Case studies / Control framework / Crosswalk
Simulated case study
Interactive framework crosswalk
158 mappings from 32 unified controls to framework requirements. Relationship, confidence and rationale are author judgement, not independent review.
No compliance claim. Requirements are paraphrased. Payment-card mappings apply only to the fictional payments segment. ISO/IEC 27001 titles come from a secondary source and SOC 2 is mapped at category level only.
| MAP-001 | UC-ACC-01 | NIST CSF 2.0 | CSF PR.AA-05 | Partial overlap | High | Both require access to be defined, approved and managed on least privilege; the CSF outcome also covers enforcement and review, which sit in other controls. |
|---|---|---|---|---|---|---|
| MAP-002 | UC-ACC-01 | NIST CSF 2.0 | CSF PR.AA-01 | Partial overlap | High | Both require access to be defined, approved and managed on least privilege; the CSF outcome also covers enforcement and review, which sit in other controls. |
| MAP-003 | UC-ACC-01 | ISO/IEC 27001:2022 Annex A | ISO A.5.15 | Partial overlap | Medium | Access control rules, identity lifecycle and provisioning of access rights cover the same ground; role-change handling is only implied. |
| MAP-004 | UC-ACC-01 | ISO/IEC 27001:2022 Annex A | ISO A.5.16 | Partial overlap | Medium | Access control rules, identity lifecycle and provisioning of access rights cover the same ground; role-change handling is only implied. |
| MAP-005 | UC-ACC-01 | ISO/IEC 27001:2022 Annex A | ISO A.5.18 | Partial overlap | Medium | Access control rules, identity lifecycle and provisioning of access rights cover the same ground; role-change handling is only implied. |
| MAP-006 | UC-ACC-01 | PCI DSS | PCI 7.2.1 | Partial overlap | Medium | PCI DSS requires an access control model, access by job function and least privilege, and approval of required privileges by authorised personnel; Northstar's control has no explicit job-function matrix. |
| MAP-007 | UC-ACC-01 | PCI DSS | PCI 7.2.2 | Partial overlap | Medium | PCI DSS requires an access control model, access by job function and least privilege, and approval of required privileges by authorised personnel; Northstar's control has no explicit job-function matrix. |
| MAP-008 | UC-ACC-01 | PCI DSS | PCI 7.2.3 | Partial overlap | Medium | PCI DSS requires an access control model, access by job function and least privilege, and approval of required privileges by authorised personnel; Northstar's control has no explicit job-function matrix. |
| MAP-009 | UC-ACC-01 | SOC 2 Trust Services Criteria (category level) | SOC2 SEC | Related (not equivalent) | Medium | Logical access controls fall under the Security category; criterion-level mapping not made because the criteria text was not accessible. |
| MAP-010 | UC-ACC-02 | NIST CSF 2.0 | CSF PR.AA-05 | Partial overlap | Medium | Removing leaver access is part of managing identities and permissions, but the CSF states no deadline. |
| MAP-011 | UC-ACC-02 | NIST CSF 2.0 | CSF PR.AA-01 | Partial overlap | Medium | Removing leaver access is part of managing identities and permissions, but the CSF states no deadline. |
| MAP-012 | UC-ACC-02 | ISO/IEC 27001:2022 Annex A | ISO A.6.5 | Partial overlap | Medium | Termination responsibilities and removal of access rights; the standard sets no number of days. |
| MAP-013 | UC-ACC-02 | ISO/IEC 27001:2022 Annex A | ISO A.5.18 | Partial overlap | Medium | Termination responsibilities and removal of access rights; the standard sets no number of days. |
