Crosswalk pair
GDPR and ISO/IEC 27001, control by control
19 canonical controls in Keel’s library satisfy clauses of both GDPR and ISO/IEC 27001. Implement each once, attach the evidence once, and it counts toward each standard. The overlap is the work you don’t repeat.
The overlap
What the two libraries have in common
Every figure here counts canonical controls in Keel’s library, not clauses of either standard. Each standard’s own authored count is on its framework page.
19
Controls that satisfy both
Canonical controls that crosswalk to at least one clause of each.
50
In Keel’s library for GDPR
38% of them also map to ISO/IEC 27001.
84
In Keel’s library for ISO/IEC 27001
23% of them also map to GDPR.
81
Evidence artifacts expected
Across the shared controls, from Keel’s evidence guidance. Gathered once.
-
GDPR 38%
19 controls of 50 in Keel’s library for GDPR also map to ISO/IEC 27001.
-
ISO/IEC 27001 23%
19 controls of 84 in Keel’s library for ISO/IEC 27001 also map to GDPR.
The mapping
Controls that satisfy both
Each row is one control in Keel’s library and the clauses it answers on each side. Do the work once; both columns are then evidenced by the same artifacts.
| Canonical control | GDPR clauses | ISO/IEC 27001 clauses |
|---|---|---|
| Governance & Risk | ||
| Information security policy A board-approved policy set covering information security and the handling of personal data, sized to the scale of the organization and the type of activities it actually carries out, reviewed at least annually and communicated to the workforce. The policy set states the direction the organization is taking on information security - what it commits to, and what it requires of everyone doing work for it - so it sets where the program is going rather than only recording what it already does. One or more named individuals are designated to coordinate the program the policies describe - the person in charge of it, named rather than implied, with the designation recorded in writing, made known to the people who need it and kept current as roles change - so there is someone who answers for the policies being carried out and not only for their being published. How far the policies go, and how far the measures they require go, is judged against four things together: the organization’s size, complexity and capabilities; its technical infrastructure and the security capabilities of its hardware and software; what the measures cost; and how likely the risks they address are and how much damage they would do. A policy may be changed at any time, provided the change is documented and is actually put into effect rather than only written down. Review is triggered by events as well as by the calendar: the policy set is revisited and updated when the requirements the organization is under change, when the threat picture changes, when the technology it depends on changes, and when its mission changes - and it is enforced rather than only issued, with non-compliance handled through the stated route instead of tolerated. | Art.24(2) | 5.2, A.5.1 |
| Risk assessment & treatment A documented process to identify, analyze, evaluate, and treat information security risks on a defined cadence, and again whenever a significant change is proposed or has happened - a new system, a new supplier, a reorganization, a serious incident - so the picture is refreshed by events and not only by the calendar. The process is repeatable: the criteria for accepting risk and for deciding when an assessment is performed are set in advance and applied the same way each time, so repeated assessments produce consistent, comparable and valid results rather than a different answer depending on who ran it. Every risk has a named owner who approves how it will be treated and accepts what is left afterwards. The assessment covers risks and vulnerabilities to the confidentiality, the integrity and the availability of the data the organization holds - all three, not confidentiality alone - and is accurate and thorough enough to be relied on by the decisions taken from it. Treatment brings each risk down to a level that is reasonable and appropriate for this organization, which is the target the process is judged against rather than merely recording that a risk exists. Each assessment and its results are retained as documented information. The process is set down as a documented risk assessment policy with supporting procedures, issued to the roles it binds, owned by a named role, and reviewed and updated on a defined cadence and after an event that changes how the organization assesses risk. The criteria are stated as risk appetite and risk tolerance: how much risk the organization is willing to seek in pursuit of its objectives, and how much variation around that it will tolerate - written down, communicated to the people who take risk decisions, and maintained as the organization and its environment change rather than set once and inherited. The method itself is standardized and communicated: how a risk is calculated, how it is documented, which category it falls into and how it is prioritized against the others, so two people assessing the same thing produce the same rating. What the assessment works from is recorded rather than assumed. The threats to the organization, internal as well as external, are identified and written down. The impacts each could have, and how likely each is, are identified and recorded against them. And the threats, the vulnerabilities, the likelihoods and the impacts are then used together to understand the risk as it stands before any treatment is applied, and to decide which responses are taken first. | Art.32(2) | 6.1, 8.2 |
| Access Control | ||
| Access control policy Rules for granting, reviewing, and revoking access to systems and data based on business need and least privilege; anyone who works with sensitive data, or in a place from which it can be reached, is individually authorized for that work or supervised while doing it; and a documented emergency route exists to obtain the data when the normal access path is unavailable, with every use of that route recorded and reviewed afterwards. The rules also settle the opposite question: which actions, if any, a person may take on a system without identifying or authenticating themselves at all. Those actions are identified rather than left as whatever the system happens to permit, they are limited to what the organization’s business actually requires, and each one is documented in the system’s security plan together with the reasoning that justifies it, so an unauthenticated path is a decision somebody made and can be asked about. The rules are enforced by access control lists set on the data itself, not only by what an application chooses to show: permissions on local and remote file systems, on databases and inside applications are configured to the holder’s need to know, so information a role has no business reading is unreachable rather than merely unadvertised. What an authorized user may DO is limited on the same terms as what they may read: the types of transaction and function each role is permitted to execute are decided in advance and enforced by the system, so holding access to an application does not carry the right to run every operation inside it, and an action outside the permitted set is refused rather than merely unadvertised in the interface. Enforcement is centralized wherever the systems support it - access decisions for enterprise assets are made by a single directory service or single sign-on provider rather than by each system keeping its own list - and the systems that make those decisions are themselves known: an inventory of the organization’s authentication and authorization systems is maintained, including those run by a service provider on its behalf, and reviewed on a defined cadence. | Art.32(1) | A.5.15 |
| Multi-factor authentication Documented procedures verify that a person or system seeking access to sensitive data is the one it claims to be, on every path by which that data can be reached - and multi-factor authentication is the enforced mechanism for remote access, administrative access, and access to sensitive systems and data. The multi-factor mechanism itself is configured so it cannot be bypassed, so the factors it uses are genuinely independent of one another - one factor’s success granting no knowledge of and no route around another - and so access is refused unless every factor required has succeeded. The requirement is not confined to the accounts that carry privilege: every account is covered, privileged and non-privileged alike, because an ordinary account is the usual way into a privileged one. The mechanisms chosen are resistant to replay, so an authentication captured on the wire or lifted from a log cannot be presented again to gain access. Authentication is not a single event at the start of a session either: the person is required to authenticate again when the organization’s defined circumstances arise - a change of role or of the authenticators themselves, an escalation to privilege, a session that has run beyond its defined life, or a request to perform an action the organization has designated as requiring fresh proof. | Art.32(1) | A.8.5 |
