Skip to content

    SOC 2 Type II to ISO/IEC 42001:2023 (clauses and Annex A) control mapping

    SOC 2 Type II and ISO/IEC 42001:2023 (clauses and Annex A) both map to 78 NIST SP 800-53 controls. Every one is listed below, with the controls on each side that map to it.

    Shared NIST 800-53 controls
    78
    SOC 2 Type II controls involved
    42
    ISO/IEC 42001:2023 (clauses and Annex A) controls involved
    54
    NIST 800-53 families touched
    20

    How this pairing is derived

    Both frameworks are mapped to NIST SP 800-53 Rev 5 in the source dataset, so the ground they share is the set of NIST controls they both reference. That set is what the table shows. It is not an authored SOC 2 Type II to ISO/IEC 42001:2023 (clauses and Annex A) crosswalk: two controls on the same row are related through the NIST control between them, not asserted to be equivalent to each other.

    Shared controls in full

    NIST SP 800-53 Rev 5 controls mapped by both SOC 2 Type II and ISO/IEC 42001:2023 (clauses and Annex A), with the controls on each side that map to them.
    NIST 800-53 controlFamilySOC 2 Type II controlsISO/IEC 42001:2023 (clauses and Annex A) controls
    AC-1Policy and ProceduresACAccess ControlCC5.3, CC6.1, CC6.65.1, 5.2, 7.5.1, 7.5.2, 7.5.3, A.2, A.2.2, A.2.3, A.2.4
    AT-1Policy and ProceduresATAwareness and TrainingCC1.4, CC5.35.1, 5.2, 7.5.1, 7.5.2, 7.5.3, A.2, A.2.2, A.2.3, A.2.4
    AU-1Policy and ProceduresAUAudit and AccountabilityCC5.3, CC7.25.1, 5.2, 7.5.1, 7.5.2, 7.5.3, A.2, A.2.2, A.2.3, A.2.4
    CA-1Policy and ProceduresCAAssessment, Authorization, and MonitoringCC4.1, CC5.35.1, 5.2, 7.5.1, 7.5.2, 7.5.3, A.2, A.2.2, A.2.3, A.2.4, A.6.2.5
    CA-2Control AssessmentsCAAssessment, Authorization, and MonitoringCC3.1, CC4.1, CC5.27.4, A.4.2, A.6.2.2, A.6.2.5
    CA-2(2)Specialized AssessmentsCAAssessment, Authorization, and MonitoringCC4.1A.6.2.5
    CA-5Plan of Action and MilestonesCAAssessment, Authorization, and MonitoringCC4.210.2, 9.3.2
    CA-7(1)Independent AssessmentCAAssessment, Authorization, and MonitoringCC1.1, CC2.2, CC2.39.2.2
    CM-1Policy and ProceduresCMConfiguration ManagementCC5.3, CC7.15.1, 5.2, 7.5.1, 7.5.2, 7.5.3, A.2, A.2.2, A.2.3, A.2.4
    CM-3Configuration Change ControlCMConfiguration ManagementCC3.4, CC8.16.3
    CM-3(1)Automated Documentation, Notification, and Prohibition of ChangesCMConfiguration ManagementCC6.86.3
    CM-4Impact AnalysesCMConfiguration ManagementCC3.4A.5.2, A.5.3
    CM-4(2)Verification of ControlsCMConfiguration ManagementCC4.1A.6.2.5
    CM-9Configuration Management PlanCMConfiguration ManagementCC7.1, CC8.1A.5.2, A.5.3
