Skip to content
Mappings
ISO 27001ASD ISM

ISO 27001 to ASD ISM

Every ISO/IEC 27001:2022 Annex A control, with the ASD ISM controls that cover the same ground. Useful when you hold ISO 27001 and are asked to show ISM alignment, or the other way round.

ISO 27001 controlsASD ISM controls
ISO 27001 controls mapped (99%)
92 of 93
Control-to-control relationships
2,068
Distinct ASD ISM controls reached
1,071 of 1,143

92 of the 93 ISO 27001 controls (99%) have at least one ASD ISM counterpart, giving 2,068 control-to-control relationships across 1,071 distinct ASD ISM controls. ISO 27001 and the ISM overlap heavily in subject matter, so coverage here is high. What differs is depth: the ISM states specific technical requirements where Annex A states outcomes.

These relationships are generated from the Control Stack catalogue and reviewed for topic fidelity, then labelled with how the two controls relate rather than asserted as equivalent. Where no counterpart exists, the row says so plainly instead of stretching for a match. Some rows are read from the other framework’s own mappings, so the wording of those summaries leads with that side.

Control Stack is a free Australian reference covering 1,484 cyber security controls: all 1,143 ASD ISM controls, 152 Essential Eight controls across three maturity levels, all 93 ISO/IEC 27001:2022 Annex A controls, 58 ASD Essentials for enterprise IT actions and all 38 ISO/IEC 42001:2023 Annex A controls. Every one of them is cross-mapped between the five frameworks and readable in full without an account.

Reviewed 16 September 2026 · Maps ISO/IEC 27001:2022 Annex A to the September 2026 ASD ISM

Control by control

What the labels mean

One card per ISO 27001 control, grouped by theme, with every ASD ISM control mapped to it, strongest relationship first.

