ISO/IEC 27001:2022 control library
Every control CMDash tracks for ISO/IEC 27001:2022, in the order the standard itself uses. Each one is a row in the product with an owner, a status, evidence and its own history — this page is the public index of what those rows are.
93 controls4 families87 mapped to other frameworksIdentifiers and titles only — text is licensed
Why the control text is not on this page
ISO standards are sold per copy and may not be redistributed, so the control text cannot be embedded in this product.
CMDash publishes the identifiers, titles and cross-framework mappings so you can see the shape of what is tracked, and links you to ISO / IEC for the document itself. A tenant that holds its own licence can load the real text through the framework import.
Buy from the ISO Store →Families
Organizational Controls · 37
| A.5.1 | Policies for information security Maps to HITRUST CSF v11, ISO/IEC 42001:2023, NIST Cybersecurity Framework (1.1, legacy) +3 more |
| A.5.2 | Information security roles and responsibilities Maps to HITRUST CSF v11, ISO/IEC 42001:2023, NIST Cybersecurity Framework (1.1, legacy) +2 more |
| A.5.3 | Segregation of duties Maps to HITRUST CSF v11, NIST Cybersecurity Framework (1.1, legacy), NIST Cybersecurity Framework 2.0 +1 more |
| A.5.4 | Management responsibilities |
| A.5.5 | Contact with authorities Maps to HITRUST CSF v11 |
| A.5.6 | Contact with special interest groups Maps to HITRUST CSF v11 |
| A.5.7 | Threat intelligence Maps to NIST Cybersecurity Framework (1.1, legacy), NIST Cybersecurity Framework 2.0 |
| A.5.8 | Information security in project management Maps to HITRUST CSF v11, TISAX (VDA ISA v6) |
| A.5.9 | Inventory of information and other associated assets Maps to HITRUST CSF v11, ISO/IEC 42001:2023, NIST Cybersecurity Framework (1.1, legacy) +2 more |
| A.5.10 | Acceptable use of information and other associated assets Maps to HITRUST CSF v11, ISO/IEC 42001:2023 |
| A.5.11 | Return of assets Maps to HITRUST CSF v11 |
| A.5.12 | Classification of information Maps to HITRUST CSF v11, NIST Cybersecurity Framework (1.1, legacy), NIST Cybersecurity Framework 2.0 +1 more |
| A.5.13 | Labelling of information Maps to HITRUST CSF v11, TISAX (VDA ISA v6) |
| A.5.14 | Information transfer Maps to HITRUST CSF v11, TISAX (VDA ISA v6) |
| A.5.15 | Access control Maps to HITRUST CSF v11, NIST Cybersecurity Framework (1.1, legacy), NIST Cybersecurity Framework 2.0 +2 more |
| A.5.16 | Identity management Maps to HITRUST CSF v11, NIST Cybersecurity Framework (1.1, legacy), NIST Cybersecurity Framework 2.0 +1 more |
| A.5.17 | Authentication information Maps to HITRUST CSF v11, NIST Cybersecurity Framework (1.1, legacy), NIST Cybersecurity Framework 2.0 +3 more |
| A.5.18 | Access rights Maps to HITRUST CSF v11, TISAX (VDA ISA v6) |
| A.5.19 | Information security in supplier relationships Maps to HITRUST CSF v11, ISO/IEC 42001:2023, NIST Cybersecurity Framework (1.1, legacy) +2 more |
| A.5.20 | Addressing information security within supplier agreements Maps to HITRUST CSF v11, ISO/IEC 42001:2023, TISAX (VDA ISA v6) |
| A.5.21 | Managing information security in the ICT supply chain Maps to TISAX (VDA ISA v6) |
| A.5.22 | Monitoring, review and change management of supplier services Maps to HITRUST CSF v11, TISAX (VDA ISA v6) |
| A.5.23 | Information security for use of cloud services Maps to NIST Cybersecurity Framework (1.1, legacy), NIST Cybersecurity Framework 2.0, TISAX (VDA ISA v6) |
| A.5.24 | Information security incident management planning and preparation Maps to HITRUST CSF v11, ISO/IEC 42001:2023, NIST Cybersecurity Framework (1.1, legacy) +3 more |