| User provisioning & deprovisioning Joiner/mover/leaver process to grant, change, and promptly remove access across systems, in which every person is issued an account of their own carrying a unique name or number, so an action in a log traces back to one named individual rather than to a shared or generic login. Each person’s right of access is recorded when it is established and reviewed on a schedule thereafter, as well as granted and changed - so what someone holds is a documented position that has been looked at again, not the accumulated residue of past requests - and what may be granted follows the organization’s access authorization rules rather than the judgment of whoever processes the request. Identity is managed as a lifecycle in its own right and not only as the access hung off it: an identity is created only after the person or the thing behind it has been verified to a stated standard, is linked to a single accountable human owner, and is disabled and then retired on a defined path rather than deleted where the record has to survive for an audit trail. A shared or generic identity exists only where there is a reason it cannot be individual, and then it is authorized, given an owner who answers for what is done with it, and reviewed. Identities issued to services, applications, devices and automation are registered on the same terms as human ones, with an owner, a purpose and a review date, because an unowned machine identity outlives every person who knew what it was for. Dormant identities are detected and removed rather than waiting for a leaver process that was never triggered. The lifecycle is run by automated mechanisms wherever the systems allow it: accounts are provisioned and deprovisioned from an authoritative source of record, and each act of creating, modifying, enabling, disabling or removing an account generates an audit record automatically rather than depending on the administrator to note it. An account issued for a temporary or emergency purpose carries an expiry from the moment it is created and is disabled or removed automatically when that expiry passes, so a route opened for one situation does not stay open after it. An account is disabled within a defined period when it has expired, when it is no longer associated with any individual, when it is in violation of the organization’s policy, or when it has been inactive beyond a defined period - and where an individual is found to pose a significant risk, within a defined period of that discovery rather than at the next scheduled review. Identifiers are managed as an object in their own right: an identifier is authorized before it is assigned, is selected to a defined convention, is never reused for a different person or entity, and is issued on the same terms whether it names an individual, a group, a role, a service or a device - and where the organization needs to distinguish one class of person from another, such as an employee from a contractor or a vendor, the identifier or its record carries that status rather than leaving it to be inferred. Identity proofing is performed to the assurance level the access warrants: the applicant is resolved to a single unique individual, is required to present identity evidence to whoever registers them, and that evidence is validated and verified by methods the organization has defined rather than accepted on sight, with an address of record confirmed through an out-of-band channel where the assurance level calls for it. All of it is answerable from one INVENTORY OF ACCOUNTS rather than from each system in turn: every account the organization manages is listed - ordinary user, administrator and service alike - with the person or function behind it, the account name, the dates it starts and stops, the department or owner it belongs to and the privilege it carries, and the list is validated against what is actually active on a defined recurring schedule, so an account nobody can account for is found by the review rather than by an incident. Accounts are managed centrally through a directory or identity service wherever a system can be brought into one, because an account that lives only inside an application is the one a leaver process misses. | Art.32(1) | A.5.16, A.5.18, A.8.3 |
| Data Protection & Privacy | ||
| Data classification & handling Information is classified and handled per its sensitivity, with rules for labeling and protection - including the everyday handling rules that stop it being seen, overheard or picked up by people with no business reading it, so exposure that happens incidentally alongside legitimate work is limited rather than accepted. The handling rules are written to cover disclosure that nobody intended as much as disclosure that somebody chose, they say what an unauthorized disclosure is against the organization’s own privacy and confidentiality rules rather than leaving that to judgment in the moment, and they reach every medium the information travels in - spoken, on paper, on a screen and in a system - because the incidental exposure they exist to limit does not respect the boundary between an administrative, a physical and a technical safeguard. Labeling is the procedure that makes the classification visible, and it is defined rather than left to habit: there is a label for each level of the scheme, a rule for how the label is applied in each form the information takes - a document, an email, a file, a database field, a screen, a report, a piece of removable media, a printed page - and, where a system supports it, the label is carried in metadata so it can be acted on automatically rather than only read. The person who creates or receives the information applies the label at that point rather than later, the label travels with the information when it is copied, extracted, exported or transferred so a copy does not arrive unclassified, and information derived from or aggregated out of classified sources is labeled for what the combination is worth rather than for what the least sensitive input was. Where a label would itself disclose something, an agreed alternative is used and recorded, and the procedure covers what to do when unlabeled information is found. On storage media the marking carries more than the level: it states the distribution limitations that apply and any handling caveats that travel with the contents, so somebody who picks the item up knows what they may do with it without having to ask. Where the organization exempts a class of media from marking because it never leaves a controlled area, that exemption is defined and recorded as a decision rather than practiced as an omission. Underneath the scheme sits a documented DATA MANAGEMENT PROCESS that the classification and the handling rules are derived from: it states how sensitivity is decided, who owns each category of data, how each category is handled, the retention limits that apply to it and what disposal it requires, and it is reviewed and updated on a defined cadence and whenever a change to the organization would alter it. That process is also what the DATA FLOWS are documented against - where each category of information originates, which systems and processes it moves between, and where it crosses out to a service provider - recorded as documentation somebody maintains rather than reconstructed when a question is asked, and reviewed on the same cadence. | Art.5(1) | A.5.12, A.5.13 |
