Home/Compliance
iso-27001-2022

ISO 27001:2022. Security Controls

93 controls · cross-mapped to ATT&CK techniques
Translate between regulatory language and what attackers actually do. Each control maps to MITRE ATT&CK techniques; open a control to see those techniques and whether we hold detection coverage for them.
NIST 800-53 (1246)NIST CSF (106)ISO 27001:2022 (93)PCI-DSS v4.0 (75)CIS v8.1 (62)CRI Profile (60)CSA CCM v4 (57)SOC 2 TSC (57)OWASP API (10)OWASP Mobile (10)OWASP Web (10)
93
Total controls
0%
Detection coverage
0
Covered controls
93
Coverage gaps
▤ Export audit (CSV) Coverage report Self-assessment Showing gaps only ×
▶ Check your own detection coverage

Paste the ATT&CK technique IDs you have Sigma/YARA rules for (one per line, e.g. T1059, T1190). The controls below will update to show YOUR coverage instead of ours.

Red team insight A iso-27001-2022 compliant org should have detection for the green-tagged techniques below. Controls showing no technique coverage are likely blind spots. Use gaps view to enumerate unmonitored attack paths.
▤

Controls

63 shown of 93
A.5.1
Policies for information security
medium
family Organizational framework iso-27001-2022
Equivalent controls in other frameworks  click any to see its ATT&CK technique mappings
nist-800-53: PL-1 ↗nist-800-53: PM-1 ↗nist-800-53: PM-9 ↗
A.5.10
Acceptable use of information and other associated assets
medium
family Organizational framework iso-27001-2022
Equivalent controls in other frameworks  click any to see its ATT&CK technique mappings
nist-800-53: AC-2 ↗nist-800-53: MP-7 ↗nist-800-53: PL-4 ↗
A.5.11
Return of assets
medium
family Organizational framework iso-27001-2022
Equivalent controls in other frameworks  click any to see its ATT&CK technique mappings
nist-800-53: MP-7 ↗nist-800-53: PS-4 ↗
A.5.12
Classification of information
medium
family Organizational framework iso-27001-2022
Equivalent controls in other frameworks  click any to see its ATT&CK technique mappings
nist-800-53: RA-2 ↗
A.5.13
Labelling of information
medium
family Organizational framework iso-27001-2022
Equivalent controls in other frameworks  click any to see its ATT&CK technique mappings
nist-800-53: MP-3 ↗
A.5.15
Access control
medium
family Organizational framework iso-27001-2022
Equivalent controls in other frameworks  click any to see its ATT&CK technique mappings
nist-800-53: AC-1 ↗nist-800-53: AC-2 ↗nist-800-53: AC-3 ↗nist-800-53: AC-6 ↗
A.5.17
Authentication information
medium
family Organizational framework iso-27001-2022
Equivalent controls in other frameworks  click any to see its ATT&CK technique mappings
nist-800-53: IA-5 ↗
A.5.19
Information security in supplier relationships
medium
family Organizational framework iso-27001-2022
Equivalent controls in other frameworks  click any to see its ATT&CK technique mappings
nist-800-53: SA-4 ↗nist-800-53: SA-9 ↗nist-800-53: SR-3 ↗
A.5.2
Information security roles and responsibilities
medium
family Organizational framework iso-27001-2022
Equivalent controls in other frameworks  click any to see its ATT&CK technique mappings
nist-800-53: PM-10 ↗nist-800-53: PM-2 ↗
A.5.20
Addressing information security within supplier agreements
medium
family Organizational framework iso-27001-2022
Equivalent controls in other frameworks  click any to see its ATT&CK technique mappings
nist-800-53: SA-4 ↗nist-800-53: SA-9 ↗nist-800-53: SR-5 ↗
A.5.21
Managing information security in the ICT supply chain
medium
family Organizational framework iso-27001-2022
Equivalent controls in other frameworks  click any to see its ATT&CK technique mappings
nist-800-53: SA-12 ↗nist-800-53: SR-3 ↗nist-800-53: SR-5 ↗nist-800-53: SR-6 ↗
A.5.22
Monitoring, review and change management of supplier services
medium
family Organizational framework iso-27001-2022
Equivalent controls in other frameworks  click any to see its ATT&CK technique mappings
