Crosswalk
ISO/IEC 27001:2022
Where the corpus maps to ISO/IEC 27001:2022: Information security management systems: requirements.
Canonical citation
- Standard ID
- ISO/IEC 27001
- Current version
- 2022
- Publication date
- 2022-10
- Topic
- Information security management systems: requirements; ISO/IEC 27001:2022/Amd 1:2024 (Climate action changes), published 2024-02-23
- Upstream check location
- https://
www.iso.org/ standard/ 27001 (opens in a new tab) - Last verified (UTC)
- 2026-09-25
Mapped control areas, 23
Control areas from the reverse crosswalk
From the Reverse Framework Control Crosswalk Matrix, which answers: given a control identifier or family, which documents address it.
Coverage, 12 domains
Coverage by domain
From the GRC Library Compliance Alignment Matrix; the main crosswalk table's document counts land here.
Governance, 22 documents
- Governance Library Charter§5.1, §5.2, §6.1
- Exception and Risk Acceptance Management Policy§6.1.3, §8.2
- Records Retention and Destruction StandardA.5.33, A.8.10
- Emergency Authority StandardA.8.2, A.5.15, A.5.18, A.8.13, A.5.26, A.5.27
- Semantic Continuity in Migration and Retirement StandardA.8.32, §7.5.3
- Delegation-of-Authority StandardA.5.15, A.5.3, A.5.18
- Document Index and Classification Register§7.5
- Continuous Assurance and Improvement Framework§9.1, §9.2, §10.1
- Document Architecture and Interrelationship Framework§7.5, A.5.1
- Governance Performance and Improvement Framework§9.1, §9.3, §10.1
- Human Capital and Ethical Conduct FrameworkA.6.3, A.5.4
- Metrics, Monitoring and Performance Reporting Framework§9.1, A.5.35
- ESG and AI Ethics Disclosure Guideline§7.4
- Minimum Viable Governance Structure Guideline§5.1, §5.3, A.5.2
- Digital Twin and Simulation Governance Policy§8.1, A.5.15, A.8.15, A.8.24
- Continuous Improvement Register Procedure§10.1, §10.2, §9.3
- GRC Programme Management and Annual Review Procedure§9.3, §10.1, §10.2
- Whistleblower and Incident Reporting ProcedureA.6.8, A.5.24, A.5.28
- Data Retention ScheduleA.5.33, A.8.10
- Digital Trust and Assurance Metrics Register§9.1, A.5.35
- Role Authority RegisterA.5.2, A.5.3, §5.3
- AI Security Tooling Landscape RegisterA.5.7
Risk, 15 documents
- Enterprise Governance and Risk Management Policy§5.1, §5.3, §6.1, §6.2
- Enterprise Risk Management Standard§6.1.1, §6.1.2, §6.1.3, §8.2, §8.3
- Third-Party and Supply Chain Risk StandardA.5.19, A.5.20, A.5.21, A.5.22
- Risk Assessment Methodology Procedure§6.1.1, §6.1.2, §6.1.3, §8.2, §8.3
- Risk Register Procedure§6.1.2, §6.1.3, §8.2, §8.3, §9.1
- Risk Acceptance Procedure§6.1.3, §8.3
- Assurance Map Register§9.1, §9.2, A.5.35
- Key Risk Indicator Catalogue§6.1, §9.1
- Scenario Risk Catalogue§6.1, §8.2
- Quantitative Risk Analysis Guideline§6.1.2, §8.2
- Enterprise Risk Register Template§6.1.2, §6.1.3, §9.1
- Operational Risk Register Template§6.1.2, §6.1.3, §9.1
- Risk Appetite Statement Template§5.1, §6.1.1, §6.1.3
- Board Risk Report Template§5.1, §9.1, §9.3
- AI-Specific Risk Methodology Annex§6.1.2, §6.1.3, §8.2
Compliance, 37 documents
- Compliance, Audit, and CAPA Management Policy§9.2, §9.3, §10.1, §10.2
- Global Regulatory Applicability Register§4.1, §4.2, §6.1
