Framework overlap

Does AWWA Cybersecurity Guidance for the Water Sector (American Water Works Association) cover ISO 26000:2010?

You hold AWWA Cybersecurity Guidance for the Water Sector (American Water Works Association) and have been told to do ISO 26000:2010. Here is how much overlaps, control by control.

18% of ISO 26000:2010 you already have

AWWA Cybersecurity Guidance for the Water Sector (American Water Works Association) already covers about 18% of ISO 26000:2010, leaving 47 of 57 controls as genuinely new work.

Already covered 1 Likely covered 9 New work 47

What is genuinely new work

Nothing in AWWA Cybersecurity Guidance for the Water Sector (American Water Works Association) reaches these. This is the list to scope.

ISO-26000-4.2
Accountability
ISO-26000-4.3
Transparency
ISO-26000-4.4
Ethical behaviour
ISO-26000-4.5
Respect for stakeholder interests
ISO-26000-4.6
Respect for the rule of law
ISO-26000-4.7
Respect for international norms of behaviour
ISO-26000-4.8
Respect for human rights
ISO-26000-5.2
Recognizing social responsibility
ISO-26000-5.3
Stakeholder identification and engagement
ISO-26000-6.2
Organizational governance
ISO-26000-6.3.4
Resolving grievances
ISO-26000-6.3.5
Discrimination and vulnerable groups
ISO-26000-6.4.1
Employment and employment relationships
ISO-26000-6.4.2
Conditions of work and social protection
ISO-26000-6.4.3
Social dialogue
ISO-26000-6.4.5
Human development and training in the workplace
ISO-26000-6.5.2
Sustainable resource use
ISO-26000-6.8
Community involvement and development
ISO-26000-7.2
Understanding the social responsibility of the organization
ISO-26000-7.3
Integrating social responsibility throughout an organization
ISO-26000-7.4
Communication on social responsibility
ISO-26000-7.5
Enhancing credibility regarding social responsibility
ISO-26000-7.6
Reviewing and improving social responsibility actions
ISO26000-6.2
Organizational Governance
ISO26000-6.3.3
Human Rights Due Diligence
ISO26000-6.3.4
Human Rights Risk Situations
ISO26000-6.3.5
Avoidance of Complicity
ISO26000-6.3.6
Resolving Grievances
ISO26000-6.3.7
Discrimination and Vulnerable Groups
ISO26000-6.4.3
Employment and Employment Relationships
ISO26000-6.4.4
Conditions of Work and Social Protection
ISO26000-6.4.5
Social Dialogue
ISO26000-6.4.6
Health and Safety at Work
ISO26000-6.4.7
Human Development and Training
ISO26000-6.5.3
Prevention of Pollution
ISO26000-6.5.4
Sustainable Resource Use
ISO26000-6.5.5
Climate Change Mitigation and Adaptation
ISO26000-6.5.6
Protection of the Environment and Biodiversity
ISO26000-6.6.3
Anti Corruption
ISO26000-6.6.4
Responsible Political Involvement
ISO26000-6.6.5
Fair Competition
ISO26000-6.6.6
Promoting Social Responsibility in the Value Chain
ISO26000-6.7.3
Fair Marketing and Contractual Practices
ISO26000-6.7.4
Protecting Consumers Health and Safety
ISO26000-6.7.6
Consumer Service, Support, and Complaint Resolution
ISO26000-6.8.3
Community Involvement
ISO26000-6.8.9
Social Investment
Show the 10 you already have
ISO-26000-6.7
Consumer issues
ISO-26000-6.3.1
Due diligence
ISO-26000-6.3.2
Human rights risk situations
ISO-26000-6.3.3
Avoidance of complicity
ISO-26000-6.4.4
Health and safety at work
ISO-26000-6.5.1
Prevention of pollution
ISO-26000-6.5.3
Climate change mitigation and adaptation
ISO-26000-6.5.4
Protection of the environment and biodiversity
ISO-26000-6.6
Fair operating practices
ISO26000-6.7.7
Consumer Data Protection and Privacy

How this is calculated

Already covered means a mapping runs from a control in AWWA Cybersecurity Guidance for the Water Sector (American Water Works Association) to that control. Likely covered means no direct mapping exists but both frameworks map to the same control in a third standard. New work means neither. We keep those separate rather than adding them into one friendlier number, because blending them would present a two-hop inference as a verified fact.

Coverage is not symmetric. Run it the other way and you will get a different number; both are correct.

From 332,959 cross-framework control mappings across 723 frameworks, 531 of them verified against their source documents. It does not tell you that you are compliant: a mapped control means the two standards ask for the same thing, not that you have done it.

Try another pair ยท Today's edition