- A.2.2AI policyPartially overlaps
- A.2.3Alignment with other organisational policiesPartially overlaps
- A.2.4Review the AI policy at planned intervals to keep it effectivePartially overlaps
ISO 27001ISO 42001
ISO 27001 to ISO 42001
Where the information security controls of ISO/IEC 27001:2022 meet the AI management controls of ISO/IEC 42001:2023. Useful when you already hold ISO 27001 and are adding AI governance on top.
- ISO 27001 controls mapped (24%)
- 22 of 93
- Control-to-control relationships
- 40
- Distinct ISO 42001 controls reached
- 25 of 38
22 of the 93 ISO 27001 controls (24%) have at least one ISO 42001 counterpart, giving 40 control-to-control relationships across 25 distinct ISO 42001 controls. Coverage is deliberately partial: ISO 42001 governs AI specifically, so most ISO 27001 controls have no counterpart and are shown as such.
These relationships are generated from the Control Stack catalogue and reviewed for topic fidelity, then labelled with how the two controls relate rather than asserted as equivalent. Where no counterpart exists, the row says so plainly instead of stretching for a match. Some rows are read from the other framework’s own mappings, so the wording of those summaries leads with that side.
Control Stack is a free Australian reference covering 1,484 cyber security controls: all 1,143 ASD ISM controls, 152 Essential Eight controls across three maturity levels, all 93 ISO/IEC 27001:2022 Annex A controls, 58 ASD Essentials for enterprise IT actions and all 38 ISO/IEC 42001:2023 Annex A controls. Every one of them is cross-mapped between the five frameworks and readable in full without an account.
Reviewed 16 September 2026 · Maps ISO/IEC 27001:2022 Annex A to ISO/IEC 42001:2023 Annex A
Control by control
What the labels meanOne card per ISO 27001 control, grouped by theme, with every ISO 42001 control mapped to it, strongest relationship first.
Showing all 93 ISO 27001 controls
Organisational controls
37 controls, 14 mapped- A.3.2Define and allocate AI roles and responsibilitiesPartially overlaps
- A.4.6Document the people and skills running your AI systemPartially overlaps
- A.10.2Allocating responsibilitiesPartially overlaps
Segregation of duties
No direct ISO 42001 equivalent
Management responsibilities for information security
No direct ISO 42001 equivalent
Establish and maintain contact with authorities
No direct ISO 42001 equivalent
Contact with special interest groups
No direct ISO 42001 equivalent
Threat intelligence collection and analysis
No direct ISO 42001 equivalent
- A.6.2.2AI system requirements and specificationPartially overlaps
- A.4.3Document the data resources used by your AI systemPartially overlaps
- A.4.4Document the tooling resources used for AI systemsPartially overlaps
- A.2.3Alignment with other organisational policiesPartially overlaps
- A.9.2Define and document processes for responsible use of AI systemsPartially overlaps
- A.10.3Manage suppliers to support responsible AI usePartially overlaps
- A.7.2Data for development and enhancement of AI systemDepends on
- A.9.4Intended use of the AI systemDepends on
Return of organisation's assets upon departure
No direct ISO 42001 equivalent
Information classification policy and practices
No direct ISO 42001 equivalent
Labelling of information
No direct ISO 42001 equivalent
Information transfer policies and procedures
No direct ISO 42001 equivalent
Access control policies and procedures
No direct ISO 42001 equivalent
Identity life cycle management
No direct ISO 42001 equivalent
Management of authentication information
No direct ISO 42001 equivalent
Managing access rights to information assets
No direct ISO 42001 equivalent
- A.10.2Allocating responsibilitiesPartially overlaps
- A.10.3Manage suppliers to support responsible AI usePartially overlaps
- A.10.2Allocating responsibilitiesPartially overlaps
- A.10.3Manage suppliers to support responsible AI usePartially overlaps
- A.10.3Manage suppliers to support responsible AI usePartially overlaps
- A.10.3Manage suppliers to support responsible AI usePartially overlaps
Cloud service security management
No direct ISO 42001 equivalent
- A.8.4Document a plan for communicating incidents to AI system usersBroader than
- A.3.2Define and allocate AI roles and responsibilitiesPartially overlaps
Assessment and decision on information security events