Showing all 93 ISO 27001 controls

Organisational controls

37 controls, 36 mapped

A.5.121 ASD ISM controls

Policies for information security

A.5.217 ASD ISM controls

Defining information security roles and responsibilities

A.5.37 ASD ISM controls

Segregation of duties

A.5.413 ASD ISM controls

Management responsibilities for information security

A.5.915 ASD ISM controls

Inventory management of information and associated assets

A.5.1029 ASD ISM controls

Acceptable use policies for information and assets

A.5.1228 ASD ISM controls

Information classification policy and practices

A.5.1320 ASD ISM controls

Labelling of information

A.5.1433 ASD ISM controls

Information transfer policies and procedures

A.5.1595 ASD ISM controls

Access control policies and procedures

A.5.1623 ASD ISM controls

Identity life cycle management

A.5.1755 ASD ISM controls

Management of authentication information

A.5.1856 ASD ISM controls

Managing access rights to information assets

A.5.1946 ASD ISM controls

Managing information security in supplier relationships

A.5.2020 ASD ISM controls

Integrating security clauses in supplier agreements

A.5.2148 ASD ISM controls

Managing information security in the ICT supply chain

A.5.2223 ASD ISM controls

Monitoring and managing supplier services

A.5.2416 ASD ISM controls

Information security incident management planning and preparation

A.5.2619 ASD ISM controls

Response to information security incidents

A.5.2815 ASD ISM controls

Procedures for collecting and preserving evidence

A.5.3013 ASD ISM controls

ICT readiness for business continuity

A.5.346 ASD ISM controls

Privacy and protection of personally identifiable information

A.5.3512 ASD ISM controls

Independent review of information security

A.5.368 ASD ISM controls

Review compliance with information security policies

A.5.377 ASD ISM controls

Documented operating procedures for information processing

People controls

8 controls, 8 mapped

A.6.332 ASD ISM controls

Information security awareness, education and training program

A.6.713 ASD ISM controls

Remote working security measures

A.6.812 ASD ISM controls

Mechanisms for reporting security events

Physical controls

14 controls, 14 mapped

A.7.112 ASD ISM controls

Physical security perimeters

A.7.213 ASD ISM controls

Physical access controls for secure areas

A.7.311 ASD ISM controls

Physical security for offices and facilities

A.7.514 ASD ISM controls

Protecting against physical and environmental threats

A.7.620 ASD ISM controls

Security measures for working in secure areas

A.7.79 ASD ISM controls

Clear desk and clear screen policies

A.7.818 ASD ISM controls

Equipment siting and protection

A.7.1064 ASD ISM controls

Secure management of storage media

A.7.1233 ASD ISM controls

Secure cabling for power and data

A.7.138 ASD ISM controls

Proper maintenance of equipment

A.7.1456 ASD ISM controls

Secure disposal or re-use of equipment

Technological controls

34 controls, 34 mapped

A.8.140 ASD ISM controls

Protection of user endpoint devices

A.8.255 ASD ISM controls

Management of privileged access rights

A.8.363 ASD ISM controls

Restrict access to information and assets

A.8.566 ASD ISM controls

Secure authentication technologies and procedures

A.8.725 ASD ISM controls

Protection against malware

A.8.856 ASD ISM controls

Management of technical vulnerabilities

A.8.976 ASD ISM controls

Configuration management for secure IT systems

A.8.1024 ASD ISM controls

Secure deletion of information when no longer needed

A.8.1230 ASD ISM controls

Data leakage prevention measures

A.8.1312 ASD ISM controls

Backup and recovery procedures for data

A.8.1557 ASD ISM controls

Logging of activities and events

A.8.1636 ASD ISM controls

Monitoring networks and systems for anomalous behaviour

A.8.186 ASD ISM controls

Use of privileged utility programs

A.8.1924 ASD ISM controls

Secure software installation procedures

A.8.20101 ASD ISM controls

Network and network devices security

A.8.2115 ASD ISM controls

Security of network services

A.8.2246 ASD ISM controls

Network segregation for security

A.8.2315 ASD ISM controls

Web filtering to reduce malicious website exposure

A.8.2492 ASD ISM controls

Effective use of cryptography and key management

A.8.2547 ASD ISM controls

Secure development lifecycle

A.8.2623 ASD ISM controls

Defining security requirements for applications

A.8.2725 ASD ISM controls

Secure system architecture and engineering principles

A.8.2834 ASD ISM controls

Secure coding practices in software development

A.8.2923 ASD ISM controls

Security testing in development and acceptance

A.8.3010 ASD ISM controls

Management of outsourced system development

A.8.317 ASD ISM controls

Separation of development, test, and production environments

A.8.3214 ASD ISM controls

Change management procedures for information systems

How to use this mapping

Read it in whichever direction you are being assessed. If ISO 27001 is your primary framework, use the cards to find the ASD ISM controls that cover the same ground, so evidence you already hold can be reused instead of rebuilt. If ASD ISM is what you are being held to, search for a ASD ISM ID to see which ISO 27001 controls contribute. A mapping means the two controls address related risk, not that satisfying one satisfies the other, so always read the relationship label before relying on it.

What the relationship labels mean

Read each row as the ISO 27001 control, then the label, then the ASD ISM control.

Equivalent
Both controls ask for the same thing. Rare, and kept for genuinely matching requirements. 15 pairings on this page
Broader than
The source control covers everything the mapped control asks for, and more. 1,257 pairings on this page
Partially meets
The source control covers part of what the mapped control asks for. 56 pairings on this page
Partially overlaps
The two share ground, but neither contains the other. 475 pairings on this page
Supports
The source control helps achieve the mapped control. 128 pairings on this page
Depends on
The source control relies on the mapped control being in place. 137 pairings on this page
ISO 27001ASD ISMAll mappings

Frequently asked questions

Does meeting ISO 27001 mean I meet the ASD ISM?

No. The mapping shows where the two frameworks address related risk, not that one satisfies the other. ISO/IEC 27001:2022 Annex A controls are broad outcome statements, while ISM controls are specific and often technical, so a single Annex A control typically corresponds to many ISM controls and rarely covers all of them. Use the mapping to reuse evidence, then check each ISM control on its own terms.

Why does one ISO 27001 control map to so many ISM controls?

Because the two are written at different levels of detail. An Annex A control such as access control states an outcome in a sentence or two. The ISM breaks the same ground into many separate, testable requirements covering privileged access, authentication, session handling and logging. A one-to-many relationship is the normal shape of this mapping rather than a sign of duplication.

What do the relationship labels mean?

Each pairing carries a label describing how the two controls relate. Partially meets means the mapped control covers part of the requirement. Partially overlaps means they share ground without either containing the other. Supports means one helps achieve the other. Depends on means one relies on the other being in place. Equivalent is reserved for genuinely matching requirements and is rare.

Is this mapping official?

No. Neither ISO nor the Australian Signals Directorate publishes an official crosswalk between these two frameworks. This mapping is produced by Control Stack from the control text of both frameworks and reviewed for topic fidelity. Treat it as a working aid for planning and evidence reuse, not as an authoritative statement from either body.