General

frameworkISO/IEC 27001:2022 sectionISMS clauses 4–10 csf 2.0GV.RM-01 GV.RM-05 GV.RM-07 GV.SC-04 GV.SC-07 GV.SC-09 GV.SC-10 ID.RA-03 ID.RA-04 ID.RA-05 PR.IR-03 topicsRisk Management frameworks5 5 1

Official text · not licensableTitle: General. The control text is ISO's copyright; see ISO/IEC 27001:2022.

gap from ISO 27001 → gap to ISO 27001 →

Wrong or missing mapping? Report it

Equivalents of Clause 6.1.1 in other frameworks
Framework	Requirement	Title	Link	Source / reason
NIST CSF 2.0	GV.RM-01 GV.RM-02 GV.RM-03 GV.RM-06	Risk management objectives are established and agreed to by organizational stakeholders; Risk appetite and risk tolerance statements are established, communicated, and maintained…	Crosswalk	Same topic: Risk Management 10 loosely related (not mappings) GV.RM-05 Lines of communication across the organization are established for cybersecurity risks, including risks from suppliers and other third parties Loosely related Only shares CSF GV.RM-05: related, not a mapping GV.RM-07 Strategic opportunities (i.e., positive risks) are characterized and are included in organizational cybersecurity risk discussions Loosely related Only shares CSF GV.RM-07: related, not a mapping GV.SC-04 Suppliers are known and prioritized by criticality Loosely related Only shares CSF GV.SC-04: related, not a mapping GV.SC-07 The risks posed by a supplier, their products and services, and other third parties are understood, recorded, prioritized, assessed, responded to, and monitored over the course of the relationship Loosely related Only shares CSF GV.SC-07: related, not a mapping GV.SC-09 Supply chain security practices are integrated into cybersecurity and enterprise risk management programs, and their performance is monitored throughout the technology product and service life cycle Loosely related Only shares CSF GV.SC-09: related, not a mapping GV.SC-10 Cybersecurity supply chain risk management plans include provisions for activities that occur after the conclusion of a partnership or service agreement Loosely related Only shares CSF GV.SC-10: related, not a mapping ID.RA-03 Internal and external threats to the organization are identified and recorded Loosely related Only shares CSF ID.RA-03: related, not a mapping ID.RA-04 Potential impacts and likelihoods of threats exploiting vulnerabilities are identified and recorded Loosely related Only shares CSF ID.RA-04: related, not a mapping …and 2 more in the downloads
CIS v8.1	CIS 15.7 CIS 15.6 CIS 15.1 CIS 15.3	Securely Decommission Service Providers; Monitor Service Providers…	Loosely related	No mapping. Only shares CSF GV.SC-04, GV.SC-07, GV.SC-10, GV.SC-09: related, not a mapping +2 more loosely related (not mappings) CIS 15.4 Ensure Service Provider Contracts Include Security Requirements Loosely related Only shares CSF GV.SC-04, GV.SC-07: related, not a mapping CIS 11.1 Establish and Maintain a Data Recovery Process Loosely related Only shares CSF PR.IR-03: related, not a mapping
SOC 2	CC3.1 CC5.1 CC9.1	Objectives specified clearly enough to identify risks; Control activities that mitigate risks…	Editorial	Same topic: Risk Management (editorial pick) 7 loosely related (not mappings) CC3.2 Risk identification and analysis Loosely related Only shares CSF ID.RA-03, ID.RA-04, ID.RA-05: related, not a mapping CC3.3 Considering the potential for fraud Loosely related Only shares CSF ID.RA-03, ID.RA-04, ID.RA-05: related, not a mapping CC3.4 Identifying and assessing significant changes Loosely related Only shares CSF ID.RA-03, ID.RA-04, ID.RA-05: related, not a mapping CC9.2 Managing vendor and business partner risk Loosely related Only shares CSF GV.SC-04, GV.SC-07, GV.SC-09: related, not a mapping A1.1 Capacity management to meet availability commitments Loosely related Only shares CSF PR.IR-03: related, not a mapping A1.2 Environmental protections, backups and recovery infrastructure Loosely related Only shares CSF PR.IR-03: related, not a mapping A1.3 Testing recovery plan procedures Loosely related Only shares CSF PR.IR-03: related, not a mapping