| Data masking & pseudonymization Where somebody needs to work with data but does not need the real values, the real values are not shown. The organization decides per use which technique fits - masking or truncating part of a value, replacing it with a token that can be mapped back only by a controlled service, pseudonymizing so the link to a person is held separately, generalizing or aggregating so an individual is not distinguishable, or generating synthetic values that carry no real subject at all - and the choice is made on whether the use needs the value to be reversible, on the sensitivity involved, and on any legal requirement that applies. It is applied where the exposure actually happens: in non-production environments, in support and administration tooling, in analytics and reporting, in exports and extracts, and in anything shown to a third party. Who is entitled to see unmasked values is authorized explicitly, is a smaller set than those who see masked ones, and their access is logged. Residual risk is assessed rather than assumed removed - a masked dataset can still identify someone through combination or through a distinctive rare value - and the assessment is repeated when new data is joined to it. Where a mapping back to the real value exists, it is protected at least as strongly as the data it can restore. Processing carried out for archiving in the public interest, for scientific or historical research, or for statistical purposes is held to this discipline as a condition of proceeding rather than as good practice: technical and organizational safeguards are in place for the people the data is about, they give effect to collecting and holding no more than the purpose needs, and pseudonymization is used wherever the purpose can still be served that way. Where the purpose can be achieved by processing that does not permit the people to be identified at all - or no longer permits it - it is achieved that way instead, and the test is applied at the start of the work rather than after a dataset has been assembled. These techniques are what protects the data while it is IN USE, as distinct from at rest or in transit: the values held in an application session, shown on a screen, loaded into an analytic workspace or opened in a support tool are reduced to what the task actually needs, the working copy is protected against alteration on the same terms as the source it came from, and it is disposed of when the task ends rather than left behind in the environment that produced it. | Art.89(1) | A.8.11 |
| Data retention & secure disposal Data is retained per policy and securely destroyed when no longer needed. Retention periods are set against the purpose the data was collected for and any legal or contractual obligation to keep it, recorded per category of data rather than left to whoever is looking at the record, and enforced when they run out - data goes because its period ended, not because somebody finally objected to keeping it. Destruction leaves it unrecoverable rather than merely removed from an index, and what was destroyed, when, by what method and on whose authority is recorded. The hardware and media that held it reach a defined final disposition at end of life, by a route the organization has decided in advance rather than by whatever happens to the box; and any media that stays in service is cleared of that data before it is reused, reassigned, or passed to anyone else. Disposal is not confined to data and media: the documentation, the tools and the system components the organization has defined as needing it are disposed of by techniques and methods it has approved in advance - so a decommissioned appliance, a retired build server, a set of network diagrams or a licensed utility leaves the organization by a route somebody chose, and the route is recorded on the same terms as a data destruction. A retention period has two ends and both are stated: the minimum the organization must keep the data for, and the maximum beyond which it may not be kept - so retention is bounded in the direction of keeping too long as well as of destroying too early. | Art.5(1) | A.7.14, A.8.10 |
| Encryption in transit & at rest Strong cryptography protects sensitive data in transit over public networks and at rest in storage. The mechanisms are chosen to do two things and are judged against both: prevent unauthorized disclosure of the information, and prevent or detect unauthorized change to it - in transit, so a message altered between sender and receiver is caught rather than delivered, and at rest, so a stored record cannot be modified undetectably by somebody with access to the storage but not to the key. Which information is protected at rest, and on which system components, is decided and recorded rather than left to whatever the platform encrypts by default. The scope named explicitly reaches the end-user device as well as the server: data held on laptops, desktops and other end-user devices that carry sensitive information is encrypted at the device or volume level, so a device that leaves the building is an object somebody lost rather than a disclosure. And data in transit is encrypted wherever it is sensitive, not only where it crosses a public network - a session between two internal systems is protected on the same terms when what it carries warrants it. Where a law, a regulation or a contract requires the cryptography to be VALIDATED rather than merely strong, the organization uses a cryptographic module that carries the validation that instrument names, and it confirms that validation against the specific module, version and operating mode actually deployed rather than inferring it from the product’s name - because a validated module run outside the configuration it was validated in is not a validated module, and the certificate that proves the point is held as evidence rather than assumed to exist. | Art.32(1) | A.8.24 |
| Personal data privacy A privacy notice the organization owns and dates tells the people whose personal data it holds - employees, customers, and anybody else it collects from - what is collected and where from, the purposes it is used for, how long it is kept, who it is disclosed to, what choices and rights they have and how to exercise them, and how employees are monitored at work. It is written in plain language, published where those people will find it, and revised and made available BEFORE a change in practice takes effect rather than after. Each request about that data - to see it or get a copy, to have it corrected, to have it erased, to restrict or object to a use - is logged when it arrives, the requester’s identity is checked, and it is decided and actioned inside the time the organization has committed to; what is provided is what was asked for, and a refusal is given with its reason rather than by silence. An accepted correction is applied to every copy the organization holds and passed on to the parties it has already disclosed that data to, so a correction does not stop at whichever system the request happened to arrive in. | Art.12(1), Art.12(2), Art.15(1), Art.16, Art.17(1), Art.21(1) | A.5.34 |
| Infrastructure & Operations | ||
| Logging & monitoring Security-relevant events - including successful and failed log-in attempts - are logged, protected, retained, and reviewed for anomalies, and the discrepancies that review finds are reported to the people who act on them. The review runs on a defined cadence and covers the records of system activity as a set - the audit logs, the reports of who accessed what, and the record of security incidents - rather than the log stream alone. For those records to be correlated into one sequence of events, the systems producing them agree on the time: every in-scope system synchronizes its clock to a single approved reference source, the source and the tolerance the organization will accept are specified rather than left to defaults, and timestamps are recorded in an unambiguous form so a reader does not have to infer a time zone. Synchronization is monitored in its own right - a system that drifts beyond tolerance or loses its source raises an alert, because a clock that is wrong makes an investigation reach the wrong conclusion rather than no conclusion - and where equipment cannot be synchronized, its offset is known and recorded so its records can still be placed. Timestamps are generated from the system’s own clock, expressed in Coordinated Universal Time or a recorded offset from it, and cut to a granularity the organization has stated rather than to whatever the platform defaults to. All of this rests on a documented audit and accountability policy with supporting procedures, aligned with the laws and obligations that apply to the organization, issued to the roles it binds, owned by a named role, and reviewed on a defined cadence. WHAT A RECORD CONTAINS is specified rather than accepted: every audit record establishes what type of event occurred, when it occurred, where it occurred, the source it came from, the outcome - success or failure - and the identity of any individual, subject or object associated with it, plus whatever further fields the organization has decided it needs to reconstruct