nist-800-53: SA-9 ↗nist-800-53: SI-2 ↗nist-800-53: SR-6 ↗
A.5.23
Information security for use of cloud services
medium
family Organizational framework iso-27001-2022
Equivalent controls in other frameworks  click any to see its ATT&CK technique mappings
nist-800-53: SA-4 ↗nist-800-53: SA-9 ↗
A.5.24
Information security incident management planning and preparation
medium
family Organizational framework iso-27001-2022
Equivalent controls in other frameworks  click any to see its ATT&CK technique mappings
nist-800-53: IR-1 ↗nist-800-53: IR-8 ↗
A.5.25
Assessment and decision on information security events
medium
family Organizational framework iso-27001-2022
Equivalent controls in other frameworks  click any to see its ATT&CK technique mappings
nist-800-53: IR-4 ↗nist-800-53: IR-5 ↗nist-800-53: IR-8 ↗
A.5.26
Response to information security incidents
medium
family Organizational framework iso-27001-2022
Equivalent controls in other frameworks  click any to see its ATT&CK technique mappings
nist-800-53: IR-4 ↗nist-800-53: IR-8 ↗nist-800-53: IR-9 ↗
A.5.27
Learning from information security incidents
medium
family Organizational framework iso-27001-2022
Equivalent controls in other frameworks  click any to see its ATT&CK technique mappings
nist-800-53: IR-4 ↗nist-800-53: IR-8 ↗
A.5.28
Collection of evidence
medium
family Organizational framework iso-27001-2022
Equivalent controls in other frameworks  click any to see its ATT&CK technique mappings
nist-800-53: AU-11 ↗nist-800-53: AU-3 ↗nist-800-53: IR-9 ↗
A.5.29
Information security during disruption
medium
family Organizational framework iso-27001-2022
Equivalent controls in other frameworks  click any to see its ATT&CK technique mappings
nist-800-53: CP-1 ↗nist-800-53: CP-2 ↗
A.5.3
Segregation of duties
medium
family Organizational framework iso-27001-2022
Equivalent controls in other frameworks  click any to see its ATT&CK technique mappings
nist-800-53: AC-5 ↗
A.5.30
ICT readiness for business continuity
medium
family Organizational framework iso-27001-2022
Equivalent controls in other frameworks  click any to see its ATT&CK technique mappings
nist-800-53: CP-11 ↗nist-800-53: CP-2 ↗nist-800-53: CP-8 ↗
A.5.31
Legal, statutory, regulatory and contractual requirements
medium
family Organizational framework iso-27001-2022
Equivalent controls in other frameworks  click any to see its ATT&CK technique mappings
nist-800-53: PL-1 ↗nist-800-53: PT-1 ↗
A.5.32
Intellectual property rights
medium
family Organizational framework iso-27001-2022
Equivalent controls in other frameworks  click any to see its ATT&CK technique mappings
nist-800-53: AT-3 ↗
A.5.34
Privacy and protection of PII
medium
family Organizational framework iso-27001-2022
Equivalent controls in other frameworks  click any to see its ATT&CK technique mappings
nist-800-53: PT-1 ↗nist-800-53: PT-2 ↗
A.5.35
Independent review of information security
medium
family Organizational framework iso-27001-2022
Equivalent controls in other frameworks  click any to see its ATT&CK technique mappings
nist-800-53: CA-2 ↗nist-800-53: CA-7 ↗
A.5.36
Compliance with policies, rules and standards for information security
medium
family Organizational framework iso-27001-2022
Equivalent controls in other frameworks  click any to see its ATT&CK technique mappings
nist-800-53: CA-7 ↗nist-800-53: CM-6 ↗
A.5.37
Documented operating procedures
medium
family Organizational framework iso-27001-2022
Equivalent controls in other frameworks  click any to see its ATT&CK technique mappings
nist-800-53: CM-6 ↗nist-800-53: PL-2 ↗
A.5.4
Management responsibilities
medium
family Organizational framework iso-27001-2022
Equivalent controls in other frameworks  click any to see its ATT&CK technique mappings
nist-800-53: PM-2 ↗nist-800-53: PM-3 ↗
A.5.5
Contact with authorities
medium
family Organizational framework iso-27001-2022
Equivalent controls in other frameworks  click any to see its ATT&CK technique mappings