| MAP-014 | UC-ACC-02 | PCI DSS | PCI 8.2.5 | Partial overlap | High | PCI DSS requires terminated users' access to be revoked immediately; Northstar allows 2 business days. The two are not equivalent and the interpretation needs confirming with an assessor. |
| MAP-015 | UC-ACC-02 | SOC 2 Trust Services Criteria (category level) | SOC2 SEC | Related (not equivalent) | Medium | Logical access removal is a Security-category topic. |
| MAP-016 | UC-ACC-03 | NIST CSF 2.0 | CSF PR.AA-05 | Partial overlap | High | CSF says permissions are reviewed; this control is the periodic review. |
| MAP-017 | UC-ACC-03 | ISO/IEC 27001:2022 Annex A | ISO A.5.18 | Partial overlap | Medium | Access rights are reviewed at planned intervals; interval and independence are not specified. |
| MAP-018 | UC-ACC-03 | PCI DSS | PCI 7.2.4 | Partial overlap | High | PCI DSS requires user accounts and privileges, including third-party accounts, to be reviewed at least every six months; Northstar's quarterly review is more frequent but must also cover third-party accounts. |
| MAP-019 | UC-ACC-03 | SOC 2 Trust Services Criteria (category level) | SOC2 SEC | Related (not equivalent) | Medium | Periodic review of access is a Security-category topic. |
| MAP-020 | UC-ACC-04 | NIST CSF 2.0 | CSF PR.AA-05 | Partial overlap | Medium | Least privilege and separation of duties apply to privileged access. |
| MAP-021 | UC-ACC-04 | ISO/IEC 27001:2022 Annex A | ISO A.8.2 | Equivalent intent | Medium | A.8.2 is specifically about privileged access rights. |
| MAP-022 | UC-ACC-04 | ISO/IEC 27001:2022 Annex A | ISO A.5.18 | Equivalent intent | Medium | A.8.2 is specifically about privileged access rights. |
| MAP-023 | UC-ACC-04 | PCI DSS | PCI 7.2.2 | Partial overlap | Medium | Covers privileged users and approval of required privileges; not specific to emergency access. |
| MAP-024 | UC-ACC-04 | PCI DSS | PCI 7.2.3 | Partial overlap | Medium | Covers privileged users and approval of required privileges; not specific to emergency access. |
| MAP-025 | UC-ACC-04 | SOC 2 Trust Services Criteria (category level) | SOC2 SEC | Related (not equivalent) | Medium | Privileged access is a Security-category topic. |
| MAP-026 | UC-ACC-05 | NIST CSF 2.0 | CSF PR.AA-01 | Partial overlap | Medium | Identities for services are managed by the organisation; ownership is implied, not stated. |
| MAP-027 | UC-ACC-05 | ISO/IEC 27001:2022 Annex A | ISO A.5.16 | Partial overlap | Low | Identity management covers the full life cycle of identities; owner assignment for non-human accounts is not explicit. |
| MAP-028 | UC-ACC-05 | PCI DSS | PCI 7.2.5 | Partial overlap | Medium | Application and system accounts must be least-privileged and their credentials protected; named ownership is a Northstar addition. |
| MAP-029 | UC-ACC-05 | PCI DSS | PCI 8.6.3 | Partial overlap | Medium | Application and system accounts must be least-privileged and their credentials protected; named ownership is a Northstar addition. |
| MAP-030 | UC-ACC-05 | SOC 2 Trust Services Criteria (category level) | SOC2 SEC | Related (not equivalent) | Low | Category-level only. |
| MAP-031 | UC-ACC-06 | NIST CSF 2.0 | CSF PR.AA-05 | Related (not equivalent) | Low | Dormant-account removal supports least privilege but is not stated in the outcome. |
| MAP-032 | UC-ACC-06 | ISO/IEC 27001:2022 Annex A | ISO A.5.18 | Related (not equivalent) | Low | Reviewing and adjusting access rights. |
| MAP-033 | UC-ACC-06 | PCI DSS | PCI 8.2.6 | Equivalent intent | High | PCI DSS requires inactive accounts to be removed or disabled within 90 days; Northstar uses the same 90 days. |
| MAP-034 | UC-ACC-07 | NIST CSF 2.0 | CSF PR.AA-03 | Partial overlap | High | Users, services and hardware are authenticated; MFA is one way to meet it. |
