ISO 27001 · ISMS clauses 4–10
Clause 4.2
Understanding the needs and expectations of interested parties
frameworkISO/IEC 27001:2022
sectionISMS clauses 4–10
csf 2.0GV.OC-02 GV.OC-03 GV.OC-04 GV.SC-05 GV.SC-06 PR.DS-01 PR.DS-02 PR.DS-10 PR.IR-03
topicsBusiness Environment
frameworks3 2 1
Official text · not licensableTitle: Understanding the needs and expectations of interested parties. The control text is ISO's copyright; see ISO/IEC 27001:2022.
Wrong or missing mapping? Report it
| Framework | Requirement | Title | Link | Source / reason |
|---|---|---|---|---|
| NIST CSF 2.0 | GV.OC-01GV.OC-04GV.OC-05 | The organizational mission is understood and informs cybersecurity risk management; Critical objectives, capabilities, and services that external stakeholders depend on or expect from the organization are understood and communicated… | Crosswalk | Same topic: Business Environment8 loosely related (not mappings)GV.OC-02 Internal and external stakeholders are understood, and their needs and expectations regarding cybersecurity risk management are understood and considered Only shares CSF GV.OC-02: related, not a mapping GV.OC-03 Legal, regulatory, and contractual requirements regarding cybersecurity - including privacy and civil liberties obligations - are understood and managed Only shares CSF GV.OC-03: related, not a mapping GV.SC-05 Requirements to address cybersecurity risks in supply chains are established, prioritized, and integrated into contracts and other types of agreements with suppliers and other relevant third parties Only shares CSF GV.SC-05: related, not a mapping GV.SC-06 Planning and due diligence are performed to reduce risks before entering into formal supplier or other third-party relationships Only shares CSF GV.SC-06: related, not a mapping PR.DS-01 The confidentiality, integrity, and availability of data-at-rest are protected Only shares CSF PR.DS-01: related, not a mapping PR.DS-02 The confidentiality, integrity, and availability of data-in-transit are protected Only shares CSF PR.DS-02: related, not a mapping PR.DS-10 The confidentiality, integrity, and availability of data-in-use are protected Only shares CSF PR.DS-10: related, not a mapping PR.IR-03 Mechanisms are implemented to achieve resilience requirements in normal and adverse situations Only shares CSF PR.IR-03: related, not a mapping |
| CIS v8.1 | CIS 15.4CIS 3.10CIS 3.11CIS 15.5 | Ensure Service Provider Contracts Include Security Requirements; Encrypt Sensitive Data in Transit… | No mapping. Only shares CSF GV.SC-05, GV.SC-06, PR.DS-02, PR.DS-01: related, not a mapping+14 more loosely related (not mappings)CIS 3.1 Establish and Maintain a Data Management Process Only shares CSF PR.DS-01, PR.DS-02, PR.DS-10: related, not a mapping CIS 3.5 Securely Dispose of Data Only shares CSF PR.DS-01, PR.DS-02, PR.DS-10: related, not a mapping CIS 3.12 Segment Data Processing and Storage Based on Sensitivity Only shares CSF PR.DS-01, PR.DS-02, PR.DS-10: related, not a mapping …and 10 more in the downloads | |
| SOC 2 | CC3.1 | Objectives specified clearly enough to identify risks | Editorial | Same topic: Business Environment (editorial pick)12 loosely related (not mappings)C1.2 Disposing of confidential information Only shares CSF PR.DS-01, PR.DS-02, PR.DS-10: related, not a mapping CC6.5 Protection of data when assets are disposed of Only shares CSF PR.DS-01, PR.DS-02, PR.DS-10: related, not a mapping CC6.7 Restricting transmission, movement and removal of information Only shares CSF PR.DS-01, PR.DS-02, PR.DS-10: related, not a mapping A1.1 Capacity management to meet availability commitments Only shares CSF GV.OC-04, PR.IR-03: related, not a mapping A1.2 Environmental protections, backups and recovery infrastructure Only shares CSF GV.OC-04, PR.IR-03: related, not a mapping CC6.1 Logical access security over information assets Only shares CSF PR.DS-01, PR.DS-02: related, not a mapping CC9.1 Mitigating risks from business disruptions Only shares CSF GV.OC-04, PR.IR-03: related, not a mapping CC9.2 Managing vendor and business partner risk Only shares CSF GV.SC-05, GV.SC-06: related, not a mapping …and 4 more in the downloads |
| PCI DSS | 12.5.2 | PCI DSS scope confirmed annually and on change | Crosswalk | Same topic: Business Environment36 loosely related (not mappings)12.8.1 List of third-party service providers kept Only shares CSF GV.OC-02, GV.OC-03, GV.SC-05, GV.SC-06: related, not a mapping 12.8.5 Responsibilities split with each provider documented Only shares CSF GV.OC-02, GV.OC-03, GV.SC-05, GV.SC-06: related, not a mapping 12.8.2 Written agreements with service providers Only shares CSF GV.OC-03, GV.SC-05, GV.SC-06: related, not a mapping 12.9.1 Service providers acknowledge responsibilities to customers Only shares CSF GV.OC-02, GV.OC-03, GV.SC-05: related, not a mapping 12.9.2 Service providers support customer compliance requests Only shares CSF GV.OC-02, GV.OC-03, GV.SC-05: related, not a mapping 3.2.1 Account data storage minimised, with retention and disposal Only shares CSF GV.OC-03, PR.DS-10: related, not a mapping 9.4.6 Hard-copy media destroyed when no longer needed Only shares CSF GV.OC-03, PR.DS-01: related, not a mapping 9.4.7 Electronic media destroyed or made unrecoverable Only shares CSF GV.OC-03, PR.DS-01: related, not a mapping …and 28 more in the downloads |