nist-800-53: IR-6 ↗nist-800-53: PM-15 ↗
A.5.6
Contact with special interest groups
medium
family Organizational framework iso-27001-2022
Equivalent controls in other frameworks  click any to see its ATT&CK technique mappings
nist-800-53: PM-15 ↗nist-800-53: SA-8 ↗
A.5.8
Information security in project management
medium
family Organizational framework iso-27001-2022
Equivalent controls in other frameworks  click any to see its ATT&CK technique mappings
nist-800-53: PL-8 ↗nist-800-53: PM-3 ↗nist-800-53: SA-3 ↗
A.5.9
Inventory of information and other associated assets
medium
family Organizational framework iso-27001-2022
Equivalent controls in other frameworks  click any to see its ATT&CK technique mappings
nist-800-53: CM-8 ↗
A.6.1
Screening
medium
family People framework iso-27001-2022
Equivalent controls in other frameworks  click any to see its ATT&CK technique mappings
nist-800-53: PS-3 ↗
A.6.2
Terms and conditions of employment
medium
family People framework iso-27001-2022
Equivalent controls in other frameworks  click any to see its ATT&CK technique mappings
nist-800-53: PL-4 ↗nist-800-53: PS-6 ↗nist-800-53: PS-7 ↗
A.6.3
Information security awareness, education and training
medium
family People framework iso-27001-2022
Equivalent controls in other frameworks  click any to see its ATT&CK technique mappings
nist-800-53: AT-2 ↗nist-800-53: AT-3 ↗
A.6.4
Disciplinary process
medium
family People framework iso-27001-2022
Equivalent controls in other frameworks  click any to see its ATT&CK technique mappings
nist-800-53: PS-8 ↗
A.6.5
Responsibilities after termination or change of employment
medium
family People framework iso-27001-2022
Equivalent controls in other frameworks  click any to see its ATT&CK technique mappings
nist-800-53: PS-4 ↗nist-800-53: PS-5 ↗
A.6.6
Confidentiality or non-disclosure agreements
medium
family People framework iso-27001-2022
Equivalent controls in other frameworks  click any to see its ATT&CK technique mappings
nist-800-53: PS-6 ↗nist-800-53: SA-9 ↗
A.6.8
Information security event reporting
medium
family People framework iso-27001-2022
Equivalent controls in other frameworks  click any to see its ATT&CK technique mappings
nist-800-53: IR-6 ↗nist-800-53: IR-8 ↗
A.7.1
Physical security perimeters
medium
family Physical framework iso-27001-2022
Equivalent controls in other frameworks  click any to see its ATT&CK technique mappings
nist-800-53: PE-1 ↗nist-800-53: PE-17 ↗nist-800-53: PE-18 ↗
A.7.10
Storage media
medium
family Physical framework iso-27001-2022
Equivalent controls in other frameworks  click any to see its ATT&CK technique mappings
nist-800-53: MP-1 ↗nist-800-53: MP-2 ↗nist-800-53: MP-3 ↗
A.7.11
Supporting utilities
medium
family Physical framework iso-27001-2022
Equivalent controls in other frameworks  click any to see its ATT&CK technique mappings
nist-800-53: PE-11 ↗nist-800-53: PE-9 ↗
A.7.12
Cabling security
medium
family Physical framework iso-27001-2022
Equivalent controls in other frameworks  click any to see its ATT&CK technique mappings
nist-800-53: PE-9 ↗
A.7.13
Equipment maintenance
medium
family Physical framework iso-27001-2022
Equivalent controls in other frameworks  click any to see its ATT&CK technique mappings
nist-800-53: MA-2 ↗nist-800-53: MA-3 ↗
A.7.2
Physical entry
medium
family Physical framework iso-27001-2022
Equivalent controls in other frameworks  click any to see its ATT&CK technique mappings
nist-800-53: PE-2 ↗nist-800-53: PE-3 ↗
A.7.3
Securing offices, rooms and facilities
medium
family Physical framework iso-27001-2022
Equivalent controls in other frameworks  click any to see its ATT&CK technique mappings
nist-800-53: PE-5 ↗
A.7.4
Physical security monitoring
medium
family Physical framework iso-27001-2022
Equivalent controls in other frameworks  click any to see its ATT&CK technique mappings
nist-800-53: CP-4 ↗nist-800-53: PE-6 ↗