- BASC IT and Information Security Responsibilities§5.3, §6.1, §9.1
- BASC IT Compliance Monitoring and KPIs§9.1
- UK AEO-S IT and Cybersecurity Requirements§5.3, §8.1, §9.1
- Legal and Regulatory Compliance Policy§4.1, §4.2, §6.1
- Internal Audit Standard§9.2
- Audit Planning Procedure§9.2
- Corrective and Preventive Action (CAPA) Procedure§10.1, §10.2
- Control Testing Procedure§9.1
- Mergers and Acquisitions Due Diligence Procedure§6.1, A.5.31
- Sanctions and Export-Control Screening Standard§4.1, A.5.31, A.5.33
- Compliance Obligations Register Template§4.1, §4.2, A.5.31
- Audit Evidence Package Template§9.2, A.5.35
- Regulator Interaction TemplatesA.5.5, A.5.24
- NIS 2 Implementation Annex§6.1, A.5.19, A.5.24
- DORA Implementation Annex§5.1, A.5.19, A.5.20, A.5.24, A.5.30
- MiCA Implementation Annex§5.1, A.5.31, A.5.36
- Financial Services Sector GRC Requirements Annex§4.1, §4.2, §6.1, A.5.19, A.5.24
- SOX IT General Controls AnnexA.5.15, A.5.18, A.8.32, A.8.13, §9.2
- Energy and Utilities Sector Requirements Annex§4.1, A.5.19, A.8.20, A.5.24, A.7.1
- Healthcare Sector GRC Requirements AnnexA.5.34, A.5.24, A.8.24
- United States HIPAA Sector Requirements AnnexA.5.31, A.5.34, A.5.26
- HIPAA Operational Compliance ProcedureA.5.34, A.5.33, A.5.26, A.5.20
- FedRAMP Sector Requirements Annex§5.1, A.5.1, A.8.16
- Public Sector GRC Requirements Annex§7.5, A.5.31, A.5.34
- eIDAS Sector Requirements AnnexA.5.31, A.8.5, A.5.34
- Canada Public Sector GRC Requirements AnnexA.5.31
- Telecommunications Sector Requirements AnnexA.8.20, A.8.16, A.5.30
- BASC Programme Overview Annex§4.1, §4.2
- Logistics Sector GRC Requirements Annex§4.1, §6.1
- BASC Information Security Policy§5.2, A.5.1, A.8.15
- UK AEO IT Self-Assessment Procedure§9.1, §9.2
- US CTPAT IT and Cybersecurity Compliance Controls RegisterA.5.15, A.8.8, A.5.24
- US CTPAT Minimum Security Criteria Controls RegisterA.7.1, A.6.1, A.5.19
- Canada PIP IT and Cybersecurity Compliance Controls RegisterA.5.15, A.8.24, A.8.8
- Trade Compliance Programme Gap Assessment Template§9.1, §9.2, A.5.36
Security, 36 documents
- Information Security Policy§5.2, A.5.1, A.5.2
- Identity and Access Management PolicyA.5.15, A.5.16, A.5.17, A.5.18
- Acceptable Use PolicyA.5.10, A.6.2, A.8.1
- Encryption and Key Management PolicyA.8.24
- Logging and Monitoring StandardA.8.15, A.8.16, A.8.17
- Monitoring Integrity and Coverage StandardA.8.6, A.8.15, A.8.16, A.5.25
- Data Classification and Handling StandardA.5.12, A.5.13, A.8.10
- Privileged Access Management StandardA.5.18, A.8.2
- Authentication and Password Management StandardA.5.17, A.8.5
- Security Incident Response ProcedureA.5.24, A.5.25, A.5.26, A.5.27, A.5.28, A.6.8
- Vulnerability Management ProcedureA.8.8
- Cryptographic Key Lifecycle Management FrameworkA.8.24
- Cryptographic Key Operations ProcedureA.8.24
- Key Escrow and Recovery ProcedureA.8.24, A.5.18
- Post-Quantum Cryptography Readiness RoadmapA.8.24
- Access Control ProcedureA.5.15, A.5.16, A.5.17, A.5.18
- Identity Management ProcedureA.5.16, A.5.17, A.5.18
- IT Onboarding and Offboarding ProcedureA.6.1, A.6.2, A.6.5, A.5.18
