Web browsers are hardened using ASD and vendor hardening guidance, with the most… Loosely related Only shares CSF PR.PS-01: related, not a mapping ISM-1485 Web browsers do not process web advertisements from the internet Loosely related Only shares CSF PR.PS-01: related, not a mapping ISM-1486 Web browsers do not process Java from the internet Loosely related Only shares CSF PR.PS-01: related, not a mapping ISM-1487 Only privileged human users responsible for checking that Microsoft Office macros are… Loosely related Only shares CSF PR.PS-01: related, not a mapping …and 43 more in the downloads
DORA	Art.5(2)(b)Art.6(5)Art.9(4)(a)Art.9(4)(c)	Governance and organisation; ICT risk management framework…	Loosely related	No mapping. Only shares CSF GV.PO-01, PR.AA-05: related, not a mapping +3 more loosely related (not mappings) Art.10(3) Detection Loosely related Only shares CSF GV.RR-04: related, not a mapping Art.28(8) General principles Loosely related Only shares CSF PR.PS-01: related, not a mapping Art.30(2) Key contractual provisions Loosely related Only shares CSF PR.PS-01: related, not a mapping
CPS 234	Para 18 Para 19	Maintain an information security policy framework; Policies direct everyone with security obligations	Loosely related	No mapping. Only shares CSF GV.PO-01: related, not a mapping
Cyber Essentials	CE 2	Secure Configuration	Editorial	Same topic: Mobile Security (editorial pick) 1 loosely related (not mappings) CE 4 User Access Control Loosely related Only shares CSF PR.AA-05, PR.PS-01: related, not a mapping

Crosswalk a published crosswalk (NIST, ENISA, CIS, PCI SSC) makes the link · Editorial ControlMapping's judgement where no crosswalk exists; the reason is shown · Loosely related only shares a CSF 2.0 outcome: worth checking, not a mapping · No mapping in our data nothing mapped in our data; often new work, but check the coverage notes. How links are sourced.