A.7.5
Protecting against physical and environmental threats
medium
family Physical framework iso-27001-2022
Equivalent controls in other frameworks  click any to see its ATT&CK technique mappings
nist-800-53: PE-18 ↗nist-800-53: PE-9 ↗
A.7.6
Working in secure areas
medium
family Physical framework iso-27001-2022
Equivalent controls in other frameworks  click any to see its ATT&CK technique mappings
nist-800-53: PE-5 ↗nist-800-53: PE-6 ↗
A.7.7
Clear desk and clear screen
medium
family Physical framework iso-27001-2022
Equivalent controls in other frameworks  click any to see its ATT&CK technique mappings
nist-800-53: MP-2 ↗nist-800-53: MP-4 ↗
A.7.8
Equipment siting and protection
medium
family Physical framework iso-27001-2022
Equivalent controls in other frameworks  click any to see its ATT&CK technique mappings
nist-800-53: PE-5 ↗
A.7.9
Security of assets off-premises
medium
family Physical framework iso-27001-2022
Equivalent controls in other frameworks  click any to see its ATT&CK technique mappings
nist-800-53: MP-5 ↗nist-800-53: PE-17 ↗
A.8.10
Information deletion
medium
family Technological framework iso-27001-2022
Equivalent controls in other frameworks  click any to see its ATT&CK technique mappings
nist-800-53: MP-6 ↗
A.8.13
Information backup
medium
family Technological framework iso-27001-2022
Equivalent controls in other frameworks  click any to see its ATT&CK technique mappings
nist-800-53: CP-9 ↗
A.8.15
Logging
medium
family Technological framework iso-27001-2022
Equivalent controls in other frameworks  click any to see its ATT&CK technique mappings
nist-800-53: AU-2 ↗nist-800-53: AU-3 ↗nist-800-53: AU-6 ↗
A.8.16
Monitoring activities
medium
family Technological framework iso-27001-2022
Equivalent controls in other frameworks  click any to see its ATT&CK technique mappings
nist-800-53: AU-6 ↗nist-800-53: CA-7 ↗nist-800-53: SI-4 ↗
A.8.17
Clock synchronisation
medium
family Technological framework iso-27001-2022
Equivalent controls in other frameworks  click any to see its ATT&CK technique mappings
nist-800-53: AU-8 ↗
A.8.18
Use of privileged utility programs
medium
family Technological framework iso-27001-2022
Equivalent controls in other frameworks  click any to see its ATT&CK technique mappings
nist-800-53: CM-7 ↗
A.8.2
Privileged access rights
medium
family Technological framework iso-27001-2022
Equivalent controls in other frameworks  click any to see its ATT&CK technique mappings
nist-800-53: AC-2 ↗nist-800-53: AC-6 ↗
A.8.20
Networks security
medium
family Technological framework iso-27001-2022
Equivalent controls in other frameworks  click any to see its ATT&CK technique mappings
nist-800-53: SC-7 ↗
A.8.21
Security of network services
medium
family Technological framework iso-27001-2022
Equivalent controls in other frameworks  click any to see its ATT&CK technique mappings
nist-800-53: SA-9 ↗nist-800-53: SC-7 ↗
A.8.23
Web filtering
medium
family Technological framework iso-27001-2022
Equivalent controls in other frameworks  click any to see its ATT&CK technique mappings
nist-800-53: AC-4 ↗nist-800-53: SI-8 ↗
A.8.25
Secure development life cycle
medium
family Technological framework iso-27001-2022
Equivalent controls in other frameworks  click any to see its ATT&CK technique mappings
nist-800-53: SA-3 ↗nist-800-53: SA-8 ↗
Showing 1-80 of 93
Prev 1 Next
Vulnerabilities
CISA KEV catalog
CWE weaknesses
CAPEC attack patterns
Package vulnerabilities
Threat intelligence
Threat actors
Tools & malware
ATT&CK techniques
IOCs
Detection & defense
Sigma rules
YARA rules
Atomic Red Team tests
D3FEND countermeasures
Compliance
NIST 800-53
ISO 27001:2022
SOC 2 TSC
PCI-DSS v4.0
CIS Controls v8.1
About
All capabilities
Live statistics
Data sources
Privacy policy
Terms of service
threatengine.sh  ·  Open-source threat intelligence platform  ·  100+ authoritative sources  ·  Every fact traces to its origin