- Zero Trust Architecture FrameworkA.5.15, A.8.20, A.8.22
- Bring Your Own Device (BYOD) PolicyA.6.7, A.8.1
- Network Communications Security PolicyA.8.20, A.8.21, A.8.22
- Endpoint Hardening StandardA.8.1, A.8.7
- Email Security StandardA.5.14, A.8.21, A.8.23
- Data Loss Prevention StandardA.8.12
- SaaS Security Posture Management StandardA.5.23, A.5.19, A.5.22
- Remote Working Security StandardA.6.7, A.8.1
- Incident Escalation MatrixA.5.24, A.5.26, A.5.5
- Security Ticket Reporting SchemeA.5.24, A.5.25
- Security Operations Centre Operating Model StandardA.5.7, A.8.15, A.8.16
- Penetration Testing and Red Team StandardA.8.8, A.5.36, A.5.19
- Threat Modelling StandardA.8.25, A.8.27, A.8.28
- Security Disciplinary Process ProcedureA.6.4
- Personnel Security Screening StandardA.6.1, A.5.15
- Security Awareness and Training StandardA.6.3, §7.2
- Insider Risk Programme FrameworkA.6.1, A.6.4, A.8.16
- Acceptance Into Service PolicyA.8.32, A.5.37
Operations, 27 documents
- Production Security RequirementsA.8.8, A.8.9, A.8.31
- Network Security and Segmentation StandardA.8.20, A.8.21, A.8.22
- Cloud Security Configuration BaselineA.8.9, A.8.23, A.8.24
- Physical Security of IT Infrastructure StandardA.7.1, A.7.2, A.7.3, A.7.4, A.7.5, A.7.6, A.7.7, A.7.8
- Certificate Authority Management StandardA.8.24
- Change Management and Configuration Control ProcedureA.8.9, A.8.32
- Endpoint Management and Device Compliance ProcedureA.8.1, A.8.7
- Media Handling and Transport ProcedureA.7.10, A.8.10
- Security Monitoring and Alert Management ProcedureA.8.15, A.8.16
- Threat Intelligence and SIEM Operations ProcedureA.5.7, A.8.16
- IT Service Management FrameworkA.5.24, A.5.26, A.8.32
- Service Level Management Standard§9.1, A.5.22
- Site Reliability Engineering StandardA.5.29, A.5.26, A.8.32
- Patch Management ProcedureA.8.8, A.8.32, A.5.36
- Release Management ProcedureA.8.32
- Capacity and Performance Management StandardA.8.6
- Observability and Telemetry StandardA.8.15, A.8.16
- IT Financial Management Standard§5.1, A.5.9
- Asset Inventory RegisterA.5.9, A.5.10, A.8.1
- IT Operations Key Performance Indicators Register§6.1, §9.1
- IT Security Operations Register§9.1, A.8.8
- OT/ICS Security StandardA.8.20, A.8.22, A.8.7, A.8.8, A.7.4
- Operational Technology Security Overview AnnexA.8.22
- Building Management Systems (BMS) Overlay AnnexA.7.4, A.8.22, A.5.34
- OT Change Management ProcedureA.8.32, A.8.9, A.5.37
- OT Incident Response ProcedureA.5.24, A.5.25, A.5.26, A.5.27, A.5.28
- OT Asset Inventory and Lifecycle RegisterA.5.9
Supply chain, 18 documents
- Supplier and Cloud Governance FrameworkA.5.19, A.5.20, A.5.21, A.5.22, A.5.23
- Supplier Security and Privacy Assurance StandardA.5.19, A.5.20, A.5.21, A.5.22
- Supplier Resilience Monitoring StandardA.5.19, A.5.22, A.5.30
- Cloud Exit and Data Portability StandardA.5.20, A.5.23
- Supplier Due Diligence ProcedureA.5.19, A.5.20
- Supplier Onboarding Security Review ProcedureA.5.19, A.5.20, A.5.21
- Supplier Ongoing Monitoring ProcedureA.5.19, A.5.22, §9.1
- Supplier Audit ProcedureA.5.20, A.5.22, §9.2
- Supplier Exit and Data Return ProcedureA.5.18, A.5.20, A.8.10
- Fourth-Party and Nth-Party Risk ProcedureA.5.19, A.5.21, A.5.22