No direct ISO 42001 equivalent
Response to information security incidents
No direct ISO 42001 equivalent
Learning from information security incidents
No direct ISO 42001 equivalent
Procedures for collecting and preserving evidence
No direct ISO 42001 equivalent
Maintain information security during disruptions
No direct ISO 42001 equivalent
ICT readiness for business continuity
No direct ISO 42001 equivalent
- A.8.5Determine and document AI reporting obligations to interested partiesPartially overlaps
Intellectual property rights protection
No direct ISO 42001 equivalent
- A.5.3Document and retain AI impact assessment resultsPartially overlaps
- A.4.3Document the data resources used by your AI systemPartially overlaps
- A.5.2AI system impact assessment processPartially overlaps
- A.5.4Assess and document AI impacts on individuals and groupsPartially overlaps
- A.8.5Determine and document AI reporting obligations to interested partiesPartially overlaps
- A.10.3Manage suppliers to support responsible AI usePartially overlaps
- A.10.4Consider customer expectations and needs when using AIPartially overlaps
Independent review of information security
No direct ISO 42001 equivalent
- A.2.4Review the AI policy at planned intervals to keep it effectivePartially overlaps
Documented operating procedures for information processing
No direct ISO 42001 equivalent
People controls
8 controls, 1 mappedPersonnel background verification
No direct ISO 42001 equivalent
Terms and conditions of employment for security
No direct ISO 42001 equivalent
Information security awareness, education and training program
No direct ISO 42001 equivalent
Disciplinary process for information security violations
No direct ISO 42001 equivalent
Responsibilities after employment termination or role change
No direct ISO 42001 equivalent
Confidentiality and non-disclosure agreements
No direct ISO 42001 equivalent
Remote working security measures
No direct ISO 42001 equivalent
- A.3.3Process for reporting concerns about AI systemsPartially overlaps
- A.8.3External reportingPartially overlaps
Physical controls
14 controls, 0 mappedPhysical security perimeters
No direct ISO 42001 equivalent
Physical access controls for secure areas
No direct ISO 42001 equivalent
Physical security for offices and facilities
No direct ISO 42001 equivalent
Continuous monitoring of physical access to premises
No direct ISO 42001 equivalent
Protecting against physical and environmental threats
No direct ISO 42001 equivalent
Security measures for working in secure areas
No direct ISO 42001 equivalent
Clear desk and clear screen policies
No direct ISO 42001 equivalent
Equipment siting and protection
No direct ISO 42001 equivalent
Security of off-site assets
No direct ISO 42001 equivalent
Secure management of storage media
No direct ISO 42001 equivalent
Protection from utility failures
No direct ISO 42001 equivalent
Secure cabling for power and data
No direct ISO 42001 equivalent
Proper maintenance of equipment
No direct ISO 42001 equivalent
Secure disposal or re-use of equipment
No direct ISO 42001 equivalent
Technological controls
34 controls, 7 mappedProtection of user endpoint devices
No direct ISO 42001 equivalent
Management of privileged access rights
No direct ISO 42001 equivalent
Restrict access to information and assets
No direct ISO 42001 equivalent
Access management for source code and tools
No direct ISO 42001 equivalent
Secure authentication technologies and procedures
No direct ISO 42001 equivalent
- A.6.2.6Defining and documenting ongoing AI system operation requirementsPartially overlaps
Protection against malware
No direct ISO 42001 equivalent
Management of technical vulnerabilities
No direct ISO 42001 equivalent
Configuration management for secure IT systems
No direct ISO 42001 equivalent
- A.5.3Document and retain AI impact assessment resultsPartially overlaps
Data masking for sensitive information
No direct ISO 42001 equivalent
Data leakage prevention measures
No direct ISO 42001 equivalent
Backup and recovery procedures for data
No direct ISO 42001 equivalent
Redundancy of information processing facilities
No direct ISO 42001 equivalent
- A.6.2.8AI system recording of event logsPartially overlaps
Monitoring networks and systems for anomalous behaviour
No direct ISO 42001 equivalent
