ISO 27001:2022 to NIST CSF 2.0 crosswalk

29 control objectives in ISO/IEC 27001 (Annex A controls and management clauses) are mapped here to NIST Cybersecurity Framework. Every one has a requirement on the other side. Each row is one shared objective, with the requirement ids on both sides.

Control objective	ISO 27001:2022	NIST CSF 2.0
Security governance and policies	`A.5.1`Policies for information security `A.5.36`Compliance with policies, rules and standards for information security	`GV.PO`Policy `GV.OV`Oversight
Security roles and accountability	`A.5.2`Information security roles and responsibilities `A.5.3`Segregation of duties	`GV.RR`Roles, responsibilities and authorities
Risk assessment and treatment	`Clause 6.1.2`Information security risk assessment `Clause 6.1.3`Information security risk treatment	`GV.RM`Risk management strategy `ID.RA`Risk assessment
Asset and system inventory	`A.5.9`Inventory of information and other associated assets	`ID.AM`Asset management
Data classification and handling	`A.5.12`Classification of information `A.5.13`Labelling of information	`ID.AM-07`Inventories of data and corresponding metadata are maintained `PR.DS`Data security
Access provisioning, review and removal	`A.5.15`Access control `A.5.16`Identity management `A.5.18`Access rights	`PR.AA-05`Access permissions, entitlements and authorizations are defined and managed (least privilege, separation of duties)
Least privilege and privileged access	`A.8.2`Privileged access rights `A.8.3`Information access restriction	`PR.AA-05`Access permissions managed incorporating least privilege
Authentication, unique IDs and multi-factor authentication	`A.5.17`Authentication information `A.8.5`Secure authentication	`PR.AA-03`Users, services and hardware are authenticated
Encryption at rest and key management	`A.8.24`Use of cryptography	`PR.DS-01`The confidentiality, integrity and availability of data-at-rest are protected
Encryption in transit	`A.5.14`Information transfer `A.8.24`Use of cryptography	`PR.DS-02`The confidentiality, integrity and availability of data-in-transit are protected
Network security and segmentation	`A.8.20`Networks security `A.8.21`Security of network services `A.8.22`Segregation of networks	`PR.IR-01`Networks and environments are protected from unauthorized logical access and usage
Secure configuration and hardening	`A.8.9`Configuration management	`PR.PS-01`Configuration management practices are established and applied
Vulnerability scanning and patching	`A.8.8`Management of technical vulnerabilities	`ID.RA`Risk assessment (vulnerability identification, ID.RA-01) `PR.PS-02`Software is maintained, replaced and removed commensurate with risk
Penetration testing and independent assessment	`A.8.29`Security testing in development and acceptance `A.5.35`Independent review of information security	`ID.IM`Improvement (incl. ID.IM-02, improvements from tests and exercises)
Logging, log review and monitoring	`A.8.15`Logging `A.8.16`Monitoring activities `A.8.17`Clock synchronization	`DE.CM`Continuous monitoring `PR.PS-04`Log records are generated and made available for continuous monitoring
Intrusion detection and integrity monitoring	`A.8.16`Monitoring activities	`DE.CM`Continuous monitoring `DE.AE`Adverse event analysis
Malware protection	`A.8.7`Protection against malware	`PR.PS-05`Installation and execution of unauthorized software are prevented `DE.CM`Continuous monitoring
Incident response and breach notification	`A.5.24`Information security incident management planning and preparation `A.5.25`Assessment and decision on information security events `A.5.26`Response to information security incidents `A.5.27`Learning from information security incidents	`RS.MA`Incident management `RS.AN`Incident analysis `RS.CO`Incident response reporting and communication `RS.MI`Incident mitigation `DE.AE`Adverse event analysis
Change management	`A.8.32`Change management	`PR.PS-01`Configuration management practices are established and applied
Secure software development	`A.8.25`Secure development life cycle `A.8.26`Application security requirements `A.8.28`Secure coding `A.8.29`Security testing in development and acceptance `A.8.31`Separation of development, test and production environments	`PR.PS-06`Secure software development practices are integrated and their performance monitored
Third-party and vendor risk management	`A.5.19`Information security in supplier relationships `A.5.20`Addressing information security within supplier agreements `A.5.21`Managing information security in the ICT supply chain `A.5.22`Monitoring, review and change management of supplier services `A.5.23`Information security for use of cloud services	`GV.SC`Cybersecurity supply chain risk management
Business continuity and disaster recovery	`A.5.29`Information security during disruption `A.5.30`ICT readiness for business continuity	`PR.IR-03`Mechanisms are implemented to achieve resilience requirements `RC.RP`Incident recovery plan execution
Backup and redundancy	`A.8.13`Information backup `A.8.14`Redundancy of information processing facilities	`PR.DS-11`Backups of data are created, protected, maintained and tested
Capacity and availability management	`A.8.6`Capacity management	`PR.IR-04`Adequate resource capacity to ensure availability is maintained
Security awareness and training	`A.6.3`Information security awareness, education and training	`PR.AT`Awareness and training
Personnel screening, terms and sanctions	`A.6.1`Screening `A.6.2`Terms and conditions of employment `A.6.4`Disciplinary process `A.6.5`Responsibilities after termination or change of employment	`GV.RR-04`Cybersecurity is included in human resources practices
Physical access and facility security	`A.7.1`Physical security perimeters `A.7.2`Physical entry `A.7.4`Physical security monitoring	`PR.AA-06`Physical access to assets is managed, monitored and enforced commensurate with risk
Data retention, media handling and secure disposal	`A.7.10`Storage media `A.7.14`Secure disposal or re-use of equipment `A.8.10`Information deletion	`ID.AM-08`Systems, hardware, software, services and data are managed throughout their life cycles
Ongoing control monitoring and internal audit	`Clause 9.2`Internal audit `Clause 9.3`Management review	`ID.IM`Improvement `GV.OV`Oversight

Open a control objective for the evidence checklist.NIST CSF 2.0 to ISO 27001:2022 →

Scope: Annex A controls are prefixed 'A.'; management-system clauses are prefixed 'Clause'. Mapped at category level (e.g. PR.AA) or subcategory where one is clearly the match (e.g. PR.AA-05). A mapping means the requirements address the same objective. It does not mean satisfying one satisfies the other, because scope, frequency and evidence rules differ.

More from ISO 27001:2022

ISO 27001:2022 to SOC 2 ISO 27001:2022 to PCI DSS 4.0 ISO 27001:2022 to HIPAA Security Rule ISO 27001:2022 to NIST 800-53 r5