ISO 27001:2022 – Control Mapping
Diese Seite zeigt für ISO 27001:2022, welche Wombat Controls welche Anforderungen dieses Rahmenwerks abdecken.
| Framework-Control | Anforderung | Wombat Controls | Schweregrad | Säule | Kategorie |
|---|---|---|---|---|---|
A.5.3 – Segregation of duties |
A.5.3 – Segregation of duties |
🔴 |
Sovereign Cloud |
identity-access |
|
A.5.10 – Acceptable use of information |
A.5.10 – Acceptable use of information |
🟠 |
Security |
identity-access |
|
A.5.12 – Classification of information |
A.5.12 – Classification of information |
🟠 |
Security, Sovereign Cloud |
identity-access |
|
A.5.13 – Labelling of information |
A.5.13 – Labelling of information |
🟠 |
Security |
identity-access |
|
A.5.15 – Access control |
A.5.15 – Access control |
🔴 🟠 |
Agentic, Security |
agentic-governance, identity-access |
|
A.5.17 – Authentication information |
A.5.17 – Authentication information |
🔴 🟠 |
Agentic, Security |
identity-access |
|
A.5.18 – Access rights |
A.5.18 – Access rights |
🔴 |
Security |
identity-access |
|
A.5.19 – Information security in supplier relationships |
A.5.19 – Information security in supplier relationships |
🟠 🟡 |
Security, Sovereign Cloud |
container-security, data-governance, logging-monitoring |
|
A.5.20 – Addressing information security in supplier agreements |
A.5.20 – Addressing information security in supplier agreements |
🟡 |
Sovereign Cloud |
logging-monitoring |
|
A.5.20 – Addressing information security in supplier agreements (including exit) |
A.5.20 – Addressing information security in supplier agreements (including exit) |
🟡 |
Sovereign Cloud |
logging-monitoring |
|
A.5.20 – Addressing information security within supplier agreements |
A.5.20 – Addressing information security within supplier agreements |
🟠 |
Security |
container-security |
|
A.5.21 – Managing information security in the ICT supply chain |
A.5.21 – Managing information security in the ICT supply chain |
🟠 🟡 |
Security, Sovereign Cloud |
container-security, logging-monitoring |
|
A.5.24 – Information security incident management planning |
A.5.24 – Information security incident management planning |
🟡 |
Security |
identity-access |
|
A.5.25 – Assessment and decision on information security events |
A.5.25 – Assessment and decision on information security events |
🟡 |
Security |
identity-access |
|
A.5.26 – Response to information security incidents |
A.5.26 – Response to information security incidents |
🟠 🟡 |
Security, Sovereign Cloud |
identity-access |
|
A.5.27 – Learning from information security incidents |
A.5.27 – Learning from information security incidents |
🟡 |
Security |
identity-access |
|
A.5.28 – Collection of evidence |
A.5.28 – Collection of evidence |
🟡 |
Security |
identity-access |
|
A.5.29 – Information security during disruption |
A.5.29 – Information security during disruption |
🔴 🟠 |
Sovereign Cloud |
identity-access, logging-monitoring |
|
A.5.33 – Protection of records |
A.5.33 – Protection of records |
🟠 |
Sovereign Cloud |
identity-access |
|
A.5.34 – Privacy and PII protection |
A.5.34 – Privacy and PII protection |
🟠 |
Sovereign Cloud |
identity-access |
|
A.5.36 – Compliance with policies, rules and standards |
A.5.36 – Compliance with policies, rules and standards |
🟡 |
Security |
identity-access |
|
A.5.37 – Documented operating procedures |
A.5.37 – Documented operating procedures |
🟡 |
Security |
identity-access |
|
A.8.1 – Information security roles and responsibilities |
A.8.1 – Information security roles and responsibilities |
WAF-AGN-030 · WAF-AGN-040 · WAF-AGN-060 · WAF-AGN-070 · WAF-AGN-100 |
🟠 🟡 🟢 |
Agentic |
logging-monitoring, reliability-design |
A.8.2 – Privileged access rights |
A.8.2 – Privileged access rights |
WAF-AGN-010 · WAF-AGN-020 · WAF-AGN-030 · WAF-AGN-040 · WAF-AGN-050 · WAF-AGN-060 · WAF-AGN-070 · WAF-AGN-080 · WAF-AGN-090 · WAF-AGN-100 · WAF-SEC-010 · WAF-SEC-020 · WAF-SOV-060 |
🔴 🟠 🟡 🟢 |
Agentic, Security, Sovereign Cloud |
agentic-governance, identity-access, logging-monitoring, reliability-design |
A.8.3 – Information access restriction |
A.8.3 – Information access restriction |
WAF-AGN-020 · WAF-AGN-050 · WAF-AGN-080 · WAF-AGN-110 · WAF-SEC-020 · WAF-SOV-060 |
🔴 🟠 |
Agentic, Security, Sovereign Cloud |
