Skip to content

    SOC 2 Type II to NIST SP 800-53 Rev 5 control mapping

    SOC 2 Type II maps to 301 NIST SP 800-53 controls in the source dataset. Every one is listed below, with the SOC 2 Type II controls that map to it.

    Shared NIST 800-53 controls
    301
    SOC 2 Type II controls involved
    61
    NIST 800-53 families touched
    20

    How this pairing is derived

    NIST SP 800-53 Rev 5 is the pivot this whole dataset is built on: every framework in it is mapped to NIST SP 800-53, which is what makes the other pairings on this site derivable at all. This page is the one case where nothing is derived. It lists the authored SOC 2 Type II to NIST SP 800-53 mapping itself, one row per NIST control, so the relationship on each row is the mapping the source states rather than an intersection inferred from two of them.

    Shared controls in full

    NIST SP 800-53 Rev 5 controls that SOC 2 Type II maps to, with the SOC 2 Type II controls that map to each one.
    NIST 800-53 controlFamilySOC 2 Type II controls
    AC-1Policy and ProceduresACAccess ControlCC5.3, CC6.1, CC6.6
    AC-2Account ManagementACAccess ControlCC6.1, CC6.6
    AC-2(7)Privileged User AccountsACAccess ControlCC6.1, CC6.3
    AC-2(12)Account Monitoring for Atypical UsageACAccess ControlCC7.2
    AC-2(13)Disable Accounts for High-risk IndividualsACAccess ControlCC1.5
    AC-3Access EnforcementACAccess ControlCC6.1, CC6.6
    AC-3(14)Individual AccessACAccess ControlP5.1
    AC-4Information Flow EnforcementACAccess ControlCC6.1, CC6.6
    AC-4(21)Physical or Logical Separation of Information FlowsACAccess ControlCC6.1
    AC-4(25)Data SanitizationACAccess ControlC1.2, CC6.5, P4.2, P4.3
    AC-5Separation of DutiesACAccess ControlCC5.1, CC6.6
    AC-6Least PrivilegeACAccess ControlCC6.1
    AC-6(7)Review of User PrivilegesACAccess ControlCC6.2
    AC-17Remote AccessACAccess ControlCC6.6
    AC-17(6)Protection of Mechanism InformationACAccess ControlCC6.6
    AC-19(5)Full Device or Container-based EncryptionACAccess ControlCC6.7
    AC-20Use of External SystemsACAccess ControlCC6.7
    AC-20(2)Portable Storage Devices — Restricted UseACAccess ControlCC6.7
    AC-20(5)Portable Storage Devices — Prohibited UseACAccess ControlCC6.7
    AC-21Information SharingACAccess ControlCC6.7, P6.1
    AC-23Data Mining ProtectionACAccess ControlP4.1
    AT-1Policy and ProceduresATAwareness and TrainingCC1.4, CC5.3
    AU-1Policy and ProceduresAUAudit and AccountabilityCC5.3, CC7.2
    AU-2Event LoggingAUAudit and AccountabilityCC7.2, CC7.3
    AU-3Content of Audit RecordsAUAudit and AccountabilityPI1.4
    AU-6Audit Record Review, Analysis, and ReportingAUAudit and AccountabilityCC7.2, CC7.3
    AU-6(3)Correlate Audit Record RepositoriesAUAudit and AccountabilityCC7.2, CC7.3
    AU-6(9)Correlation with Information from Nontechnical SourcesAUAudit and AccountabilityCC7.2, CC7.3
    AU-7Audit Record Reduction and Report GenerationAUAudit and AccountabilityCC7.2, CC7.3
    AU-7(1)Automatic ProcessingAUAudit and AccountabilityCC7.2, CC7.3
    AU-9Protection of Audit InformationAUAudit and AccountabilityPI1.4, PI1.5
    AU-11Audit Record RetentionAUAudit and AccountabilityC1.2