- Third-Party AI Due Diligence ProcedureA.5.19, A.5.20, A.5.21, A.5.22
- Concentration Risk RegisterA.5.19, A.5.21, A.5.30, §6.1
- Software Bill of Materials RegisterA.5.21, A.8.8
- Subprocessor Register TemplateA.5.19, A.5.20, A.5.21, A.5.34
- Supplier Risk Register TemplateA.5.19, A.5.20, A.5.21, A.5.22
- Supplier Offboarding Evidence TemplateA.5.11, A.5.22, A.8.10
- Supplier Security QuestionnaireA.5.19, A.5.21, A.5.22
- Trade and Supply-Chain Continuity Controls AnnexA.5.19, A.5.29, A.5.30
Resilience, 21 documents
- Business Continuity and Disaster Recovery PolicyA.5.29, A.5.30
- Business Continuity and Disaster Recovery StandardA.5.29, A.5.30, A.8.14
- Backup and Recovery ProcedureA.8.13
- Business Continuity and Resilience FrameworkA.5.29, A.5.30, A.8.13, A.8.14
- Business Continuity and Crisis Management PlanA.5.24, A.5.29, A.5.30
- IT Disaster Recovery PlanA.5.29, A.5.30, A.8.13, A.8.14
- Pandemic Continuity PlanA.5.29, A.5.30
- Physical Site Continuity PlanA.5.29, A.5.30
- Crisis Communication PlanA.5.24, A.5.26
- Business Impact Analysis ProcedureA.5.29, A.5.30
- Continuity and Recovery Testing ProcedureA.5.30, A.8.13
- Crisis Management and Emergency Operations Activation ProcedureA.5.29, A.5.30
- Cross-Domain Incident Coordination ProcedureA.5.24, A.5.26, A.5.28
- Security Incident Reporting and Escalation ProcedureA.5.24, A.5.25, A.5.26, A.6.8
- Emergency Response and Protective Actions GuidelineA.5.24, A.5.29
- Emergency Operations Contact Directory RegisterA.5.24, A.5.29
- Resilience Metrics and Testing Log RegisterA.5.29, A.5.30, §9.1
- Departmental Continuity Plan TemplateA.5.29, A.5.30
- Lessons Learned TemplateA.5.27
- Recovery Runbook TemplateA.5.30, A.8.13
- Tabletop Exercise TemplateA.5.30
Privacy, 52 documents
- Privacy and Data Governance PolicyA.5.34, A.8.11, A.8.12
- Privacy Impact and Cross-Border Transfer ProcedureA.5.34
- Privacy Management Programme CharterA.5.34, A.5.31, §5.3
- Children's Data FrameworkA.5.34, A.8.12
- Consent Management FrameworkA.5.34
- Privacy by Design FrameworkA.5.34, A.8.25, A.8.27
- Pseudonymization and Anonymization StandardA.8.11, A.5.34
- Automated Decision-Making and Profiling RegisterA.5.34
- Cookie and Tracker RegisterA.5.34
- Cross-Border Data Flow RegisterA.5.34, A.5.31
- Transfer Impact Assessment (TIA) TemplateA.5.34, A.5.31
- Privacy Jurisdiction IndexA.5.31, A.5.34
- Data Protection and Privacy Breach Response ProcedureA.5.34, A.5.26, A.6.8
- Breach Notification Regulator Register TemplateA.5.34, A.6.8
- Data Subject Rights Management ProcedureA.5.34, A.5.33
- DPIA (Data Protection Impact Assessment) TemplateA.5.34, §6.1
- Legitimate Interest Assessment (LIA) TemplateA.5.34, §6.1
- Data Subject Access Request Workflow TemplateA.5.34, A.5.33
- Joint Controller Arrangement TemplateA.5.34
- Privacy Notice TemplateA.5.34, §7.4
- Record of Processing Activities TemplateA.5.34, A.5.33, §7.5
- Data Processing Agreement Template (GDPR Article 28)A.5.34, A.5.20, A.5.19
- Australia Privacy Regulatory RequirementsA.5.34, A.5.31
- Brazil Privacy Regulatory RequirementsA.5.34, A.5.31
- Chile Privacy Regulatory RequirementsA.5.34, A.5.31
