Outsourced development

frameworkISO/IEC 27001:2022 sectionA.8 Technological controls csf 2.0GV.OV-03 topics— frameworks2 0 3

Official text · not licensableTitle: Outsourced development. The control text is ISO's copyright; see ISO/IEC 27001:2022.

gap from ISO 27001 → gap to ISO 27001 →

Wrong or missing mapping? Report it

Equivalents of A.8.30 in other frameworks
Framework	Requirement	Title	Link	Source / reason
NIST CSF 2.0	GV.OV-03	Organizational cybersecurity risk management performance is evaluated and reviewed for adjustments needed	Loosely related	No mapping. Only shares CSF GV.OV-03: related, not a mapping
CIS v8.1	—	No requirement	No mapping in our data	No mapping in our data (most CIS links are editorial: CIS's published crosswalk covers 49 of 153 safeguards).
SOC 2	CC4.1 CC4.2	Ongoing and/or separate evaluations of controls; Communicating and remediating control deficiencies	Loosely related	No mapping. Only shares CSF GV.OV-03: related, not a mapping
PCI DSS	7.2.5.1 10.7.2 11.3.1 11.3.2	System and application account access periodically reviewed; Critical security control failures detected and reported…	Loosely related	No mapping. Only shares CSF GV.OV-03: related, not a mapping +4 more loosely related (not mappings) 11.4.4 Penetration test findings corrected and retested Loosely related Only shares CSF GV.OV-03: related, not a mapping 12.3.1 Targeted risk analysis for flexible-frequency requirements Loosely related Only shares CSF GV.OV-03: related, not a mapping 12.3.4 Hardware and software technologies reviewed annually Loosely related Only shares CSF GV.OV-03: related, not a mapping 12.4.2 Service providers: quarterly reviews of operational tasks Loosely related Only shares CSF GV.OV-03: related, not a mapping
CMMC	RA.L2-3.11.1 CA.L2-3.12.1	Risk Assessments; Security Control Assessment	Loosely related	No mapping. Only shares CSF GV.OV-03: related, not a mapping
800-53	SA-4 SA-10 SA-11 SA-15 SR-2 SR-4	Acquisition Process; Developer Configuration Management…	Crosswalk	NIST SP 800-53 → ISO 27001 mapping 5 loosely related (not mappings) PM-4 Plan of Action and Milestones Process Loosely related Only shares CSF GV.OV-03: related, not a mapping PM-6 Measures of Performance Loosely related Only shares CSF GV.OV-03: related, not a mapping RA-7 Risk Response Loosely related Only shares CSF GV.OV-03: related, not a mapping SR-6 Supplier Assessments and Reviews Loosely related Only shares CSF GV.OV-03: related, not a mapping CA-2 Control Assessments Loosely related Only shares CSF GV.OV-03: related, not a mapping
HIPAA	§164.308(a)(8)	Evaluation	Loosely related	No mapping. Only shares CSF GV.OV-03: related, not a mapping
GDPR	Art.5(2)	Principles relating to processing of personal data	Loosely related	No mapping. Only shares CSF GV.OV-03: related, not a mapping
NIS2	5.1	Supply chain security policy	Crosswalk	ENISA NIS2 → ISO 27001 mapping 1 loosely related (not mappings) 2.3 Independent review of information and network security Loosely related Only shares CSF GV.OV-03: related, not a mapping
Essential Eight	—	No requirement	No mapping in our data	No mapping in our data (Essential Eight links are editorial only).
DORA	Art.5(2)(f)Art.6(6)Art.6(7)	Governance and organisation; ICT risk management framework…	Loosely related	No mapping. Only shares CSF GV.OV-03: related, not a mapping
CPS 234	Para 32 Para 33 Para 34	Internal audit reviews control design and effectiveness; Assurance provided by appropriately skilled personnel…	Loosely related	No mapping. Only shares CSF GV.OV-03: related, not a mapping
Cyber Essentials	—	No requirement	No mapping in our data	No mapping in our data (Cyber Essentials covers five technical controls only).

Crosswalk a published crosswalk (NIST, ENISA, CIS, PCI SSC) makes the link · Editorial ControlMapping's judgement where no crosswalk exists; the reason is shown · Loosely related only shares a CSF 2.0 outcome: worth checking, not a mapping · No mapping in our data nothing mapped in our data; often new work, but check the coverage notes. How links are sourced.