ISO/IEC 29147:2018: every control, and what you already have

110 controls 302 frameworks share controls with it International (ISO/IEC JTC 1/SC 27); adopted as EN ISO/IEC 29147:2020 and nationally verified against its source document

Every control below is one this framework asks for. The right hand column counts how many other frameworks in our corpus carry the same control, which is the difference between doing this work once and doing it again for the next standard.

There is no implementation kit for this framework yet. The control list and the overlap above are free and complete.

What you already have

Frameworks whose controls overlap this one, most first. If you run any of them, the count is roughly what you have already evidenced.

If you run	Shared controls
AICPA Privacy Management Framework (PMF)	4	measure it →
FedRAMP Rev 5	4	measure it →
FTC GLBA Safeguards Rule (16 CFR Part 314)	4	measure it →
HKMA Cyber Resilience Assessment Framework (C-RAF)	4	measure it →
ISMAP (Japan)	4	measure it →
ISO 27017	4	measure it →
ISO 27018	4	measure it →
ISO/IEC 29134:2023	4	measure it →
Kuwait National Cybersecurity Framework	4	measure it →
MTCS (Singapore)	4	measure it →
NIST SP 800-144	4	measure it →
NIST SP 800-145	4	measure it →

Every control

Code	Control	Also in
`29147-5.1`	Vulnerability Disclosure Policy	0
`29147-5.10`	Disclosure Records and Retention	0
`29147-5.11`	Researcher Safe Harbour and Legal Posture	159
`29147-5.12`	Bug Bounty Programme Integration	0
`29147-5.13`	External Stakeholder Notification	0
`29147-5.14`	Embargo Management	0
`29147-5.15`	Programme Governance and Roles	0
`29147-5.16`	Training and Awareness	1
`29147-5.2`	Receipt of Vulnerability Reports	0
`29147-5.3`	Initial Triage and Verification	0
`29147-5.4`	Finder Communication and Coordination	0
`29147-5.5`	Coordinated Disclosure Timeline	0
`29147-5.6`	Advisory Content and Quality	64
`29147-5.7`	Multi-Party Coordination	0
`29147-5.8`	Confidentiality of Reports	18
`29147-5.9`	Post-Disclosure Monitoring	0
`29147-6.1`	General receiving guidelines	0
`29147-6.2`	Vulnerability report contents	0
`29147-6.3`	Initial assessment	0
`29147-6.4`	Further investigation	0
`29147-6.5`	Ongoing communication	0
`29147-6.6`	Coordinator involvement	0
`29147-6.7`	Operational security	0
`29147-7.3`	Advisory publication guidelines	0
`29147-7.4`	Advisory content elements	0
`29147-7.5`	Communication channels	13
`29147-7.6`	Advisory format	0
`29147-7.7`	Advisory authenticity	0
`29147-7.8`	Remediation information	64
`29147-8.1`	Coordination general	0
`29147-8.2`	Vendors playing multiple roles	0
`29147-9.1`	Vulnerability disclosure policy development	0
`29147-9.2`	Contact mechanisms and scope	169
`29147-9.3`	Communication expectations and timelines	13
`5`	5 Concepts	0
`5.10`	5.10 Vulnerability exploitation	0
`5.11`	5.11 Vulnerabilities and risk	0
`5.3`	5.3 Relationships to other International Standards	0
`5.3.1`	5.3.1 ISO/IEC 30111	0
`5.4`	5.4 Systems, components, and services	0
`5.4.6`	5.4.6 Product interdependency	0
`5.5`	5.5 Stakeholder roles	0
`5.5.2`	5.5.2 User	0
