ISO/IEC 27400:2022: every control, and what you already have

53 controls 290 frameworks share controls with it International (ISO/IEC JTC 1/SC 27) verified against its source document

Every control below is one this framework asks for. The right hand column counts how many other frameworks in our corpus carry the same control, which is the difference between doing this work once and doing it again for the next standard.

There is no implementation kit for this framework yet. The control list and the overlap above are free and complete.

What you already have

Frameworks whose controls overlap this one, most first. If you run any of them, the count is roughly what you have already evidenced.

If you run	Shared controls
NIST Privacy Framework	8	measure it →
TISAX	8	measure it →
FTC GLBA Safeguards Rule (16 CFR Part 314)	8	measure it →
Oman National Cybersecurity Framework	8	measure it →
AWWA Cybersecurity Guidance for the Water Sector (American Water Works Association)	7	measure it →
FedRAMP Rev 5	7	measure it →
NIS2 Directive Implementing Acts	7	measure it →
SOC for Cybersecurity	7	measure it →
Bahrain PDPL	7	measure it →
Federal Decree-Law No. 45 of 2021 on the Protection of Personal Data (UAE PDPL)	7	measure it →
Family Educational Rights and Privacy Act (FERPA)	7	measure it →
Iceland Data Protection and Processing of Personal Data Act (Act No. 90/2018)	7	measure it →

Every control

Code	Control	Also in
`27400-10.1`	Vulnerability Management for IoT	0
`27400-10.2`	Incident Response for IoT	0
`27400-10.3`	Logging and Monitoring	3
`27400-11.1`	Decommissioning and Disposal	0
`27400-11.2`	Supplier and Third-Party Management	0
`27400-4`	IoT overview and concepts	0
`27400-5.1`	IoT Security and Privacy Governance	18
`27400-5.2`	IoT Risk Assessment	27
`27400-5.3`	Network and communication risks	0
`27400-5.4`	Data and privacy risks	117
`27400-6.1`	Secure Device Design	111
`27400-6.2`	Device Identity and Authentication	138
`27400-6.3`	Secure Update Mechanism	81
`27400-6.4`	Default Configuration Security	58
`27400-6.5`	Security monitoring and incident response	157
`27400-7.1`	Network Security for IoT	110
`27400-7.2`	Gateway Security	0
`27400-7.3`	Data minimization and purpose limitation	117
`27400-7.4`	Data retention and deletion	110
`27400-8.1`	Platform and Backend Security	0
`27400-8.2`	Data Protection in IoT	0
`27400-8.3`	Maintenance and update security	0
`27400-8.4`	Decommissioning security	0
`27400-9.1`	Privacy by Design for IoT	0
`27400-9.2`	Consent and Transparency	0
`27400-9.3`	Data Subject Rights for IoT	0
`5`	5 IoT concepts	0
`5.2`	5.2 Characteristics of IoT systems	0
`5.3`	5.3 Stakeholders of IoT systems	0
`5.3.2`	5.3.2 IoT service provider	0
`5.3.3`	5.3.3 IoT service developer	0
`5.3.4`	5.3.4 IoT user	0
`5.4`	5.4 IoT ecosystem	0
`5.5`	5.5 IoT service life cycles	0
`5.6`	5.6 Domain based reference model	0
`6`	6 Risk sources for IoT systems	0
`6.1`	6.1 Risk sources: general	0
`6.2`	6.2 Risk sources	0
`6.2.1`	6.2.1 Risk sources: general categories	0
`6.2.2`	6.2.2 Sample risk sources related to IoT domains	0
`6.2.3`	6.2.3 Risk sources from outside the IoT domains	0
`6.2.4`	6.2.4 Privacy related risk sources	0
`7`	7 Security and privacy controls	0
`7.1`	7.1 Security controls	0
`7.1.2`	7.1.2 Security controls for IoT service developer and IoT service provider	0
`7.1.3`	7.1.3 Security controls for IoT user	0
`7.2`	7.2 Privacy controls	0
`7.2.2`	7.2.2 Privacy controls for IoT service developer and IoT service provider	0
`7.2.3`	7.2.3 Privacy controls for IoT user	0
`ANNEXA`	Annex A (informative): IoT monitoring camera sample risk scenario	0
`FRONT`	Clauses 2 to 4: references, terms and abbreviations	0
`STANDARD`	ISO/IEC 27400:2022: the standard, its scope and what is held	0
`STATUS`	Edition status: first edition 2022, current; ISO/IEC 27402 builds on its controls	0

Tell me when ISO/IEC 27400:2022 files something new

One email when a public company newly discloses something this framework governs, naming the company and what our corpus says it puts in scope. Nothing else, and one click to stop.

What this page is

A control-level reference for ISO/IEC 27400:2022, drawn from our framework corpus. Control codes and titles are references to the standard, not reproductions of it. The overlap counts and the auditor artefacts are our own work and are the part you will not find elsewhere.

Measure this against what you already run · All frameworks · Today's edition