Framework overlap

Does ISO/IEC 25012:2008 cover FFIEC IT Examination Handbook?

You hold ISO/IEC 25012:2008 and have been told to do FFIEC IT Examination Handbook. Here is how much overlaps, control by control.

21% of FFIEC IT Examination Handbook you already have

ISO/IEC 25012:2008 already covers about 21% of FFIEC IT Examination Handbook, leaving 62 of 78 controls as genuinely new work.

Already covered 4 Likely covered 12 New work 62

What is genuinely new work

Nothing in ISO/IEC 25012:2008 reaches these. This is the list to scope.

FFIEC-01
Information security program management
FFIEC-02
Board and management oversight
FFIEC-04
Security policy framework
FFIEC-13
Third-party dependency management
FFIEC-15
Communication and escalation procedures
FFIEC-16
Due diligence and onboarding
FFIEC-17
Contractual security requirements
FFIEC-19
Concentration risk management
FFIEC-21
Incident detection and classification
FFIEC-22
Incident response and containment
IS-II.A.1
Board Oversight of Information Security
IS-II.A.2
Senior Management Responsibilities
IS-II.B.1
Information Security Culture
IS-II.C.1
Information Security Roles and Responsibilities
IS-III.A.1
Information Security Risk Management Framework
IS-III.B.2
Risk Measurement and Analysis
IS-III.B.3
Risk Mitigation Strategy
IS-III.C.1
Risk Monitoring and Reporting
IS-III.D.1
Information Security Strategy
IS-IV.A.1
Inventory and Classification of Information Assets
IS-IV.A.2
Data Flow Diagrams
IS-IV.B.1
Identity and Access Management Program
IS-IV.B.2
Authentication Controls
IS-IV.B.3
Privileged Access Management
IS-IV.B.4
Access Reviews and Recertification
IS-IV.B.5
Joiner Mover Leaver Process
IS-IV.C.1
Network Security Architecture
IS-IV.C.2
Firewall Configuration and Review
IS-IV.C.3
Wireless Network Security
IS-IV.C.4
Remote Access Security
IS-IV.D.1
Endpoint Security Controls
IS-IV.D.2
Mobile Device Management
IS-IV.D.3
Removable Media Controls
IS-IV.E.1
Secure Software Development Lifecycle
IS-IV.E.2
Application Security Testing
IS-IV.E.3
Application Change Management
IS-IV.F.1
Encryption Standards and Key Management
IS-IV.F.2
Data in Transit Encryption
IS-IV.F.3
Data at Rest Encryption
IS-IX.A.1
Third Party Risk Management
IS-IX.A.2
Cloud Service Provider Oversight
IS-V.A.1
IT Operations Management
IS-V.A.2
Configuration Management
IS-V.A.3
Patch Management
IS-V.B.1
Vulnerability Management Program
IS-V.B.2
Penetration Testing
IS-V.C.1
Physical and Environmental Security
IS-VI.A.1
Security Logging Standards
IS-VI.A.2
Security Monitoring and SIEM
IS-VI.A.3
Threat Intelligence
IS-VI.B.1
User Behavior Analytics
IS-VII.A.1
Incident Response Program
IS-VII.A.2
Incident Detection and Classification
IS-VII.A.3
Incident Response Testing and Exercises
IS-VII.A.4
Notification of Customers Regulators and Law Enforcement
IS-VIII.A.1
Business Continuity Integration
IS-VIII.A.2
Backup and Recovery
IS-X.A.1
Security Awareness Training
IS-X.B.1
Independent Information Security Audit
IS-X.B.2
Cybersecurity Assessment and Maturity
IS-XI.A.1
Architecture and Operations Alignment
IS-XI.A.2
Management Booklet Governance Alignment
Show the 16 you already have
FFIEC-05
Roles and responsibilities definition
FFIEC-11
Business continuity planning and testing
FFIEC-12
Disaster recovery procedures
FFIEC-14
Critical service identification
FFIEC-03
Risk appetite and tolerance for IT risk
FFIEC-06
Network security and segmentation
FFIEC-07
Endpoint protection and detection
FFIEC-08
Application security controls
FFIEC-09
Encryption and key management
FFIEC-10
Secure configuration standards
FFIEC-18
Ongoing monitoring and assessment
FFIEC-20
Exit strategy and transition planning
FFIEC-23
Regulatory reporting requirements
FFIEC-24
Customer notification procedures
FFIEC-25
Post-incident review and improvement
IS-III.B.1
Risk Identification

How this is calculated

Already covered means a mapping runs from a control in ISO/IEC 25012:2008 to that control. Likely covered means no direct mapping exists but both frameworks map to the same control in a third standard. New work means neither. We keep those separate rather than adding them into one friendlier number, because blending them would present a two-hop inference as a verified fact.

Coverage is not symmetric. Run it the other way and you will get a different number; both are correct.

From 332,959 cross-framework control mappings across 723 frameworks, 531 of them verified against their source documents. It does not tell you that you are compliant: a mapped control means the two standards ask for the same thing, not that you have done it.

Try another pair ยท Today's edition