    AU-12Audit Record GenerationAUAudit and AccountabilityCC7.2, CC7.3
    CA-1Policy and ProceduresCAAssessment, Authorization, and MonitoringCC4.1, CC5.3
    CA-2Control AssessmentsCAAssessment, Authorization, and MonitoringCC3.1, CC4.1, CC5.2
    CA-2(1)Independent AssessorsCAAssessment, Authorization, and MonitoringCC4.1
    CA-2(2)Specialized AssessmentsCAAssessment, Authorization, and MonitoringCC4.1
    CA-5Plan of Action and MilestonesCAAssessment, Authorization, and MonitoringCC4.2
    CA-7Continuous MonitoringCAAssessment, Authorization, and MonitoringCC1.1, CC2.2, CC2.3
    CA-7(1)Independent AssessmentCAAssessment, Authorization, and MonitoringCC1.1, CC2.2, CC2.3
    CM-1Policy and ProceduresCMConfiguration ManagementCC5.3, CC7.1
    CM-2Baseline ConfigurationCMConfiguration ManagementCC7.1, CC8.1
    CM-2(2)Automation Support for Accuracy and CurrencyCMConfiguration ManagementCC7.2, CC8.1
    CM-3Configuration Change ControlCMConfiguration ManagementCC3.4, CC8.1
    CM-3(1)Automated Documentation, Notification, and Prohibition of ChangesCMConfiguration ManagementCC6.8
    CM-3(2)Testing, Validation, and Documentation of ChangesCMConfiguration ManagementCC3.4, CC8.1
    CM-3(4)Security and Privacy RepresentativesCMConfiguration ManagementCC3.4
    CM-3(7)Review System ChangesCMConfiguration ManagementCC3.4, CC8.1
    CM-4Impact AnalysesCMConfiguration ManagementCC3.4
    CM-4(2)Verification of ControlsCMConfiguration ManagementCC4.1
    CM-6Configuration SettingsCMConfiguration ManagementCC7.1, CC8.1
    CM-6(1)Automated Management, Application, and VerificationCMConfiguration ManagementCC7.2, CC8.1
    CM-9Configuration Management PlanCMConfiguration ManagementCC7.1, CC8.1
    CP-1Policy and ProceduresCPContingency PlanningA1.2, CC5.3, CC7.5, CC9.1
    CP-2Contingency PlanCPContingency PlanningA1.2, CC7.5, CC9.1
    CP-2(2)Capacity PlanningCPContingency PlanningA1.1
    CP-2(3)Resume Mission and Business FunctionsCPContingency PlanningCC7.5
    CP-2(5)Continue Mission and Business FunctionsCPContingency PlanningCC7.5
    CP-2(8)Identify Critical AssetsCPContingency PlanningCC7.5
    CP-3(1)Simulated EventsCPContingency PlanningA1.3
    CP-4Contingency Plan TestingCPContingency PlanningA1.3, CC7.5
    CP-6Alternate Storage SiteCPContingency PlanningA1.2
    CP-6(1)Separation from Primary SiteCPContingency PlanningA1.2
    CP-6(3)AccessibilityCPContingency PlanningA1.2
    CP-7Alternate Processing SiteCPContingency PlanningA1.2
    CP-7(1)Separation from Primary SiteCPContingency PlanningA1.2
    CP-7(2)AccessibilityCPContingency PlanningA1.2
    CP-7(3)Priority of ServiceCPContingency PlanningA1.2
    CP-8Telecommunications ServicesCPContingency PlanningA1.2
    CP-8(1)Priority of Service ProvisionsCPContingency PlanningA1.2
    CP-8(2)Single Points of FailureCPContingency PlanningA1.2
    CP-9System BackupCPContingency PlanningA1.2, CC7.5
    CP-9(1)Testing for Reliability and IntegrityCPContingency PlanningA1.2, CC7.5
    CP-9(3)Separate Storage for Critical InformationCPContingency PlanningA1.2
    CP-9(8)Cryptographic ProtectionCPContingency PlanningA1.2