- Peru Privacy Regulatory RequirementsA.5.34, A.5.31
- Colombia Privacy Regulatory RequirementsA.5.34, A.5.31
- Ecuador Privacy Regulatory RequirementsA.5.34, A.5.31
- Canada Privacy Regulatory RequirementsA.5.34, A.5.31
- China Privacy Regulatory RequirementsA.5.34, A.5.31
- European Union Privacy Regulatory RequirementsA.5.34, A.5.31
- India Privacy Regulatory RequirementsA.5.34, A.5.31
- Indonesia Privacy Regulatory RequirementsA.5.34, A.5.31
- Japan Privacy Regulatory RequirementsA.5.34, A.5.31
- Kenya Privacy Regulatory RequirementsA.5.34, A.5.31
- Latin America Privacy Regulatory RequirementsA.5.34, A.5.31
- Malaysia Privacy Regulatory RequirementsA.5.34, A.5.31
- Mexico Privacy Regulatory RequirementsA.5.34, A.5.31
- New Zealand Privacy Regulatory RequirementsA.5.34, A.5.31
- Nigeria Privacy Regulatory RequirementsA.5.34, A.5.31
- Philippines Privacy Regulatory RequirementsA.5.34, A.5.31
- Saudi Arabia Privacy Regulatory RequirementsA.5.34, A.5.31
- Singapore Privacy Regulatory RequirementsA.5.34, A.5.31
- South Africa Privacy Regulatory RequirementsA.5.34, A.5.31
- South Korea Privacy Regulatory RequirementsA.5.34, A.5.31
- Switzerland Privacy Regulatory RequirementsA.5.34, A.5.31
- Thailand Privacy Regulatory RequirementsA.5.34, A.5.31
- Turkey Privacy Regulatory RequirementsA.5.34, A.5.31
- United Arab Emirates Privacy Regulatory RequirementsA.5.34, A.5.31
- United Kingdom Privacy Regulatory RequirementsA.5.34, A.5.31
- United States Privacy Regulatory RequirementsA.5.34, A.5.31
- Vietnam Privacy Regulatory RequirementsA.5.34, A.5.31
Architecture, 8 documents
- Enterprise Architecture Framework§6.1, A.5.8, A.8.27
- Architecture Review ProcedureA.5.8, A.8.27, §8.1
- API Design StandardA.5.14, A.8.26, A.8.27
- Architecture Decision Records Standard§7.5, A.8.27
- Data Architecture StandardA.5.12, A.5.13, A.5.34, A.8.10
- Integration Architecture StandardA.5.14, A.8.20, A.8.21, A.8.26
- Reference Architecture StandardA.8.27, A.8.32
- Technology Radar Standard§6.1, A.5.21
Dev security, 17 documents
- AI Coding Assistant Security GuidelineA.8.27, A.8.29, A.5.36
- Secure Development and Engineering PolicyA.8.25, A.8.28, A.8.29, A.8.30, A.8.31
- Secure Code Review ProcedureA.8.28, A.8.29, A.8.30, A.8.4
- Compliance Controls and Gap Register TemplateA.5.36, A.5.35, §9.1
- API Security StandardA.8.26, A.8.28, A.8.25, A.5.14
- AWS Cloud Hardening Baseline StandardA.8.9, A.8.20, A.8.24, A.8.15, A.5.15
- Azure Cloud Hardening Baseline StandardA.8.9, A.8.20, A.8.24, A.8.15, A.5.15
- Google Cloud Platform Hardening Baseline StandardA.8.9, A.8.20, A.8.24, A.8.15, A.5.15
- Container and Image Security StandardA.8.25, A.8.8, A.8.7, A.8.28
- Developer Security RequirementsA.8.28, A.8.25, A.5.17, A.8.24, A.8.8
- DevOps Security RequirementsA.8.25, A.8.27, A.8.31, A.8.32
- Mobile Application Security StandardA.8.26, A.8.25, A.8.28, A.8.24
- Quality Assurance and Testing StandardA.8.29, A.8.31, A.8.32
- Security Baseline and Standards ReferenceA.5.1, A.5.12, A.5.15, A.8.15, A.8.24
- Security Quick ReferenceA.5.15, A.5.12, A.8.24, A.8.8, A.8.32
- Software Composition Analysis StandardA.8.8, A.5.21
- Software Evaluation, Acceptance and Lifecycle Management StandardA.8.29, A.8.31, A.8.32
