ISO/IEC 27019:2024: every control, and what you already have

67 controls 245 frameworks share controls with it International (ISO/IEC JTC 1/SC 27) verified against its source document

Every control below is one this framework asks for. The right hand column counts how many other frameworks in our corpus carry the same control, which is the difference between doing this work once and doing it again for the next standard.

There is no implementation kit for this framework yet. The control list and the overlap above are free and complete.

What you already have

Frameworks whose controls overlap this one, most first. If you run any of them, the count is roughly what you have already evidenced.

If you run	Shared controls
API 1164	16	measure it →
IEC 62443	16	measure it →
NIST SP 1800-32	16	measure it →
NIST SP 800-82 Revision 3: Guide to Industrial Control Systems (ICS) Security	15	measure it →
NIST SP 800-53 Rev 5	13	measure it →
South Korea ISMS-P	13	measure it →
BSI IT-Grundschutz	12	measure it →
ISO/IEC 27010:2015	12	measure it →
Singapore Government Instruction Manual on ICT&SS Management (IM8)	12	measure it →
NIST Privacy Framework	12	measure it →
TISAX	12	measure it →
MTCS (Singapore)	11	measure it →

Every control

Code	Control	Also in
`ISO27019-01`	Critical asset identification and inventory	0
`ISO27019-02`	System security categorization	42
`ISO27019-03`	Security governance structure	0
`ISO27019-04`	Roles and responsibilities for critical systems	1
`ISO27019-05`	Security policy for operational technology	7
`ISO27019-06`	Physical and logical access controls	0
`ISO27019-07`	Personnel risk assessment	164
`ISO27019-08`	Electronic access perimeter management	98
`ISO27019-09`	Interactive remote access security	0
`ISO27019-10`	Revocation of access procedures	98
`ISO27019-11`	Security patch management for OT	14
`ISO27019-11.1.1`	Physical Security for Substations and Plants	0
`ISO27019-11.2.4`	Maintenance of Process Control Equipment	0
`ISO27019-12`	Malware prevention for operational systems	29
`ISO27019-12.1.2`	Change Management for Control Systems	2
`ISO27019-12.2.1`	Malware Protection in OT	3
`ISO27019-12.3.1`	Backup of Control System Configurations	0
`ISO27019-12.4.1`	Event Logging in Control Systems	1
`ISO27019-12.6.1`	Vulnerability Management for OT	0
`ISO27019-13`	Network security monitoring	74
`ISO27019-13.1.1`	Network Security for Energy Operations	0
`ISO27019-13.1.3`	Segregation of Networks	1
`ISO27019-14`	System security hardening	43
`ISO27019-14.2.1`	Secure Development of Control Applications	0
`ISO27019-15`	Ports and services management	0
`ISO27019-15.1.1`	Supplier Relationships in Energy	1
`ISO27019-16`	Incident response plan for operational disruptions	136
`ISO27019-16.1.1`	Incident Management for Energy Operations	0
`ISO27019-17`	Recovery plan for critical systems	0
`ISO27019-17.1.2`	Business Continuity for Energy Supply	0
`ISO27019-18`	Reporting obligations to authorities	142
`ISO27019-18.1.1`	Compliance with Energy Sector Regulations	0
`ISO27019-19`	Coordination with sector-specific agencies	0
`ISO27019-20`	Exercises and drills for OT incidents	136
`ISO27019-21`	Supply chain risk management for critical components	74
`ISO27019-22`	Configuration management for OT systems	88
`ISO27019-23`	Change management procedures	84
`ISO27019-24`	Vulnerability assessment for critical systems	156
`ISO27019-6.1.1`	Information Security Roles for Energy Operations	0
`ISO27019-6.1.5`	Information Security in Project Management for Energy	0
`ISO27019-7.1.1`	Screening of Personnel with OT Access	0
`ISO27019-8.1.1`	Inventory of Process Control Assets	0
`ISO27019-8.2.1`	Classification of Energy Sector Information	0
`ISO27019-9.1.1`	Access Control Policy for Control Systems	1
`ISO27019-9.2.3`	Privileged Access in Control Environments	0
`ISO27019-ENR.1`	Safety and Security Integration	0
`5`	5 Organizational controls	0
`5.2`	5.2 Information security roles and responsibilities	0
`5.38`	5.38 ENR: Identification of risks related to external business partners	0
`5.39`	5.39 ENR: Addressing security when dealing with customers	0
`6`	6 People controls	0
`7`	7 Physical controls	0
`7.15`	7.15 ENR: Securing control centres	0
`7.16`	7.16 ENR: Securing equipment rooms	0
`7.17`	7.17 ENR: Securing peripheral sites	0
`7.18`	7.18 ENR: Interconnected control and communication systems	0
`8`	8 Technological controls	0
`8.35`	8.35 ENR: Treatment of legacy systems	0
`8.36`	8.36 ENR: Integrity and availability of safety functions	0
`8.37`	8.37 ENR: Securing process control data communication	0
`8.38`	8.38 ENR: Logical connection of external process control systems	0
`8.39`	8.39 ENR: Least functionality	0
`8.40`	8.40 ENR: Emergency communication	0
`ANNEXES`	Annex A (the energy-specific controls) and Annex B (correspondence with the 2017 edition)	0
`FRONT`	Introduction and clauses 2 to 4: the sector's requirements, the terms and the structure	0
`STANDARD`	ISO/IEC 27019:2024: the standard, its scope and what is held	0
`STATUS`	Edition status: 2024 is current; the batch node had carried the bare name ISO 27019 with the 2017 edition's structure	0

Tell me when ISO/IEC 27019:2024 files something new

One email when a public company newly discloses something this framework governs, naming the company and what our corpus says it puts in scope. Nothing else, and one click to stop.

What this page is

A control-level reference for ISO/IEC 27019:2024, drawn from our framework corpus. Control codes and titles are references to the standard, not reproductions of it. The overlap counts and the auditor artefacts are our own work and are the part you will not find elsewhere.

Measure this against what you already run · All frameworks · Today's edition