    CP-10System Recovery and ReconstitutionCPContingency PlanningA1.2, CC7.5, CC9.1
    CP-10(2)Transaction RecoveryCPContingency PlanningA1.2
    CP-10(6)Component ProtectionCPContingency PlanningCC7.5
    CP-11Alternate Communications ProtocolsCPContingency PlanningA1.2
    CP-13Alternative Security MechanismsCPContingency PlanningCC9.1
    IA-1Policy and ProceduresIAIdentification and AuthenticationCC5.3, CC6.1, CC6.6
    IA-2Identification and Authentication (Organizational Users)IAIdentification and AuthenticationCC6.1
    IA-3Device Identification and AuthenticationIAIdentification and AuthenticationCC6.1
    IA-3(1)Cryptographic Bidirectional AuthenticationIAIdentification and AuthenticationCC6.1
    IA-3(4)Device AttestationIAIdentification and AuthenticationCC6.1
    IA-4Identifier ManagementIAIdentification and AuthenticationCC6.1, CC6.6
    IA-4(4)Identify User StatusIAIdentification and AuthenticationCC6.1, CC6.6
    IA-5Authenticator ManagementIAIdentification and AuthenticationCC6.1
    IA-5(1)Password-based AuthenticationIAIdentification and AuthenticationCC6.1
    IA-5(5)Change Authenticators Prior to DeliveryIAIdentification and AuthenticationCC6.1
    IA-8Identification and Authentication (Non-organizational Users)IAIdentification and AuthenticationCC6.1
    IA-9Service Identification and AuthenticationIAIdentification and AuthenticationCC6.1
    IA-12(4)In-person Validation and VerificationIAIdentification and AuthenticationCC6.2
    IR-1Policy and ProceduresIRIncident ResponseCC5.3, CC7.3, CC7.4
    IR-4Incident HandlingIRIncident ResponseCC7.3, CC7.4
    IR-4(3)Continuity of OperationsIRIncident ResponseA1.2, CC7.5, CC9.1
    IR-4(4)Information CorrelationIRIncident ResponseCC7.2, CC7.3
    IR-4(10)Supply Chain CoordinationIRIncident ResponseCC7.3, CC7.4, P6.5, P6.6
    IR-4(11)Integrated Incident Response TeamIRIncident ResponseCC7.4
    IR-4(13)Behavior AnalysisIRIncident ResponseCC7.2
    IR-5Incident MonitoringIRIncident ResponseCC7.4
    IR-6Incident ReportingIRIncident ResponseCC2.3, CC7.4, P6.3, P6.7
    IR-6(3)Supply Chain CoordinationIRIncident ResponseCC7.4
    IR-7(2)Coordination with External ProvidersIRIncident ResponseCC7.4
    IR-8Incident Response PlanIRIncident ResponseCC7.3, CC7.4
    IR-8(1)BreachesIRIncident ResponseCC7.3, P6.3, P6.6, P6.7
    IR-9Information Spillage ResponseIRIncident ResponseP6.3
    MA-1Policy and ProceduresMAMaintenanceCC5.3
    PE-1Policy and ProceduresPEPhysical and Environmental ProtectionA1.2, CC5.3, CC6.4
    PE-2Physical Access AuthorizationsPEPhysical and Environmental ProtectionCC6.4
    PE-2(1)Access by Position or RolePEPhysical and Environmental ProtectionCC6.4
    PE-3Physical Access ControlPEPhysical and Environmental ProtectionCC6.4
    PE-3(2)Facility and SystemsPEPhysical and Environmental ProtectionCC6.4
    PE-3(3)Continuous GuardsPEPhysical and Environmental ProtectionCC6.4
    PE-5Access Control for Output DevicesPEPhysical and Environmental ProtectionPI1.4
    PE-9Power Equipment and CablingPEPhysical and Environmental ProtectionA1.2
    PE-9(2)Automatic Voltage ControlsPEPhysical and Environmental ProtectionA1.2
    PE-10Emergency ShutoffPEPhysical and Environmental ProtectionA1.2