PCI DSS	12.3.1	Targeted risk analysis for flexible-frequency requirements	Crosswalk	Same topic: Risk Management 35 loosely related (not mappings) 12.8.5 Responsibilities split with each provider documented Loosely related Only shares CSF GV.RM-05, GV.SC-04, GV.SC-07, GV.SC-09…: related, not a mapping 12.8.2 Written agreements with service providers Loosely related Only shares CSF GV.RM-05, GV.SC-04, GV.SC-07, GV.SC-10: related, not a mapping 12.8.4 Service provider compliance monitored annually Loosely related Only shares CSF GV.RM-05, GV.SC-04, GV.SC-07, GV.SC-09: related, not a mapping 1.2.4 Accurate account-data flow diagram maintained Loosely related Only shares CSF GV.SC-04, GV.SC-07, GV.SC-10: related, not a mapping 6.3.1 Vulnerabilities identified and risk-ranked Loosely related Only shares CSF GV.SC-07, GV.SC-09, ID.RA-05: related, not a mapping 6.3.2 Inventory of custom software and its components Loosely related Only shares CSF GV.SC-04, GV.SC-07, GV.SC-09: related, not a mapping 6.4.3 Payment page scripts authorised and integrity-checked Loosely related Only shares CSF GV.SC-07, GV.SC-09, GV.SC-10: related, not a mapping 12.5.2 PCI DSS scope confirmed annually and on change Loosely related Only shares CSF GV.SC-04, GV.SC-07, GV.SC-10: related, not a mapping …and 27 more in the downloads
CMMC	RA.L2-3.11.1	Risk Assessments	Crosswalk	Same topic: Risk Management 4 loosely related (not mappings) RA.L2-3.11.2 Vulnerability Scan Loosely related Only shares CSF GV.SC-10: related, not a mapping RA.L2-3.11.3 Vulnerability Remediation Loosely related Only shares CSF GV.SC-10: related, not a mapping SC.L2-3.13.2 Security Engineering Loosely related Only shares CSF PR.IR-03: related, not a mapping SI.L2-3.14.3 Security Alerts & Advisories Loosely related Only shares CSF ID.RA-03: related, not a mapping
800-53	PM-9 PM-28 RA-7 PM-1 PM-4 PM-6	Risk Management Strategy; Risk Framing…	Crosswalk	Same topic: Risk Management NIST SP 800-53 → ISO 27001 mapping 27 loosely related (not mappings) RA-3 Risk Assessment Loosely related Only shares CSF GV.RM-07, GV.SC-09, GV.SC-10, ID.RA-03…: related, not a mapping SA-9 External System Services Loosely related Only shares CSF GV.SC-04, GV.SC-07, GV.SC-09, GV.SC-10: related, not a mapping SR-6 Supplier Assessments and Reviews Loosely related Only shares CSF GV.SC-04, GV.SC-07, GV.SC-09, GV.SC-10: related, not a mapping PM-30 Supply Chain Risk Management Strategy Loosely related Only shares CSF GV.RM-05, GV.RM-07, GV.SC-09: related, not a mapping RA-9 Criticality Analysis Loosely related Only shares CSF GV.SC-04, GV.SC-07, ID.RA-04: related, not a mapping SA-4 Acquisition Process Loosely related Only shares CSF GV.SC-07, GV.SC-09, GV.SC-10: related, not a mapping SR-2 Supply Chain Risk Management Plan Loosely related Only shares CSF GV.RM-01, GV.SC-09, GV.SC-10: related, not a mapping SR-3 Supply Chain Controls and Processes Loosely related Only shares CSF GV.SC-07, GV.SC-09, GV.SC-10: related, not a mapping …and 19 more in the downloads
HIPAA	§164.308(a)(1)(ii)(B)	Risk Management	Editorial	Same topic: Risk Management (editorial pick) 11 loosely related (not mappings) §164.308(a)(1)(ii)(A) Risk Analysis Loosely related Only shares CSF GV.RM-07, GV.SC-09, GV.SC-10, ID.RA-03…: related, not a mapping §164.316(a) Policies and Procedures Loosely related Only shares CSF GV.RM-07, GV.SC-09, GV.SC-10, ID.RA-03…: related, not a mapping §164.308(b)(1) Business Associate Contracts and Other Arrangements Loosely related Only shares CSF GV.SC-04, GV.SC-07, GV.SC-09, GV.SC-10: related, not a mapping §164.308(b)(4) Written Contract or Other Arrangement Loosely related Only shares CSF GV.SC-04, GV.SC-07, GV.SC-09, GV.SC-10: related, not a mapping §164.314(a) Business Associate Contracts or Other Arrangements Loosely related Only shares CSF GV.SC-04, GV.SC-07, GV.SC-09, GV.SC-10: related, not a mapping §164.314(a)(2)(i) Business Associate Contracts Loosely related Only shares CSF GV.SC-04, GV.SC-07, GV.SC-09, GV.SC-10: related, not a mapping §164.314(a)(2)(ii) Other Arrangements Loosely related Only shares CSF GV.SC-04, GV.SC-07, GV.SC-09, GV.SC-10: related, not a mapping §164.314(a)(2)(iii) Business associate contracts with subcontractors Loosely related Only shares CSF GV.SC-04, GV.SC-07, GV.SC-09, GV.SC-10: related, not a mapping …and 3 more in the downloads
