United Kingdom (BSI; used internationally)

BS 65000:2014

32 controls. 134 other frameworks in our corpus share controls with it. Here is all of it, and how much of it you are already doing.

Page built . This page is derived from the framework corpus, which changes when the corpus is extended rather than daily.

32 controls 134 frameworks share controls with it United Kingdom (BSI; used internationally) verified against its source document

Every control below is one this framework asks for. The right hand column counts how many other frameworks in our corpus carry the same control, which is the difference between doing this work once and doing it again for the next standard.

There is no implementation kit for this framework yet. The control list and the overlap above are free and complete.

What you already have

Frameworks whose controls overlap this one, most first. If you run any of them, the count is roughly what you have already evidenced.

If you runShared controls
ISO/IEC 23894:20236measure it →
ISO 27005:20224measure it →
ISO 27701:20193measure it →
ISO 31000:20183measure it →
ISO/IEC 42001:20233measure it →
APRA CPS 2343measure it →
FFIEC Cybersecurity Assessment Tool (CAT)3measure it →
FFIEC IT Examination Handbook3measure it →
GLBA3measure it →
HKMA Cyber Resilience Assessment Framework (C-RAF)3measure it →
HKMA SPM3measure it →
IEEE 70003measure it →

Every control

CodeControlAlso in
BS65000-10.1Continual Improvement16
BS65000-10.2Learning from Incidents and Near Misses0
BS65000-4.1Context of the Organization2
BS65000-4.2Resilience Vision and Objectives0
BS65000-5.1Leadership Commitment15
BS65000-5.2Resilience Culture0
BS65000-5.3Governance and Accountability1
BS65000-6.1Risk and Opportunity Identification0
BS65000-6.2Scenario Planning0
BS65000-7.1Resources for Resilience0
BS65000-7.2Competence and Awareness0
BS65000-7.4Communication5
BS65000-8.1Strategic Resilience0
BS65000-8.2Operational Resilience0
BS65000-8.3People Resilience0
BS65000-8.4Supply Chain Resilience0
BS65000-8.5Technology and Information Resilience0
BS65000-8.6Physical and Site Resilience0
BS65000-8.7Incident and Crisis Management0
BS65000-8.8Adaptive Capacity0
BS65000-9.1Monitoring and Measurement2
BS65000-9.2Exercises and Testing0
BS65000-9.3Internal Audit and Review0
BS65000-RM-01Resilience Journey88
BS65000-RM-02Integrated Approach100
BS65000-RM-03Leadership and Culture53
33 Overview of organizational resilience0
44 The organizational foundations for resilience0
55 Building resilience0
66 Assessing the resilience of an organization0
GGuidance clauses 3 to 6 of BS 65000:20140
STDBS 65000: the 2014 guidance standard, the 2022 Code of Practice, and what is held0

Tell me when BS 65000:2014 files something new

One email when a public company newly discloses something this framework governs, naming the company and what our corpus says it puts in scope. Nothing else, and one click to stop.

What an auditor will ask you to produce

The artefacts named on the failure modes this framework speaks to.

  • Concentration risk analysis
  • vendor inventory
  • criticality classifications
  • dependency mapping
  • annual reviews
  • Risk assessment methodology
  • PDPA compliance roadmap
  • enforcement readiness assessment
  • board-level PDPA reporting
  • Metrics catalogue

How programmes fail on this

Failure modes named by this framework and others. Each opens the full record.

What this page is

A control-level reference for BS 65000:2014, drawn from our framework corpus. Control codes and titles are references to the standard, not reproductions of it. The overlap counts and the auditor artefacts are our own work and are the part you will not find elsewhere.

Measure this against what you already run · All frameworks · Today's edition