    PE-11Emergency PowerPEPhysical and Environmental ProtectionA1.2
    PE-11(1)Alternate Power Supply — Minimal Operational CapabilityPEPhysical and Environmental ProtectionA1.2
    PE-11(2)Alternate Power Supply — Self-containedPEPhysical and Environmental ProtectionA1.2
    PE-12Emergency LightingPEPhysical and Environmental ProtectionA1.2
    PE-13Fire ProtectionPEPhysical and Environmental ProtectionA1.2
    PE-13(1)Detection Systems — Automatic Activation and NotificationPEPhysical and Environmental ProtectionA1.2
    PE-13(2)Suppression Systems — Automatic Activation and NotificationPEPhysical and Environmental ProtectionA1.2
    PE-14Environmental ControlsPEPhysical and Environmental ProtectionA1.2
    PE-14(2)Monitoring with Alarms and NotificationsPEPhysical and Environmental ProtectionA1.2
    PE-15Water Damage ProtectionPEPhysical and Environmental ProtectionA1.2
    PE-16Delivery and RemovalPEPhysical and Environmental ProtectionA1.2
    PE-17Alternate Work SitePEPhysical and Environmental ProtectionA1.2
    PE-18Location of System ComponentsPEPhysical and Environmental ProtectionA1.2
    PE-19Information LeakagePEPhysical and Environmental ProtectionA1.2
    PE-21Electromagnetic Pulse ProtectionPEPhysical and Environmental ProtectionA1.2
    PE-23Facility LocationPEPhysical and Environmental ProtectionA1.2, CC6.4, CC9.1
    PL-1Policy and ProceduresPLPlanningCC1.5, CC2.2, CC2.3, CC3.1, CC3.4, CC5.2, CC5.3, PI1.2, PI1.3
    PL-2System Security and Privacy PlansPLPlanningCC2.1, CC4.1
    PL-4Rules of BehaviorPLPlanningCC1.1
    PL-7Concept of OperationsPLPlanningCC5.1, CC7.2
    PL-8Security and Privacy ArchitecturesPLPlanningCC3.1, CC4.1, CC5.1
    PL-9Central ManagementPLPlanningCC1.1, CC1.3, CC5.1
    PL-10Baseline SelectionPLPlanningCC7.1, CC8.1
    RA-1Policy and ProceduresRARisk AssessmentCC3.1, CC4.1, CC5.1, CC5.3, CC9.1
    RA-2Security CategorizationRARisk AssessmentCC3.2
    RA-3Risk AssessmentRARisk AssessmentA1.2, CC4.1, CC7.3
    RA-3(1)Supply Chain Risk AssessmentRARisk AssessmentCC9.2
    RA-5Vulnerability Monitoring and ScanningRARisk AssessmentCC7.1
    RA-8Privacy Impact AssessmentsRARisk AssessmentCC3.2, CC5.2, PI1.1
    RA-9Criticality AnalysisRARisk AssessmentCC2.2, CC4.1, CC5.2, CC9.1, PI1.1
    SA-1Policy and ProceduresSASystem and Services AcquisitionCC5.2, CC5.3, P6.4, PI1.1, PI1.2, PI1.3, PI1.4, PI1.5
    SA-2Allocation of ResourcesSASystem and Services AcquisitionCC1.4, CC4.1
    SA-3System Development Life CycleSASystem and Services AcquisitionCC5.2, CC8.1
    SA-3(1)Manage Preproduction EnvironmentSASystem and Services AcquisitionCC5.2, CC8.1
    SA-4Acquisition ProcessSASystem and Services AcquisitionCC3.3, CC3.4, CC5.2, CC9.1, CC9.2, P6.4, PI1.2, PI1.3
    SA-4(1)Functional Properties of ControlsSASystem and Services AcquisitionCC2.1
    SA-4(2)Design and Implementation Information for ControlsSASystem and Services AcquisitionCC2.1
    SA-4(3)Development Methods, Techniques, and PracticesSASystem and Services AcquisitionPI1.1, PI1.2, PI1.3, PI1.4, PI1.5
    SA-4(12)Data OwnershipSASystem and Services AcquisitionCC2.1