an event afterwards. Because every person holds an account of their own, the identity a record carries resolves to one named individual rather than to a shared or generic login, so an action can be traced to whoever actually took it and that person can be held accountable for it - which is the whole reason the identity field is mandatory rather than useful. WHICH EVENTS ARE LOGGED is decided and then kept under review rather than configured once: the set of event types selected for logging is agreed with the roles who investigate, is reviewed on a defined cadence and again after an incident that showed the set was wrong, and is updated as a result - so the log answers the questions being asked now instead of the ones somebody anticipated at build. Storage is sized for that: enough capacity is allocated to hold the volume produced for the retention period the organization has set, and records are retained for that period specifically so an investigation after the fact is possible and so regulatory and internal obligations are met, rather than for as long as the disk happens to last. When the logging process itself fails - the pipeline stops, the store fills, a source goes silent - a defined role is alerted within a defined time and the organization takes the response it decided on in advance, because a logging failure is the one failure the logs cannot tell you about. REVIEW AND ANALYSIS are supported by machinery rather than by reading. Automated mechanisms integrate the review, analysis and reporting of audit records into a single process, and records drawn from separate repositories are correlated so the organization sees one organization-wide picture of activity instead of several partial ones. A reduction and reporting capability supports on-demand review, analysis and reporting and the investigation of an incident, and it does so without altering the original records or their ordering; it lets an analyst filter, sort and search records by the criteria the organization has defined, so events of interest surface in time to matter. THE RECORDS THEMSELVES ARE PROTECTED as an asset. Audit information and the logging tools that produce it are protected from unauthorized access, modification and deletion, a defined role is alerted when evidence of tampering is detected, and the ability to manage the logging function - what is collected, what is retained, what is deleted - is restricted to a named subset of privileged users rather than being available to every administrator whose activity it records. MONITORING runs on top of the record. The organization monitors its systems to detect attack and indicators of potential attack, unauthorized local, network and remote connections, and use that is outside what it has authorized; it identifies that use against defined criteria for what unusual looks like. Inbound and outbound communications traffic is watched for those conditions specifically, because exfiltration and command traffic look ordinary unless somebody has said what ordinary is. Automated tools and mechanisms support analysis close to real time rather than at the next review, and when the system produces an indication of compromise or potential compromise a defined role is alerted. What monitoring finds is reported to the people who act on it, at the frequency the organization has set. WHICH SOURCES ARE COLLECTED is decided rather than left to whatever a platform emits by default. Access to information the organization has classified as sensitive is logged, including modification and disposal and not only reading. DNS queries, URL requests and command-line activity are collected where the asset supports it, because those three are what an investigation reconstructs an intrusion from, and network traffic flow records are collected from the network devices so that movement between systems can be reviewed and alerted on. Logs from the service providers the organization depends on are collected too, so authentication, user-management and data-lifecycle events that happen outside its own estate sit inside the same record. Collection and retention are centralized so far as the estate allows, into a platform that correlates sources rather than storing them side by side, and security event alerting is centralized on top of it so that a pattern spanning two sources raises one alert to one place. The alerting thresholds are tuned on a defined cadence rather than set once, because an alert stream nobody can read is the same as no alerting at all. Time synchronization uses more than one source: at least two reference sources are configured wherever an asset supports it, so losing one does not silently leave the estate drifting. WHAT IS WATCHED includes people as well as machines: the activity of personnel and their use of the organization’s technology are monitored against what has been authorized for them and against what the organization has told them is monitored, so misuse and a compromised account surface from the same record. Analysis goes past the alert to the activity behind it - what else the same account, host or address did before and after, and whether the separate events form one sequence - so a potentially adverse event is understood rather than merely counted. And each such event is scoped before it is handed on: the estimated impact and the reach of it - which systems, which data, which accounts, over what period - is established from the correlated record and carried into the incident assessment rather than left for the responder to rebuild. | Art.32(1) | A.8.15, A.8.16, A.8.17 |
| Vulnerability management Regular scanning, prioritization, and remediation of vulnerabilities across systems and applications, fed by current information about threats and weaknesses collected from outside the organization as well as from its own scans - vendor and industry security advisories for the software actually in use, and the threat feeds, bulletins and sector reporting that describe how systems like these are being attacked now - which is gathered continuously rather than at the next scan, evaluated for whether it applies here, and used to decide what is looked for and what is fixed first. The set of vulnerabilities the scanner actually looks for is updated on a defined cadence and whenever new ones are identified and reported, so a scan reflects what is known today rather than what the tool shipped with. Scans that need to see inside a system are given the privileged access to do so, granted deliberately to the scanning activity for the components that require it rather than left to run blind and report clean. Whether a fix is actually present is confirmed by automated mechanisms that report, per component, which security-relevant software and firmware updates are installed - so remediation is evidenced by the estate rather than by a closed ticket. The organization also runs a PUBLIC intake: a reporting channel that anybody outside the organization can find and use to report a vulnerability they have discovered in its systems or products, with a stated scope, a stated way to report, an acknowledgment, and a route into the same triage and remediation process everything else uses. All of this rests on a documented system and information integrity policy with supporting procedures, issued to the roles it binds, owned by a named role and reviewed on a defined cadence. The scanning and the fixing are each defined rather than assumed. Internal assets are scanned automatically on a defined cadence, both with credentials and without, because the two find different things - one shows what is installed, the other shows what somebody with no account can see. Externally exposed assets are scanned on their own cadence, which is at least as frequent, because they are reachable by everyone. Patching is automated for operating systems and, on the same terms and cadence, for the applications running on them, so an application left to be updated by whoever notices is not the gap. Remediation runs to a documented, risk-based strategy - what is fixed first, within what period, and who may approve an exception - reviewed on a defined cadence rather than written once. The public intake is governed by a written vulnerability handling policy that names how to report, who is responsible for handling a report, and the steps from intake through assignment and remediation to remediation testing, with reports tracked in a system that records a severity rating and the timing of identification, analysis and remediation, so how long the organization takes is a measured number rather than an impression. | Art.32(1) | A.5.7, A.8.8 |
