Framework overlap

Does GDPR cover FISMA?

You hold GDPR and have been told to do FISMA. Here is how much overlaps, control by control.

25% of FISMA you already have

GDPR already covers about 25% of FISMA, leaving 9 of 12 controls as genuinely new work.

Already covered 0 Likely covered 3 New work 9

No control in GDPR maps directly to one in FISMA. Everything counted as covered is covered because both map to the same third standard, which is what a crosswalk is, but it is an inference rather than a lookup.

What is genuinely new work

Nothing in GDPR reaches these. This is the list to scope.

FISMA-3551-3552-Purposes-Defs
Purposes and Definitions (44 USC 3551-3552)
FISMA-3553-OMB-CISA-BOD
OMB and CISA Authority and Binding Operational Directives (44 USC 3553)
FISMA-3555-Annual-IG-Evaluation
Annual Independent Evaluation by Inspector General (44 USC 3555)
FISMA-3556-FederalCIRC-3557-NSS
Federal Information Security Incident Center (44 USC 3556) + National Security Systems Exclusion (44 USC 3557)
FISMA-Coord-NIST-CSF-ISO27001-SOC2
Coordination with NIST CSF 2.0, ISO 27001, SOC 2 and Industry Frameworks
FISMA-FedRAMP-Cloud-Coordination
FedRAMP for Cloud Services + 800-37 ATO Integration
FISMA-Reform-Pipeline
FISMA 2.0 Reform Pipeline, Legislative Activity and Future State
FISMA-Status-2024-2025
FISMA Status, 2024-2025 Modernization, OMB FISMA Report and Reform Proposals
FISMA-Status-RefArchitecture
FISMA-Status-Reference-Architecture - Operationalisation Map
Show the 3 you already have
FISMA-3554-Agency-Responsibilities
Federal Agency Responsibilities (44 USC 3554) - CIO + CISO + Program + Reporting
FISMA-CIRCIA-ZTA-EO14028
CIRCIA, Zero Trust Architecture, EO 14028 + 14110 + OMB Memoranda
FISMA-NIST-800-53-RMF-800-171-FIPS
Operationalisation via NIST 800-53 + 800-37 RMF + 800-171 + FIPS 199 + FIPS 200

How this is calculated

Already covered means a mapping runs from a control in GDPR to that control. Likely covered means no direct mapping exists but both frameworks map to the same control in a third standard. New work means neither. We keep those separate rather than adding them into one friendlier number, because blending them would present a two-hop inference as a verified fact.

Coverage is not symmetric. Run it the other way and you will get a different number; both are correct.

From 332,959 cross-framework control mappings across 723 frameworks, 531 of them verified against their source documents. It does not tell you that you are compliant: a mapped control means the two standards ask for the same thing, not that you have done it.

Try another pair ยท Today's edition