    SA-8Security and Privacy Engineering PrinciplesSASystem and Services AcquisitionCC2.2, CC3.2, CC5.1, CC5.2, CC7.1, CC8.1
    SA-8(14)Least PrivilegeSASystem and Services AcquisitionCC6.1
    SA-8(30)Procedural RigorSASystem and Services AcquisitionCC5.2, CC8.1
    SA-8(31)Secure System ModificationSASystem and Services AcquisitionCC3.4, CC8.1
    SA-8(32)Sufficient DocumentationSASystem and Services AcquisitionCC2.2, CC5.1, CC5.3
    SA-9External System ServicesSASystem and Services AcquisitionCC3.3, P6.4
    SA-9(1)Risk Assessments and Organizational ApprovalsSASystem and Services AcquisitionCC3.4, CC9.2
    SA-9(3)Establish and Maintain Trust Relationship with ProvidersSASystem and Services AcquisitionCC3.1, CC3.2, CC3.3, CC4.1, CC9.1, CC9.2
    SA-9(4)Consistent Interests of Consumers and ProvidersSASystem and Services AcquisitionCC3.3
    SA-9(5)Processing, Storage, and Service LocationSASystem and Services AcquisitionCC9.1
    SA-11(2)Threat Modeling and Vulnerability AnalysesSASystem and Services AcquisitionCC4.2
    SA-11(5)Penetration TestingSASystem and Services AcquisitionCC4.1, CC4.2
    SA-15Development Process, Standards, and ToolsSASystem and Services AcquisitionPI1.1, PI1.2, PI1.3, PI1.4, PI1.5
    SA-15(2)Security and Privacy Tracking ToolsSASystem and Services AcquisitionCC4.2
    SA-15(3)Criticality AnalysisSASystem and Services AcquisitionPI1.1
    SA-15(5)Attack Surface ReductionSASystem and Services AcquisitionCC2.2, CC3.2, CC5.1, CC5.2, CC7.1, CC8.1
    SA-23SpecializationSASystem and Services AcquisitionCC5.2, PI1.2, PI1.3
    SC-1Policy and ProceduresSCSystem and Communications ProtectionCC2.2, CC3.2, CC5.1, CC5.2, CC5.3, CC6.1, CC6.6
    SC-5Denial-of-service ProtectionSCSystem and Communications ProtectionA1.1
    SC-5(1)Restrict Ability to Attack Other SystemsSCSystem and Communications ProtectionA1.1
    SC-5(2)Capacity, Bandwidth, and RedundancySCSystem and Communications ProtectionA1.1
    SC-5(3)Detection and MonitoringSCSystem and Communications ProtectionA1.1
    SC-6Resource AvailabilitySCSystem and Communications ProtectionA1.1
    SC-7Boundary ProtectionSCSystem and Communications ProtectionCC6.1, CC6.6, CC6.8
    SC-7(3)Access PointsSCSystem and Communications ProtectionCC6.1, CC6.6
    SC-7(5)Deny by Default — Allow by ExceptionSCSystem and Communications ProtectionCC6.6
    SC-7(9)Restrict Threatening Outgoing Communications TrafficSCSystem and Communications ProtectionCC6.1, CC6.6, CC6.8
    SC-7(11)Restrict Incoming Communications TrafficSCSystem and Communications ProtectionCC6.1, CC6.6, CC6.8
    SC-7(13)Isolation of Security Tools, Mechanisms, and Support ComponentsSCSystem and Communications ProtectionCC6.1
    SC-7(14)Protect Against Unauthorized Physical ConnectionsSCSystem and Communications ProtectionA1.2
    SC-7(18)Fail SecureSCSystem and Communications ProtectionCC2.2, CC3.2, CC5.1, CC5.2
    SC-7(27)Unclassified Non-national Security System ConnectionsSCSystem and Communications ProtectionCC6.1
    SC-7(29)Separate Subnets to Isolate FunctionsSCSystem and Communications ProtectionCC6.1
    SC-8Transmission Confidentiality and IntegritySCSystem and Communications ProtectionCC6.1, CC6.7