    CP-1Policy and ProceduresCPContingency PlanningA1.2, CC5.3, CC7.5, CC9.15.1, 5.2, 7.5.1, 7.5.2, 7.5.3, A.2, A.2.2, A.2.3, A.2.4
    IA-1Policy and ProceduresIAIdentification and AuthenticationCC5.3, CC6.1, CC6.65.1, 5.2, 7.5.1, 7.5.2, 7.5.3, A.2, A.2.2, A.2.3, A.2.4
    IR-1Policy and ProceduresIRIncident ResponseCC5.3, CC7.3, CC7.45.1, 5.2, 7.5.1, 7.5.2, 7.5.3, A.2, A.2.2, A.2.3, A.2.4
    IR-4Incident HandlingIRIncident ResponseCC7.3, CC7.4A.3.3
    IR-6Incident ReportingIRIncident ResponseCC2.3, CC7.4, P6.3, P6.7A.8.3, A.8.4
    MA-1Policy and ProceduresMAMaintenanceCC5.35.1, 5.2, 7.5.1, 7.5.2, 7.5.3, A.2, A.2.2, A.2.3, A.2.4
    PE-1Policy and ProceduresPEPhysical and Environmental ProtectionA1.2, CC5.3, CC6.45.1, 5.2, 7.5.1, 7.5.2, 7.5.3, A.2, A.2.2, A.2.3, A.2.4
    PL-1Policy and ProceduresPLPlanningCC1.5, CC2.2, CC2.3, CC3.1, CC3.4, CC5.2, CC5.3, PI1.2, PI1.34.1, 5.1, 5.2, 7.1, 7.5.1, 7.5.2, 7.5.3, A.2, A.2.2, A.2.3, A.2.4, A.4.2, A.6.1, A.6.1.3, A.6.2.3
    PL-4Rules of BehaviorPLPlanningCC1.17.3
    PL-9Central ManagementPLPlanningCC1.1, CC1.3, CC5.15.3, A.3.2
    RA-1Policy and ProceduresRARisk AssessmentCC3.1, CC4.1, CC5.1, CC5.3, CC9.15.1, 5.2, 6.1.1, 6.1.2, 6.1.3, 7.5.1, 7.5.2, 7.5.3, 8.2, A.2, A.2.2, A.2.3, A.2.4, A.5
    RA-3Risk AssessmentRARisk AssessmentA1.2, CC4.1, CC7.36.1.2, 8.2, A.5.3, A.5.4, A.5.5
    RA-8Privacy Impact AssessmentsRARisk AssessmentCC3.2, CC5.2, PI1.16.1.4, 8.4, A.5.3, A.5.4, A.5.5
    RA-9Criticality AnalysisRARisk AssessmentCC2.2, CC4.1, CC5.2, CC9.1, PI1.14.1, 4.2, A.4.2, A.6.2.2
    SA-1Policy and ProceduresSASystem and Services AcquisitionCC5.2, CC5.3, P6.4, PI1.1, PI1.2, PI1.3, PI1.4, PI1.55.1, 5.2, 7.5.1, 7.5.2, 7.5.3, A.2, A.2.2, A.2.3, A.2.4, A.6.1, A.6.1.3, A.6.2.3
    SA-2Allocation of ResourcesSASystem and Services AcquisitionCC1.4, CC4.15.1, 7.1, A.4.2
    SA-3System Development Life CycleSASystem and Services AcquisitionCC5.2, CC8.1A.3.3, A.4.2, A.6.2.2, A.6.2.7, A.6.2.8
    SA-3(1)Manage Preproduction EnvironmentSASystem and Services AcquisitionCC5.2, CC8.1A.3.3, A.4.2, A.6.2.2, A.6.2.7, A.6.2.8
    SA-4Acquisition ProcessSASystem and Services AcquisitionCC3.3, CC3.4, CC5.2, CC9.1, CC9.2, P6.4, PI1.2, PI1.3A.10, A.10.2, A.10.3, A.6.1, A.6.1.3, A.6.2.2, A.6.2.3
    SA-4(3)Development Methods, Techniques, and PracticesSASystem and Services AcquisitionPI1.1, PI1.2, PI1.3, PI1.4, PI1.5A.6.1.3, A.6.2.3
    SA-8(30)Procedural RigorSASystem and Services AcquisitionCC5.2, CC8.1A.3.3, A.4.2, A.6.2.2, A.6.2.7, A.6.2.8
    SA-8(31)Secure System ModificationSASystem and Services AcquisitionCC3.4, CC8.16.3