| Resilience & Continuity | ||
| Backups Regular, tested backups of critical data and systems with defined retention, each one a RETRIEVABLE EXACT COPY of the data it protects - complete and restorable, not a partial or lossy snapshot - including a copy taken before equipment holding that data is moved. Backup information is tested on a defined cadence to verify that the media are still reliable and the information still has its integrity - a restore actually performed, not a job that reported success - and it is protected by cryptographic mechanisms so a copy obtained by somebody who should not have it discloses nothing and cannot be altered undetected. Copies are held somewhere other than where the original lives: an alternate storage site is established, with the agreements needed to store backups there and to retrieve them when they are wanted, carrying security controls equivalent to those at the primary site rather than weaker ones because it is only a copy. The alternate site is chosen far enough from the primary that the same fire, flood, outage or regional event is unlikely to take both, and the organization identifies in advance the problems that would make the site hard to reach during a wide-area disruption - roads, transport, staff availability, network dependency - and states explicit mitigation actions for each rather than discovering them on the day. The recovery itself is a documented process and not only a schedule: it states which assets are in scope for recovery, the order in which they are brought back, and how the backup data is protected while it waits, and it is reviewed and updated on a defined cadence and whenever a change to the organization would alter it. Recovery data carries protection EQUIVALENT to the data it copies rather than weaker protection because it is a copy. And at least one instance of it is ISOLATED - held offline, off-site, or in a separately controlled service, out of reach of the credentials and the network paths that operate the live environment - so an event that reaches production does not also reach the copy that would undo it. Verification is performed at the point of USE as well as on the cadence: before a backup or any other restoration asset is relied on to bring a system back, its integrity is checked against the value recorded when it was taken and the check is logged - so a restoration does not carry corrupted or tampered data into a system that has just been cleaned. | Art.32(1) | A.8.13 |
| Business continuity & disaster recovery BC/DR plans with defined RTO/RPO, tested periodically AND REVISED on what the testing finds and on what has changed since, to restore service after disruption - including how the critical processes that protect sensitive data keep running while the organization is operating in emergency mode, and an assessment of how critical each application and data set is, which is what sets those recovery targets and the order in which things come back. The disruptions the organization could actually face are identified and a response chosen for each, rather than one plan written against one scenario, and the loss that would still remain after those responses is quantified and put to a deliberate decision - accepted, reduced further, or transferred, including by insurance - so exposure to a disruption is something somebody chose rather than something nobody priced. The level of information security to be MAINTAINED while the organization is disrupted is decided in advance rather than allowed to fall to whatever the emergency leaves standing: for each control that cannot run in the degraded state, a compensating measure is defined for the period, and where none is available the exposure is accepted deliberately and for a stated maximum duration. The alternate site, the standby service and the emergency working arrangements carry protection equivalent to normal operations - the same access rules, the same logging, the same handling of sensitive information - and the security of those arrangements is exercised in the same tests rather than assumed to have been inherited. Restoring normal operation includes restoring the controls that were relaxed, and confirming that they are back on. The program rests on a documented contingency planning policy with supporting procedures, issued to the roles it binds, owned by a named role and reviewed on a defined cadence. The plan is not written alone: it is developed in coordination with the organizational elements responsible for the related plans - incident response, crisis management, physical security, occupant emergency, supply chain - so the plans agree about who does what rather than each assuming the others, and the testing is coordinated with those same elements for the same reason. What has to come back is named rather than implied: the essential mission and business functions are identified, the critical system assets and components that support them are identified through a deliberate criticality analysis performed at defined points in the system’s life rather than once at the start, and the plan states the time within which each essential function will be resumed after the plan is activated. Testing runs on a defined cadence using methods chosen to establish the plan’s effectiveness and the organization’s readiness to execute it, and the results are reviewed and corrective action taken. People are trained for the role the plan gives them: within a defined period of being assigned it, again when the system or the plan changes materially, and on a defined cadence thereafter, with the training content revised for what the exercises and the incidents showed. Where a system is transaction-based, recovery includes the transactions themselves - the mechanisms that let in-flight work be rolled back or replayed to a consistent point, so recovery does not mean a service that is up over data that is half-written. The criticality analysis names the objectives, capabilities and services that parties OUTSIDE the organization depend on or expect from it - customers, regulators, and the organizations it is itself a supplier to - and what the organization commits to restoring, and how quickly, is communicated to them rather than held internally. Recovery is entered deliberately rather than drifted into: the criteria for initiating it are set in advance and applied to the incident in front of the responders, and the recovery actions are then selected, scoped, prioritized and performed against the plan instead of improvised in the order things are noticed. What normal looks like afterwards is a decision too - the essential mission functions and the risk picture the incident has just changed are both considered when the post-incident operating norms are set, so the organization does not return to a posture the incident has already disproved. The end of recovery is declared against stated criteria by the role authorized to declare it, and the recovery documentation is completed at that point rather than left open behind a service that is back up. | Art.32(1) | A.5.29, A.5.30 |
| Incident response A documented, tested plan to detect, triage, contain, remediate, and communicate security incidents, and to mitigate - so far as is practicable - the harmful effect of a use or disclosure of personal data the organization knows breached its own policies or the law. Each incident is recorded together with its outcome - what happened, what was done about it and how it ended - as a record of that incident, which is a different artifact from the plan being documented. The mitigation duty runs to violations by the organization itself AND to violations by the processors, vendors and other parties handling that data on its behalf: the plan reaches an incident somebody else caused with the organization’s data, so learning of one triggers the same containment and remediation as an incident inside its own walls rather than a request that the other party deal with it. Where an incident carries a duty to tell someone outside the organization, the plan discharges it on the clock the applicable law sets - and, where the organization has itself committed to a timeframe for telling people, on that commitment too, whether or not a statute stands behind it - rather than whenever the investigation happens to conclude: whether an incident is notifiable is decided against written criteria rather than argued after the fact, the regulator or supervisory authority is notified inside the deadline that regime states and inside any shorter or additional timeframe the organization has committed to, the people whose data is affected are told where the