Policies for information security
No direct ASD Essentials equivalent
ISO 27001ASD Essentials
ISO 27001 to ASD Essentials
Each ISO/IEC 27001:2022 Annex A control with the ASD Essentials for enterprise IT actions that cover the same ground, so an ISO-aligned organisation can see what it already has in place.
- ISO 27001 controls mapped (47%)
- 44 of 93
- Relationships
- 116
- Distinct ASD Essentials actions reached
- 55 of 58
44 of the 93 ISO 27001 controls (47%) have at least one ASD Essentials counterpart, giving 116 relationships across 55 distinct ASD Essentials actions. ASD publishes no ISO/IEC 27001 mapping for the Essentials, so these relationships are Control Stack’s own.
These relationships are generated from the Control Stack catalogue and reviewed for topic fidelity, then labelled with how the two controls relate rather than asserted as equivalent. Where no counterpart exists, the row says so plainly instead of stretching for a match. Some rows are read from the other framework’s own mappings, so the wording of those summaries leads with that side.
Control Stack is a free Australian reference covering 1,484 cyber security controls: all 1,143 ASD ISM controls, 152 Essential Eight controls across all four maturity levels, all 93 ISO/IEC 27001:2022 Annex A controls, 58 ASD Essentials for enterprise IT actions and all 38 ISO/IEC 42001:2023 Annex A controls. Every one of them is cross-mapped between the five frameworks and readable in full without an account.
Reviewed 16 October 2026 · Maps ISO/IEC 27001:2022 Annex A to ASD Essentials for enterprise IT
Control by control
What the labels meanOne card per ISO 27001 control, grouped by theme, with every ASD Essentials action mapped to it, strongest relationship first.
Showing all 93 ISO 27001 controls
Organisational controls
37 controls, 21 mapped- IT.GOV-01.1Formalise Executive and Board Accountability for Cyber Security and Risk AppetiteBroader than
- IT.GOV-04.1Assign Sufficient Skilled Personnel to Run Security Controls and Define Role ResponsibilitiesPartially overlaps
Segregation of Duties
No direct ASD Essentials equivalent
Management responsibilities for information security
No direct ASD Essentials equivalent
Establish and Maintain Contact with Authorities
No direct ASD Essentials equivalent
Contact with special interest groups
No direct ASD Essentials equivalent
- IT.IDE-04.1Feed Continuously Reviewed Threat Intelligence and Weaknesses into Risk AssessmentsPartially overlaps
- IT.PRO-06.3Remediate or Mitigate Above-Threshold Vulnerabilities Within Defined Timeframes and Verify EffectivenessSupports
Information security in project management
No direct ASD Essentials equivalent
- IT.IDE-01.2Keep Current Records of Infrastructure, Software, Identities, Credentials and DataEquivalent
- IT.IDE-01.1Use an Approved Inventory with Automated Discovery of New and Changed AssetsBroader than
Acceptable Use Policies for Information and Assets
No direct ASD Essentials equivalent
Return of Organisation's Assets upon Departure
No direct ASD Essentials equivalent
Information Classification Policy and Practices
No direct ASD Essentials equivalent
Labelling of Information
No direct ASD Essentials equivalent
Information Transfer Policies and Procedures
No direct ASD Essentials equivalent
- IT.PRO-12.3Provision User, Administrative and Non-Person Accounts with Minimum Required PrivilegesBroader than
- IT.PRO-01.1Design Systems with Telemetry, Least Privilege, Data Protection and Minimal Attack SurfacePartially overlaps
- IT.PRO-13.1Regularly Find and Disable or Remove Default and Unused AccountsBroader than
- IT.IDE-01.2Keep Current Records of Infrastructure, Software, Identities, Credentials and DataPartially overlaps
- IT.PRO-13.2Store Keys, Secrets and Tokens in Approved, Access-Controlled Repositories with MFABroader than
- IT.PRO-13.3Run Regular Secret Scanning and Rotate or Revoke Exposed CredentialsBroader than
- IT.PRO-13.6Enforce Unique Credentials per System and Account, Especially in High-Privilege ContextsBroader than
- IT.PRO-12.1Periodically Review and Update Access Privileges to Match Current Roles and DutiesBroader than
