Framework overlap

Does NIST SP 800-137 cover ISO/IEC 27010:2015?

You hold NIST SP 800-137 and have been told to do ISO/IEC 27010:2015. Here is how much overlaps, control by control.

43% of ISO/IEC 27010:2015 you already have

NIST SP 800-137 already covers about 43% of ISO/IEC 27010:2015, leaving 16 of 28 controls as genuinely new work.

Already covered 7 Likely covered 5 New work 16

What is genuinely new work

Nothing in NIST SP 800-137 reaches these. This is the list to scope.

27010-12.1
Operational Procedures
27010-13.2
Information transfer
27010-14.1
Supplier and Third Party Handling
27010-18.1
Review and Improvement
27010-19.1
Trust Anchors and Reputation
27010-4.1
Information Sharing Community
27010-4.2
Sharing Agreements
27010-5.1
Management Direction
27010-5.2
Information sharing community policies
27010-6.1
Roles and Responsibilities
27010-6.2
Contact with Authorities
27010-7.2
Handling Shared Information
27010-A
Benefits of information sharing
27010-B
Trust assessment guidance
27010-C
Traffic Light Protocol
27010-D
Information sharing community models
Show the 12 you already have
27010-10.1
Cryptographic Protection
27010-12.2
Protection from malware
27010-13.1
Communications Security
27010-8.1
Membership Onboarding
27010-8.2
Membership Termination
27010-9.1
Access Control to Shared Information
27010-9.2
Authentication of Sources
27010-11.1
Physical Protection
27010-15.1
Incident Management
27010-16.1
Continuity of Sharing
27010-17.1
Compliance
27010-7.1
Information Classification for Sharing

How this is calculated

Already covered means a mapping runs from a control in NIST SP 800-137 to that control. Likely covered means no direct mapping exists but both frameworks map to the same control in a third standard. New work means neither. We keep those separate rather than adding them into one friendlier number, because blending them would present a two-hop inference as a verified fact.

Coverage is not symmetric. Run it the other way and you will get a different number; both are correct.

From 332,959 cross-framework control mappings across 723 frameworks, 531 of them verified against their source documents. It does not tell you that you are compliant: a mapped control means the two standards ask for the same thing, not that you have done it.

Try another pair ยท Today's edition