Framework overlap

Does BIMCO Cyber Security cover C2M2?

You hold BIMCO Cyber Security and have been told to do C2M2. Here is how much overlaps, control by control.

64% of C2M2 you already have

BIMCO Cyber Security already covers about 64% of C2M2, leaving 8 of 22 controls as genuinely new work.

Already covered 0 Likely covered 14 New work 8

No control in BIMCO Cyber Security maps directly to one in C2M2. Everything counted as covered is covered because both map to the same third standard, which is what a crosswalk is, but it is an inference rather than a lookup.

What is genuinely new work

Nothing in BIMCO Cyber Security reaches these. This is the list to scope.

ACCESS-1
Establish and Maintain Identities
ACCESS-2
Control Logical and Physical Access
ARCH-3
Implement Data Security
PROGRAM-1
Establish and Maintain the Cybersecurity Program
RESPONSE-1
Detect and Analyze Cybersecurity Events
RISK-1
Establish a Cyber Risk Management Strategy and Program
RISK-3
Manage and Respond to Cyber Risk
SITUATION-2
Establish and Maintain a Common Operating Picture
Show the 14 you already have
ARCH-1
Establish a Cybersecurity Architecture Strategy
ARCH-2
Implement Network Protections
ASSET-1
Manage IT and OT Asset Inventory
ASSET-2
Manage Asset Configuration and Changes
RESPONSE-2
Respond to and Recover from Cybersecurity Incidents
RESPONSE-3
Plan for Continuity of Operations
RISK-2
Identify and Analyze Cyber Risk
SITUATION-1
Perform Logging and Monitoring
THIRD-1
Identify and Manage Third-Party Risk
THIRD-2
Manage Supplier Relationships and Incident Notification
THREAT-1
Identify and Respond to Cyber Threats
THREAT-2
Reduce Cybersecurity Vulnerabilities
WORKFORCE-1
Establish Cybersecurity Responsibilities and Workforce
WORKFORCE-2
Develop Cybersecurity Workforce and Awareness

How this is calculated

Already covered means a mapping runs from a control in BIMCO Cyber Security to that control. Likely covered means no direct mapping exists but both frameworks map to the same control in a third standard. New work means neither. We keep those separate rather than adding them into one friendlier number, because blending them would present a two-hop inference as a verified fact.

Coverage is not symmetric. Run it the other way and you will get a different number; both are correct.

From 332,959 cross-framework control mappings across 723 frameworks, 531 of them verified against their source documents. It does not tell you that you are compliant: a mapped control means the two standards ask for the same thing, not that you have done it.

Try another pair ยท Today's edition