Control Explorer

One control, every framework

The core idea of the academy: technical controls, mapped to the frameworks that require them, each mapping confidence-graded. Search or filter to explore.

Filter by framework:

6 controls

Backup and tested restore

Resilience

Maintain backups of essential data and systems, and periodically test restoration to confirm recoverability within objectives.

Framework / Service	Reference	What it requires
ISO/IEC 27001	A.8.13	Maintain backups of essential data and systems, and periodically test restoration to confirm recoverability within objectives.
NIST CSF 2.0	PR.DS-11	equivalent — PR.DS-11 requires backups of data to be created, protected, maintained, and tested — directly matching ISO A.8.13 including the test element.
SOC 2	A1.2	equivalent — Availability criterion A1.2 covers backup and recovery of data and systems, including tested restoration.
CIS Controls v8	11	equivalent — CIS Control 11 (Data Recovery) covers automated backups and recovery testing, closely matching the ISO control.

Centralised logging and retention

Detection

Capture security-relevant events from systems, applications, and identity providers into a centralised, tamper-resistant store with a defined retention period.

Framework / Service	Reference	What it requires
ISO/IEC 27001	A.8.15	Capture security-relevant events from systems, applications, and identity providers into a centralised, tamper-resistant store with a defined retention period.
NIST CSF 2.0	PR.PS-04	equivalent — PR.PS-04 requires log records to be generated and made available for continuous monitoring — the same outcome as ISO A.8.15.
SOC 2	CC7.2	partial — CC7.2 concerns monitoring to detect anomalies; logging is the necessary substrate but the criterion is broader than log capture alone.
CIS Controls v8	8	equivalent — CIS Control 8 (Audit Log Management) directly covers collection, central storage, and retention of logs.

Encryption of data in transit and at rest

Data Protection

Protect the confidentiality of data in transit and at rest using current, well-managed cryptography and key management.

Framework / Service	Reference	What it requires
ISO/IEC 27001	A.8.24	Protect the confidentiality of data in transit and at rest using current, well-managed cryptography and key management.
NIST CSF 2.0	PR.DS-01	equivalent — PR.DS-01 (data at rest) together with PR.DS-02 (data in transit) express the same protection outcome as ISO A.8.24.
SOC 2	CC6.7	partial — CC6.7 addresses transmission and movement of data; at-rest encryption is covered under CC6.1, so the mapping spans more than one criterion.
GDPR	Art. 32(1)(a)	related — GDPR names encryption as an example measure appropriate to risk, not a hard requirement — related rather than equivalent.

Multi-factor authentication for privileged accounts

Identity & Access

Require a second authentication factor for all accounts holding administrative privileges over production systems and identity providers.

Framework / Service	Reference	What it requires
ISO/IEC 27001	A.8.5	Require a second authentication factor for all accounts holding administrative privileges over production systems and identity providers.
NIST CSF 2.0	PR.AA-03	equivalent — Both require authentication proportionate to risk for privileged identities; CSF 2.0 states it as an outcome rather than a prescriptive control.
SOC 2	CC6.1	partial — CC6.1 covers logical access broadly; MFA is one of several means an auditor accepts, so the mapping is directional, not one-to-one.
CIS Controls v8	6.5	partial — CIS v8.1 Safeguard 6.5 requires MFA for administrative access specifically; narrower in scope than the ISO control but directly aligned for admins.

Periodic access review

Identity & Access

Review user and service access rights on a defined cadence to confirm they remain appropriate, and revoke access that is no longer required.

Framework / Service	Reference	What it requires
ISO/IEC 27001	A.5.18	Review user and service access rights on a defined cadence to confirm they remain appropriate, and revoke access that is no longer required.
NIST CSF 2.0	PR.AA-05	partial — PR.AA-05 covers privilege and access-permission management (least privilege, separation of duties) but is less explicit than ISO A.5.18 about a periodic review cadence.
SOC 2	CC6.2	partial — CC6.2/CC6.3 address registration, authorization, and modification of access; periodic recertification is one accepted control activity among several.
CIS Controls v8	6	partial — CIS Control 6 (Access Control Management) includes granting and revoking access; recurring review is implied through its safeguards rather than a single named requirement.

Vulnerability management and patch SLAs

Threat & Vulnerability

Continuously identify technical vulnerabilities in in-scope assets, assess their risk, and remediate within defined, severity-based timeframes.

Framework / Service	Reference	What it requires
ISO/IEC 27001	A.8.8	Continuously identify technical vulnerabilities in in-scope assets, assess their risk, and remediate within defined, severity-based timeframes.
NIST CSF 2.0	ID.RA-01	equivalent — ID.RA-01 requires vulnerabilities in assets to be identified and recorded — the identification half of ISO A.8.8; remediation is tracked under other CSF outcomes.
SOC 2	CC7.1	partial — CC7.1 covers detection of configuration changes and vulnerabilities; remediation SLAs are evaluated by the auditor but not prescribed.
CIS Controls v8	7	equivalent — CIS Control 7 (Continuous Vulnerability Management) covers both scanning and remediation, closely matching the ISO control.

Sourced from the crosswalk dataset. Mappings are confidence-graded; always consult the authoritative standard text.