Storage media

frameworkISO/IEC 27001:2022 sectionA.7 Physical controls csf 2.0ID.AM-08 PR.DS-01 topics— frameworks2 0 0

Official text · not licensableTitle: Storage media. The control text is ISO's copyright; see ISO/IEC 27001:2022.

Wrong or missing mapping? Report it

Equivalents of A.7.10 in other frameworks
Framework	Requirement	Title	Link	Source / reason
NIST CSF 2.0	ID.AM-08 PR.DS-01	Systems, hardware, software, services, and data are managed throughout their life cycles; The confidentiality, integrity, and availability of data-at-rest are protected	Loosely related	No mapping. Only shares CSF ID.AM-08, PR.DS-01: related, not a mapping
CIS v8.1	CIS 3.5 CIS 1.1 CIS 3.11 CIS 1.2	Securely Dispose of Data; Establish and Maintain Detailed Enterprise Asset Inventory…	Loosely related	No mapping. Only shares CSF ID.AM-08, PR.DS-01: related, not a mapping +12 more loosely related (not mappings) CIS 1.3 Utilize an Active Discovery Tool Loosely related Only shares CSF ID.AM-08: related, not a mapping CIS 1.4 Use Dynamic Host Configuration Protocol (DHCP) Logging to Update Enterprise Asset Inventory Loosely related Only shares CSF ID.AM-08: related, not a mapping CIS 1.5 Use a Passive Asset Discovery Tool Loosely related Only shares CSF ID.AM-08: related, not a mapping CIS 2.3 Address Unauthorized Software Loosely related Only shares CSF ID.AM-08: related, not a mapping …and 8 more in the downloads
SOC 2	CC6.1 C1.2 CC6.5 CC6.7	Logical access security over information assets; Disposing of confidential information…	Loosely related	No mapping. Only shares CSF ID.AM-08, PR.DS-01: related, not a mapping
PCI DSS	3.3.1 3.5.1 3.5.1.3 3.6.1	Sensitive authentication data not kept after authorisation; PAN rendered unreadable wherever stored…	Loosely related	No mapping. Only shares CSF PR.DS-01: related, not a mapping +19 more loosely related (not mappings) 3.6.1.1 Service providers document their cryptographic architecture Loosely related Only shares CSF PR.DS-01: related, not a mapping 3.6.1.2 Secret and private keys stored in approved forms Loosely related Only shares CSF PR.DS-01: related, not a mapping 3.6.1.3 Cleartext key components accessible to fewest custodians Loosely related Only shares CSF PR.DS-01: related, not a mapping 3.6.1.4 Keys stored in the fewest possible locations Loosely related Only shares CSF PR.DS-01: related, not a mapping …and 15 more in the downloads
CMMC	SC.L2-3.13.2 AC.L2-3.1.13 CA.L2-3.12.4 MA.L2-3.7.1	Security Engineering; Remote Access Confidentiality…	Loosely related	No mapping. Only shares CSF ID.AM-08, PR.DS-01: related, not a mapping +19 more loosely related (not mappings) MA.L2-3.7.3 Equipment Sanitization Loosely related Only shares CSF ID.AM-08: related, not a mapping MP.L2-3.8.5 Media Accountability Loosely related Only shares CSF PR.DS-01: related, not a mapping MP.L2-3.8.6 Portable Storage Encryption Loosely related Only shares CSF PR.DS-01: related, not a mapping MP.L2-3.8.9 Protect Backups Loosely related Only shares CSF PR.DS-01: related, not a mapping …and 15 more in the downloads
800-53	MA-2 MP-2 MP-4 MP-5 MP-6 MP-7 PE-16	Controlled Maintenance; Media Access…	Crosswalk	NIST SP 800-53 → ISO 27001 mapping 29 loosely related (not mappings) CA-3 Information Exchange Loosely related Only shares CSF PR.DS-01: related, not a mapping CM-9 Configuration Management Plan Loosely related Only shares CSF ID.AM-08: related, not a mapping CM-13 Data Action Mapping Loosely related Only shares CSF ID.AM-08: related, not a mapping CP-9 System Backup Loosely related Only shares CSF PR.DS-01: related, not a mapping MA-6 Timely Maintenance Loosely related Only shares CSF ID.AM-08: related, not a mapping MP-8 Media Downgrading Loosely related Only shares CSF PR.DS-01: related, not a mapping PL-2 System Security and Privacy Plans Loosely related Only shares CSF ID.AM-08: related, not a mapping PM-22 Personally Identifiable Information Quality Management Loosely related Only shares CSF ID.AM-08: related, not a mapping …and 21 more in the downloads
