ISO/IEC 27031:2011: every control, and what you already have

27 controls 316 frameworks share controls with it International held in the corpus

Every control below is one this framework asks for. The right hand column counts how many other frameworks in our corpus carry the same control, which is the difference between doing this work once and doing it again for the next standard.

There is no implementation kit for this framework yet. The control list and the overlap above are free and complete.

What you already have

Frameworks whose controls overlap this one, most first. If you run any of them, the count is roughly what you have already evidenced.

If you run	Shared controls
ASIS SPC.1-2009	8	measure it →
FFIEC IT Examination Handbook	8	measure it →
GLBA	8	measure it →
HKMA SPM	8	measure it →
Monetary Authority of Singapore Technology Risk Management Guidelines	8	measure it →
Open Banking Security	8	measure it →
OSFI B-13	8	measure it →
PCI P2PE	8	measure it →
PCI PIN Security	8	measure it →
PCI SSF	8	measure it →
PSD2 SCA	8	measure it →
Singapore Government Instruction Manual on ICT&SS Management (IM8)	8	measure it →

Every control

Code	Control	Also in
`27031-10.1`	Continual Improvement	16
`27031-10.2`	Supplier Continuity Arrangements	0
`27031-10.3`	Communication During Incidents	13
`27031-4.1`	Overview of IRBC	0
`27031-4.2`	IRBC framework elements	0
`27031-5.1`	IRBC Policy	169
`27031-5.2`	ICT services and infrastructure scope	0
`27031-6.1`	Understanding the Organisation	0
`27031-6.2`	Business Impact Analysis for ICT	1
`27031-6.3`	Risk Assessment for ICT Continuity	4
`27031-7.1`	IRBC Strategy	30
`27031-7.2`	Resource Requirements	181
`27031-7.3`	Incident Response Structure	0
`27031-7.4`	IRBC Plans	0
`27031-7.5`	Awareness and Training	1
`27031-8.1`	Exercising and Testing	113
`27031-8.2`	Maintaining IRBC	83
`27031-8.3`	IRBC plan documents	0
`27031-8.4`	Awareness, competency and training	0
`27031-9.1`	Performance Measurement	0
`27031-9.2`	Internal Audit	14
`27031-9.3`	Management Review	98
`27031-9.4`	IRBC review and improvement	0
`27031-A`	IRBC milestones during disruption	0
`27031-B`	High availability embedded systems	56
`27031-C`	Assessing failure scenarios	0
`27031-D`	Developing performance criteria	30

Tell me when ISO/IEC 27031:2011 files something new

One email when a public company newly discloses something this framework governs, naming the company and what our corpus says it puts in scope. Nothing else, and one click to stop.

What an auditor will ask you to produce

The artefacts named on the failure modes this framework speaks to.

Approved information security policy
Policy review and approval history
Roles and responsibilities matrix
Management commitment statement
Policy communication evidence
breach notification template
complaint handling procedure
complaint register
PDPC complaint responses
30-day SLA tracking

How programmes fail on this

Failure modes named by this framework and others. Each opens the full record.

No defined review cadence named by 4 frameworks
no root cause analysis named by 3 frameworks

What this page is

A control-level reference for ISO/IEC 27031:2011, drawn from our framework corpus. Control codes and titles are references to the standard, not reproductions of it. The overlap counts and the auditor artefacts are our own work and are the part you will not find elsewhere.

Measure this against what you already run · All frameworks · Today's edition