GDPR	Art.24(1)Art.32(2)	Responsibility of the controller; Security of processing	Editorial	Same topic: Risk Management (editorial pick) 6 loosely related (not mappings) Art.28(1) Processor Loosely related Only shares CSF GV.SC-04, GV.SC-07, GV.SC-09: related, not a mapping Art.35(1) Data protection impact assessment Loosely related Only shares CSF ID.RA-03, ID.RA-04, ID.RA-05: related, not a mapping Art.35(7) Data protection impact assessment Loosely related Only shares CSF ID.RA-03, ID.RA-04, ID.RA-05: related, not a mapping Art.28(3) Processor Loosely related Only shares CSF GV.SC-04, GV.SC-07: related, not a mapping Art.32(1)(b) Security of processing Loosely related Only shares CSF PR.IR-03: related, not a mapping Art.32(1)(c) Security of processing Loosely related Only shares CSF PR.IR-03: related, not a mapping
NIS2	2.1 7.1	Risk management framework; Policies and procedures to assess the effectiveness of cybersecurity risk-management measures	Crosswalk	Same topic: Risk Management 4 loosely related (not mappings) 5.1 Supply chain security policy Loosely related Only shares CSF GV.SC-04, GV.SC-07, GV.SC-09, GV.SC-10: related, not a mapping 6.10 Vulnerability handling and disclosure Loosely related Only shares CSF ID.RA-04, ID.RA-05: related, not a mapping 4.3 Crisis management Loosely related Only shares CSF PR.IR-03: related, not a mapping 5.2 Directory of suppliers and service providers Loosely related Only shares CSF GV.SC-04: related, not a mapping
Essential Eight	ISM-1515	Restoration of data, applications and settings from backups to a common point in time…	Loosely related	No mapping. Only shares CSF PR.IR-03: related, not a mapping
DORA	Art.5(2)(a)Art.6(1)Art.6(8)Art.16(1)Art.24(1)	Governance and organisation; ICT risk management framework…	Editorial	Same topic: Risk Management (editorial pick) 18 loosely related (not mappings) Art.8(2) Identification Loosely related Only shares CSF ID.RA-03, ID.RA-04, ID.RA-05: related, not a mapping Art.8(3) Identification Loosely related Only shares CSF ID.RA-03, ID.RA-04, ID.RA-05: related, not a mapping Art.8(7) Identification Loosely related Only shares CSF ID.RA-03, ID.RA-04, ID.RA-05: related, not a mapping Art.28(3) General principles Loosely related Only shares CSF GV.SC-04, GV.SC-07: related, not a mapping Art.28(4) General principles Loosely related Only shares CSF GV.SC-04, GV.SC-07: related, not a mapping Art.28(5) General principles Loosely related Only shares CSF GV.SC-04, GV.SC-07: related, not a mapping Art.28(8) General principles Loosely related Only shares CSF GV.SC-04, GV.SC-07: related, not a mapping Art.30(2) Key contractual provisions Loosely related Only shares CSF GV.SC-04, GV.SC-07: related, not a mapping …and 10 more in the downloads
CPS 234	Para 13 Para 15 Para 27 Para 31	Board ultimately responsible for information security; Maintain a capability commensurate with threats…	Editorial	Same topic: Risk Management (editorial pick) 6 loosely related (not mappings) Para 16 Assess third parties' information security capability Loosely related Only shares CSF GV.SC-04, GV.SC-07, GV.SC-09: related, not a mapping Para 17 Keep capability current as threats and vulnerabilities change Loosely related Only shares CSF ID.RA-03, ID.RA-04, ID.RA-05: related, not a mapping Para 21 Timely controls commensurate with risk and asset life-cycle Loosely related Only shares CSF ID.RA-03, ID.RA-04, ID.RA-05: related, not a mapping Para 22 Evaluate the design of third parties' controls Loosely related Only shares CSF GV.SC-04, GV.SC-07, GV.SC-09: related, not a mapping Para 28 Check third parties' control testing is adequate Loosely related Only shares CSF GV.SC-04, GV.SC-07: related, not a mapping Para 34 Internal audit assesses third-party assurance relied on Loosely related Only shares CSF GV.SC-04, GV.SC-07: related, not a mapping
Cyber Essentials	—	No requirement	No mapping in our data	No mapping in our data (Cyber Essentials covers five technical controls only).

Crosswalk a published crosswalk (NIST, ENISA, CIS, PCI SSC) makes the link · Editorial ControlMapping's judgement where no crosswalk exists; the reason is shown · Loosely related only shares a CSF 2.0 outcome: worth checking, not a mapping · No mapping in our data nothing mapped in our data; often new work, but check the coverage notes. How links are sourced.