- IT.PRO-12.2Restrict Account and Role Management and Privileged Functions to Authorised Administrative RolesBroader than
- IT.PRO-12.3Provision User, Administrative and Non-Person Accounts with Minimum Required PrivilegesBroader than
- IT.PRO-13.1Regularly Find and Disable or Remove Default and Unused AccountsBroader than
- IT.GOV-11.1Base Supplier Selection on Proportionate Cyber Supply Chain Risk AssessmentsBroader than
- IT.GOV-11.2Maintain Current Supplier Assurance and Act on Lapses or Risk ChangesBroader than
- IT.GOV-11.1Base Supplier Selection on Proportionate Cyber Supply Chain Risk AssessmentsPartially overlaps
- IT.GOV-11.2Maintain Current Supplier Assurance and Act on Lapses or Risk ChangesSupports
- IT.GOV-11.1Base Supplier Selection on Proportionate Cyber Supply Chain Risk AssessmentsBroader than
- IT.GOV-11.2Maintain Current Supplier Assurance and Act on Lapses or Risk ChangesBroader than
- IT.PRO-16.1Verify Integrity, Authenticity and Provenance of Software, Components and Updates Before UseBroader than
- IT.PRO-16.2Monitor Vendor Advisories and Threat Intelligence to Act on Supply Chain ExposureBroader than
- IT.GOV-11.2Maintain Current Supplier Assurance and Act on Lapses or Risk ChangesEquivalent
- IT.GOV-11.1Base Supplier Selection on Proportionate Cyber Supply Chain Risk AssessmentsPartially overlaps
- IT.GOV-11.2Maintain Current Supplier Assurance and Act on Lapses or Risk ChangesPartially overlaps
- IT.RES-05.1Build External Reporting and Coordination Obligations into Incident Response ProceduresBroader than
- IT.RES-03.1Respond to Cyber Security Incidents Using Documented, Tested and Approved ProceduresPartially overlaps
- IT.RES-04.2Evaluate Monitoring Coverage and Response Procedures After Incidents and Validate ImprovementsPartially overlaps
- IT.DET-03.1Triage Alerts and Events Promptly Against Defined Incident ThresholdsEquivalent
- IT.DET-03.2Correlate Signals Across Identities, Applications, Data and Infrastructure to Identify IncidentsBroader than
- IT.RES-03.1Respond to Cyber Security Incidents Using Documented, Tested and Approved ProceduresEquivalent
- IT.RES-04.1Perform Post-Incident Reviews to Identify Security Gaps Behind Each Incident StageBroader than
- IT.RES-04.2Evaluate Monitoring Coverage and Response Procedures After Incidents and Validate ImprovementsBroader than
- IT.DET-01.1Encrypt Event Logs and Restrict Access to Prevent Tampering and DeletionDepends on
- IT.DET-01.3Establish Centralised Event Log Storage Protected from Unauthorised Access and TamperingDepends on
Maintain information security during disruptions
No direct ASD Essentials equivalent
- IT.PRO-10.1Back Up Data, Applications and Settings on Schedule to Encrypted, Resilient StorageBroader than
- IT.PRO-10.3Regularly Test Backup and Restoration Procedures Against Defined Recovery ObjectivesBroader than
Intellectual Property Rights Protection
No direct ASD Essentials equivalent
- IT.DET-01.1Encrypt Event Logs and Restrict Access to Prevent Tampering and DeletionBroader than
- IT.DET-01.3Establish Centralised Event Log Storage Protected from Unauthorised Access and TamperingBroader than
Privacy and Protection of Personally Identifiable Information
No direct ASD Essentials equivalent
Independent review of information security
No direct ASD Essentials equivalent
Documented Operating Procedures for Information Processing
No direct ASD Essentials equivalent
People controls
8 controls, 2 mappedPersonnel Background Verification
No direct ASD Essentials equivalent
Terms and conditions of employment for security
No direct ASD Essentials equivalent
- IT.PRO-14.1Require Role-Tailored Cyber Security Awareness Training Before Granting AccessBroader than
- IT.PRO-14.2Regularly Update and Deliver Security Awareness Training as Threats and Operations ChangeBroader than
Disciplinary Process for Information Security Violations
No direct ASD Essentials equivalent
Responsibilities after employment termination or role change
No direct ASD Essentials equivalent
Confidentiality and Non-disclosure Agreements
No direct ASD Essentials equivalent
- IT.PRO-13.4Enforce Phishing-Resistant MFA for All User Authentication, Including from Untrusted LocationsPartially overlaps
