Framework overlap

Does SSAE 18 cover ISO/IEC 27031:2011?

You hold SSAE 18 and have been told to do ISO/IEC 27031:2011. Here is how much overlaps, control by control.

33% of ISO/IEC 27031:2011 you already have

SSAE 18 already covers about 33% of ISO/IEC 27031:2011, leaving 18 of 27 controls as genuinely new work.

Already covered 6 Likely covered 3 New work 18

What is genuinely new work

Nothing in SSAE 18 reaches these. This is the list to scope.

27031-10.1
Continual Improvement
27031-10.2
Supplier Continuity Arrangements
27031-10.3
Communication During Incidents
27031-4.1
Overview of IRBC
27031-4.2
IRBC framework elements
27031-5.2
ICT services and infrastructure scope
27031-6.1
Understanding the Organisation
27031-6.2
Business Impact Analysis for ICT
27031-7.3
Incident Response Structure
27031-7.4
IRBC Plans
27031-7.5
Awareness and Training
27031-8.3
IRBC plan documents
27031-8.4
Awareness, competency and training
27031-9.1
Performance Measurement
27031-9.2
Internal Audit
27031-9.4
IRBC review and improvement
27031-A
IRBC milestones during disruption
27031-C
Assessing failure scenarios
Show the 9 you already have
27031-5.1
IRBC Policy
27031-7.2
Resource Requirements
27031-8.1
Exercising and Testing
27031-8.2
Maintaining IRBC
27031-9.3
Management Review
27031-B
High availability embedded systems
27031-6.3
Risk Assessment for ICT Continuity
27031-7.1
IRBC Strategy
27031-D
Developing performance criteria

How this is calculated

Already covered means a mapping runs from a control in SSAE 18 to that control. Likely covered means no direct mapping exists but both frameworks map to the same control in a third standard. New work means neither. We keep those separate rather than adding them into one friendlier number, because blending them would present a two-hop inference as a verified fact.

Coverage is not symmetric. Run it the other way and you will get a different number; both are correct.

From 332,959 cross-framework control mappings across 723 frameworks, 531 of them verified against their source documents. It does not tell you that you are compliant: a mapped control means the two standards ask for the same thing, not that you have done it.

Try another pair ยท Today's edition