NIST CSF 2.0 to ISO 27001:2022 crosswalk

29 control objectives in NIST Cybersecurity Framework are mapped here to ISO/IEC 27001 (Annex A controls and management clauses). Every one has a requirement on the other side. Each row is one shared objective, with the requirement ids on both sides.

Control objective	NIST CSF 2.0	ISO 27001:2022
Security governance and policies	`GV.PO`Policy `GV.OV`Oversight	`A.5.1`Policies for information security `A.5.36`Compliance with policies, rules and standards for information security
Security roles and accountability	`GV.RR`Roles, responsibilities and authorities	`A.5.2`Information security roles and responsibilities `A.5.3`Segregation of duties
Risk assessment and treatment	`GV.RM`Risk management strategy `ID.RA`Risk assessment	`Clause 6.1.2`Information security risk assessment `Clause 6.1.3`Information security risk treatment
Asset and system inventory	`ID.AM`Asset management	`A.5.9`Inventory of information and other associated assets
Data classification and handling	`ID.AM-07`Inventories of data and corresponding metadata are maintained `PR.DS`Data security	`A.5.12`Classification of information `A.5.13`Labelling of information
Access provisioning, review and removal	`PR.AA-05`Access permissions, entitlements and authorizations are defined and managed (least privilege, separation of duties)	`A.5.15`Access control `A.5.16`Identity management `A.5.18`Access rights
Least privilege and privileged access	`PR.AA-05`Access permissions managed incorporating least privilege	`A.8.2`Privileged access rights `A.8.3`Information access restriction
Authentication, unique IDs and multi-factor authentication	`PR.AA-03`Users, services and hardware are authenticated	`A.5.17`Authentication information `A.8.5`Secure authentication
Encryption at rest and key management	`PR.DS-01`The confidentiality, integrity and availability of data-at-rest are protected	`A.8.24`Use of cryptography
Encryption in transit	`PR.DS-02`The confidentiality, integrity and availability of data-in-transit are protected	`A.5.14`Information transfer `A.8.24`Use of cryptography
Network security and segmentation	`PR.IR-01`Networks and environments are protected from unauthorized logical access and usage	`A.8.20`Networks security `A.8.21`Security of network services `A.8.22`Segregation of networks
Secure configuration and hardening	`PR.PS-01`Configuration management practices are established and applied	`A.8.9`Configuration management
Vulnerability scanning and patching	`ID.RA`Risk assessment (vulnerability identification, ID.RA-01) `PR.PS-02`Software is maintained, replaced and removed commensurate with risk	`A.8.8`Management of technical vulnerabilities
Penetration testing and independent assessment	`ID.IM`Improvement (incl. ID.IM-02, improvements from tests and exercises)	`A.8.29`Security testing in development and acceptance `A.5.35`Independent review of information security
Logging, log review and monitoring	`DE.CM`Continuous monitoring `PR.PS-04`Log records are generated and made available for continuous monitoring	`A.8.15`Logging `A.8.16`Monitoring activities `A.8.17`Clock synchronization
Intrusion detection and integrity monitoring	`DE.CM`Continuous monitoring `DE.AE`Adverse event analysis	`A.8.16`Monitoring activities
Malware protection	`PR.PS-05`Installation and execution of unauthorized software are prevented `DE.CM`Continuous monitoring	`A.8.7`Protection against malware
Incident response and breach notification	`RS.MA`Incident management `RS.AN`Incident analysis `RS.CO`Incident response reporting and communication `RS.MI`Incident mitigation `DE.AE`Adverse event analysis	`A.5.24`Information security incident management planning and preparation `A.5.25`Assessment and decision on information security events `A.5.26`Response to information security incidents `A.5.27`Learning from information security incidents
Change management	`PR.PS-01`Configuration management practices are established and applied	`A.8.32`Change management
Secure software development	`PR.PS-06`Secure software development practices are integrated and their performance monitored	`A.8.25`Secure development life cycle `A.8.26`Application security requirements `A.8.28`Secure coding `A.8.29`Security testing in development and acceptance `A.8.31`Separation of development, test and production environments
Third-party and vendor risk management	`GV.SC`Cybersecurity supply chain risk management	`A.5.19`Information security in supplier relationships `A.5.20`Addressing information security within supplier agreements `A.5.21`Managing information security in the ICT supply chain `A.5.22`Monitoring, review and change management of supplier services `A.5.23`Information security for use of cloud services
Business continuity and disaster recovery	`PR.IR-03`Mechanisms are implemented to achieve resilience requirements `RC.RP`Incident recovery plan execution	`A.5.29`Information security during disruption `A.5.30`ICT readiness for business continuity
Backup and redundancy	`PR.DS-11`Backups of data are created, protected, maintained and tested	`A.8.13`Information backup `A.8.14`Redundancy of information processing facilities
Capacity and availability management	`PR.IR-04`Adequate resource capacity to ensure availability is maintained	`A.8.6`Capacity management
Security awareness and training	`PR.AT`Awareness and training	`A.6.3`Information security awareness, education and training
Personnel screening, terms and sanctions	`GV.RR-04`Cybersecurity is included in human resources practices	`A.6.1`Screening `A.6.2`Terms and conditions of employment `A.6.4`Disciplinary process `A.6.5`Responsibilities after termination or change of employment
Physical access and facility security	`PR.AA-06`Physical access to assets is managed, monitored and enforced commensurate with risk	`A.7.1`Physical security perimeters `A.7.2`Physical entry `A.7.4`Physical security monitoring
Data retention, media handling and secure disposal	`ID.AM-08`Systems, hardware, software, services and data are managed throughout their life cycles	`A.7.10`Storage media `A.7.14`Secure disposal or re-use of equipment `A.8.10`Information deletion
Ongoing control monitoring and internal audit	`ID.IM`Improvement `GV.OV`Oversight	`Clause 9.2`Internal audit `Clause 9.3`Management review

Open a control objective for the evidence checklist.ISO 27001:2022 to NIST CSF 2.0 →

Scope: Mapped at category level (e.g. PR.AA) or subcategory where one is clearly the match (e.g. PR.AA-05). Annex A controls are prefixed 'A.'; management-system clauses are prefixed 'Clause'. A mapping means the requirements address the same objective. It does not mean satisfying one satisfies the other, because scope, frequency and evidence rules differ.

More from NIST CSF 2.0

NIST CSF 2.0 to SOC 2 NIST CSF 2.0 to PCI DSS 4.0 NIST CSF 2.0 to HIPAA Security Rule NIST CSF 2.0 to NIST 800-53 r5