| MAP-035 | UC-ACC-07 | ISO/IEC 27001:2022 Annex A | ISO A.8.5 | Partial overlap | Medium | Secure authentication; the standard does not mandate MFA for every account. |
| MAP-036 | UC-ACC-07 | PCI DSS | PCI 8.4.2 | Partial overlap | High | PCI DSS requires MFA for all access into the card-data environment; Northstar's control is broader (all human accounts). |
| MAP-037 | UC-ACC-07 | PCI DSS | PCI 8.3.1 | Partial overlap | High | PCI DSS requires MFA for all access into the card-data environment; Northstar's control is broader (all human accounts). |
| MAP-038 | UC-ACC-07 | SOC 2 Trust Services Criteria (category level) | SOC2 SEC | Related (not equivalent) | Medium | Authentication is a Security-category topic. |
| MAP-039 | UC-CHG-01 | NIST CSF 2.0 | CSF ID.RA-07 | Partial overlap | Medium | Changes are assessed for risk impact, recorded and tracked; configuration management practices apply. |
| MAP-040 | UC-CHG-01 | NIST CSF 2.0 | CSF PR.PS-01 | Partial overlap | Medium | Changes are assessed for risk impact, recorded and tracked; configuration management practices apply. |
| MAP-041 | UC-CHG-01 | ISO/IEC 27001:2022 Annex A | ISO A.8.32 | Equivalent intent | Medium | Change management for information processing facilities and systems. |
| MAP-042 | UC-CHG-01 | PCI DSS | PCI 6.5.1 | Partial overlap | Medium | PCI DSS requires change procedures covering reason, security impact, approval, testing and procedures to return to a secure state after failure; Northstar's control does not require the security-impact assessment or a return-to-secure-state procedure. |
| MAP-043 | UC-CHG-01 | SOC 2 Trust Services Criteria (category level) | SOC2 SEC | Related (not equivalent) | Low | Change management supports Security and, where relevant, Processing Integrity. |
| MAP-044 | UC-CHG-01 | SOC 2 Trust Services Criteria (category level) | SOC2 PIN | Related (not equivalent) | Low | Change management supports Security and, where relevant, Processing Integrity. |
| MAP-045 | UC-CHG-02 | NIST CSF 2.0 | CSF PR.AA-05 | Related (not equivalent) | Low | Separation of duties appears in the access outcome, not as a change outcome. |
| MAP-046 | UC-CHG-02 | ISO/IEC 27001:2022 Annex A | ISO A.5.3 | Partial overlap | Medium | Segregation of duties and separation of development, test and production environments. |
| MAP-047 | UC-CHG-02 | ISO/IEC 27001:2022 Annex A | ISO A.8.31 | Partial overlap | Medium | Segregation of duties and separation of development, test and production environments. |
| MAP-048 | UC-CHG-02 | PCI DSS | PCI 6.5.4 | Partial overlap | High | PCI DSS separates roles between production and pre-production so that only reviewed and approved changes are deployed. |
| MAP-049 | UC-CHG-02 | PCI DSS | PCI 6.5.3 | Partial overlap | High | PCI DSS separates roles between production and pre-production so that only reviewed and approved changes are deployed. |
| MAP-050 | UC-CHG-03 | NIST CSF 2.0 | CSF ID.RA-07 | Partial overlap | Low | Changes and exceptions are managed and tracked; emergency handling is not specific. |
| MAP-051 | UC-CHG-03 | ISO/IEC 27001:2022 Annex A | ISO A.8.32 | Partial overlap | Low | Change management; emergency changes are not addressed separately in the title. |
| MAP-052 | UC-CHG-03 | PCI DSS | PCI 6.5.1 | Related (not equivalent) | Low | Production changes follow established procedures; whether retrospective approval is acceptable for emergencies is not confirmed. |
| MAP-053 | UC-VUL-01 | NIST CSF 2.0 | CSF ID.RA-01 | Partial overlap | High | Vulnerabilities are identified, responses prioritised and tracked, and software is maintained. |
