Framework overlap

Does NIST SP 1800-32 cover ISO 20000-1?

You hold NIST SP 1800-32 and have been told to do ISO 20000-1. Here is how much overlaps, control by control.

22% of ISO 20000-1 you already have

NIST SP 1800-32 already covers about 22% of ISO 20000-1, leaving 21 of 27 controls as genuinely new work.

Already covered 4 Likely covered 2 New work 21

What is genuinely new work

Nothing in NIST SP 1800-32 reaches these. This is the list to scope.

7.5
Threat assessment
8.6.1
Incident Management
8.6.2
Service Request Management
8.6.3
Problem Management
8.7.1
Service Availability Management
8.7.2
Service Continuity Management
8.7.3
Information Security Management
ISO20000-01
Service portfolio management
ISO20000-02
Service level management
ISO20000-04
IT service continuity management
ISO20000-05
Information security for services
ISO20000-07
Release and deployment management
ISO20000-08
Service validation and testing
ISO20000-09
Knowledge management
ISO20000-12
Problem management
ISO20000-13
Event management and monitoring
ISO20000-14
Request fulfillment
ISO20000-16
Service measurement and reporting
ISO20000-17
Continual improvement process
ISO20000-18
Benchmarking and maturity assessment
ISO20000-19
Stakeholder feedback management
Show the 6 you already have
ISO20000-06
Change management processes
ISO20000-10
Configuration management
ISO20000-11
Incident management
ISO20000-15
Access management for services
9.1
Risk communication and consultation
ISO20000-03
Capacity and availability management

How this is calculated

Already covered means a mapping runs from a control in NIST SP 1800-32 to that control. Likely covered means no direct mapping exists but both frameworks map to the same control in a third standard. New work means neither. We keep those separate rather than adding them into one friendlier number, because blending them would present a two-hop inference as a verified fact.

Coverage is not symmetric. Run it the other way and you will get a different number; both are correct.

From 332,959 cross-framework control mappings across 723 frameworks, 531 of them verified against their source documents. It does not tell you that you are compliant: a mapped control means the two standards ask for the same thing, not that you have done it.

Try another pair ยท Today's edition