Mechanisms for Reporting Security Events
No direct ASD Essentials equivalent
Physical controls
14 controls, 0 mappedPhysical Security Perimeters
No direct ASD Essentials equivalent
Physical access controls for secure areas
No direct ASD Essentials equivalent
Physical Security for Offices and Facilities
No direct ASD Essentials equivalent
Continuous monitoring of physical access to premises
No direct ASD Essentials equivalent
Protecting against physical and environmental threats
No direct ASD Essentials equivalent
Security Measures for Working in Secure Areas
No direct ASD Essentials equivalent
Clear desk and clear screen policies
No direct ASD Essentials equivalent
Equipment Siting and Protection
No direct ASD Essentials equivalent
Security of Off-Site Assets
No direct ASD Essentials equivalent
Secure Management of Storage Media
No direct ASD Essentials equivalent
Protection from Utility Failures
No direct ASD Essentials equivalent
Secure Cabling for Power and Data
No direct ASD Essentials equivalent
Proper Maintenance of Equipment
No direct ASD Essentials equivalent
Secure disposal or re-use of equipment
No direct ASD Essentials equivalent
Technological controls
34 controls, 21 mappedProtection of User Endpoint Devices
No direct ASD Essentials equivalent
- IT.PRO-05.1Restrict Administration to Dedicated, Hardened Environments Isolated from Unprivileged User WorkloadsBroader than
- IT.PRO-05.2Require Explicit Session Establishment and Time-Bound Grants for Privileged ActionsBroader than
- IT.PRO-12.2Restrict Account and Role Management and Privileged Functions to Authorised Administrative RolesBroader than
- IT.PRO-01.1Design Systems with Telemetry, Least Privilege, Data Protection and Minimal Attack SurfacePartially overlaps
- IT.PRO-12.1Periodically Review and Update Access Privileges to Match Current Roles and DutiesPartially overlaps
- IT.PRO-12.3Provision User, Administrative and Non-Person Accounts with Minimum Required PrivilegesPartially overlaps
- IT.PRO-05.3Log Every Administrative and Management Change with User, Timestamp and TargetDepends on
- IT.PRO-12.3Provision User, Administrative and Non-Person Accounts with Minimum Required PrivilegesBroader than
- IT.PRO-01.1Design Systems with Telemetry, Least Privilege, Data Protection and Minimal Attack SurfacePartially overlaps
Access management for source code and tools
No direct ASD Essentials equivalent
- IT.PRO-13.4Enforce Phishing-Resistant MFA for All User Authentication, Including from Untrusted LocationsBroader than
- IT.PRO-13.5Disable Legacy Authentication Protocols and Restrict, Monitor and Decommission ExceptionsBroader than
Capacity Management for Resource Use
No direct ASD Essentials equivalent
- IT.PRO-09.3Inspect All Inbound Content Channels and Block Malicious or Unsafe ContentBroader than
- IT.PRO-07.1Restrict Execution to Supported, Verified and Authorised Software with Time-Bound ExceptionsDepends on
- IT.PRO-09.2Block Outbound Connections to Known Malicious and Untrusted Destinations Using Threat IntelligenceDepends on
- IT.PRO-14.1Require Role-Tailored Cyber Security Awareness Training Before Granting AccessDepends on
- IT.PRO-14.2Regularly Update and Deliver Security Awareness Training as Threats and Operations ChangeDepends on
- IT.PRO-06.1Continuously Scan and Assess Assets for Known Software and Configuration WeaknessesBroader than
- IT.PRO-06.2Apply Security Patches Within Risk-Based Timeframes and Automate Low-Impact UpdatesBroader than
- IT.PRO-06.3Remediate or Mitigate Above-Threshold Vulnerabilities Within Defined Timeframes and Verify EffectivenessBroader than
- IT.GOV-14.1Identify, Assess and Treat Legacy System Risks Until Removal or ReplacementPartially overlaps
- IT.IDE-04.1Feed Continuously Reviewed Threat Intelligence and Weaknesses into Risk AssessmentsPartially overlaps
- IT.PRO-16.2Monitor Vendor Advisories and Threat Intelligence to Act on Supply Chain ExposurePartially overlaps
- IT.PRO-04.1Define Approved Hardening Baselines Disabling Unneeded Services, Insecure Settings and Weak ProtocolsBroader than
- IT.PRO-04.2Deploy Approved Configuration Baselines to All Infrastructure, Operating Systems and ApplicationsBroader than
