Framework overlap

Does Azure Security Benchmark cover GHG Protocol?

You hold Azure Security Benchmark and have been told to do GHG Protocol. Here is how much overlaps, control by control.

17% of GHG Protocol you already have

Azure Security Benchmark already covers about 17% of GHG Protocol, leaving 10 of 12 controls as genuinely new work.

Already covered 1 Likely covered 1 New work 10

What is genuinely new work

Nothing in Azure Security Benchmark reaches these. This is the list to scope.

GHG-Boundaries-BaseYear-Recalc
Organisational + Operational Boundaries, Base Year and Recalculation
GHG-Coord-EU-Taxonomy-CSDDD-EU-ETS
Coordination with EU Taxonomy, CSDDD, EU ETS and Other Climate Regulatory Frameworks
GHG-Coord-SBTi-CDP-CSRD-ISSB
Coordination with SBTi, CDP, CSRD/ESRS E1, ISSB IFRS S2, ISO 14064 and Climate Frameworks
GHG-Crosswalk-ISO-14064-PCAF-Sectoral
Crosswalk to ISO 14064-1/2/3, PCAF, Sectoral Standards and Climate Disclosure Frameworks
GHG-DataQuality-Verification-Disclosure
Data Quality, Uncertainty, External Verification and Public Disclosure
GHG-Implementation-Roadmap-Inventory
GHG Protocol Implementation - Inventory Process, Organizational Roles and Tooling
GHG-Scope1-Direct
Scope 1 Direct Emissions - Stationary + Mobile Combustion + Process + Fugitive
GHG-Scope2-Dual-Reporting
Scope 2 Indirect Energy Emissions - Location-Based + Market-Based Dual Reporting (2015 Guidance)
GHG-Status-2024-2025-Update-AI-Land
Status, 2024-2025 Update Pipeline, AI/ML Emissions, Land Sector + Removals Guidance 2025
GHG-Status-Adoption-Sectoral
GHG Protocol Adoption Status and Sectoral Application 2024-2025
Show the 2 you already have
GHG-Suite-Corporate-Principles
GHG Protocol Suite, Corporate Standard and 5 Reporting Principles
GHG-Scope3-Value-Chain-15Categories
Scope 3 Value Chain Emissions - 15 Categories (8 Upstream + 7 Downstream)

How this is calculated

Already covered means a mapping runs from a control in Azure Security Benchmark to that control. Likely covered means no direct mapping exists but both frameworks map to the same control in a third standard. New work means neither. We keep those separate rather than adding them into one friendlier number, because blending them would present a two-hop inference as a verified fact.

Coverage is not symmetric. Run it the other way and you will get a different number; both are correct.

From 332,959 cross-framework control mappings across 723 frameworks, 531 of them verified against their source documents. It does not tell you that you are compliant: a mapped control means the two standards ask for the same thing, not that you have done it.

Try another pair ยท Today's edition