    SC-8(1)Cryptographic ProtectionSCSystem and Communications ProtectionCC6.1, CC6.7
    SC-8(2)Pre- and Post-transmission HandlingSCSystem and Communications ProtectionCC6.1, CC6.7
    SC-8(3)Cryptographic Protection for Message ExternalsSCSystem and Communications ProtectionCC6.6, CC6.7
    SC-12Cryptographic Key Establishment and ManagementSCSystem and Communications ProtectionCC6.1
    SC-12(2)Symmetric KeysSCSystem and Communications ProtectionCC6.1
    SC-12(3)Asymmetric KeysSCSystem and Communications ProtectionCC6.1
    SC-13Cryptographic ProtectionSCSystem and Communications ProtectionCC6.1, CC6.7
    SC-17Public Key Infrastructure CertificatesSCSystem and Communications ProtectionCC6.1
    SC-18(1)Identify Unacceptable Code and Take Corrective ActionsSCSystem and Communications ProtectionCC4.2
    SC-28Protection of Information at RestSCSystem and Communications ProtectionCC6.1, CC6.7
    SC-28(1)Cryptographic ProtectionSCSystem and Communications ProtectionA1.2, CC6.1, CC6.7
    SC-28(2)Offline StorageSCSystem and Communications ProtectionA1.2, CC7.5
    SC-28(3)Cryptographic KeysSCSystem and Communications ProtectionCC6.1
    SC-38Operations SecuritySCSystem and Communications ProtectionCC2.2
    SC-40Wireless Link ProtectionSCSystem and Communications ProtectionCC6.6
    SC-48Sensor RelocationSCSystem and Communications ProtectionCC7.2
    SI-1Policy and ProceduresSISystem and Information IntegrityCC2.2, CC3.2, CC5.1, CC5.2, CC5.3
    SI-3Malicious Code ProtectionSISystem and Information IntegrityCC6.6, CC6.8
    SI-4System MonitoringSISystem and Information IntegrityCC6.6, CC7.2, CC7.3
    SI-4(1)System-wide Intrusion Detection SystemSISystem and Information IntegrityCC7.2
    SI-4(2)Automated Tools and Mechanisms for Real-time AnalysisSISystem and Information IntegrityCC7.2
    SI-4(4)Inbound and Outbound Communications TrafficSISystem and Information IntegrityCC7.2
    SI-4(5)System-generated AlertsSISystem and Information IntegrityCC7.2
    SI-4(11)Analyze Communications Traffic AnomaliesSISystem and Information IntegrityCC7.2
    SI-4(14)Wireless Intrusion DetectionSISystem and Information IntegrityCC7.2
    SI-4(15)Wireless to Wireline CommunicationsSISystem and Information IntegrityCC7.2
    SI-4(16)Correlate Monitoring InformationSISystem and Information IntegrityCC7.2, CC7.3
    SI-4(23)Host-based DevicesSISystem and Information IntegrityCC7.2
    SI-4(24)Indicators of CompromiseSISystem and Information IntegrityCC6.8, CC7.1
    SI-4(25)Optimize Network Traffic AnalysisSISystem and Information IntegrityCC6.1, CC6.6, CC7.2
    SI-5Security Alerts, Advisories, and DirectivesSISystem and Information IntegrityCC6.6
    SI-7Software, Firmware, and Information IntegritySISystem and Information IntegrityCC6.6, CC6.8
    SI-7(1)Integrity ChecksSISystem and Information IntegrityCC7.1
    SI-7(6)Cryptographic ProtectionSISystem and Information IntegrityCC6.1
    SI-7(7)Integration of Detection and ResponseSISystem and Information IntegrityCC7.3
    SI-10Information Input ValidationSISystem and Information IntegrityCC6.6
    SI-12Information Management and RetentionSISystem and Information IntegrityC1.2, CC6.5, P4.2, P4.3, PI1.5
