22% of ISO/IEC 27031:2011 you already have
GDPR already covers about 22% of ISO/IEC 27031:2011, leaving
21 of 27 controls as genuinely new work.
Already covered 1
Likely covered 5
New work 21
What is genuinely new work
Nothing in GDPR reaches these. This is the list to scope.
27031-10.1Continual Improvement
27031-10.2Supplier Continuity Arrangements
27031-10.3Communication During Incidents
27031-4.1Overview of IRBC
27031-4.2IRBC framework elements
27031-5.2ICT services and infrastructure scope
27031-6.1Understanding the Organisation
27031-6.2Business Impact Analysis for ICT
27031-6.3Risk Assessment for ICT Continuity
27031-7.3Incident Response Structure
27031-7.5Awareness and Training
27031-8.3IRBC plan documents
27031-8.4Awareness, competency and training
27031-9.1Performance Measurement
27031-9.4IRBC review and improvement
27031-AIRBC milestones during disruption
27031-CAssessing failure scenarios
27031-DDeveloping performance criteria
Show the 6 you already have
27031-7.2Resource Requirements
27031-8.1Exercising and Testing
27031-8.2Maintaining IRBC
27031-9.3Management Review
27031-BHigh availability embedded systems
How this is calculated
Already covered means a mapping runs from a control in GDPR to that control. Likely
covered means no direct mapping exists but both frameworks map to the same control in a third
standard. New work means neither. We keep those separate rather than adding them into one
friendlier number, because blending them would present a two-hop inference as a verified
fact.
Coverage is not symmetric.
Run it the other way and you will get a
different number; both are correct.
From 332,959 cross-framework control
mappings across 723 frameworks, 531 of them verified against
their source documents. It does not tell you that you are compliant: a mapped control means
the two standards ask for the same thing, not that you have done it.
Try another pair ยท
Today's edition