ISO 27001:2022 to SOC 2 crosswalk

29 control objectives in ISO/IEC 27001 (Annex A controls and management clauses) are mapped here to SOC 2 Trust Services Criteria. Every one has a requirement on the other side. Each row is one shared objective, with the requirement ids on both sides.

Control objective	ISO 27001:2022	SOC 2
Security governance and policies	`A.5.1`Policies for information security `A.5.36`Compliance with policies, rules and standards for information security	`CC1.1`Demonstrates commitment to integrity and ethical values `CC1.2`Board exercises oversight responsibility `CC5.3`Deploys control activities through policies and procedures
Security roles and accountability	`A.5.2`Information security roles and responsibilities `A.5.3`Segregation of duties	`CC1.3`Establishes structure, authority and responsibility `CC1.5`Enforces accountability
Risk assessment and treatment	`Clause 6.1.2`Information security risk assessment `Clause 6.1.3`Information security risk treatment	`CC3.1`Specifies suitable objectives `CC3.2`Identifies and analyzes risk `CC3.3`Considers potential for fraud `CC3.4`Identifies and assesses significant changes
Asset and system inventory	`A.5.9`Inventory of information and other associated assets	`CC6.1`Logical access security (inventory of information assets is a point of focus)
Data classification and handling	`A.5.12`Classification of information `A.5.13`Labelling of information	`C1.1`Identifies and maintains confidential information
Access provisioning, review and removal	`A.5.15`Access control `A.5.16`Identity management `A.5.18`Access rights	`CC6.2`Registers and authorizes new users prior to issuing credentials `CC6.3`Authorizes, modifies or removes access based on roles
Least privilege and privileged access	`A.8.2`Privileged access rights `A.8.3`Information access restriction	`CC6.3`Role-based access and least privilege
Authentication, unique IDs and multi-factor authentication	`A.5.17`Authentication information `A.8.5`Secure authentication	`CC6.1`Logical access security software, infrastructure and architectures
Encryption at rest and key management	`A.8.24`Use of cryptography	`CC6.1`Logical access security (encryption of data at rest)
Encryption in transit	`A.5.14`Information transfer `A.8.24`Use of cryptography	`CC6.7`Restricts transmission, movement and removal of information
Network security and segmentation	`A.8.20`Networks security `A.8.21`Security of network services `A.8.22`Segregation of networks	`CC6.6`Implements logical access security measures against threats from outside system boundaries
Secure configuration and hardening	`A.8.9`Configuration management	`CC7.1`Uses detection and monitoring procedures to identify changes to configurations
Vulnerability scanning and patching	`A.8.8`Management of technical vulnerabilities	`CC7.1`Detection and monitoring procedures identify vulnerabilities
Penetration testing and independent assessment	`A.8.29`Security testing in development and acceptance `A.5.35`Independent review of information security	`CC4.1`Selects, develops and performs ongoing and/or separate evaluations `CC7.1`Detection and monitoring procedures
Logging, log review and monitoring	`A.8.15`Logging `A.8.16`Monitoring activities `A.8.17`Clock synchronization	`CC7.2`Monitors system components for anomalies indicative of malicious acts, natural disasters and errors
Intrusion detection and integrity monitoring	`A.8.16`Monitoring activities	`CC7.2`Monitors system components for anomalies `CC6.8`Prevents or detects unauthorized or malicious software
Malware protection	`A.8.7`Protection against malware	`CC6.8`Implements controls to prevent or detect and act upon the introduction of unauthorized or malicious software
Incident response and breach notification	`A.5.24`Information security incident management planning and preparation `A.5.25`Assessment and decision on information security events `A.5.26`Response to information security incidents `A.5.27`Learning from information security incidents	`CC7.3`Evaluates security events to determine whether they are incidents `CC7.4`Responds to identified security incidents `CC7.5`Identifies, develops and implements activities to recover from incidents
Change management	`A.8.32`Change management	`CC8.1`Authorizes, designs, develops, configures, documents, tests, approves and implements changes
Secure software development	`A.8.25`Secure development life cycle `A.8.26`Application security requirements `A.8.28`Secure coding `A.8.29`Security testing in development and acceptance `A.8.31`Separation of development, test and production environments	`CC8.1`Changes are developed, tested and approved
Third-party and vendor risk management	`A.5.19`Information security in supplier relationships `A.5.20`Addressing information security within supplier agreements `A.5.21`Managing information security in the ICT supply chain `A.5.22`Monitoring, review and change management of supplier services `A.5.23`Information security for use of cloud services	`CC9.2`Assesses and manages risks associated with vendors and business partners
Business continuity and disaster recovery	`A.5.29`Information security during disruption `A.5.30`ICT readiness for business continuity	`CC9.1`Identifies, selects and develops risk mitigation activities for business disruptions `A1.2`Environmental protections, software, data backup processes and recovery infrastructure `A1.3`Tests recovery plan procedures
Backup and redundancy	`A.8.13`Information backup `A.8.14`Redundancy of information processing facilities	`A1.2`Data backup processes and recovery infrastructure
Capacity and availability management	`A.8.6`Capacity management	`A1.1`Maintains, monitors and evaluates current processing capacity
Security awareness and training	`A.6.3`Information security awareness, education and training	`CC1.4`Demonstrates commitment to attract, develop and retain competent individuals `CC2.2`Internally communicates information necessary to support internal control
Personnel screening, terms and sanctions	`A.6.1`Screening `A.6.2`Terms and conditions of employment `A.6.4`Disciplinary process `A.6.5`Responsibilities after termination or change of employment	`CC1.4`Hiring and competence practices `CC6.3`Removes access on termination
Physical access and facility security	`A.7.1`Physical security perimeters `A.7.2`Physical entry `A.7.4`Physical security monitoring	`CC6.4`Restricts physical access to facilities and protected information assets
Data retention, media handling and secure disposal	`A.7.10`Storage media `A.7.14`Secure disposal or re-use of equipment `A.8.10`Information deletion	`CC6.5`Discontinues logical and physical protections over assets only after the ability to read or recover data is diminished `C1.2`Disposes of confidential information
Ongoing control monitoring and internal audit	`Clause 9.2`Internal audit `Clause 9.3`Management review	`CC4.1`Selects, develops and performs ongoing and/or separate evaluations `CC4.2`Evaluates and communicates internal control deficiencies

Open a control objective for the evidence checklist.SOC 2 to ISO 27001:2022 →

Scope: Annex A controls are prefixed 'A.'; management-system clauses are prefixed 'Clause'. Security (CC series), Availability (A1) and Confidentiality (C1). Processing Integrity and Privacy are not covered in this dataset version. A mapping means the requirements address the same objective. It does not mean satisfying one satisfies the other, because scope, frequency and evidence rules differ.

More from ISO 27001:2022

ISO 27001:2022 to PCI DSS 4.0 ISO 27001:2022 to NIST CSF 2.0 ISO 27001:2022 to HIPAA Security Rule ISO 27001:2022 to NIST 800-53 r5