risk to them warrants it and, independently of that threshold, wherever the organization’s own privacy commitments say they will be told - so individual notification is never conditioned solely on a statutory risk test - and any other party that law or those commitments require to be notified is told on the same terms, and where a deadline is missed the notification itself explains the delay instead of passing over it. What a notification carries is fixed in advance rather than composed under pressure: to a regulator it describes at least the nature of what happened, including where possible the categories and the approximate number of people affected and of records involved; names a contact point - the data protection officer where there is one, otherwise whoever can answer - from whom more can be obtained; describes the likely consequences; and describes the measures taken or proposed to address it, including where appropriate the measures that will mitigate its adverse effects. Where all of that cannot honestly be given at once, it is given in phases without further undue delay rather than held back until the picture is complete, and each phase says what is still outstanding. The communication to the people affected describes what happened in clear and plain language and carries the same contact point, likely consequences and measures. Every compromise of personal data is documented whether or not it turned out to be notifiable - the facts of it, its effects, and the remedial action taken - in enough detail that a regulator reviewing the file can verify for itself that the notification decision was the right one. Recovery is part of the plan rather than something that follows it: service and data are restored to a state the organization has established is clean, the restoration is verified before the system is handed back to use, the cause is determined rather than inferred from the symptom, and the weakness the incident exposed is fixed - with the plan itself updated for what the incident showed about it. Between the report and the response sits an assessment step that is a duty of its own: every reported event is assessed against written categorization and prioritization criteria by people competent to apply them, and the decision - whether this event is an incident, and at what severity - is recorded with the reasoning, so two assessors reach the same answer and an event judged not to be an incident is a decision somebody made rather than a report that went quiet. Learning is treated as a duty separate from fixing the incident in front of you: the types, volumes and costs of incidents are quantified and reviewed as a set for what the pattern says, and what is learned is pushed back into the controls, the risk assessment, the awareness material and the assessment criteria themselves rather than staying in the report of the incident that produced it. The plan is a documented incident response policy with supporting procedures, issued to the roles it binds, owned by a named role, and reviewed and updated on a defined cadence. The people the plan assigns roles to are trained for them: within a defined period of taking the role, again when the system or the plan changes in a way that affects it, and on a defined cadence thereafter, with the content revised for what exercises and real incidents have shown. The capability is TESTED rather than assumed - on a defined cadence, using tests the organization has chosen for the purpose, such as a tabletop, a walkthrough, a simulation or a live exercise - and that testing is coordinated with the organizational elements that own the related plans, incident response and contingency planning in particular, so the two do not each assume the other. Handling and reporting are supported by automated mechanisms rather than run by hand at the worst moment: detection, triage, tracking, evidence collection and the routing of a report are automated so far as the organization’s systems allow, and the reports that must go outside are produced and sent by mechanism rather than composed under pressure. The roles the plan assigns are named across the functions an incident actually needs and not security alone - legal, IT, information security, facilities, communications, human resources, the responders and the analysts - and the assignment is reviewed on a defined cadence. So are the CHANNELS: a primary and a secondary mechanism for communicating and reporting during an incident are chosen in advance, on the understanding that the ordinary one may be the thing that is unavailable or compromised, and both are reviewed on the same cadence. The plan reaches the parties outside the organization that an incident actually involves: the suppliers and other third parties whose services, staff or systems would be part of the response are named in it, take part in the planning and the exercises, and are called on during response and recovery on terms agreed in advance rather than negotiated during the event. ESCALATION is a defined step and not a judgment call - the plan states the conditions under which an incident is escalated or elevated, whether by severity, by elapsed time, by the functions it has reached or by the obligations it triggers, who it goes to at each step, and what changes when it gets there. The analysis establishes what actually took place during the incident as well as why it happened, and the incident’s magnitude - how many systems, records and people it reached, and over what period - is estimated as the investigation proceeds and then VALIDATED against the evidence rather than left at the first number anybody said out loud. Notification runs to internal stakeholders as well as external ones, so the functions inside the organization that have to act on an incident are told on the same defined terms as the parties outside it. And containment is followed by ERADICATION as a separate act: the malicious code, the unauthorized access and the persistence left behind are removed and their removal is confirmed, so a contained incident is not mistaken for a finished one. | Art.33(1), Art.33(3), Art.33(4), Art.33(5), Art.34(1), Art.34(2) | A.5.24, A.5.25, A.5.26, A.5.27 |
| Third-party Risk | ||
| Third-party / vendor risk management Due diligence, contractual safeguards, and ongoing monitoring of vendors that handle your data: the agreement obliges the vendor to comply in its own right with the security requirements that apply to it - an absolute standard, not a promise to match whatever you happen to do - to pass those obligations down to any subcontractor it brings in BY ENTERING INTO a contract or equivalent written arrangement with that subcontractor rather than by merely requiring equivalent practice of it, and to report to you, within a stated time, security incidents it becomes aware of and confirmed breaches of your data. Where a contract is not the instrument available, an equivalent written arrangement carrying the same obligations discharges the duty. The same obligations, together with the separation that keeps a related organization out of data it is not entitled to, are written into the governing document of any other arrangement that puts your data in the hands of a sponsor, parent, affiliate or plan. Diligence is not confined to security where the relationship warrants more: for suppliers significant enough to matter, the organization states the standards of conduct it expects of them - how they behave commercially and how they treat the environment around their operations - and screens candidates and incumbents against those stated expectations as part of the same selection and monitoring cycle, rather than accepting a signature on a code as evidence of it. Where the vendor handles personal data, the agreement binds it to privacy obligations no weaker than the commitments the organization has itself made about that data - the purposes it may be used for, the limits on passing it on further, and the help the organization needs in order to answer the requests individuals make about it - and the reporting duty above reaches a suspected as well as a confirmed compromise of that personal data, on the same stated clock. Which requirements apply to a given supplier is decided by the TYPE of relationship rather than by one clause set issued to everyone - what data it touches, what access it holds, whether it can affect the organization’s own service, and what it would cost if it failed - and the requirements are agreed and recorded before access begins rather than negotiated after go-live. Once the relationship is running, what the supplier actually delivers is reviewed