AI, 45 documents
- AI Governance Council Charter§5.1, §5.3, A.5.2
- AI Ethics Review Panel Charter§5.3, A.5.4
- AI Algorithmic Compliance ChecklistA.5.36, A.8.29, A.8.34
- AI Governance and Risk Framework§6.1, A.5.9, A.5.19
- AI Model Documentation and Transparency Framework§7.5, A.5.37, A.5.34
- AI Model Risk Framework§6.1, §8.2, A.8.29
- AI System Audit and Certification Framework§9.2, §9.3, A.5.35
- AI Adversarial Test ReferenceA.8.29, A.8.8, A.8.34
- AI Security Technical Implementation GuideA.8.25, A.8.28, A.8.16
- Adversarial Evaluation Suite Development GuidelineA.8.29, A.8.8, A.5.36
- Ethical AI Use GuidelineA.5.1, A.6.3, A.5.34
- AI Incident Response PlanA.5.24, A.5.26, A.5.27
- AI Compliance PolicyA.5.31, §5.2, A.5.24
- AI Audit Procedure§9.2, §10.1, A.5.35
- AI Evaluation Procedure§8.1, A.8.29, A.5.35
- AI Model Lifecycle Management Procedure§8.1, A.8.32, A.8.16
- AI Model Risk Assessment Procedure§6.1.2, §8.2, A.5.7
- AI System Impact Assessment ProcedureA.5.34, §6.1.2, A.5.7
- Foundation Model Lifecycle ProcedureA.5.19, A.5.21, A.8.32
- Training Data Governance ProcedureA.5.34, A.5.33, A.8.10
- AI Risk Register§6.1.2, §6.1.3, §8.2
- Model Context Protocol Server RegisterA.5.19, A.8.9, A.8.15
- Model Registry§8.1, A.5.9, A.8.32
- AI Access and Agent Permissions StandardA.5.15, A.5.16, A.5.17, A.5.18, A.8.2
- AI and Agentic Development Security StandardA.8.25, A.8.28, A.8.29, A.8.16
- AI Inference Cost Governance StandardA.8.6, A.5.20
- AI Model Risk StandardA.5.9, A.8.16, A.5.7, A.5.36
- AI Security and Risk StandardA.5.1, A.8.16, A.5.15, A.5.19
- AI Testing, Validation and Documentation StandardA.8.29, A.8.33, A.5.36, A.8.16
- AI Red Team Report TemplateA.8.29, A.8.8, §9.1
- AI System Register TemplateA.5.9, §6.1.2, A.5.19
- AI Vendor Security Questionnaire TemplateA.5.19, A.5.20, A.5.21
- Dataset Datasheet TemplateA.5.9, A.8.10, §7.5
- Model Card Template§7.5, A.5.9, §9.1
- System Card Template§7.5, A.5.15, §9.1
- Agentic Response State Model FrameworkA.5.25, A.5.26, A.8.15
- AI Human-Oversight StandardA.5.2, A.6.3
- AI Maturity Model Framework§9.1, §10.1
- AI Value and Decision-Governance Framework§5.3, §9.1
- AI Board Oversight Guide§5.1, §5.3, §9.3
- AI Synthetic-Content Provenance GuidelineA.5.31
- Integrated AI and Privacy Assessment ProcedureA.5.34, §6.1.2
- AI Data Quality and Readiness Validation Standard§8.1, A.8.10
- AI Model Succession and Identity Continuity StandardA.5.18
- AI Actor Role and Forum Standing CharterA.5.2
Crypto, 2 documents
- Crypto-Asset Governance Framework§6.1.2, A.5.2, A.5.9, A.5.19, A.5.31
- Digital Asset Custody StandardA.5.1, A.5.3, A.5.9, A.5.26, A.5.33, A.8.24
Corpus citations, 119
Documents naming it in their framework alignment
Generated from each document's framework alignment list in the taxonomy, through the committed alias map.
- Acceptable Use PolicySecurity
- Acceptance Into Service PolicySecurity
- Access Control ProcedureSecurity
- AI Access and Agent Permissions StandardAI
- AI Coding Assistant Security GuidelineDev security
- AI Model Succession and Identity Continuity StandardAI
- AI Red Team Report TemplateAI
