Framework overlap

Does Azure Security Benchmark cover 21 CFR Part 58?

You hold Azure Security Benchmark and have been told to do 21 CFR Part 58. Here is how much overlaps, control by control.

7% of 21 CFR Part 58 you already have

Azure Security Benchmark already covers about 7% of 21 CFR Part 58, leaving 27 of 29 controls as genuinely new work.

Already covered 0 Likely covered 2 New work 27

No control in Azure Security Benchmark maps directly to one in 21 CFR Part 58. Everything counted as covered is covered because both map to the same third standard, which is what a crosswalk is, but it is an inference rather than a lookup.

What is genuinely new work

Nothing in Azure Security Benchmark reaches these. This is the list to scope.

58.10
Applicability to Grants and Contracts
58.105
Test and Control Article Characterization
58.107
Test and Control Article Handling
58.113
Mixtures of Articles with Carriers
58.120
Protocol
58.130
Conduct of a Nonclinical Laboratory Study
58.15
Inspection of Testing Facility
58.185
Reporting of Nonclinical Laboratory Study Results
58.190
Storage and Retrieval of Records and Data
58.195
Retention of Records
58.200
Purpose of Disqualification
58.202
Grounds for Disqualification
58.206
Final Order on Disqualification
58.219
Reinstatement of Disqualified Facility
58.29
Personnel
58.31
Testing Facility Management
58.33
Study Director
58.35
Quality Assurance Unit
58.41
General Facility Requirements
58.45
Animal Supply Facilities
58.47
Laboratory Operation Areas
58.51
Specimen and Data Storage Facilities
58.61
Equipment Design
58.63
Maintenance and Calibration of Equipment
58.81
Standard Operating Procedures
58.83
Reagents and Solutions
58.90
Animal Care
Show the 2 you already have
58.43
Animal Care Facilities
58.49
Laboratory Operation Areas

How this is calculated

Already covered means a mapping runs from a control in Azure Security Benchmark to that control. Likely covered means no direct mapping exists but both frameworks map to the same control in a third standard. New work means neither. We keep those separate rather than adding them into one friendlier number, because blending them would present a two-hop inference as a verified fact.

Coverage is not symmetric. Run it the other way and you will get a different number; both are correct.

From 332,959 cross-framework control mappings across 723 frameworks, 531 of them verified against their source documents. It does not tell you that you are compliant: a mapped control means the two standards ask for the same thing, not that you have done it.

Try another pair ยท Today's edition