against what was agreed on a stated cadence: the service records, the security reports and assurance the agreement entitles the organization to, the incidents it has declared, and the findings of any audit or test right the organization holds - exercised rather than merely retained. A change on the supplier’s side is managed as a change rather than discovered - a new subcontractor, a new location or jurisdiction, a change of ownership, a material change to the technology or to the people delivering the service is notified in advance under the agreement, assessed for what it does to the risk, and approved or refused before it takes effect. ACQUISITION is governed as its own act, under a documented system and services acquisition policy with supporting procedures, owned by a named role and reviewed on a defined cadence. When a system, a component or a service is bought, the contract states the security and privacy requirements it must meet - the functional requirements, meaning what the controls have to do; the strength requirements; the assurance requirements, meaning what evidence the supplier must produce that they work; the documentation the supplier must deliver and how it must be protected and distributed; the description of the development environment and of the environment the product will run in; and the acceptance criteria the delivery is measured against - all stated in the solicitation before a supplier is chosen rather than negotiated after award, and all expressed in terms of the applicable laws and standards. The supplier is required to describe the functional properties of the controls it will implement, and to provide design and implementation information for those controls at a level of detail the organization has specified, so the organization can judge them rather than take their existence on trust. It is also required to identify the functions, ports, protocols and other services the delivered product intends to use in the organization’s environment - and, for an external service provider, the ones its service requires - so an integration does not open a path nobody asked for. The program has three artifacts of its own. An INVENTORY of service providers lists every one the organization knows of, records the classification given to it and names the person inside the organization who owns the relationship, and is reviewed on a defined cadence and whenever a change to the organization would alter it. A POLICY governs the whole cycle - how providers are classified, how the inventory is kept, how they are assessed, how they are monitored and how they are decommissioned - owned by a named role and reviewed on the same terms. And a CLASSIFICATION is applied to each provider against stated criteria such as the sensitivity and volume of the data it holds, the availability the organization depends on it for, the regulation that reaches it, and the risk that remains after the controls in place - reviewed rather than assigned once. DECOMMISSIONING is performed rather than allowed to lapse: when a relationship ends, the user and service accounts are deactivated, the data flows into and out of the provider are terminated, and the organization’s data held in the provider’s systems is disposed of and the disposal evidenced. Who does what is settled before the relationship starts and written down on both sides: the cybersecurity roles and responsibilities of the organization, of the supplier, and of the customers and partners the arrangement reaches are established, communicated to each of them and coordinated between them, so a duty is not left in the gap where each party assumed the other held it. Planning and due diligence come before the agreement rather than after it - what the relationship would expose, what the candidate’s security actually looks like, and what would have to be true before it starts are established while declining is still an option. The risk a supplier carries is then held as a record rather than as an impression: understood, written down, prioritized against the other suppliers, assessed on a stated cadence, responded to with an owner and a date, and monitored for the whole life of the relationship instead of at onboarding only. The provider inventory records the SERVICES each one actually provides as well as its name, so what the organization has placed outside itself is answerable from the list. Where a PROCESS itself is provided from outside, it stays inside the management system’s control rather than leaving it: the controls the organization intends to apply to the external provider and the controls it intends to apply to the resulting output are defined separately and both are applied, because a well-governed supplier can still ship a nonconforming output. What the arrangement could do to the organization’s own ability to consistently meet its customers’ requirements is considered when those controls are set, and the verification or other activity necessary to establish that what arrives meets requirements is determined in advance and carried out rather than inferred from the supplier’s own assurances. | Art.28(1), Art.28(3) | A.5.19, A.5.20, A.5.22 |
| People & Culture | ||
| Personnel security (HR) Background screening, confidentiality agreements, and onboarding/offboarding security steps. Before a person is given access to sensitive data, and again whenever their role changes, a documented determination is made that the access their work calls for is appropriate to it - the screening informs that decision but is not the decision. What screening may ask is itself bounded: inquiries about a candidate’s health, disability or medical history are not made, and medical examinations are not required, before a conditional offer of the role has been made, and where such inquiries or examinations are made after an offer they are applied to everyone entering that role rather than to the individuals somebody chose to ask. Access is ended when their employment, or any other arrangement under which they worked for the organization, comes to an end, and whenever that determination says they should no longer hold it. The security responsibilities a person carries are stated in the terms under which they are engaged - in the employment contract or the equivalent agreement for a contractor or temporary worker - together with the organization’s own obligations to them, the duties that continue after the engagement ends and for how long, and what happens if the terms are broken; the terms are accepted before access is given. At the end of an engagement, and on a change of role that removes the need, every asset the person holds is returned and the return is recorded against the inventory rather than assumed - devices, media, tokens and keys, documents and any organization information held on equipment they own - and where information exists only on equipment the organization is not taking back, its transfer and deletion are performed and confirmed before the person leaves. The practice is governed by a documented personnel security policy with supporting procedures, issued to the roles it binds, owned by a named role and reviewed on a defined cadence. Security and privacy responsibilities are written into the POSITION DESCRIPTION for each role rather than only into the contract everybody signs, so what a particular job is accountable for is visible when it is advertised, filled, evaluated and re-scoped - and the descriptions are revised when the responsibilities change. | Art.32(4) | A.5.11, A.6.1, A.6.2, A.6.5 |