- AI Security and Risk StandardAI
- AI Testing, Validation and Documentation StandardAI
- API Design StandardArchitecture
- API Security StandardDev security
- Architecture Review ProcedureArchitecture
- Asset Inventory RegisterOperations
- Assurance Map RegisterRisk
- Audit Planning ProcedureCompliance
- Audit Programme SpecificationGovernance
- Authentication and Password Management StandardSecurity
- AWS Cloud Hardening Baseline StandardDev security
- Azure Cloud Hardening Baseline StandardDev security
- BASC Information Security PolicyCompliance
- Board Risk Report TemplateRisk
- Bring Your Own Device (BYOD) PolicySecurity
- Building Management Systems (BMS) Overlay AnnexOperations
- Capability Is Not Authority PrincipleGovernance
- Capacity and Performance Management StandardOperations
- Certificate Authority Management StandardOperations
- Change Management and Configuration Control ProcedureOperations
- Citation Verification SpecificationGovernance
- Cloud Exit and Data Portability StandardSupply chain
- Cloud Security Configuration BaselineOperations
- Container and Image Security StandardDev security
- Continuous Assurance and Improvement FrameworkGovernance
- Continuous Improvement Register ProcedureGovernance
- Control Testing ProcedureCompliance
- Corrective and Preventive Action (CAPA) ProcedureCompliance
- Cross-Domain Incident Coordination ProcedureResilience
- Data Architecture StandardArchitecture
- Data Processing Agreement Template (GDPR Article 28)Privacy
- Data Retention ScheduleGovernance
- Delegation-of-Authority StandardGovernance
- Developer Security RequirementsDev security
- DevOps Security RequirementsDev security
- Digital Twin and Simulation Governance PolicyGovernance
- DORA Implementation AnnexCompliance
- Email Security StandardSecurity
- Emergency Authority StandardGovernance
- Employee Monitoring Notice TemplatePrivacy
- Endpoint Hardening StandardSecurity
- Endpoint Management and Device Compliance ProcedureOperations
- Energy and Utilities Sector Requirements AnnexCompliance
- Enterprise Architecture FrameworkArchitecture
- Exception and Risk Acceptance Management PolicyGovernance
- Fail-Closed Automation PrincipleGovernance
- Google Cloud Platform Hardening Baseline StandardDev security
- Governance Performance and Improvement FrameworkGovernance
- GRC Programme Management and Annual Review ProcedureGovernance
- HIPAA Operational Compliance ProcedureCompliance
- Identity and Access Management PolicySecurity
- Identity Management ProcedureSecurity
- Information Security PolicySecurity
- Insider Risk Programme FrameworkSecurity
- Integration Architecture StandardArchitecture
- Integrity and Trustworthiness PrincipleGovernance
- Internal Audit StandardCompliance
- IT Financial Management StandardOperations
- IT Onboarding and Offboarding ProcedureSecurity
- IT Security Operations RegisterOperations
- Legal and Regulatory Compliance PolicyCompliance
- Legitimate Interest Assessment for Employment Monitoring AnnexPrivacy
- Library Health Report TemplateGovernance
- Media Handling and Transport ProcedureOperations
- MiCA Implementation AnnexCompliance
- Minimum Viable Governance Structure GuidelineGovernance