| CMMC | SC.L2-3.13.2RA.L2-3.11.1SC.L2-3.13.1SC.L2-3.13.4 | Security Engineering; Risk Assessments… | No mapping. Only shares CSF PR.DS-01, PR.DS-02, PR.DS-10, PR.IR-03…: related, not a mapping+24 more loosely related (not mappings)SC.L2-3.13.5 Public-Access System Separation Only shares CSF PR.DS-01, PR.DS-02, PR.DS-10: related, not a mapping SC.L2-3.13.6 Network Communication by Exception Only shares CSF PR.DS-01, PR.DS-02, PR.DS-10: related, not a mapping SI.L2-3.14.2 Malicious Code Protection Only shares CSF PR.DS-01, PR.DS-02, PR.DS-10: related, not a mapping …and 20 more in the downloads | |
| 800-53 | PM-11RA-9PM-1 | Mission and Business Process Definition; Criticality Analysis… | Crosswalk | Same topic: Business Environment NIST SP 800-53 → ISO 27001 mapping 49 loosely related (not mappings)SC-4 Information in Shared System Resources Only shares CSF PR.DS-01, PR.DS-02, PR.DS-10: related, not a mapping …and 41 more in the downloads |
| HIPAA | §164.308(b)(1)§164.308(b)(4)§164.314(a)(2)(ii)§164.312(c) | Business Associate Contracts and Other Arrangements; Written Contract or Other Arrangement… | No mapping. Only shares CSF GV.SC-05, GV.SC-06, PR.DS-01, PR.DS-02…: related, not a mapping+44 more loosely related (not mappings)§164.308(a)(1)(ii)(D) Information System Activity Review Only shares CSF PR.DS-01, PR.DS-02, PR.DS-10: related, not a mapping §164.308(a)(4)(ii)(A) Isolating Health care Clearinghouse Function Only shares CSF PR.DS-01, PR.DS-02, PR.DS-10: related, not a mapping §164.308(a)(7)(ii)(B) Disaster Recovery Plan Only shares CSF GV.OC-04, PR.DS-01, PR.DS-10: related, not a mapping §164.312(a)(2)(iv) Encryption and Decryption Only shares CSF PR.DS-01, PR.DS-02, PR.DS-10: related, not a mapping …and 40 more in the downloads | |
| GDPR | Art.32(1)(b)Art.5(1)(e)Art.5(1)(f)Art.28(1) | Security of processing; Principles relating to processing of personal data… | No mapping. Only shares CSF GV.OC-04, PR.DS-01, PR.DS-02, PR.DS-10…: related, not a mapping+5 more loosely related (not mappings)Art.34(3)(a) Communication of a personal data breach to the data subject Only shares CSF PR.DS-01, PR.DS-02: related, not a mapping Art.5(2) Principles relating to processing of personal data Only shares CSF GV.OC-03: related, not a mapping …and 1 more in the downloads | |
| NIS2 | 5.11.19.14.1 | Supply chain security policy; Policy on the security of network and information systems… | No mapping. Only shares CSF GV.OC-03, GV.SC-05, GV.SC-06, GV.OC-02…: related, not a mapping+5 more loosely related (not mappings)6.1 Security in acquisition of ICT services, ICT systems or ICT products Only shares CSF GV.SC-06: related, not a mapping …and 1 more in the downloads | |
| Essential Eight | ISM-1488ISM-1515 | Microsoft Office macros in files originating from the internet are blocked; Restoration of data, applications and settings from backups to a common point in time… | No mapping. Only shares CSF PR.DS-02, PR.IR-03: related, not a mapping | |
| DORA | Art.8(1)Art.11(5) | Identification; Response and recovery | Editorial | Same topic: Business Environment (editorial pick)21 loosely related (not mappings)Art.9(2) Protection and prevention Only shares CSF PR.DS-01, PR.DS-02, PR.DS-10: related, not a mapping Art.9(3)(c) Protection and prevention Only shares CSF PR.DS-01, PR.DS-02, PR.DS-10: related, not a mapping Art.9(3)(d) Protection and prevention Only shares CSF PR.DS-01, PR.DS-02, PR.DS-10: related, not a mapping …and 13 more in the downloads |
| CPS 234 | Para 21Para 16Para 22Para 34 | Timely controls commensurate with risk and asset life-cycle; Assess third parties' information security capability… | No mapping. Only shares CSF PR.DS-01, PR.DS-02, PR.DS-10, GV.SC-05…: related, not a mapping+3 more loosely related (not mappings)Para 28 Check third parties' control testing is adequate Only shares CSF GV.SC-06: related, not a mapping Para 32 Internal audit reviews control design and effectiveness Only shares CSF GV.OC-03: related, not a mapping Para 33 Assurance provided by appropriately skilled personnel Only shares CSF GV.OC-03: related, not a mapping | |
| Cyber Essentials | — | No requirement | No mapping in our data | No mapping in our data (Cyber Essentials covers five technical controls only). |
Crosswalk a published crosswalk (NIST, ENISA, CIS, PCI SSC) makes the link · Editorial ControlMapping's judgement where no crosswalk exists; the reason is shown · only shares a CSF 2.0 outcome: worth checking, not a mapping · No mapping in our data nothing mapped in our data; often new work, but check the coverage notes. How links are sourced.