- IT.PRO-04.3Detect and Remediate Configuration Drift Using Scheduled Assessments and Automated MonitoringBroader than
- IT.PRO-13.5Disable Legacy Authentication Protocols and Restrict, Monitor and Decommission ExceptionsBroader than
- IT.PRO-01.1Design Systems with Telemetry, Least Privilege, Data Protection and Minimal Attack SurfacePartially overlaps
- IT.PRO-01.2Use Secure Build and Deployment Processes to Enforce Security Controls ConsistentlyPartially overlaps
- IT.PRO-06.1Continuously Scan and Assess Assets for Known Software and Configuration WeaknessesPartially overlaps
Secure deletion of information when no longer needed
No direct ASD Essentials equivalent
Data Masking for Sensitive Information
No direct ASD Essentials equivalent
- IT.PRO-09.1Inspect Outbound Content on Egress Paths to Detect Unauthorised Data TransfersBroader than
- IT.PRO-13.3Run Regular Secret Scanning and Rotate or Revoke Exposed CredentialsDepends on
- IT.PRO-10.1Back Up Data, Applications and Settings on Schedule to Encrypted, Resilient StorageBroader than
- IT.PRO-10.3Regularly Test Backup and Restoration Procedures Against Defined Recovery ObjectivesBroader than
Redundancy of Information Processing Facilities
No direct ASD Essentials equivalent
- IT.DET-01.1Encrypt Event Logs and Restrict Access to Prevent Tampering and DeletionBroader than
- IT.DET-01.2Forward High-Value Security Logs and Configuration Changes to Central Log StorageBroader than
- IT.DET-01.3Establish Centralised Event Log Storage Protected from Unauthorised Access and TamperingBroader than
- IT.DET-02.1Normalise, Time-Synchronise and Enrich Event Logs for Cross-System CorrelationBroader than
- IT.PRO-05.3Log Every Administrative and Management Change with User, Timestamp and TargetBroader than
- IT.DET-02.2Deploy Detection Rules for Unauthorised Changes, Anomalous Authentication and Suspicious Software ExecutionBroader than
- IT.DET-03.1Triage Alerts and Events Promptly Against Defined Incident ThresholdsBroader than
- IT.DET-03.2Correlate Signals Across Identities, Applications, Data and Infrastructure to Identify IncidentsBroader than
- IT.DET-04.1Continuously Monitor Software Execution to Detect Malicious Use of Legitimate ToolsBroader than
- IT.PRO-09.1Inspect Outbound Content on Egress Paths to Detect Unauthorised Data TransfersBroader than
- IT.RES-04.2Evaluate Monitoring Coverage and Response Procedures After Incidents and Validate ImprovementsPartially overlaps
- IT.DET-02.1Normalise, Time-Synchronise and Enrich Event Logs for Cross-System CorrelationDepends on
- IT.DET-05.1Periodically Review Detection Coverage for Gaps as Assets, Services and Architecture ChangeDepends on
- IT.DET-02.1Normalise, Time-Synchronise and Enrich Event Logs for Cross-System CorrelationPartially overlaps
- IT.PRO-07.2Restrict Administrative and Management Tools to Approved Sets and Authorised LocationsBroader than
- IT.DET-04.1Continuously Monitor Software Execution to Detect Malicious Use of Legitimate ToolsPartially overlaps
- IT.PRO-01.2Use Secure Build and Deployment Processes to Enforce Security Controls ConsistentlyPartially overlaps
- IT.PRO-07.1Restrict Execution to Supported, Verified and Authorised Software with Time-Bound ExceptionsPartially overlaps
- IT.PRO-16.1Verify Integrity, Authenticity and Provenance of Software, Components and Updates Before UsePartially overlaps
- IT.PRO-09.2Block Outbound Connections to Known Malicious and Untrusted Destinations Using Threat IntelligenceBroader than
- IT.PRO-18.1Isolate Systems in Criticality- and Trust-Based Network Zones with Approved, Monitored PathwaysBroader than
- IT.PRO-18.2Restrict Lateral Movement Between and Within Segments to Approved Pathways and ServicesBroader than
- IT.PRO-04.2Deploy Approved Configuration Baselines to All Infrastructure, Operating Systems and ApplicationsPartially overlaps
Security of Network Services
No direct ASD Essentials equivalent
- IT.PRO-10.2Isolate Backup Repositories from General User Environments and Production WorkloadsBroader than
- IT.PRO-18.1Isolate Systems in Criticality- and Trust-Based Network Zones with Approved, Monitored PathwaysPartially meets