`5.5.3`	5.5.3 Vendor	0
`5.5.4`	5.5.4 Reporter	0
`5.5.5`	5.5.5 Coordinator	0
`5.6`	5.6 Vulnerability handling process summary	0
`5.6.8`	5.6.8 Embargo period	0
`5.7`	5.7 Information exchange during vulnerability disclosure	0
`5.8`	5.8 Confidentiality of exchanged information	0
`5.8.2`	5.8.2 Secure communications	0
`5.9`	5.9 Vulnerability advisories	0
`6`	6 Receiving vulnerability reports	0
`6.2`	6.2 Vulnerability reports	0
`6.2.2`	6.2.2 Capability to receive reports	0
`6.2.3`	6.2.3 Monitoring	0
`6.2.4`	6.2.4 Report tracking	0
`6.2.5`	6.2.5 Report acknowledgement	0
`6.3`	6.3 Initial assessment	0
`6.4`	6.4 Further investigation	0
`6.5`	6.5 On-going communication	0
`6.6`	6.6 Coordinator involvement	0
`6.7`	6.7 Operational security	0
`7`	7 Publishing vulnerability advisories	0
`7.2`	7.2 Advisory	0
`7.3`	7.3 Advisory publication timing	0
`7.4`	7.4 Advisory elements	0
`7.4.10`	7.4.10 Impact	0
`7.4.11`	7.4.11 Severity	0
`7.4.12`	7.4.12 Remediation	0
`7.4.13`	7.4.13 References	0
`7.4.14`	7.4.14 Credit	0
`7.4.15`	7.4.15 Contact information	0
`7.4.16`	7.4.16 Revision history	0
`7.4.17`	7.4.17 Terms of use	0
`7.4.2`	7.4.2 Identifiers	0
`7.4.3`	7.4.3 Date and time	0
`7.4.4`	7.4.4 Title	0
`7.4.5`	7.4.5 Overview	0
`7.4.6`	7.4.6 Affected products	0
`7.4.7`	7.4.7 Intended audience	0
`7.4.8`	7.4.8 Localization	0
`7.4.9`	7.4.9 Description	0
`7.5`	7.5 Advisory communication	0
`7.6`	7.6 Advisory format	0
`7.7`	7.7 Advisory authenticity	0
`7.8`	7.8 Remediations	0
`7.8.2`	7.8.2 Remediation authenticity	0
`7.8.3`	7.8.3 Remediation deployment	0
`8`	8 Coordination	0
`8.1`	8.1 Coordination: general	0
`8.2`	8.2 Vendors playing multiple roles	0
`8.2.2`	8.2.2 Vulnerability reporting among vendors	0
`8.2.3`	8.2.3 Reporting vulnerability information to other vendors	0
`9`	9 Vulnerability disclosure policy	0
`9.2`	9.2 Required policy elements	0
`9.2.2`	9.2.2 Preferred contact mechanism	0
`9.3`	9.3 Recommended policy elements	0
`9.3.2`	9.3.2 Vulnerability report contents	0
`9.3.3`	9.3.3 Secure communication options	0
`9.3.4`	9.3.4 Setting communication expectations	0
`9.3.5`	9.3.5 Scope	0
`9.3.6`	9.3.6 Publication	0
`9.3.7`	9.3.7 Recognition	0
`9.4`	9.4 Optional policy elements	0
`9.4.2`	9.4.2 Legal considerations	0
`9.4.3`	9.4.3 Disclosure timeline	0
`ANNEXES`	Annexes A to D (informative)	0
`STANDARD`	ISO/IEC 29147:2018: the standard, its scope and what is held	0
`STATUS`	Edition status: the 2018 second edition is current; the CRA and EUCC point at it	0

Tell me when ISO/IEC 29147:2018 files something new

One email when a public company newly discloses something this framework governs, naming the company and what our corpus says it puts in scope. Nothing else, and one click to stop.

What this page is

A control-level reference for ISO/IEC 29147:2018, drawn from our framework corpus. Control codes and titles are references to the standard, not reproductions of it. The overlap counts and the auditor artefacts are our own work and are the part you will not find elsewhere.

Measure this against what you already run · All frameworks · Today's edition