| MAP-054 | UC-VUL-01 | NIST CSF 2.0 | CSF ID.RA-06 | Partial overlap | High | Vulnerabilities are identified, responses prioritised and tracked, and software is maintained. |
| MAP-055 | UC-VUL-01 | NIST CSF 2.0 | CSF PR.PS-02 | Partial overlap | High | Vulnerabilities are identified, responses prioritised and tracked, and software is maintained. |
| MAP-056 | UC-VUL-01 | ISO/IEC 27001:2022 Annex A | ISO A.8.8 | Equivalent intent | Medium | Management of technical vulnerabilities. |
| MAP-057 | UC-VUL-01 | PCI DSS | PCI 6.3.1 | Partial overlap | Medium | Vulnerability identification, patching of critical or high items within one month and quarterly external scans. Northstar's control sets 30 days for critical items only, so high-severity patching is not covered. |
| MAP-058 | UC-VUL-01 | PCI DSS | PCI 6.3.3 | Partial overlap | Medium | Vulnerability identification, patching of critical or high items within one month and quarterly external scans. Northstar's control sets 30 days for critical items only, so high-severity patching is not covered. |
| MAP-059 | UC-VUL-01 | PCI DSS | PCI 11.3.2 | Partial overlap | Medium | Vulnerability identification, patching of critical or high items within one month and quarterly external scans. Northstar's control sets 30 days for critical items only, so high-severity patching is not covered. |
| MAP-060 | UC-VUL-01 | SOC 2 Trust Services Criteria (category level) | SOC2 SEC | Related (not equivalent) | Medium | Vulnerability management is a Security-category topic. |
| MAP-061 | UC-VUL-02 | NIST CSF 2.0 | CSF ID.IM-02 | Related (not equivalent) | Low | Improvements are identified from security tests; the outcome is wider than penetration testing. |
| MAP-062 | UC-VUL-02 | ISO/IEC 27001:2022 Annex A | ISO A.8.29 | Related (not equivalent) | Low | Security testing in development and acceptance; does not require independent annual penetration tests. |
| MAP-063 | UC-VUL-02 | PCI DSS | PCI 11.4.1 | Partial overlap | Medium | PCI DSS requires a defined penetration testing methodology; cadence and independence not compared in full. |
| MAP-064 | UC-LOG-01 | NIST CSF 2.0 | CSF PR.PS-04 | Partial overlap | High | Log records are generated and available for monitoring, and systems and data are monitored. |
| MAP-065 | UC-LOG-01 | NIST CSF 2.0 | CSF DE.CM-09 | Partial overlap | High | Log records are generated and available for monitoring, and systems and data are monitored. |
| MAP-066 | UC-LOG-01 | ISO/IEC 27001:2022 Annex A | ISO A.8.15 | Equivalent intent | Medium | Logging, including protection of log information. |
| MAP-067 | UC-LOG-01 | PCI DSS | PCI 10.2.1 | Partial overlap | High | Logs enabled for all components, protected against modification and retained 12 months (3 months immediately available); Northstar's 12-month retention matches but the three-month availability is not stated. |
| MAP-068 | UC-LOG-01 | PCI DSS | PCI 10.3.2 | Partial overlap | High | Logs enabled for all components, protected against modification and retained 12 months (3 months immediately available); Northstar's 12-month retention matches but the three-month availability is not stated. |
| MAP-069 | UC-LOG-01 | PCI DSS | PCI 10.5.1 | Partial overlap | High | Logs enabled for all components, protected against modification and retained 12 months (3 months immediately available); Northstar's 12-month retention matches but the three-month availability is not stated. |
| MAP-070 | UC-LOG-01 | SOC 2 Trust Services Criteria (category level) | SOC2 SEC | Related (not equivalent) | Medium | Monitoring is a Security-category topic. |
