Framework overlap

Does ISO/IEC 29147:2018 cover ISO 13485?

You hold ISO/IEC 29147:2018 and have been told to do ISO 13485. Here is how much overlaps, control by control.

52% of ISO 13485 you already have

ISO/IEC 29147:2018 already covers about 52% of ISO 13485, leaving 14 of 29 controls as genuinely new work.

Already covered 1 Likely covered 14 New work 14

What is genuinely new work

Nothing in ISO/IEC 29147:2018 reaches these. This is the list to scope.

5.6
Monitoring Audit Programme
7.5
Threat assessment
ISO13485-10
Contingency planning for ePHI
ISO13485-11
Business associate management
ISO13485-13
Automatic logoff and session management
ISO13485-14
Audit controls and monitoring
ISO13485-15
Integrity controls for ePHI
ISO13485-18
Workstation security and use policies
ISO13485-19
Device and media controls
ISO13485-20
Disposal and re-use procedures
ISO13485-21
Security and privacy policies
ISO13485-22
Documentation and record retention
ISO13485-23
Compliance evaluation and review
ISO13485-24
Incident reporting procedures
Show the 15 you already have
ISO13485-06
Security management process and risk analysis
6.4
Logging and Monitoring
8.3
Statement of Applicability linkage
8.5
Control effectiveness review
ISO13485-01
ePHI access controls and authorization
ISO13485-02
ePHI encryption at rest and in transit
ISO13485-03
Minimum necessary standard enforcement
ISO13485-04
Patient data de-identification procedures
ISO13485-05
Audit trail for ePHI access
ISO13485-07
Workforce security and clearance procedures
ISO13485-08
Information access management
ISO13485-09
Security awareness and training program
ISO13485-12
Unique user identification and authentication
ISO13485-16
Transmission security and encryption
ISO13485-17
Facility access controls

How this is calculated

Already covered means a mapping runs from a control in ISO/IEC 29147:2018 to that control. Likely covered means no direct mapping exists but both frameworks map to the same control in a third standard. New work means neither. We keep those separate rather than adding them into one friendlier number, because blending them would present a two-hop inference as a verified fact.

Coverage is not symmetric. Run it the other way and you will get a different number; both are correct.

From 332,959 cross-framework control mappings across 723 frameworks, 531 of them verified against their source documents. It does not tell you that you are compliant: a mapped control means the two standards ask for the same thing, not that you have done it.

Try another pair ยท Today's edition