    SI-12(1)Limit Personally Identifiable Information ElementsSISystem and Information IntegrityP4.1
    SI-12(2)Minimize Personally Identifiable Information in Testing, Training, and ResearchSISystem and Information IntegrityP4.1
    SI-12(3)Information DisposalSISystem and Information IntegrityC1.2, CC6.5, P4.2, P4.3
    SI-13Predictable Failure PreventionSISystem and Information IntegrityA1.2
    SI-18Personally Identifiable Information Quality OperationsSISystem and Information IntegrityCC2.1
    SI-18(1)Automation SupportSISystem and Information IntegrityCC2.1
    SI-18(4)Individual RequestsSISystem and Information IntegrityP5.1, P5.2
    SI-18(5)Notice of Correction or DeletionSISystem and Information IntegrityP5.1, P5.2
    MP-1Policy and ProceduresMPMedia ProtectionC1.1, CC2.1, CC5.3, CC6.5, CC6.7, PI1.5
    MP-2Media AccessMPMedia ProtectionC1.1
    MP-6Media SanitizationMPMedia ProtectionCC6.5, P4.3
    MP-6(3)Nondestructive TechniquesMPMedia ProtectionCC6.5, P4.3
    MP-7Media UseMPMedia ProtectionCC6.7, PI1.5
    PS-1Policy and ProceduresPSPersonnel SecurityCC1.1, CC1.4, CC5.3
    PS-2Position Risk DesignationPSPersonnel SecurityCC1.2, CC1.3, CC1.5, CC5.3
    PS-4Personnel TerminationPSPersonnel SecurityCC1.5
    PS-4(1)Post-employment RequirementsPSPersonnel SecurityCC1.5
    PS-5Personnel TransferPSPersonnel SecurityCC1.5
    PS-6Access AgreementsPSPersonnel SecurityCC1.5
    PS-6(2)Classified Information Requiring Special ProtectionPSPersonnel SecurityCC1.5
    PS-7External Personnel SecurityPSPersonnel SecurityCC5.3
    PS-8Personnel SanctionsPSPersonnel SecurityCC1.5
    PS-9Position DescriptionsPSPersonnel SecurityCC1.2, CC1.3, CC2.2
    PM-1Information Security Program PlanPMProgram ManagementCC1.1, CC1.2, CC5.3
    PM-2Information Security Program Leadership RolePMProgram ManagementCC1.1, CC1.3
    PM-3Information Security and Privacy ResourcesPMProgram ManagementCC1.4
    PM-4Plan of Action and Milestones ProcessPMProgram ManagementCC4.2
    PM-6Measures of PerformancePMProgram ManagementCC1.1, CC1.2, CC1.3, CC1.5, CC2.2, CC4.1
    PM-7Enterprise ArchitecturePMProgram ManagementCC3.1, CC4.1, CC5.1
    PM-8Critical Infrastructure PlanPMProgram ManagementA1.2, CC1.5, CC2.2, CC2.3, CC7.5, CC9.1
    PM-9Risk Management StrategyPMProgram ManagementCC3.1, CC4.1, CC5.1, CC9.1
    PM-10Authorization ProcessPMProgram ManagementCC4.1
    PM-11Mission and Business Process DefinitionPMProgram ManagementCC1.3, CC3.1, CC3.4, CC4.1, CC5.1, CC5.2, PI1.1
    PM-12Insider Threat ProgramPMProgram ManagementCC3.3
    PM-13Security and Privacy WorkforcePMProgram ManagementCC1.2, CC1.3, CC1.4, CC2.2
    PM-14Testing, Training, and MonitoringPMProgram ManagementCC1.1, CC2.2, CC2.3
    PM-15Security and Privacy Groups and AssociationsPMProgram ManagementCC2.3, CC3.3, CC9.1
    PM-16Threat Awareness ProgramPMProgram ManagementCC3.3, CC9.1
    PM-20Dissemination of Privacy Program InformationPMProgram ManagementP1.1
    PM-20(1)Privacy Policies on Websites, Applications, and Digital ServicesPMProgram ManagementP1.1
    PM-21Accounting of DisclosuresPMProgram ManagementP6.2, P6.3