| MAP-071 | UC-LOG-02 | NIST CSF 2.0 | CSF DE.CM-03 | Partial overlap | Medium | Monitoring, communicating adverse events to authorised staff and declaring incidents. |
| MAP-072 | UC-LOG-02 | NIST CSF 2.0 | CSF DE.AE-06 | Partial overlap | Medium | Monitoring, communicating adverse events to authorised staff and declaring incidents. |
| MAP-073 | UC-LOG-02 | NIST CSF 2.0 | CSF DE.AE-08 | Partial overlap | Medium | Monitoring, communicating adverse events to authorised staff and declaring incidents. |
| MAP-074 | UC-LOG-02 | ISO/IEC 27001:2022 Annex A | ISO A.8.16 | Partial overlap | Medium | Monitoring activities for anomalous behaviour. |
| MAP-075 | UC-LOG-02 | PCI DSS | PCI 10.4.1 | Partial overlap | High | PCI DSS requires security events and critical-system logs to be reviewed at least daily; Northstar reviews weekly. Not equivalent for the Payments API segment (automated mechanisms may apply; not assessed). |
| MAP-076 | UC-LOG-02 | SOC 2 Trust Services Criteria (category level) | SOC2 SEC | Related (not equivalent) | Medium | Detection and monitoring are Security-category topics. |
| MAP-077 | UC-INC-01 | NIST CSF 2.0 | CSF RS.MA-01 | Partial overlap | Medium | The incident response plan is executed, maintained and improved. |
| MAP-078 | UC-INC-01 | NIST CSF 2.0 | CSF ID.IM-04 | Partial overlap | Medium | The incident response plan is executed, maintained and improved. |
| MAP-079 | UC-INC-01 | ISO/IEC 27001:2022 Annex A | ISO A.5.24 | Equivalent intent | Medium | Incident management planning and preparation. |
| MAP-080 | UC-INC-01 | PCI DSS | PCI 12.10.1 | Equivalent intent | High | PCI DSS requires an incident response plan and a review and test at least every 12 months, matching Northstar's annual exercise. |
| MAP-081 | UC-INC-01 | PCI DSS | PCI 12.10.2 | Equivalent intent | High | PCI DSS requires an incident response plan and a review and test at least every 12 months, matching Northstar's annual exercise. |
| MAP-082 | UC-INC-01 | SOC 2 Trust Services Criteria (category level) | SOC2 SEC | Related (not equivalent) | Medium | Incident response is a Security-category topic. |
| MAP-083 | UC-INC-02 | NIST CSF 2.0 | CSF RS.MA-02 | Partial overlap | Medium | Reports are triaged and stakeholders notified; the outcome does not require a written rationale. |
| MAP-084 | UC-INC-02 | NIST CSF 2.0 | CSF RS.CO-02 | Partial overlap | Medium | Reports are triaged and stakeholders notified; the outcome does not require a written rationale. |
| MAP-085 | UC-INC-02 | ISO/IEC 27001:2022 Annex A | ISO A.5.25 | Partial overlap | Medium | Assessment and decision on events and response to incidents. |
| MAP-086 | UC-INC-02 | ISO/IEC 27001:2022 Annex A | ISO A.5.26 | Partial overlap | Medium | Assessment and decision on events and response to incidents. |
| MAP-087 | UC-INC-02 | PCI DSS | PCI 12.10.1 | Related (not equivalent) | Low | The plan must include communication strategies (including notification of payment brands and acquirers) and analysis of legal reporting requirements; per-incident decision records are a Northstar addition. |
| MAP-088 | UC-INC-02 | PIPEDA fair information principles | PIPEDA 7 | Related (not equivalent) | Low | Safeguards principle; breach reporting duties under Canadian law were not researched and are not assessed here. |
| MAP-089 | UC-BCR-01 | NIST CSF 2.0 | CSF PR.DS-11 | Partial overlap | High | Backups of data are created, protected, maintained and tested. |
| MAP-090 | UC-BCR-01 | ISO/IEC 27001:2022 Annex A | ISO A.8.13 | Equivalent intent | Medium | Information backup. |
| MAP-091 | UC-BCR-01 | PCI DSS | PCI 9.4.1.1 | Related (not equivalent) | Low | Covers secure storage of offline backups containing cardholder data, not backup success. |
