Framework overlap

Does GDPR cover ISO/IEC 27010:2015?

You hold GDPR and have been told to do ISO/IEC 27010:2015. Here is how much overlaps, control by control.

39% of ISO/IEC 27010:2015 you already have

GDPR already covers about 39% of ISO/IEC 27010:2015, leaving 17 of 28 controls as genuinely new work.

Already covered 0 Likely covered 11 New work 17

No control in GDPR maps directly to one in ISO/IEC 27010:2015. Everything counted as covered is covered because both map to the same third standard, which is what a crosswalk is, but it is an inference rather than a lookup.

What is genuinely new work

Nothing in GDPR reaches these. This is the list to scope.

27010-12.1
Operational Procedures
27010-13.2
Information transfer
27010-14.1
Supplier and Third Party Handling
27010-18.1
Review and Improvement
27010-19.1
Trust Anchors and Reputation
27010-4.1
Information Sharing Community
27010-4.2
Sharing Agreements
27010-5.1
Management Direction
27010-5.2
Information sharing community policies
27010-6.1
Roles and Responsibilities
27010-6.2
Contact with Authorities
27010-7.2
Handling Shared Information
27010-8.1
Membership Onboarding
27010-A
Benefits of information sharing
27010-B
Trust assessment guidance
27010-C
Traffic Light Protocol
27010-D
Information sharing community models
Show the 11 you already have
27010-10.1
Cryptographic Protection
27010-11.1
Physical Protection
27010-12.2
Protection from malware
27010-13.1
Communications Security
27010-15.1
Incident Management
27010-16.1
Continuity of Sharing
27010-17.1
Compliance
27010-7.1
Information Classification for Sharing
27010-8.2
Membership Termination
27010-9.1
Access Control to Shared Information
27010-9.2
Authentication of Sources

How this is calculated

Already covered means a mapping runs from a control in GDPR to that control. Likely covered means no direct mapping exists but both frameworks map to the same control in a third standard. New work means neither. We keep those separate rather than adding them into one friendlier number, because blending them would present a two-hop inference as a verified fact.

Coverage is not symmetric. Run it the other way and you will get a different number; both are correct.

From 332,959 cross-framework control mappings across 723 frameworks, 531 of them verified against their source documents. It does not tell you that you are compliant: a mapped control means the two standards ask for the same thing, not that you have done it.

Try another pair ยท Today's edition