Skip to content

    SOC 2 Type II to ISO/IEC 27001:2022 (ISMS clauses) control mapping

    SOC 2 Type II and ISO/IEC 27001:2022 (ISMS clauses) both map to 44 NIST SP 800-53 controls. Every one is listed below, with the controls on each side that map to it.

    Shared NIST 800-53 controls
    44
    SOC 2 Type II controls involved
    37
    ISO/IEC 27001:2022 (ISMS clauses) controls involved
    22
    NIST 800-53 families touched
    20

    How this pairing is derived

    Both frameworks are mapped to NIST SP 800-53 Rev 5 in the source dataset, so the ground they share is the set of NIST controls they both reference. That set is what the table shows. It is not an authored SOC 2 Type II to ISO/IEC 27001:2022 (ISMS clauses) crosswalk: two controls on the same row are related through the NIST control between them, not asserted to be equivalent to each other.

    Shared controls in full

    NIST SP 800-53 Rev 5 controls mapped by both SOC 2 Type II and ISO/IEC 27001:2022 (ISMS clauses), with the controls on each side that map to them.
    NIST 800-53 controlFamilySOC 2 Type II controlsISO/IEC 27001:2022 (ISMS clauses) controls
    AC-1Policy and ProceduresACAccess ControlCC5.3, CC6.1, CC6.65.1, 5.2, 7.5.1, 7.5.2, 7.5.3
    AT-1Policy and ProceduresATAwareness and TrainingCC1.4, CC5.35.1, 5.2, 7.4, 7.5.1, 7.5.2, 7.5.3
    AU-1Policy and ProceduresAUAudit and AccountabilityCC5.3, CC7.25.1, 5.2, 7.5.1, 7.5.2, 7.5.3
    CA-1Policy and ProceduresCAAssessment, Authorization, and MonitoringCC4.1, CC5.35.1, 5.2, 7.5.1, 7.5.2, 7.5.3
    CA-2Control AssessmentsCAAssessment, Authorization, and MonitoringCC3.1, CC4.1, CC5.28.1, 9.1
    CA-7Continuous MonitoringCAAssessment, Authorization, and MonitoringCC1.1, CC2.2, CC2.310.1, 8.1
    CA-7(1)Independent AssessmentCAAssessment, Authorization, and MonitoringCC1.1, CC2.2, CC2.310.1, 8.1
    CM-1Policy and ProceduresCMConfiguration ManagementCC5.3, CC7.15.1, 5.2, 7.5.1, 7.5.2, 7.5.3
    CM-3Configuration Change ControlCMConfiguration ManagementCC3.4, CC8.16.3
    CP-1Policy and ProceduresCPContingency PlanningA1.2, CC5.3, CC7.5, CC9.15.1, 5.2, 7.5.1, 7.5.2, 7.5.3
    IA-1Policy and ProceduresIAIdentification and AuthenticationCC5.3, CC6.1, CC6.65.1, 5.2, 7.5.1, 7.5.2, 7.5.3
    IR-1Policy and ProceduresIRIncident ResponseCC5.3, CC7.3, CC7.45.1, 5.2, 7.5.1, 7.5.2, 7.5.3
    MA-1Policy and ProceduresMAMaintenanceCC5.35.1, 5.2, 7.5.1, 7.5.2, 7.5.3
    PE-1Policy and ProceduresPEPhysical and Environmental ProtectionA1.2, CC5.3, CC6.45.1, 5.2, 7.5.1, 7.5.2, 7.5.3
    PL-1Policy and ProceduresPLPlanningCC1.5, CC2.2, CC2.3, CC3.1, CC3.4, CC5.2, CC5.3, PI1.2, PI1.34.1, 5.1, 5.2, 7.5.1, 7.5.2, 7.5.3, 9.1, 9.2.1, 9.2.2
    PL-4Rules of BehaviorPLPlanningCC1.17.3
    PL-9Central ManagementPLPlanningCC1.1, CC1.3, CC5.15.1, 5.3
    RA-1Policy and ProceduresRARisk AssessmentCC3.1, CC4.1, CC5.1, CC5.3, CC9.15.1, 5.2, 6.1.1, 6.1.2, 7.5.1, 7.5.2, 7.5.3, 8.2
    RA-2Security CategorizationRARisk AssessmentCC3.26.1.2
    RA-3Risk AssessmentRARisk AssessmentA1.2, CC4.1, CC7.36.1.2, 8.2
