Every control, mapped honestly.

Organisational policyCC1.1 Conduct commitment · CC1.2 Board oversight · CC1.3 Reporting lines · CC2.1 Good control information · CC2.2 Staff duty briefings · CC2.3 Outside party talks · CC3.1 Risk goals · CC3.2 Risk weighing · CC3.3 Fraud risk review · CC3.4 Change impact review · CC5.1 Risk cutting controls · CC5.2 Technology control choices · CC5.3 Rolled out policies · CC9.1 Disruption risk reduction · P1.1 Privacy notice · P2.1 Consent choices · P3.1 Lawful collection · P3.2 Explicit sensitive consent · P4.1 Stated purpose limits · P6.1 Consent before sharing · P6.2 Sharing records · P6.3 Unauthorized sharing records

Operational processesCC4.1 Ongoing control reviews · CC4.2 Weakness reporting · CC6.8 Unwanted software blocking · CC7.3 Event judging · CC7.4 Incident response steps · CC7.5 Incident recovery learning · A1.1 Capacity watching · A1.3 Recovery testing · PI1.1 Defined processing goals · PI1.4 Output delivery review · PI1.5 Stored item integrity · P5.1 Access request answers · P5.2 Correction handling · P6.7 Sharing accounting · P7.1 Accurate personal data · P8.1 Complaint handling

Physical securityCC6.4 Physical entry limits · CC6.5 Asset data disposal

Contracts and vendorsCC9.2 Vendor risk management · P6.4 Vendor privacy commitments · P6.5 Vendor incident reporting

People and HRCC1.4 Capable staff hiring · CC1.5 Duty answerability

Regulatory procedureP6.6 Breach notices

Toevan gives supporting evidence for 2 of these.

Organisational policyA.5.1 Written policy set · A.5.2 Security role owners · A.5.4 Leadership backing · A.5.5 Authority contacts · A.5.6 Expert group contacts · A.5.8 Project security steps · A.5.9 Owned asset list · A.5.10 Asset use rules · A.5.11 Assets handed back · A.5.12 Sensitivity sorting · A.5.13 Sensitivity marking · A.5.14 Data transfer rules · A.5.23 Cloud use rules · A.5.37 Written operating steps · A.6.7 Remote work safeguards

Operational processesA.5.7 Attacker news tracking · A.5.24 Incident readiness · A.5.25 Event severity sorting · A.5.26 Incident response steps · A.5.27 Incident learning · A.5.28 Incident evidence collection · A.5.29 Outage security plans · A.5.30 Recovery readiness · A.6.8 Staff problem reporting · A.8.1 User device protection · A.8.6 Capacity planning · A.8.7 Malware defense · A.8.14 Spare capacity · A.8.16 Unusual behavior watching · A.8.17 Clock matching · A.8.18 Utility program limits · A.8.19 Live software approval · A.8.21 Network service rules · A.8.23 Web traffic filtering

Physical securityA.7.1 Secure site boundaries · A.7.2 Site entry controls · A.7.3 Locked rooms · A.7.4 Premises watching · A.7.5 Fire flood protection · A.7.6 Secure area rules · A.7.7 Tidy desks · A.7.8 Equipment siting · A.7.9 Away asset safeguards · A.7.10 Disk drive care · A.7.11 Power failure backup · A.7.12 Cabling protection · A.7.13 Equipment servicing · A.7.14 Safe equipment wiping

Contracts and vendorsA.5.19 Vendor security demands · A.5.20 Vendor agreement clauses · A.5.21 Supply chain controls · A.5.22 Vendor service review · A.8.30 Outside developer oversight

People and HRA.6.1 Hiring background screening · A.6.2 Written security duties · A.6.3 Security awareness training · A.6.4 Rule breaking consequences · A.6.5 Duties after leaving · A.6.6 Promises about secrets

Regulatory procedureA.5.31 Legal duty tracking · A.5.32 Software rights records · A.5.33 Records safekeeping · A.5.34 Privacy duties

External assessmentA.5.35 Independent review · A.5.36 Policy compliance review · A.8.34 Audit safeguards

