Framework overlap

Does PCI SSF cover ISO 31000?

You hold PCI SSF and have been told to do ISO 31000. Here is how much overlaps, control by control.

23% of ISO 31000 you already have

PCI SSF already covers about 23% of ISO 31000, leaving 33 of 43 controls as genuinely new work.

Already covered 3 Likely covered 7 New work 33

What is genuinely new work

Nothing in PCI SSF reaches these. This is the list to scope.

ISO31000-02
Risk governance structure
ISO31000-03
Risk culture and communication
ISO31000-04
Stakeholder requirements for risk
ISO31000-06
Risk identification methods
ISO31000-08
Risk criteria and thresholds
ISO31000-11
Risk treatment options and selection
ISO31000-12
Risk treatment plan development
ISO31000-13
Residual risk acceptance
ISO31000-14
Risk transfer and insurance
ISO31000-15
Control implementation and monitoring
ISO31000-16
Risk monitoring procedures
ISO31000-17
Risk reporting and communication
ISO31000-20
Management review of risk program
ISO31000-4.1
Risk management principles overview
ISO31000-4.2
Integrated principle
ISO31000-4.3
Structured and comprehensive principle
ISO31000-4.4
Customised principle
ISO31000-4.5
Inclusive principle
ISO31000-4.6
Dynamic principle
ISO31000-4.7
Best available information principle
ISO31000-4.8
Human and cultural factors principle
ISO31000-4.9
Continual improvement principle
ISO31000-5.3
Integration into the organisation
ISO31000-5.4
Design of framework
ISO31000-5.5
Implementation
ISO31000-5.6
Evaluation
ISO31000-5.7
Improvement
ISO31000-6.4.1
Risk identification
ISO31000-6.4.2
Risk analysis
ISO31000-6.4.3
Risk evaluation
ISO31000-6.5
Risk treatment
ISO31000-6.6
Monitoring and review
ISO31000-6.7
Recording and reporting
Show the 10 you already have
ISO31000-01
Risk management policy and scope
ISO31000-05
Risk management integration
ISO31000-18
Risk register maintenance
ISO31000-07
Risk analysis and evaluation
ISO31000-09
Risk scenario development
ISO31000-10
Risk interdependency analysis
ISO31000-19
Continuous improvement of risk processes
ISO31000-5.2
Leadership and commitment
ISO31000-6.2
Communication and consultation
ISO31000-6.3
Scope, context and criteria

How this is calculated

Already covered means a mapping runs from a control in PCI SSF to that control. Likely covered means no direct mapping exists but both frameworks map to the same control in a third standard. New work means neither. We keep those separate rather than adding them into one friendlier number, because blending them would present a two-hop inference as a verified fact.

Coverage is not symmetric. Run it the other way and you will get a different number; both are correct.

From 332,959 cross-framework control mappings across 723 frameworks, 531 of them verified against their source documents. It does not tell you that you are compliant: a mapped control means the two standards ask for the same thing, not that you have done it.

Try another pair ยท Today's edition