| A.5.25 | Assessment and decision on information security events Maps to HITRUST CSF v11, TISAX (VDA ISA v6) |
| A.5.26 | Response to information security incidents Maps to HITRUST CSF v11, NIST Cybersecurity Framework (1.1, legacy), NIST Cybersecurity Framework 2.0 +1 more |
| A.5.27 | Learning from information security incidents Maps to HITRUST CSF v11, TISAX (VDA ISA v6) |
| A.5.28 | Collection of evidence Maps to HITRUST CSF v11, TISAX (VDA ISA v6) |
| A.5.29 | Information security during disruption Maps to HITRUST CSF v11, NIST Cybersecurity Framework (1.1, legacy), NIST Cybersecurity Framework 2.0 +2 more |
| A.5.30 | ICT readiness for business continuity Maps to HITRUST CSF v11, TISAX (VDA ISA v6) |
| A.5.31 | Legal, statutory, regulatory and contractual requirements Maps to HITRUST CSF v11, TISAX (VDA ISA v6) |
| A.5.32 | Intellectual property rights Maps to HITRUST CSF v11 |
| A.5.33 | Protection of records Maps to HITRUST CSF v11, TISAX (VDA ISA v6) |
| A.5.34 | Privacy and protection of PII Maps to HITRUST CSF v11, NIST Cybersecurity Framework (1.1, legacy), NIST Cybersecurity Framework 2.0 +1 more |
| A.5.35 | Independent review of information security Maps to HITRUST CSF v11, TISAX (VDA ISA v6) |
| A.5.36 | Compliance with policies, rules and standards for information security Maps to HITRUST CSF v11 |
| A.5.37 | Documented operating procedures Maps to HITRUST CSF v11 |
People Controls · 8
| A.6.1 | Screening Maps to HITRUST CSF v11, NIST Cybersecurity Framework (1.1, legacy), NIST Cybersecurity Framework 2.0 +1 more |
| A.6.2 | Terms and conditions of employment Maps to HITRUST CSF v11, TISAX (VDA ISA v6) |
| A.6.3 | Information security awareness, education and training Maps to HITRUST CSF v11, ISO/IEC 42001:2023, NIST Cybersecurity Framework (1.1, legacy) +2 more |
| A.6.4 | Disciplinary process Maps to HITRUST CSF v11, TISAX (VDA ISA v6) |
| A.6.5 | Responsibilities after termination or change of employment Maps to HITRUST CSF v11, TISAX (VDA ISA v6) |
| A.6.6 | Confidentiality or non-disclosure agreements Maps to TISAX (VDA ISA v6) |
| A.6.7 | Remote working Maps to HITRUST CSF v11, TISAX (VDA ISA v6) |
| A.6.8 | Information security event reporting Maps to HITRUST CSF v11, ISO/IEC 42001:2023 |
Physical Controls · 14
| A.7.1 | Physical security perimeters Maps to HITRUST CSF v11, NIST Cybersecurity Framework (1.1, legacy), NIST Cybersecurity Framework 2.0 +1 more |
| A.7.2 | Physical entry Maps to HITRUST CSF v11, TISAX (VDA ISA v6) |
| A.7.3 | Securing offices, rooms and facilities Maps to HITRUST CSF v11 |
| A.7.4 | Physical security monitoring Maps to NIST Cybersecurity Framework (1.1, legacy), NIST Cybersecurity Framework 2.0 |
| A.7.5 | Protecting against physical and environmental threats Maps to HITRUST CSF v11, TISAX (VDA ISA v6) |
| A.7.6 | Working in secure areas Maps to HITRUST CSF v11 |
| A.7.7 | Clear desk and clear screen Maps to HITRUST CSF v11, TISAX (VDA ISA v6) |
| A.7.8 | Equipment siting and protection Maps to HITRUST CSF v11 |
| A.7.9 | Security of assets off-premises Maps to HITRUST CSF v11 |
| A.7.10 | Storage media Maps to HITRUST CSF v11, TISAX (VDA ISA v6) |
| A.7.11 | Supporting utilities Maps to HITRUST CSF v11 |
| A.7.12 | Cabling security Maps to HITRUST CSF v11 |
| A.7.13 | Equipment maintenance Maps to HITRUST CSF v11 |
| A.7.14 | Secure disposal or re-use of equipment Maps to HITRUST CSF v11 |
Technological Controls · 34
| A.8.1 | User endpoint devices Maps to HITRUST CSF v11, NIST Cybersecurity Framework (1.1, legacy), NIST Cybersecurity Framework 2.0 +1 more |