Organisational policyReq.1.1 Network policy record · Req.1.5 Endpoint bridging policy · Req.2.1 Hardening policy record · Req.3.1 Data protection policy · Req.4.1 Transit policy record · Req.5.1 Malware policy record · Req.6.1 Development policy record · Req.7.1 Access policy record · Req.8.1 Sign in policy · Req.9.1 Physical policy record · Req.10.1 Logging policy record · Req.11.1 Testing policy record · Req.12.1 Security policy program · Req.12.2 Acceptable use rules · Req.12.3 Targeted risk review · Req.12.4 Compliance oversight · Req.12.5 Scope definition record

Operational processesReq.2.3 Wireless review · Req.3.7 Key lifecycle process · Req.5.2 Endpoint malware defense · Req.5.3 Malware update monitoring · Req.5.4 Phishing defenses · Req.10.4 Routine log review · Req.10.6 Clock synchronization · Req.10.7 Failure detection process · Req.11.2 Rogue wireless review · Req.11.5 Intrusion detection process · Req.12.10 Incident response plan

Physical securityReq.9.2 Facility entry controls · Req.9.3 Visitor access records · Req.9.4 Media handling rules · Req.9.5 Terminal tamper review

Contracts and vendorsReq.12.8 Provider contracts · Req.12.9 Provider support duties

People and HRReq.12.6 Awareness training · Req.12.7 Staff screening

External assessmentReq.11.4 Penetration testing

Toevan gives supporting evidence for 4 of these.

Organisational policyAC-1 Policy and Procedures · AT-1 Policy and Procedures · AU-1 Policy and Procedures · CA-1 Policy and Procedures · CM-1 Policy and Procedures · CP-1 Policy and Procedures · IA-1 Policy and Procedures · IR-1 Policy and Procedures · MA-1 Policy and Procedures · MP-1 Policy and Procedures · PE-1 Policy and Procedures · PL-1 Policy and Procedures · PL-2 System Security and Privacy Plans · PL-4 Rules of Behavior · PL-8 Security and Privacy Architectures · PL-10 Baseline Selection · PL-11 Baseline Tailoring · PS-1 Policy and Procedures · RA-1 Policy and Procedures · RA-2 Security Categorization · RA-3 Risk Assessment · RA-7 Risk Response · RA-9 Criticality Analysis · SA-1 Policy and Procedures · SA-2 Allocation of Resources · SA-3 System Development Life Cycle · SA-5 System Documentation · SA-8 Security and Privacy Engineering Principles · SA-15 Development Process, Standards, and Tools · SA-22 Unsupported System Components · SC-1 Policy and Procedures · SI-1 Policy and Procedures · SR-1 Policy and Procedures

Operational processesAC-8 System Use Notification · AC-14 Permitted Actions Without Identification or Authentication · AC-18 Wireless Access · AC-19 Access Control for Mobile Devices · AC-20 Use of External Systems · AC-21 Information Sharing · AC-22 Publicly Accessible Content · AU-4 Audit Log Storage Capacity · AU-5 Response to Audit Logging Process Failures · AU-6 Audit Record Review, Analysis, and Reporting · AU-7 Audit Record Reduction and Report Generation · CM-4 Impact Analyses · CM-8 System Component Inventory · CM-9 Configuration Management Plan · CM-10 Software Usage Restrictions · CM-11 User-installed Software · CM-12 Information Location · CP-2 Contingency Plan · CP-3 Contingency Training · CP-4 Contingency Plan Testing · CP-6 Alternate Storage Site · CP-7 Alternate Processing Site · CP-8 Telecommunications Services · CP-10 System Recovery and Reconstitution · IA-3 Device Identification and Authentication · IA-7 Cryptographic Module Authentication · IA-11 Re-authentication · IA-12 Identity Proofing · IR-2 Incident Response Training · IR-3 Incident Response Testing · IR-4 Incident Handling · IR-5 Incident Monitoring · IR-6 Incident Reporting · IR-7 Incident Response Assistance · IR-8 Incident Response Plan · SC-2 Separation of System and User Functionality · SC-4 Information in Shared System Resources · SC-5 Denial-of-service Protection · SC-10 Network Disconnect · SC-15 Collaborative Computing Devices and Applications · SC-17 Public Key Infrastructure Certificates · SC-18 Mobile Code · SC-20 Secure Name/Address Resolution Service (Authoritative Source) · SC-21 Secure Name/Address Resolution Service (Recursive or Caching Resolver) · SC-22 Architecture and Provisioning for Name/Address Resolution Service · SC-39 Process Isolation · SI-3 Malicious Code Protection · SI-4 System Monitoring · SI-5 Security Alerts, Advisories, and Directives · SI-8 Spam Protection · SI-16 Memory Protection

