52% of APPI you already have
NIST Cybersecurity Framework 2.0 already covers about 52% of APPI, leaving
10 of 21 controls as genuinely new work.
Already covered 4
Likely covered 7
New work 10
What is genuinely new work
Nothing in NIST Cybersecurity Framework 2.0 reaches these. This is the list to scope.
APPI-01Scope and Definitions
APPI-02Lawful Basis and Purpose Specification
APPI-03Notice at Acquisition
APPI-04Special Care-Required Personal Information
APPI-05Data Accuracy and Retention
APPI-08Supervision of Trustees
APPI-10Records of Third Party Provision
APPI-11Cross-Border Transfer Rules
APPI-14Cessation of Use and Provision
APPI-20Complaint Handling
Show the 11 you already have
APPI-16Anonymously Processed Information
APPI-17Pseudonymously Processed Information
APPI-18Personally Referable Information
APPI-21Governance and DPO Equivalent
APPI-06Security Control Measures
APPI-07Supervision of Employees
APPI-09Restriction on Third Party Provision
APPI-12Disclosure Request (Access)
APPI-13Correction, Addition, and Deletion
APPI-15Leakage Notification
APPI-19PPC Cooperation and Investigation
How this is calculated
Already covered means a mapping runs from a control in NIST Cybersecurity Framework 2.0 to that control. Likely
covered means no direct mapping exists but both frameworks map to the same control in a third
standard. New work means neither. We keep those separate rather than adding them into one
friendlier number, because blending them would present a two-hop inference as a verified
fact.
Coverage is not symmetric.
Run it the other way and you will get a
different number; both are correct.
From 332,959 cross-framework control
mappings across 723 frameworks, 531 of them verified against
their source documents. It does not tell you that you are compliant: a mapped control means
the two standards ask for the same thing, not that you have done it.
Try another pair ยท
Today's edition