| A.8.2 | Privileged access rights Maps to HITRUST CSF v11, TISAX (VDA ISA v6) |
| A.8.3 | Information access restriction Maps to HITRUST CSF v11 |
| A.8.4 | Access to source code Maps to HITRUST CSF v11, TISAX (VDA ISA v6) |
| A.8.5 | Secure authentication Maps to HITRUST CSF v11, NIST Cybersecurity Framework (1.1, legacy), NIST Cybersecurity Framework 2.0 +1 more |
| A.8.6 | Capacity management Maps to HITRUST CSF v11 |
| A.8.7 | Protection against malware Maps to HITRUST CSF v11, NIST Cybersecurity Framework (1.1, legacy), NIST Cybersecurity Framework 2.0 +3 more |
| A.8.8 | Management of technical vulnerabilities Maps to HITRUST CSF v11, NIST Cybersecurity Framework (1.1, legacy), NIST Cybersecurity Framework 2.0 +2 more |
| A.8.9 | Configuration management Maps to NIST Cybersecurity Framework (1.1, legacy), NIST Cybersecurity Framework 2.0, PCI DSS v4.0.1 |
| A.8.10 | Information deletion |
| A.8.11 | Data masking |
| A.8.12 | Data leakage prevention Maps to NIST Cybersecurity Framework (1.1, legacy), NIST Cybersecurity Framework 2.0 |
| A.8.13 | Information backup Maps to HITRUST CSF v11, NIST Cybersecurity Framework (1.1, legacy), NIST Cybersecurity Framework 2.0 +1 more |
| A.8.14 | Redundancy of information processing facilities Maps to HITRUST CSF v11 |
| A.8.15 | Logging Maps to HITRUST CSF v11, ISO/IEC 42001:2023, NIST Cybersecurity Framework (1.1, legacy) +4 more |
| A.8.16 | Monitoring activities Maps to HITRUST CSF v11, ISO/IEC 42001:2023, NIST Cybersecurity Framework (1.1, legacy) +2 more |
| A.8.17 | Clock synchronization Maps to HITRUST CSF v11 |
| A.8.18 | Use of privileged utility programs Maps to HITRUST CSF v11 |
| A.8.19 | Installation of software on operational systems Maps to HITRUST CSF v11 |
| A.8.20 | Networks security Maps to HITRUST CSF v11, NIST Cybersecurity Framework (1.1, legacy), NIST Cybersecurity Framework 2.0 +2 more |
| A.8.21 | Security of network services Maps to HITRUST CSF v11 |
| A.8.22 | Segregation of networks Maps to HITRUST CSF v11, TISAX (VDA ISA v6) |
| A.8.23 | Web filtering Maps to HITRUST CSF v11 |
| A.8.24 | Use of cryptography Maps to HITRUST CSF v11, NIST Cybersecurity Framework (1.1, legacy), NIST Cybersecurity Framework 2.0 +2 more |
| A.8.25 | Secure development life cycle Maps to HITRUST CSF v11, ISO/IEC 42001:2023, NIST Cybersecurity Framework (1.1, legacy) +2 more |
| A.8.26 | Application security requirements Maps to HITRUST CSF v11 |
| A.8.27 | Secure system architecture and engineering principles |
| A.8.28 | Secure coding |
| A.8.29 | Security testing in development and acceptance Maps to HITRUST CSF v11, ISO/IEC 42001:2023, TISAX (VDA ISA v6) |
| A.8.30 | Outsourced development Maps to HITRUST CSF v11 |
| A.8.31 | Separation of development, test and production environments Maps to HITRUST CSF v11 |
| A.8.32 | Change management Maps to HITRUST CSF v11, ISO/IEC 42001:2023, PCI DSS v4.0.1 +2 more |
| A.8.33 | Test information Maps to HITRUST CSF v11 |
| A.8.34 | Protection of information systems during audit testing |
Where this comes from
Control identifiers, families and titles are the rows CMDash’s own seed data writes for ISO/IEC 27001:2022 2022, published from a build-time export rather than read from any customer’s workspace. Cross-framework mappings are CMDash’s own, and each one is shown on both frameworks it connects.
Track these controls in CMDash
Every control on this page becomes a row with an owner, a status, evidence and an audit trail — with the crosswalks already wired, so evidence mapped once counts in more than one framework.