CIS Critical Security Controls ↔ ISO/IEC 27001
17 canonical controls in Keel's library satisfy clauses of both CIS Critical Security Controls and ISO/IEC 27001. Implement each once, attach the evidence once, and it counts toward each standard. The overlap is the work you don't repeat.
Controls that satisfy both
| Canonical control | CIS Critical Security Controls clauses | ISO/IEC 27001 clauses |
|---|---|---|
| Risk assessment & treatment A documented process to identify, analyze, evaluate, and treat information security risks on a defined cadence. | 18 | A.5.7 |
| Access control policy Rules for granting, reviewing, and revoking access to systems and data based on business need and least privilege. | 5, 6 | A.5.15 |
| User provisioning & deprovisioning Joiner/mover/leaver process to grant, change, and promptly remove access across systems. | 5.3, 6 | A.8.3 |
| Multi-factor authentication MFA enforced for remote access, administrative access, and access to sensitive systems and data. | 6.3, 6.5 | A.8.5 |
| Encryption in transit & at rest Strong cryptography protects sensitive data in transit over public networks and at rest in storage. | 3.11 | A.8.24 |
| Logging & monitoring Security-relevant events are logged, protected, retained, and reviewed for anomalies. | 8.1, 8.2 | A.8.15, A.8.16 |
| Vulnerability management Regular scanning, prioritization, and remediation of vulnerabilities across systems and applications. | 7.1, 7.3 | A.8.8 |
| Malware protection Anti-malware controls prevent, detect, and respond to malicious software on endpoints and servers. | 9, 10 | A.8.7 |
| Backups Regular, tested backups of critical data and systems with defined retention. | 11 | A.8.13 |
| Incident response A documented, tested plan to detect, triage, contain, remediate, and communicate security incidents. | 17.1, 17.4 | A.5.24, A.5.26 |
| Third-party / vendor risk management Due diligence, contractual safeguards, and ongoing monitoring of vendors that handle your data. | 15 | A.5.19 |
| Security awareness training Ongoing security awareness training for all personnel, with completion tracking. | 14 | A.6.3 |
| Asset inventory An inventory of hardware, software, and information assets with assigned owners. | 1, 2 | A.5.9 |
| Data classification & handling Information is classified and handled per its sensitivity, with rules for labeling and protection. | 3 | A.5.12 |
| Secure software development Secure coding, review, and testing practices across the development lifecycle. | 16 | A.8.25 |
| Network security controls Firewalls/segmentation and network controls restrict traffic to and from sensitive environments. | 12, 13, 4.4, 4.5 | A.8.20, A.8.22 |
| Data retention & secure disposal Data is retained per policy and securely destroyed when no longer needed. | 3.5 | A.8.10 |
Clause identifiers (CIS Critical Security Controls and ISO/IEC 27001) are referenced factually for mapping. Keel is not affiliated with or endorsed by the bodies that publish these standards. Control descriptions are Keel's own; a framework's full authored control count is on its framework page.
Why this is one project, not two
On a crosswalk-native model, ISO/IEC 27001 mostly lights up controls you already built for CIS Critical Security Controls. You're not re-uploading the same screenshot for a second audit. You apply the framework and see the genuine delta worth working. That's the whole idea behind collect once, comply everywhere.