Clock synchronisation for information systems
No direct ISO 42001 equivalent
Use of privileged utility programs
No direct ISO 42001 equivalent
Secure software installation procedures
No direct ISO 42001 equivalent
Network and network devices security
No direct ISO 42001 equivalent
Security of network services
No direct ISO 42001 equivalent
Network segregation for security
No direct ISO 42001 equivalent
Web filtering to reduce malicious website exposure
No direct ISO 42001 equivalent
Effective use of cryptography and key management
No direct ISO 42001 equivalent
Secure development lifecycle
No direct ISO 42001 equivalent
- A.6.2.2AI system requirements and specificationPartially overlaps
- A.6.2.3Documentation of AI system design and developmentPartially overlaps
Secure coding practices in software development
No direct ISO 42001 equivalent
- A.6.2.4AI system verification and validationPartially overlaps
Management of outsourced system development
No direct ISO 42001 equivalent
Separation of development, test, and production environments
No direct ISO 42001 equivalent
- A.6.2.6Defining and documenting ongoing AI system operation requirementsPartially overlaps
Test information selection and protection
No direct ISO 42001 equivalent
Protection of information systems during audits
No direct ISO 42001 equivalent
No ISO 27001 controls match these filters
Try a different relationship, theme or ID, or clear the filters to see all 93.
How to use this mapping
Read it in whichever direction you are being assessed. If ISO 27001 is your primary framework, use the cards to find the ISO 42001 controls that cover the same ground, so evidence you already hold can be reused instead of rebuilt. If ISO 42001 is what you are being held to, search for a ISO 42001 ID to see which ISO 27001 controls contribute. A mapping means the two controls address related risk, not that satisfying one satisfies the other, so always read the relationship label before relying on it.
Adding ISO 42001 to an ISO 27001 system? Mindset Cyber's PECB ISO 42001 Lead Implementer course covers the AI management system side.
What the relationship labels mean
Read each row as the ISO 27001 control, then the label, then the ISO 42001 control.
- Broader than
- The source control covers everything the mapped control asks for, and more. 1 pairing on this page
- Partially overlaps
- The two share ground, but neither contains the other. 37 pairings on this page
- Depends on
- The source control relies on the mapped control being in place. 2 pairings on this page
Frequently asked questions
Why do most ISO 27001 controls have no ISO 42001 counterpart?
Because the two standards cover different subjects. ISO/IEC 27001:2022 manages information security across the whole organisation, while ISO/IEC 42001:2023 manages artificial intelligence, with 38 Annex A controls concentrated on AI impact assessment, data provenance, the AI system life cycle and transparency. Only the parts of ISO 27001 that touch those areas have a counterpart, so a blank row is the expected result rather than a gap in the data.
Can I reuse my ISO 27001 management system for ISO 42001?
Largely, yes. Both standards share the harmonised clause structure, so the internal audit program, management review, document control, corrective action process and much of the supplier and incident work can be extended rather than rebuilt. The scopes, risk assessments, Statements of Applicability and certificates stay separate, and each standard is audited on its own terms.
What does ISO 42001 add that ISO 27001 does not have?
The AI system impact assessment is the clearest difference. ISO 27001 assesses risk to the organisation, while ISO 42001 also requires you to assess consequences for individuals, groups and societies across the AI system life cycle. It also adds requirements on data provenance and quality, documentation for users of an AI system, and responsible use of third-party AI.
Is this mapping official?
No. ISO does not publish a control-level crosswalk between these two standards. This mapping is produced by Control Stack from the control text of both and reviewed for topic fidelity, and it is the thinnest of the crosswalks on this site because ISO 42001 is the newest and least mapped framework in the catalogue. Read the relationship label on each pairing before relying on it.