    SA-1Policy and ProceduresSASystem and Services AcquisitionCC5.2, CC5.3, P6.4, PI1.1, PI1.2, PI1.3, PI1.4, PI1.55.1, 5.2, 7.5.1, 7.5.2, 7.5.3
    SA-8(32)Sufficient DocumentationSASystem and Services AcquisitionCC2.2, CC5.1, CC5.38.1
    SA-9(3)Establish and Maintain Trust Relationship with ProvidersSASystem and Services AcquisitionCC3.1, CC3.2, CC3.3, CC4.1, CC9.1, CC9.24.3
    SC-1Policy and ProceduresSCSystem and Communications ProtectionCC2.2, CC3.2, CC5.1, CC5.2, CC5.3, CC6.1, CC6.65.1, 5.2, 7.5.1, 7.5.2, 7.5.3
    SC-38Operations SecuritySCSystem and Communications ProtectionCC2.28.1
    SI-1Policy and ProceduresSISystem and Information IntegrityCC2.2, CC3.2, CC5.1, CC5.2, CC5.35.1, 5.2, 7.5.1, 7.5.2, 7.5.3
    SI-5Security Alerts, Advisories, and DirectivesSISystem and Information IntegrityCC6.67.4
    MP-1Policy and ProceduresMPMedia ProtectionC1.1, CC2.1, CC5.3, CC6.5, CC6.7, PI1.55.1, 5.2, 7.5.1, 7.5.2, 7.5.3
    PS-1Policy and ProceduresPSPersonnel SecurityCC1.1, CC1.4, CC5.35.1, 5.2, 7.2, 7.3, 7.5.1, 7.5.2, 7.5.3
    PS-2Position Risk DesignationPSPersonnel SecurityCC1.2, CC1.3, CC1.5, CC5.37.2
    PS-9Position DescriptionsPSPersonnel SecurityCC1.2, CC1.3, CC2.25.3, 7.3
    PM-1Information Security Program PlanPMProgram ManagementCC1.1, CC1.2, CC5.310.1, 4.4, 5.1, 5.2, 6.1.1, 7.5.1, 7.5.2, 7.5.3, 8.1
    PM-2Information Security Program Leadership RolePMProgram ManagementCC1.1, CC1.35.1, 5.3
    PM-3Information Security and Privacy ResourcesPMProgram ManagementCC1.45.1, 7.1
    PM-6Measures of PerformancePMProgram ManagementCC1.1, CC1.2, CC1.3, CC1.5, CC2.2, CC4.15.1, 5.3, 9.1
    PM-8Critical Infrastructure PlanPMProgram ManagementA1.2, CC1.5, CC2.2, CC2.3, CC7.5, CC9.14.1, 9.1, 9.2.1, 9.2.2
    PM-9Risk Management StrategyPMProgram ManagementCC3.1, CC4.1, CC5.1, CC9.16.1.1, 6.1.2, 8.2
    PM-13Security and Privacy WorkforcePMProgram ManagementCC1.2, CC1.3, CC1.4, CC2.25.3, 7.3, 7.4
    PM-14Testing, Training, and MonitoringPMProgram ManagementCC1.1, CC2.2, CC2.310.1, 8.1
    PM-28Risk FramingPMProgram ManagementCC3.26.1.2
    PM-29Risk Management Program Leadership RolesPMProgram ManagementCC1.1, CC1.3, CC3.1, CC3.2, CC4.1, CC5.1, CC9.1, CC9.25.1, 5.3, 6.1.1, 6.1.2, 8.2
    PT-1Policy and ProceduresPTPII Processing and TransparencyCC2.2, CC3.2, CC5.1, CC5.2, CC5.35.1, 5.2, 7.5.1, 7.5.2, 7.5.3
    SR-1Policy and ProceduresSRSupply Chain Risk ManagementCC3.3, CC5.3, CC9.1, CC9.25.1, 5.2, 7.5.1, 7.5.2, 7.5.3
    SR-7Supply Chain Operations SecuritySRSupply Chain Risk ManagementCC2.2, CC3.1, CC3.2, CC4.1, CC9.28.1

    Source and method

    Derived from the Top Floor framework mapping dataset: 4,123 cross-framework control mappings across 19 frameworks, every one pivoted through NIST SP 800-53 Rev 5.

    Cross-framework mappings on this page are derived from the 2026.2 release of the Secure Controls Framework, used under CC BY-ND 4.0.

    Mappings are illustrative aids for planning and are not a substitute for the official text of any framework or for an assessor’s judgment. Always verify control requirements against the authoritative publication. Where no official crosswalk exists, the mapping judgment is our own analysis.