Framework overlap

Does ISO 39001:2012 cover ISO/IEC 27031:2011?

You hold ISO 39001:2012 and have been told to do ISO/IEC 27031:2011. Here is how much overlaps, control by control.

48% of ISO/IEC 27031:2011 you already have

ISO 39001:2012 already covers about 48% of ISO/IEC 27031:2011, leaving 14 of 27 controls as genuinely new work.

Already covered 4 Likely covered 9 New work 14

What is genuinely new work

Nothing in ISO 39001:2012 reaches these. This is the list to scope.

27031-10.2
Supplier Continuity Arrangements
27031-4.1
Overview of IRBC
27031-4.2
IRBC framework elements
27031-5.2
ICT services and infrastructure scope
27031-6.1
Understanding the Organisation
27031-6.3
Risk Assessment for ICT Continuity
27031-7.3
Incident Response Structure
27031-7.4
IRBC Plans
27031-8.3
IRBC plan documents
27031-8.4
Awareness, competency and training
27031-9.1
Performance Measurement
27031-9.4
IRBC review and improvement
27031-A
IRBC milestones during disruption
27031-C
Assessing failure scenarios
Show the 13 you already have
27031-5.1
IRBC Policy
27031-7.1
IRBC Strategy
27031-7.2
Resource Requirements
27031-D
Developing performance criteria
27031-10.1
Continual Improvement
27031-10.3
Communication During Incidents
27031-6.2
Business Impact Analysis for ICT
27031-7.5
Awareness and Training
27031-8.1
Exercising and Testing
27031-8.2
Maintaining IRBC
27031-9.2
Internal Audit
27031-9.3
Management Review
27031-B
High availability embedded systems

How this is calculated

Already covered means a mapping runs from a control in ISO 39001:2012 to that control. Likely covered means no direct mapping exists but both frameworks map to the same control in a third standard. New work means neither. We keep those separate rather than adding them into one friendlier number, because blending them would present a two-hop inference as a verified fact.

Coverage is not symmetric. Run it the other way and you will get a different number; both are correct.

From 332,959 cross-framework control mappings across 723 frameworks, 531 of them verified against their source documents. It does not tell you that you are compliant: a mapped control means the two standards ask for the same thing, not that you have done it.

Try another pair ยท Today's edition