| MAP-092 | UC-BCR-01 | SOC 2 Trust Services Criteria (category level) | SOC2 AVL | Partial overlap | Medium | Backup supports the Availability category. |
| MAP-093 | UC-BCR-02 | NIST CSF 2.0 | CSF PR.DS-11 | Equivalent intent | High | Backups are tested and their integrity verified before restoration. |
| MAP-094 | UC-BCR-02 | NIST CSF 2.0 | CSF RC.RP-03 | Equivalent intent | High | Backups are tested and their integrity verified before restoration. |
| MAP-095 | UC-BCR-02 | ISO/IEC 27001:2022 Annex A | ISO A.8.13 | Partial overlap | Medium | Backup and ICT readiness for business continuity; no named test frequency. |
| MAP-096 | UC-BCR-02 | ISO/IEC 27001:2022 Annex A | ISO A.5.30 | Partial overlap | Medium | Backup and ICT readiness for business continuity; no named test frequency. |
| MAP-097 | UC-BCR-02 | SOC 2 Trust Services Criteria (category level) | SOC2 AVL | Partial overlap | Medium | Recovery capability supports Availability. |
| MAP-098 | UC-BCR-03 | NIST CSF 2.0 | CSF RC.RP-02 | Partial overlap | Medium | Recovery actions are performed and resilience mechanisms exist. |
| MAP-099 | UC-BCR-03 | NIST CSF 2.0 | CSF PR.IR-03 | Partial overlap | Medium | Recovery actions are performed and resilience mechanisms exist. |
| MAP-100 | UC-BCR-03 | ISO/IEC 27001:2022 Annex A | ISO A.5.29 | Partial overlap | Medium | Security during disruption and ICT readiness. |
| MAP-101 | UC-BCR-03 | ISO/IEC 27001:2022 Annex A | ISO A.5.30 | Partial overlap | Medium | Security during disruption and ICT readiness. |
| MAP-102 | UC-BCR-03 | SOC 2 Trust Services Criteria (category level) | SOC2 AVL | Partial overlap | Medium | Disaster recovery supports Availability. |
| MAP-103 | UC-SUP-01 | NIST CSF 2.0 | CSF GV.SC-06 | Equivalent intent | High | Due diligence before entering supplier relationships; suppliers prioritised by criticality. |
| MAP-104 | UC-SUP-01 | NIST CSF 2.0 | CSF GV.SC-04 | Equivalent intent | High | Due diligence before entering supplier relationships; suppliers prioritised by criticality. |
| MAP-105 | UC-SUP-01 | ISO/IEC 27001:2022 Annex A | ISO A.5.19 | Partial overlap | Medium | Information security in supplier relationships and agreements. |
| MAP-106 | UC-SUP-01 | ISO/IEC 27001:2022 Annex A | ISO A.5.20 | Partial overlap | Medium | Information security in supplier relationships and agreements. |
| MAP-107 | UC-SUP-01 | PCI DSS | PCI 12.8.1 | Partial overlap | Medium | Maintain a list of service providers and written agreements; applies only to providers that handle or can affect account data, to be confirmed for each vendor. |
| MAP-108 | UC-SUP-01 | PCI DSS | PCI 12.8.2 | Partial overlap | Medium | Maintain a list of service providers and written agreements; applies only to providers that handle or can affect account data, to be confirmed for each vendor. |
| MAP-109 | UC-SUP-01 | SOC 2 Trust Services Criteria (category level) | SOC2 SEC | Related (not equivalent) | Low | Vendor management is a Security-category topic. |
| MAP-110 | UC-SUP-02 | NIST CSF 2.0 | CSF GV.SC-07 | Equivalent intent | High | Supplier risks are understood, recorded, assessed and monitored. |
| MAP-111 | UC-SUP-02 | NIST CSF 2.0 | CSF GV.SC-09 | Equivalent intent | High | Supplier risks are understood, recorded, assessed and monitored. |
| MAP-112 | UC-SUP-02 | ISO/IEC 27001:2022 Annex A | ISO A.5.22 | Equivalent intent | Medium | Monitoring, review and change management of supplier services. |
| MAP-113 | UC-SUP-02 | PCI DSS | PCI 12.8.4 | Partial overlap | Medium | Monitor service providers' PCI DSS compliance at least every 12 months and record which requirements each manages. |