- Mobile Application Security StandardDev security
- Model Context Protocol Server RegisterAI
- Monitoring Integrity and Coverage StandardSecurity
- Network Communications Security PolicySecurity
- Network Security and Segmentation StandardOperations
- Network Telemetry and DPI Controls StandardPrivacy
- NIS 2 Implementation AnnexCompliance
- Observability and Telemetry StandardOperations
- Operational Technology Security Overview AnnexOperations
- OT Asset Inventory and Lifecycle RegisterOperations
- OT Change Management ProcedureOperations
- OT/ICS Security StandardOperations
- Patch Management ProcedureOperations
- Penetration Testing and Red Team StandardSecurity
- Personnel Security Screening StandardSecurity
- Physical Security of IT Infrastructure StandardOperations
- Post-Quantum Cryptography Readiness RoadmapSecurity
- Presence Inference Limitations StandardPrivacy
- Privileged Access Management StandardSecurity
- Production Security RequirementsOperations
- Quality Assurance and Testing StandardDev security
- Release Management ProcedureOperations
- Remote Working Security StandardSecurity
- SaaS Security Posture Management StandardSecurity
- Secure Code Review ProcedureDev security
- Security Awareness and Training StandardSecurity
- Security Baseline and Standards ReferenceDev security
- Security Disciplinary Process ProcedureSecurity
- Security Incident Response ProcedureSecurity
- Security Operations Centre Operating Model StandardSecurity
- Semantic Continuity in Migration and Retirement StandardGovernance
- Site Reliability Engineering StandardOperations
- Software Evaluation, Acceptance and Lifecycle Management StandardDev security
- Supplier Offboarding Evidence TemplateSupply chain
- Supplier Security and Privacy Assurance StandardSupply chain
- Tabletop Exercise TemplateResilience
- Technology Radar StandardArchitecture
- Third-Party and Supply Chain Risk StandardRisk
- Threat Intelligence and SIEM Operations ProcedureOperations
- Threat Modelling StandardSecurity
- UK AEO IT Self-Assessment ProcedureCompliance
- Vulnerability Management ProcedureSecurity
- Whistleblower and Incident Reporting ProcedureGovernance
- Workforce Network Monitoring PolicySecurity
- Works Council and Employee Representative Consultation ProcedurePrivacy
- Zero Trust Architecture FrameworkSecurity
Note
What this mapping is
From the GRC Library Compliance Alignment Matrix: citations are indicative, not exhaustive (the representative-citation convention), and no entry constitutes a certification, attestation, or legal opinion.
From the Reverse Framework Control Crosswalk Matrix: coverage is partial, and external control identifiers and clause numbers are referenced for navigation only; the library does not reproduce third-party control text.
From the Cross-Framework Alignment Matrix: the alignment is not an official mapping, certification claim, legal opinion, or reproduction of third-party framework content.
The standards, laws, frameworks, and programmes in the canonical citations register, mapped here or not, are listed with their current editions on the Standards & frameworks page, generated from that register.