    SA-8(32)Sufficient DocumentationSASystem and Services AcquisitionCC2.2, CC5.1, CC5.37.5.1, 7.5.2, 7.5.3, A.6.2.7, A.6.2.8
    SA-9External System ServicesSASystem and Services AcquisitionCC3.3, P6.4A.10, A.10.2, A.10.3
    SA-9(3)Establish and Maintain Trust Relationship with ProvidersSASystem and Services AcquisitionCC3.1, CC3.2, CC3.3, CC4.1, CC9.1, CC9.25.3, A.10, A.10.2, A.10.3, A.10.4
    SA-11(2)Threat Modeling and Vulnerability AnalysesSASystem and Services AcquisitionCC4.210.2
    SA-11(5)Penetration TestingSASystem and Services AcquisitionCC4.1, CC4.210.2, A.6.2.5
    SA-15Development Process, Standards, and ToolsSASystem and Services AcquisitionPI1.1, PI1.2, PI1.3, PI1.4, PI1.5A.6.1.3, A.6.2.3
    SA-15(2)Security and Privacy Tracking ToolsSASystem and Services AcquisitionCC4.210.2, 9.3.2
    SA-23SpecializationSASystem and Services AcquisitionCC5.2, PI1.2, PI1.3A.6.1, A.6.1.3, A.6.2, A.6.2.2, A.6.2.3, A.6.2.7, A.6.2.8
    SC-1Policy and ProceduresSCSystem and Communications ProtectionCC2.2, CC3.2, CC5.1, CC5.2, CC5.3, CC6.1, CC6.65.1, 5.2, 7.5.1, 7.5.2, 7.5.3, A.2, A.2.2, A.2.3, A.2.4
    SC-18(1)Identify Unacceptable Code and Take Corrective ActionsSCSystem and Communications ProtectionCC4.210.2
    SC-38Operations SecuritySCSystem and Communications ProtectionCC2.27.5.3
    SI-1Policy and ProceduresSISystem and Information IntegrityCC2.2, CC3.2, CC5.1, CC5.2, CC5.35.1, 5.2, 7.5.1, 7.5.2, 7.5.3, A.2, A.2.2, A.2.3, A.2.4
    SI-18Personally Identifiable Information Quality OperationsSISystem and Information IntegrityCC2.1A.7, A.7.2, A.7.3, A.7.4, A.7.5, A.7.6
    SI-18(1)Automation SupportSISystem and Information IntegrityCC2.1A.7, A.7.2, A.7.3, A.7.4, A.7.5, A.7.6
    MP-1Policy and ProceduresMPMedia ProtectionC1.1, CC2.1, CC5.3, CC6.5, CC6.7, PI1.55.1, 5.2, 7.5.1, 7.5.2, 7.5.3, A.2, A.2.2, A.2.3, A.2.4
    PS-1Policy and ProceduresPSPersonnel SecurityCC1.1, CC1.4, CC5.35.1, 5.2, 7.2, 7.5.1, 7.5.2, 7.5.3, A.2, A.2.2, A.2.3, A.2.4
    PS-2Position Risk DesignationPSPersonnel SecurityCC1.2, CC1.3, CC1.5, CC5.37.2
    PS-6Access AgreementsPSPersonnel SecurityCC1.57.3
    PS-6(2)Classified Information Requiring Special ProtectionPSPersonnel SecurityCC1.57.3
    PS-8Personnel SanctionsPSPersonnel SecurityCC1.57.3
    PS-9Position DescriptionsPSPersonnel SecurityCC1.2, CC1.3, CC2.25.3, 7.2, A.3.2
    PM-1Information Security Program PlanPMProgram ManagementCC1.1, CC1.2, CC5.35.1, 5.2, 7.5.1, 7.5.2, 7.5.3, A.2, A.2.2, A.2.3, A.2.4
    PM-2Information Security Program Leadership RolePMProgram ManagementCC1.1, CC1.35.3, A.3.2
    PM-3Information Security and Privacy ResourcesPMProgram ManagementCC1.45.1, 7.1, A.6.2.2