| Security awareness training Ongoing security and data-handling awareness training for all personnel, with completion tracking, and periodic security updates - reminders, bulletins and alerts - issued to the workforce between training cycles. New joiners are trained within a defined period of starting, anyone whose work is affected is retrained within a defined period after a material change to the policies or procedures, and every completion is recorded. The program itself rests on a documented awareness and training policy with supporting procedures, issued to the people and roles it binds, owned by a named role, and reviewed and updated on a defined cadence rather than at whatever point somebody notices it is stale. The curriculum names two threats explicitly, because both are answered by a person rather than by a system. The first is INSIDER THREAT: what the potential indicators look like - unexplained access outside a role, bulk copying, hostility after a disciplinary or a passed-over promotion, working around a control rather than raising it - and where to report a concern about a colleague, without the reporter being asked to conclude anything. The second is SOCIAL ENGINEERING AND SOCIAL MINING: the phishing message, the pretext phone call, the urgent request from an apparent executive, the person following somebody through a door, and the slower pattern of harmless-seeming questions that assembles into an answer nobody would have given at once - together with the instruction to report both the attempts that worked and those that did not. The curriculum is stated as a set of topics rather than left to whoever assembles the material. AUTHENTICATION: how multi-factor authentication works and why it is required, what makes a passphrase strong, and how credentials are stored and never shared. DATA HANDLING: how to identify sensitive information and how to store, transfer, archive and destroy it, together with the clear screen and clear desk habits that go with it - locking a screen on standing up, clearing a whiteboard at the end of a meeting, and putting paper and portable media away rather than leaving them out. UNINTENTIONAL EXPOSURE: the ways data leaves by accident, such as a message sent to the wrong recipient, a portable device left behind, or a file published to a wider audience than intended. INCIDENTS: how to recognize that something may be an incident and how to report it without first establishing that it is. MISSING UPDATES: how to tell that an asset is not receiving its security updates, and to report a failure of an automated patching tool rather than assume somebody is watching it. INSECURE NETWORKS: the risk of connecting to and sending organizational data over networks the organization does not control, including what is expected of a home network where people work from one. And beyond the common curriculum, ROLE-SPECIFIC training is given where a role carries specific risk - system administration, secure development, and the roles most likely to be targeted directly. | Art.32(4) | A.6.3 |
| Physical & Environmental | ||
| Physical security Physical access to facilities and equipment holding sensitive data is restricted and monitored, and a person’s access is validated against the role or function that justifies it rather than only logged; visitors are controlled as a case of their own, and so is access to software programs held for testing and revision. The facility and the equipment in it are safeguarded against tampering and theft as well as against unauthorized entry, and so is the SUPPORT INFRASTRUCTURE the systems depend on - the power feed and its distribution, the cabling and patching, the cooling and environmental plant, the fire detection and suppression, and the points at which communications enter the building - which is protected and monitored on the same terms rather than treated as building services somebody else owns, because a system is stopped as surely by reaching its power or its cooling as by reaching its data. The people who have to reach the site and the equipment when a continuity or recovery plan is invoked can still get in, by a route that is planned rather than improvised; and repairs and modifications to the physical security components of a facility - doors, locks, walls, and the hardware that controls entry - are recorded. The offices, rooms and facilities themselves are designed and fitted for that job rather than simply occupied: rooms holding sensitive information or the equipment that processes it are sited away from public access and from routes people pass through for other reasons, the building’s signage, directories and public information do not advertise where sensitive processing happens, doors, windows, walls and any shared boundary with another tenant are specified against the risk the room actually carries, and a room is locked and checked when it is unoccupied rather than left secured by whoever was last out. Monitoring is continuous rather than periodic: the premises are watched for unauthorized physical access by detection suited to the site - intruder alarms, cameras, contact and motion detection, staffed reception or patrols - covering every way in including delivery and fire doors and including the hours nobody is there, with an alarm going to somebody who responds and a stated response. The monitoring system is protected in its own right, so its configuration, its coverage and its recordings cannot be altered or read by the people it is watching, and recordings are retained and handled under the privacy rules that apply to them. The detection is specified rather than generic: intrusion alarms and surveillance equipment are employed as the means of monitoring physical access, and what they cover, what raises an alarm and who responds is decided in advance. Visitors are escorted for the whole time they are inside a controlled area and their activity while there is monitored, rather than being signed in at a desk and then left to move around; that applies to contractors, delivery and service personnel and auditors alike, and where somebody is authorized to work unaccompanied that is a recorded decision rather than a courtesy. Visitors leave a record: who came, who they were visiting, when they arrived and left, and the identification presented; the record is retained for a defined period, reviewed on a defined cadence rather than only after an incident, and anomalies in it are reported to a designated role. Deliveries and removals are controlled as a class - system components and equipment entering or leaving the facility are authorized before they move, the movement is monitored, and a record of what came in and what went out is kept - and the delivery area itself is arranged so that a delivery does not become unescorted access to the interior. PHYSICAL ACCESS IS LOGGED and not only permitted: entry to the facility and to each controlled area inside it is recorded - who entered, which area, and when - by the entry system, the staffed reception, the visitor register or a combination of them, and the log is retained for a defined period and reviewed on a defined cadence, so a person can be placed in a room at a time and matched against what the systems in it recorded. PHYSICAL ACCESS DEVICES are managed as a controlled inventory rather than handed out: the keys, locks, combinations, badges, cards, fobs and biometric enrollments that open a door are listed with the holder of each, issue and return are recorded against that person, the inventory is reconciled on a defined cadence, and combinations are changed and locks re-keyed when a device is lost or stolen, when a holder leaves or moves, and on the cadence the organization has set rather than only after an incident. All of this rests on a documented physical and environmental protection policy with supporting procedures, issued to the roles it binds, owned by a named role and reviewed on a defined cadence. | Art.32(1) | A.7.1, A.7.2, A.7.3, A.7.4 |
Beyond the pair
Where else this work counts
A framework is lit when a shared control above also maps to it. Unlit means none of them do — an absence, not a judgment about that standard.
Also reached by these 19 controls
- AI Governance Essentials not reached
- Amazon Appstore Child-Directed Apps not reached
- Apple App Store Kids Category not reached
- CIS Critical Security Controls also reached
- COPPA also reached
- ESG Essentials also reached
- EU AI Act not reached
- Google Play Families not reached
- HIPAA also reached
- ISO 9001 also reached
- ISO/IEC 42001 not reached
- NIST AI Risk Management Framework not reached
- NIST Cybersecurity Framework also reached
- NIST SP 800-171 also reached
- NIST SP 800-53 also reached
- PCI DSS also reached
- PIPEDA also reached
- SOC 2 also reached
- SOX (Sarbanes-Oxley) Section 404 also reached
- US Employment Law - Federal Baseline also reached
Nearby pairs
- ISO/IEC 27001 and NIST SP 800-53 52 shared controls
- ISO/IEC 27001 and NIST Cybersecurity Framework 45 shared controls
- ISO/IEC 27001 and NIST SP 800-171 35 shared controls
- ISO/IEC 27001 and CIS Critical Security Controls 32 shared controls
- ISO/IEC 27001 and SOC 2 32 shared controls
- ISO/IEC 27001 and PCI DSS 27 shared controls
The thesis
Why this is one project, not two
On a crosswalk-native model, ISO/IEC 27001 mostly lights up controls you already built for GDPR. You’re not re-uploading the same screenshot for a second audit. You apply the framework and see the genuine delta worth working. That’s the whole idea behind collect once, comply everywhere.
Next step
Add ISO/IEC 27001 to the work you already did
Apply both frameworks in one workspace and see the overlap measured against the controls you already hold.