Framework overlap

Does ISO/IEC 42001:2023 cover ISO 27701:2019?

You hold ISO/IEC 42001:2023 and have been told to do ISO 27701:2019. Here is how much overlaps, control by control.

32% of ISO 27701:2019 you already have

ISO/IEC 42001:2023 already covers about 32% of ISO 27701:2019, leaving 88 of 130 controls as genuinely new work.

Already covered 31 Likely covered 11 New work 88

What is genuinely new work

Nothing in ISO/IEC 42001:2023 reaches these. This is the list to scope.

5.2.3
Determining the scope of the information security management system
5.2.4
Information security management system
5.6.2
Information security risk assessment
5.6.3
Information security risk treatment
5.8
Improvement
6.10.1
Network security management
6.10.2
Information transfer
6.11.1
Security requirements of information systems
6.11.2
Security in development and support processes
6.11.3
Test data
6.12
Supplier relationships
6.12.1
Information security in supplier 0d0997ee1127/iso-iec-27701-2019 relationships
6.12.2
Supplier service delivery management
6.13
Information security incident management
6.13.1
Management of information security incidents and improvements
6.14
Information security aspects of business continuity management
6.14.1
Information security continuity
6.14.2
Redundancies
6.15.1
Compliance with legal and contractual requirements
6.15.2
Information security reviews
6.2.1
Management direction for information security
6.3
Organization of information security
6.3.2
Mobile devices and teleworking
6.4
Human resource security
6.4.1
Prior to employment
6.4.2
During employment
6.4.3
Termination and change of employment
6.5.2
Information classification
6.5.3
Media handling
6.6
Access control
6.6.1
Business requirements of access control
6.6.2
User access management
6.6.4
System and application access control
6.7
Cryptography
6.7.1
Cryptographic controls
6.8
Physical and environmental security
6.8.1
Secure areas
6.8.2
Equipment
6.9
Operations security
6.9.2
Protection from malware
6.9.3
Backup
6.9.4
Logging and monitoring
6.9.5
Control of operational software
6.9.6
Technical vulnerability management
6.9.7
Information systems audit considerations
7.2.1
Identify and document purpose
7.2.2
Identify lawful basis
7.2.3
Determine when and how consent is to be obtained
7.2.4
Obtain and record consent
7.2.5
Privacy impact assessment
7.2.6
Contracts with PII processors
7.2.7
Joint PII controller
7.2.8
Records related to processing PII
7.3.1
Determining and fulfilling obligations to PII principals
7.3.10
Automated decision making
7.3.2
Determining information for PII principals
7.3.3
Providing information to PII principals
7.3.4
Providing mechanism to modify or withdraw consent
7.3.5
Providing mechanism to object to PII processing
7.3.6
Access, correction and/or erasure
7.3.7
PII controllers' obligations to inform third parties
7.3.8
Providing copy of PII processed
7.3.9
Handling requests
7.4.1
Limit collection
7.4.2
Limit processing
7.4.3
Accuracy and quality
7.4.4
PII minimization objectives
7.4.5
PII de-identification and deletion at the end of processing
7.4.6
Temporary files
7.4.7
Retention
7.4.8
Disposal
7.4.9
PII transmission controls
7.5.4
Records of PII disclosure to third parties
8.2.1
Customer agreement
8.2.2
Organization’s purposes
8.2.4
Infringing instruction
8.2.6
Records related to processing PII
8.3.1
Obligations to PII principals
8.4.1
Temporary files
8.4.3
PII transmission controls
8.5.1
Basis for PII transfer between jurisdictions
8.5.2
Countries and international organizations to which PII can be transferred
8.5.3
Records of PII disclosure to third parties
8.5.4
Notification of PII disclosure requests
8.5.5
Legally binding PII disclosures
8.5.6
Disclosure of subcontractors used to process PII
8.5.7
Engagement of a subcontractor to process PII
8.5.8
Change of subcontractor to process PII
Show the 42 you already have
4.1
Structure of this document
4.2
Application of ISO/IEC 27001:2013 requirements
4.3
Application of ISO/IEC 27002:2013 guidelines
4.4
Customer
5.2
Context of the organization
5.2.1
Understanding the organization and its context
5.2.2
Understanding the needs and expectations of interested parties
5.3
Leadership
5.3.1
Leadership and commitment
5.3.3
Organizational roles, responsibilities and authorities
5.4.1
Actions to address risks and opportunities
5.5.4
Communication
5.5.5
Documented information
5.6.1
Operational planning and control
5.7.1
Monitoring, measurement, analysis and evaluation
5.7.2
Internal audit
5.7.3
Management review
5.8.1
Nonconformity and corrective action
5.8.2
Continual improvement
6.2
Information security policies
6.3.1
Internal organization
7.2
Conditions for collection and processing
7.3
Obligations to PII principals
7.4
Privacy by design and privacy by default
7.5
PII sharing, transfer, and disclosure
7.5.1
Identify basis for PII transfer between jurisdictions
7.5.2
Countries and international organizations to which PII can be transferred
7.5.3
Records of transfer of PII
8.2
Conditions for collection and processing
8.4
Privacy by design and privacy by default
8.5
PII sharing, transfer, and disclosure
5.5.2
Competence
5.5.3
Awareness
5.6
Operation
5.7
Performance evaluation
6.10
Communications security
6.15
Compliance
6.5
Asset management
6.5.1
Responsibility for assets
6.6.3
User responsibilities
6.9.1
Operational procedures and responsibilities
8.4.2
Return, transfer or disposal of PII

How this is calculated

Already covered means a mapping runs from a control in ISO/IEC 42001:2023 to that control. Likely covered means no direct mapping exists but both frameworks map to the same control in a third standard. New work means neither. We keep those separate rather than adding them into one friendlier number, because blending them would present a two-hop inference as a verified fact.

Coverage is not symmetric. Run it the other way and you will get a different number; both are correct.

From 332,959 cross-framework control mappings across 723 frameworks, 531 of them verified against their source documents. It does not tell you that you are compliant: a mapped control means the two standards ask for the same thing, not that you have done it.

Try another pair · Today's edition