    PM-4Plan of Action and Milestones ProcessPMProgram ManagementCC4.210.2, 9.3.2
    PM-6Measures of PerformancePMProgram ManagementCC1.1, CC1.2, CC1.3, CC1.5, CC2.2, CC4.15.1, 5.3, 9.3.2, A.3.2
    PM-8Critical Infrastructure PlanPMProgram ManagementA1.2, CC1.5, CC2.2, CC2.3, CC7.5, CC9.14.1
    PM-9Risk Management StrategyPMProgram ManagementCC3.1, CC4.1, CC5.1, CC9.16.1.1, 6.1.2, 6.1.3, 8.2, A.5
    PM-10Authorization ProcessPMProgram ManagementCC4.1A.6.2.5
    PM-11Mission and Business Process DefinitionPMProgram ManagementCC1.3, CC3.1, CC3.4, CC4.1, CC5.1, CC5.2, PI1.14.1, 4.2, 7.4
    PM-13Security and Privacy WorkforcePMProgram ManagementCC1.2, CC1.3, CC1.4, CC2.25.3, 7.2, A.3.2
    PM-22Personally Identifiable Information Quality ManagementPMProgram ManagementCC2.1, P7.1A.7, A.7.2, A.7.3, A.7.4, A.7.5, A.7.6
    PM-28Risk FramingPMProgram ManagementCC3.26.1.2, 6.1.4, 8.4
    PM-29Risk Management Program Leadership RolesPMProgram ManagementCC1.1, CC1.3, CC3.1, CC3.2, CC4.1, CC5.1, CC9.1, CC9.25.3, 6.1.1, 6.1.2, 6.1.3, 8.2, A.10, A.10.2, A.10.3, A.3.2, A.5
    PM-30Supply Chain Risk Management StrategyPMProgram ManagementCC3.1, CC3.2, CC4.1, CC9.2A.10, A.10.2, A.10.3
    PT-1Policy and ProceduresPTPII Processing and TransparencyCC2.2, CC3.2, CC5.1, CC5.2, CC5.35.1, 5.2, 7.5.1, 7.5.2, 7.5.3, A.2, A.2.2, A.2.3, A.2.4
    SR-1Policy and ProceduresSRSupply Chain Risk ManagementCC3.3, CC5.3, CC9.1, CC9.25.1, 5.2, 7.5.1, 7.5.2, 7.5.3, A.10, A.10.2, A.10.3, A.2, A.2.2, A.2.3, A.2.4
    SR-2Supply Chain Risk Management PlanSRSupply Chain Risk ManagementCC3.1, CC3.2, CC4.1, CC9.1, CC9.2A.10, A.10.2, A.10.3
    SR-2(1)Establish SCRM TeamSRSupply Chain Risk ManagementCC9.1A.10, A.10.2, A.10.3
    SR-3(1)Diverse Supply BaseSRSupply Chain Risk ManagementCC3.3, CC9.1A.6.1.3, A.6.2.3
    SR-3(3)Sub-tier Flow DownSRSupply Chain Risk ManagementCC9.1A.10.2, A.10.3
    SR-7Supply Chain Operations SecuritySRSupply Chain Risk ManagementCC2.2, CC3.1, CC3.2, CC4.1, CC9.27.5.3, A.10, A.10.2, A.10.3

    Source and method

    Derived from the Top Floor framework mapping dataset: 4,123 cross-framework control mappings across 19 frameworks, every one pivoted through NIST SP 800-53 Rev 5.

    Cross-framework mappings on this page are derived from the 2026.2 release of the Secure Controls Framework, used under CC BY-ND 4.0.

    Mappings are illustrative aids for planning and are not a substitute for the official text of any framework or for an assessor’s judgment. Always verify control requirements against the authoritative publication. Where no official crosswalk exists, the mapping judgment is our own analysis.