agentic-governance, identity-access, logging-monitoring |
A.8.5 – Secure authentication |
A.8.5 – Secure authentication |
🔴 🟠 |
Agentic, Security |
identity-access |
|
A.8.7 – Protection against malware |
A.8.7 – Protection against malware |
🟠 |
Security |
container-security, identity-access |
|
A.8.8 – Management of technical vulnerabilities |
A.8.8 – Management of technical vulnerabilities |
🟠 🟡 |
Security |
container-security, identity-access |
|
A.8.9 – Configuration management |
A.8.9 – Configuration management |
🟠 |
Security |
network-security |
|
A.8.10 – Information deletion |
A.8.10 – Information deletion |
🔴 🟠 🟡 |
Security, Sovereign Cloud |
identity-access, logging-monitoring |
|
A.8.11 – Data masking |
A.8.11 – Data masking |
🟠 |
Security |
identity-access |
|
A.8.13 – Information backup |
A.8.13 – Information backup |
🔴 🟠 |
Reliability, Sovereign Cloud |
backup-recovery, logging-monitoring, secret-management |
|
A.8.14 – Redundancy of information processing facilities |
A.8.14 – Redundancy of information processing facilities |
🟠 |
Reliability |
backup-recovery |
|
A.8.15 – Logging |
A.8.15 – Logging |
🟠 |
Security, Sovereign Cloud |
identity-access, logging-monitoring, network-security |
|
A.8.16 – Monitoring activities |
A.8.16 – Monitoring activities |
WAF-SEC-080 · WAF-SEC-140 · WAF-SEC-160 · WAF-SOV-040 · WAF-SOV-070 |
🟠 |
Security, Sovereign Cloud |
identity-access, logging-monitoring, network-security |
A.8.19 – Installation of software on operational systems |
A.8.19 – Installation of software on operational systems |
🟠 🟡 |
Security |
container-security, identity-access |
|
A.8.20 – Networks security |
A.8.20 – Networks security |
🟠 |
Security, Sovereign Cloud |
identity-access, network-security |
|
A.8.21 – Security of network services |
A.8.21 – Security of network services |
🟠 |
Security, Sovereign Cloud |
identity-access, network-security |
|
A.8.22 – Segregation of networks |
A.8.22 – Segregation of networks |
🟠 |
Security, Sovereign Cloud |
identity-access, network-security |
|
A.8.23 – Data leakage prevention |
A.8.23 – Data leakage prevention |
🟠 |
Agentic |
logging-monitoring |
|
A.8.23 – Web filtering |
A.8.23 – Web filtering |
🟠 |
Security |
network-security |
|
A.8.24 – Use of cryptography |
A.8.24 – Use of cryptography |
WAF-SEC-030 · WAF-SEC-040 · WAF-SEC-060 · WAF-SEC-130 · WAF-SOV-050 · WAF-SOV-110 |
🔴 🟠 |
Security, Sovereign Cloud |
encryption-key-management, identity-access |
A.8.25 – Secure development life cycle |
A.8.25 – Secure development life cycle |
🔴 |
Sovereign Cloud |
encryption-key-management |
|
A.8.27 – Secure system architecture |
A.8.27 – Secure system architecture |
🟠 |
Agentic |
agentic-governance |
|
A.8.30 – Outsourced development |
A.8.30 – Outsourced development |
🟠 |
Security |
container-security |
|
A.8.32 – Change management |
A.8.32 – Change management |
🟡 |
Security |
container-security |
|
A.12.1 – Control of operational software |
A.12.1 – Control of operational software |
🟡 |
Agentic |
logging-monitoring |
|
A.13.1.1 – Control of information in sessions |
A.13.1.1 – Control of information in sessions |
🟠 |
Agentic |
identity-access, logging-monitoring |
|
A.15.1 – Information security in supplier relationships |
A.15.1 – Information security in supplier relationships |
🟡 |
Reliability |
reliability-design |
|
A.16.1 – Management of information security incidents and improvements |
A.16.1 – Management of information security incidents and improvements |
🟠 |
Reliability |
logging-monitoring |
|
A.17.1 – Information security continuity |
A.17.1 – Information security continuity |
WAF-REL-010 · WAF-REL-030 · WAF-REL-040 · WAF-REL-050 · WAF-REL-080 · WAF-REL-100 · WAF-REL-110 |
🔴 🟠 🟡 |
Reliability |
data-governance, logging-monitoring, network-encryption, reliability-design, secret-management |
A.17.1.3 – Verify, review and evaluate information security continuity |
A.17.1.3 – Verify, review and evaluate information security continuity |
🟠 🟡 |
Reliability |
backup-recovery, logging-monitoring |
|
A.17.2 – Redundancies |
A.17.2 – Redundancies |
🔴 🟠 |
Reliability |
logging-monitoring, network-encryption |
|
6.1.2 – Information security risk assessment |
6.1.2 – Information security risk assessment |
🟡 |
Reliability |
reliability-design |