- IT.PRO-05.1Restrict Administration to Dedicated, Hardened Environments Isolated from Unprivileged User WorkloadsPartially overlaps
- IT.PRO-18.2Restrict Lateral Movement Between and Within Segments to Approved Pathways and ServicesPartially overlaps
- IT.PRO-09.2Block Outbound Connections to Known Malicious and Untrusted Destinations Using Threat IntelligencePartially overlaps
- IT.PRO-09.3Inspect All Inbound Content Channels and Block Malicious or Unsafe ContentPartially overlaps
- IT.PRO-13.2Store Keys, Secrets and Tokens in Approved, Access-Controlled Repositories with MFAPartially overlaps
- IT.PRO-10.1Back Up Data, Applications and Settings on Schedule to Encrypted, Resilient StorageSupports
- IT.PRO-01.1Design Systems with Telemetry, Least Privilege, Data Protection and Minimal Attack SurfaceBroader than
- IT.PRO-01.2Use Secure Build and Deployment Processes to Enforce Security Controls ConsistentlyPartially overlaps
Defining Security Requirements for Applications
No direct ASD Essentials equivalent
- IT.PRO-01.1Design Systems with Telemetry, Least Privilege, Data Protection and Minimal Attack SurfaceBroader than
Secure Coding Practices in Software Development
No direct ASD Essentials equivalent
Security testing in development and acceptance
No direct ASD Essentials equivalent
- IT.GOV-11.2Maintain Current Supplier Assurance and Act on Lapses or Risk ChangesPartially overlaps
Separation of Development, Test, and Production Environments
No direct ASD Essentials equivalent
- IT.PRO-05.3Log Every Administrative and Management Change with User, Timestamp and TargetDepends on
Test Information Selection and Protection
No direct ASD Essentials equivalent
Protection of information systems during audits
No direct ASD Essentials equivalent
No ISO 27001 controls match these filters
Try a different relationship, theme or ID, or clear the filters to see all 93.
How to use this mapping
Read it in whichever direction you are being assessed. If ISO 27001 is your primary framework, use the cards to find the ASD Essentials actions that cover the same ground, so evidence you already hold can be reused instead of rebuilt. If ASD Essentials is what you are being held to, search for a ASD Essentials ID to see which ISO 27001 controls contribute. A mapping means the two controls address related risk, not that satisfying one satisfies the other, so always read the relationship label before relying on it.
What the relationship labels mean
Read each row as the ISO 27001 control, then the label, then the ASD Essentials action.
- Equivalent
- Both controls ask for the same thing. Rare, and kept for genuinely matching requirements. 4 pairings on this page
- Broader than
- The source control covers everything the mapped control asks for, and more. 62 pairings on this page
- Partially meets
- The source control covers part of what the mapped control asks for. 1 pairing on this page
- Partially overlaps
- The two share ground, but neither contains the other. 34 pairings on this page
- Supports
- The source control helps achieve the mapped control. 4 pairings on this page
- Depends on
- The source control relies on the mapped control being in place. 11 pairings on this page
Frequently asked questions
Is this mapping official?
No. ASD publishes no ISO/IEC 27001 mapping for the Essentials. These relationships are Control Stack’s, reviewed for topic fidelity and labelled with how the two relate. Use them for planning and evidence reuse, not as ASD’s view.
Does ISO 27001 certification cover the Essentials?
No. ISO/IEC 27001 is a risk-based management system: you choose controls to treat your own risks. The Essentials sets specific actions that are applied domain by domain in ASD’s priority order and rated for effectiveness. An ISO 27001 program brings governance, risk and evidence habits that help, but each action still needs checking in the domains it applies to.
Why do some Annex A controls have no Essentials counterpart?
Annex A reaches into areas the Essentials leaves out, such as physical security and most people controls like screening and terms of employment. The Essentials concentrates on technical and governance outcomes for enterprise IT.