HIPAA	§164.308(b)(4)§164.308(a)(1)(ii)(B)§164.308(a)(1)(ii)(D)§164.308(a)(4)(ii)(A)	Written Contract or Other Arrangement; Risk Management…	Loosely related	No mapping. Only shares CSF ID.AM-08, PR.DS-01: related, not a mapping +23 more loosely related (not mappings) §164.308(a)(7)(ii)(A) Data Backup Plan Loosely related Only shares CSF PR.DS-01: related, not a mapping §164.308(a)(7)(ii)(B) Disaster Recovery Plan Loosely related Only shares CSF PR.DS-01: related, not a mapping §164.308(b)(1) Business Associate Contracts and Other Arrangements Loosely related Only shares CSF PR.DS-01: related, not a mapping §164.310(a)(2)(ii) Facility Security Plan Loosely related Only shares CSF ID.AM-08: related, not a mapping …and 19 more in the downloads
GDPR	Art.5(1)(e)Art.5(1)(f)Art.30(1)Art.32(1)(a)	Principles relating to processing of personal data; Principles relating to processing of personal data…	Loosely related	No mapping. Only shares CSF PR.DS-01, ID.AM-08: related, not a mapping +2 more loosely related (not mappings) Art.32(1)(b) Security of processing Loosely related Only shares CSF PR.DS-01: related, not a mapping Art.34(3)(a) Communication of a personal data breach to the data subject Loosely related Only shares CSF PR.DS-01: related, not a mapping
NIS2	12.2 12.3	Handling of assets; Removable media policy	Crosswalk	ENISA NIS2 → ISO 27001 mapping 3 loosely related (not mappings) 6.2 Secure development life cycle Loosely related Only shares CSF ID.AM-08: related, not a mapping 9.1 Cryptography Loosely related Only shares CSF PR.DS-01: related, not a mapping 12.4 Asset inventory Loosely related Only shares CSF ID.AM-08: related, not a mapping
Essential Eight	ISM-1807	An automated method of asset discovery is used at least fortnightly to support the…	Loosely related	No mapping. Only shares CSF ID.AM-08: related, not a mapping
DORA	Art.8(1)Art.8(4)Art.8(6)Art.9(2)	Identification; Identification…	Loosely related	No mapping. Only shares CSF ID.AM-08, PR.DS-01: related, not a mapping +4 more loosely related (not mappings) Art.9(3)(a) Protection and prevention Loosely related Only shares CSF PR.DS-01: related, not a mapping Art.9(3)(c) Protection and prevention Loosely related Only shares CSF PR.DS-01: related, not a mapping Art.9(3)(d) Protection and prevention Loosely related Only shares CSF PR.DS-01: related, not a mapping Art.9(4)(d) Protection and prevention Loosely related Only shares CSF PR.DS-01: related, not a mapping
CPS 234	Para 20 Para 21	Classify information assets by criticality and sensitivity; Timely controls commensurate with risk and asset life-cycle	Loosely related	No mapping. Only shares CSF ID.AM-08, PR.DS-01: related, not a mapping
Cyber Essentials	CE 3	Security Update Management	Loosely related	No mapping. Only shares CSF ID.AM-08: related, not a mapping

Crosswalk a published crosswalk (NIST, ENISA, CIS, PCI SSC) makes the link · Editorial ControlMapping's judgement where no crosswalk exists; the reason is shown · Loosely related only shares a CSF 2.0 outcome: worth checking, not a mapping · No mapping in our data nothing mapped in our data; often new work, but check the coverage notes. How links are sourced.