| MAP-114 | UC-SUP-02 | PCI DSS | PCI 12.8.5 | Partial overlap | Medium | Monitor service providers' PCI DSS compliance at least every 12 months and record which requirements each manages. |
| MAP-115 | UC-PRV-01 | NIST CSF 2.0 | CSF GV.OC-03 | Related (not equivalent) | Low | Legal and regulatory obligations including privacy are understood; no impact-assessment outcome. |
| MAP-116 | UC-PRV-01 | ISO/IEC 27001:2022 Annex A | ISO A.5.34 | Partial overlap | Medium | Privacy and protection of PII and legal requirements. |
| MAP-117 | UC-PRV-01 | ISO/IEC 27001:2022 Annex A | ISO A.5.31 | Partial overlap | Medium | Privacy and protection of PII and legal requirements. |
| MAP-118 | UC-PRV-01 | SOC 2 Trust Services Criteria (category level) | SOC2 PRV | Partial overlap | Medium | Privacy category, if in a report's scope. |
| MAP-119 | UC-PRV-01 | PIPEDA fair information principles | PIPEDA 2 | Partial overlap | Medium | Identifying purposes and accountability are the principles an impact assessment supports. |
| MAP-120 | UC-PRV-01 | PIPEDA fair information principles | PIPEDA 1 | Partial overlap | Medium | Identifying purposes and accountability are the principles an impact assessment supports. |
| MAP-121 | UC-PRV-02 | ISO/IEC 27001:2022 Annex A | ISO A.8.10 | Partial overlap | Medium | Information deletion and protection of records. |
| MAP-122 | UC-PRV-02 | ISO/IEC 27001:2022 Annex A | ISO A.5.33 | Partial overlap | Medium | Information deletion and protection of records. |
| MAP-123 | UC-PRV-02 | PCI DSS | PCI 3.2.1 | Partial overlap | Medium | Account data storage is minimised through retention and disposal. |
| MAP-124 | UC-PRV-02 | SOC 2 Trust Services Criteria (category level) | SOC2 PRV | Partial overlap | Medium | Retention and disposal appear under Privacy and Confidentiality. |
| MAP-125 | UC-PRV-02 | SOC 2 Trust Services Criteria (category level) | SOC2 CON | Partial overlap | Medium | Retention and disposal appear under Privacy and Confidentiality. |
| MAP-126 | UC-PRV-02 | PIPEDA fair information principles | PIPEDA 5 | Equivalent intent | Medium | Limiting use, disclosure and retention. |
| MAP-127 | UC-SDL-01 | NIST CSF 2.0 | CSF PR.PS-06 | Equivalent intent | High | Secure software development practices are integrated. |
| MAP-128 | UC-SDL-01 | ISO/IEC 27001:2022 Annex A | ISO A.8.25 | Partial overlap | Medium | Secure development life cycle and secure coding. |
| MAP-129 | UC-SDL-01 | ISO/IEC 27001:2022 Annex A | ISO A.8.28 | Partial overlap | Medium | Secure development life cycle and secure coding. |
| MAP-130 | UC-SDL-01 | PCI DSS | PCI 6.2.1 | Partial overlap | High | Bespoke software is developed securely and reviewed before release. |
| MAP-131 | UC-SDL-01 | PCI DSS | PCI 6.2.3 | Partial overlap | High | Bespoke software is developed securely and reviewed before release. |
| MAP-132 | UC-SDL-01 | SOC 2 Trust Services Criteria (category level) | SOC2 SEC | Related (not equivalent) | Low | Category-level only. |
| MAP-133 | UC-AIG-01 | NIST CSF 2.0 | CSF GV.RM-01 | Related (not equivalent) | Low | General risk management objectives; AI-specific risk is not addressed by CSF 2.0 subcategories I verified. See Project 4 for NIST AI RMF. |
| MAP-134 | UC-AIG-02 | NIST CSF 2.0 | CSF GV.RM-03 | Related (not equivalent) | Low | Risk activities feed enterprise risk management; no outcome concerns human review of AI output. |
| MAP-135 | UC-AIG-03 | NIST CSF 2.0 | CSF GV.OV-03 | Related (not equivalent) | Low | Risk management performance is evaluated; AI-specific monitoring is not an outcome. |
