Framework overlap

Does API 1164 cover ISO/IEC 29147:2018?

You hold API 1164 and have been told to do ISO/IEC 29147:2018. Here is how much overlaps, control by control.

15% of ISO/IEC 29147:2018 you already have

API 1164 already covers about 15% of ISO/IEC 29147:2018, leaving 29 of 34 controls as genuinely new work.

Already covered 1 Likely covered 4 New work 29

What is genuinely new work

Nothing in API 1164 reaches these. This is the list to scope.

29147-5.1
Vulnerability Disclosure Policy
29147-5.10
Disclosure Records and Retention
29147-5.12
Bug Bounty Programme Integration
29147-5.13
External Stakeholder Notification
29147-5.14
Embargo Management
29147-5.15
Programme Governance and Roles
29147-5.16
Training and Awareness
29147-5.2
Receipt of Vulnerability Reports
29147-5.3
Initial Triage and Verification
29147-5.4
Finder Communication and Coordination
29147-5.5
Coordinated Disclosure Timeline
29147-5.7
Multi-Party Coordination
29147-5.9
Post-Disclosure Monitoring
29147-6.1
General receiving guidelines
29147-6.2
Vulnerability report contents
29147-6.3
Initial assessment
29147-6.4
Further investigation
29147-6.5
Ongoing communication
29147-6.6
Coordinator involvement
29147-6.7
Operational security
29147-7.3
Advisory publication guidelines
29147-7.4
Advisory content elements
29147-7.5
Communication channels
29147-7.6
Advisory format
29147-7.7
Advisory authenticity
29147-8.1
Coordination general
29147-8.2
Vendors playing multiple roles
29147-9.1
Vulnerability disclosure policy development
29147-9.3
Communication expectations and timelines
Show the 5 you already have
29147-5.11
Researcher Safe Harbour and Legal Posture
29147-5.6
Advisory Content and Quality
29147-5.8
Confidentiality of Reports
29147-7.8
Remediation information
29147-9.2
Contact mechanisms and scope

How this is calculated

Already covered means a mapping runs from a control in API 1164 to that control. Likely covered means no direct mapping exists but both frameworks map to the same control in a third standard. New work means neither. We keep those separate rather than adding them into one friendlier number, because blending them would present a two-hop inference as a verified fact.

Coverage is not symmetric. Run it the other way and you will get a different number; both are correct.

From 332,959 cross-framework control mappings across 723 frameworks, 531 of them verified against their source documents. It does not tell you that you are compliant: a mapped control means the two standards ask for the same thing, not that you have done it.

Try another pair ยท Today's edition