Mappings
Cross-framework mappings.
Most Australian organisations are held to more than one framework at a time. These crosswalks show where controls cover the same ground, so evidence you already hold can be reused rather than rebuilt.
Control Stack is a free Australian reference covering 1,484 cyber security controls: all 1,143 ASD ISM controls, 152 Essential Eight controls across three maturity levels, all 93 ISO/IEC 27001:2022 Annex A controls, 58 ASD Essentials for enterprise IT actions and all 38 ISO/IEC 42001:2023 Annex A controls. Every one of them is cross-mapped between the five frameworks and readable in full without an account.
Crosswalks
- ISO 27001Essential Eight
ISO 27001 to Essential Eight
Which ISO/IEC 27001:2022 Annex A controls line up with each Essential Eight mitigation strategy. Hand-verified, and deliberately strict about what counts as a direct match.
8 of 93 controls mapped
Hand-verified crosswalk
- ISO 27001ASD ISM
ISO 27001 to ASD ISM
The ISM controls that cover the same ground as each Annex A control. The densest mapping on the site, because the two frameworks overlap heavily in subject matter.
92 of 93 controls mapped
2,068 relationships
- Essential EightASD ISM
Essential Eight to ASD ISM
The ISM controls behind each Essential Eight requirement, at every maturity level. Both frameworks come from ASD, so the relationships are unusually direct.
152 of 152 controls mapped
1,218 relationships
- ISO 27001ISO 42001
ISO 27001 to ISO 42001
Where information security management meets AI management. The thinnest crosswalk here, because ISO 42001 governs AI specifically and most of ISO 27001 has no AI counterpart.
22 of 93 controls mapped
40 relationships
- Essential EightASD Essentials
Essential Eight to ASD Essentials
Each Essential Eight requirement against the ASD Essentials for enterprise IT actions ASD links it to. ASD's strategy-level crosswalk is in the transition guide.
141 of 152 controls mapped
209 relationships
- ISO 27001ASD Essentials
ISO 27001 to ASD Essentials
The ASD Essentials for enterprise IT actions that cover the same ground as each Annex A control. ASD publishes no ISO 27001 mapping, so this one is Control Stack’s.
44 of 93 controls mapped
116 relationships
How to read a mapping
A mapping means two controls address related risk. It does not mean satisfying one satisfies the other, and it is not a certification shortcut. Each pairing carries a relationship label, such as partially meets, partially overlaps, supports or depends on, and the honest answer for many pairs is that no counterpart exists. Those rows say so rather than stretching for a match.
Read each row as the source control, then the label, then the mapped control.
- Equivalent
- Both controls ask for the same thing. Rare, and kept for genuinely matching requirements.
- Broader than
- The source control covers everything the mapped control asks for, and more.
- Partially meets
- The source control covers part of what the mapped control asks for.
- Partially overlaps
- The two share ground, but neither contains the other.
- Supports
- The source control helps achieve the mapped control.
- Depends on
- The source control relies on the mapped control being in place.