| MAP-136 | UC-GOV-01 | NIST CSF 2.0 | CSF GV.PO-01 | Equivalent intent | High | Policy for managing cybersecurity risk is established, communicated, reviewed and updated. |
| MAP-137 | UC-GOV-01 | NIST CSF 2.0 | CSF GV.PO-02 | Equivalent intent | High | Policy for managing cybersecurity risk is established, communicated, reviewed and updated. |
| MAP-138 | UC-GOV-01 | ISO/IEC 27001:2022 Annex A | ISO A.5.1 | Equivalent intent | Medium | Policies for information security. |
| MAP-139 | UC-GOV-01 | PCI DSS | PCI 12.1.1 | Equivalent intent | High | An information security policy is established, published, maintained and disseminated. |
| MAP-140 | UC-GOV-01 | SOC 2 Trust Services Criteria (category level) | SOC2 SEC | Related (not equivalent) | Low | Category-level only. |
| MAP-141 | UC-GOV-02 | NIST CSF 2.0 | CSF ID.AM-01 | Equivalent intent | High | Inventories of hardware, software, services and data are maintained. |
| MAP-142 | UC-GOV-02 | NIST CSF 2.0 | CSF ID.AM-02 | Equivalent intent | High | Inventories of hardware, software, services and data are maintained. |
| MAP-143 | UC-GOV-02 | NIST CSF 2.0 | CSF ID.AM-07 | Equivalent intent | High | Inventories of hardware, software, services and data are maintained. |
| MAP-144 | UC-GOV-02 | ISO/IEC 27001:2022 Annex A | ISO A.5.9 | Equivalent intent | Medium | Inventory of information and associated assets; classification of information. |
| MAP-145 | UC-GOV-02 | ISO/IEC 27001:2022 Annex A | ISO A.5.12 | Equivalent intent | Medium | Inventory of information and associated assets; classification of information. |
| MAP-146 | UC-GOV-02 | SOC 2 Trust Services Criteria (category level) | SOC2 CON | Related (not equivalent) | Low | Classification supports Confidentiality commitments. |
| MAP-147 | UC-GOV-03 | NIST CSF 2.0 | CSF PR.AT-01 | Equivalent intent | High | Personnel and specialised roles receive awareness and training. |
| MAP-148 | UC-GOV-03 | NIST CSF 2.0 | CSF PR.AT-02 | Equivalent intent | High | Personnel and specialised roles receive awareness and training. |
| MAP-149 | UC-GOV-03 | ISO/IEC 27001:2022 Annex A | ISO A.6.3 | Equivalent intent | Medium | Information security awareness, education and training. |
| MAP-150 | UC-GOV-03 | PCI DSS | PCI 12.6.1 | Equivalent intent | High | A formal security awareness program is implemented. |
| MAP-151 | UC-GOV-03 | SOC 2 Trust Services Criteria (category level) | SOC2 SEC | Related (not equivalent) | Low | Category-level only. |
| MAP-152 | UC-CFG-01 | NIST CSF 2.0 | CSF PR.PS-01 | Equivalent intent | High | Configuration management practices are established and applied. |
| MAP-153 | UC-CFG-01 | ISO/IEC 27001:2022 Annex A | ISO A.8.9 | Equivalent intent | Medium | Configuration management. |
| MAP-154 | UC-CFG-01 | PCI DSS | PCI 2.2.1 | Equivalent intent | High | Configuration standards are developed, implemented and maintained for all system components. |
| MAP-155 | UC-CFG-01 | SOC 2 Trust Services Criteria (category level) | SOC2 SEC | Related (not equivalent) | Low | Category-level only. |
| MAP-156 | UC-GOV-04 | PCI DSS | PCI 12.5.2 | Equivalent intent | High | Scope is documented and confirmed at least every 12 months and on significant change. |
| MAP-157 | UC-GOV-04 | NIST CSF 2.0 | CSF ID.AM-03 | Related (not equivalent) | Low | Data flows and asset prioritisation support scoping but are not the same as a confirmed scope document. |
| MAP-158 | UC-GOV-04 | NIST CSF 2.0 | CSF ID.AM-05 | Related (not equivalent) | Low | Data flows and asset prioritisation support scoping but are not the same as a confirmed scope document. |
No rows match the current filters.