    PM-22Personally Identifiable Information Quality ManagementPMProgram ManagementCC2.1, P7.1
    PM-23Data Governance BodyPMProgram ManagementP7.1
    PM-24Data Integrity BoardPMProgram ManagementP7.1
    PM-25Minimization of Personally Identifiable Information Used in Testing, Training, and ResearchPMProgram ManagementP4.1
    PM-26Complaint ManagementPMProgram ManagementP5.1, P5.2, P8.1
    PM-27Privacy ReportingPMProgram ManagementCC2.3
    PM-28Risk FramingPMProgram ManagementCC3.2
    PM-29Risk Management Program Leadership RolesPMProgram ManagementCC1.1, CC1.3, CC3.1, CC3.2, CC4.1, CC5.1, CC9.1, CC9.2
    PM-30Supply Chain Risk Management StrategyPMProgram ManagementCC3.1, CC3.2, CC4.1, CC9.2
    PM-30(1)Suppliers of Critical or Mission-essential ItemsPMProgram ManagementCC9.1, PI1.1
    PM-31Continuous Monitoring StrategyPMProgram ManagementCC7.2
    PT-1Policy and ProceduresPTPII Processing and TransparencyCC2.2, CC3.2, CC5.1, CC5.2, CC5.3
    PT-2Authority to Process Personally Identifiable InformationPTPII Processing and TransparencyP3.1, P4.1
    PT-3Personally Identifiable Information Processing PurposesPTPII Processing and TransparencyP4.1
    PT-4ConsentPTPII Processing and TransparencyP2.1, P3.2
    PT-4(2)Just-in-time ConsentPTPII Processing and TransparencyP2.1, P3.2
    PT-5Privacy NoticePTPII Processing and TransparencyP1.1
    PT-5(1)Just-in-time NoticePTPII Processing and TransparencyP2.1, P3.2
    PT-5(2)Privacy Act StatementsPTPII Processing and TransparencyP1.1
    PT-7Specific Categories of Personally Identifiable InformationPTPII Processing and TransparencyP4.1
    SR-1Policy and ProceduresSRSupply Chain Risk ManagementCC3.3, CC5.3, CC9.1, CC9.2
    SR-2Supply Chain Risk Management PlanSRSupply Chain Risk ManagementCC3.1, CC3.2, CC4.1, CC9.1, CC9.2
    SR-2(1)Establish SCRM TeamSRSupply Chain Risk ManagementCC9.1
    SR-3Supply Chain Controls and ProcessesSRSupply Chain Risk ManagementCC9.1
    SR-3(1)Diverse Supply BaseSRSupply Chain Risk ManagementCC3.3, CC9.1
    SR-3(2)Limitation of HarmSRSupply Chain Risk ManagementCC9.1
    SR-3(3)Sub-tier Flow DownSRSupply Chain Risk ManagementCC9.1
    SR-5Acquisition Strategies, Tools, and MethodsSRSupply Chain Risk ManagementCC3.3, CC9.1
    SR-6Supplier Assessments and ReviewsSRSupply Chain Risk ManagementCC3.4, CC9.1
    SR-6(1)Testing and AnalysisSRSupply Chain Risk ManagementCC3.4, CC9.1
    SR-7Supply Chain Operations SecuritySRSupply Chain Risk ManagementCC2.2, CC3.1, CC3.2, CC4.1, CC9.2
    SR-12Component DisposalSRSupply Chain Risk ManagementCC6.5

    Source and method

    Derived from the Top Floor framework mapping dataset: 4,123 cross-framework control mappings across 19 frameworks, every one pivoted through NIST SP 800-53 Rev 5.

    Cross-framework mappings on this page are derived from the 2026.2 release of the Secure Controls Framework, used under CC BY-ND 4.0.

    Mappings are illustrative aids for planning and are not a substitute for the official text of any framework or for an assessor’s judgment. Always verify control requirements against the authoritative publication. Where no official crosswalk exists, the mapping judgment is our own analysis.