Physical securityMA-2 Controlled Maintenance · MA-3 Maintenance Tools · MA-4 Nonlocal Maintenance · MA-5 Maintenance Personnel · MA-6 Timely Maintenance · MP-2 Media Access · MP-3 Media Marking · MP-4 Media Storage · MP-5 Media Transport · MP-6 Media Sanitization · MP-7 Media Use · PE-2 Physical Access Authorizations · PE-3 Physical Access Control · PE-4 Access Control for Transmission · PE-5 Access Control for Output Devices · PE-6 Monitoring Physical Access · PE-8 Visitor Access Records · PE-9 Power Equipment and Cabling · PE-10 Emergency Shutoff · PE-11 Emergency Power · PE-12 Emergency Lighting · PE-13 Fire Protection · PE-14 Environmental Controls · PE-15 Water Damage Protection · PE-16 Delivery and Removal · PE-17 Alternate Work Site

Contracts and vendorsSA-4 Acquisition Process · SA-9 External System Services · SR-2 Supply Chain Risk Management Plan · SR-3 Supply Chain Controls and Processes · SR-5 Acquisition Strategies, Tools, and Methods · SR-6 Supplier Assessments and Reviews · SR-8 Notification Agreements · SR-10 Inspection of Systems or Components · SR-12 Component Disposal

People and HRAT-2 Literacy Training and Awareness · AT-3 Role-based Training · AT-4 Training Records · PS-2 Position Risk Designation · PS-3 Personnel Screening · PS-4 Personnel Termination · PS-5 Personnel Transfer · PS-6 Access Agreements · PS-7 External Personnel Security · PS-8 Personnel Sanctions · PS-9 Position Descriptions

External assessmentCA-2 Control Assessments · CA-3 Information Exchange · CA-5 Plan of Action and Milestones · CA-6 Authorization · CA-7 Continuous Monitoring · CA-9 Internal System Connections

Toevan gives supporting evidence for 2 of these.

Organisational policy164.308(a)(2) Assigned security responsibility · 164.310(b) Workstation use · 164.316(a) Policies and procedures · 164.316(b)(1) Documentation · 164.506 Uses and disclosures to carry out treatment, payment, or health care operations · 164.508 Uses and disclosures for which an authorization is required · 164.509 Uses and disclosures for which an attestation is required · 164.510 Uses and disclosures requiring an opportunity for the individual to agree or to object · 164.512 Uses and disclosures for which an authorization or opportunity to agree or object is not required · 164.520 Notice of privacy practices for protected health information · 164.522 Rights to request privacy protection for protected health information · 164.528 Accounting of disclosures of protected health information · 164.530 Administrative requirements

Operational processes164.308(a)(1) Security management process · 164.308(a)(6) Security incident procedures · 164.308(a)(7) Contingency plan · 164.524 Access of individuals to protected health information · 164.526 Amendment of protected health information

Physical security164.310(a)(1) Facility access controls · 164.310(c) Workstation security · 164.310(d)(1) Device and media controls

Contracts and vendors164.308(b)(1) Business associate contracts and other arrangements · 164.314(a)(1) Business associate contracts or other arrangements · 164.314(b)(1) Requirements for group health plans · 164.504 Uses and disclosures: Organizational requirements

People and HR164.308(a)(3) Workforce security · 164.308(a)(5) Security awareness and training

Regulatory procedure164.404 Notification to individuals · 164.406 Notification to the media · 164.408 Notification to the Secretary · 164.410 Notification by a business associate · 164.412 Law enforcement delay · 164.414 Administrative requirements and burden of proof

External assessment164.308(a)(8) Evaluation

Toevan gives supporting evidence for 1 of these.

Organisational policyArt.6 Lawfulness of processing · Art.7 Conditions for consent · Art.8 Conditions applicable to child's consent in relation to information society services · Art.9 Processing of special categories of personal data · Art.10 Processing of personal data relating to criminal convictions and offences · Art.11 Processing which does not require identification · Art.24 Responsibility of the controller · Art.26 Joint controllers · Art.27 Representatives of controllers or processors not established in the Union · Art.29 Processing under the authority of the controller or processor · Art.30 Records of processing activities · Art.31 Cooperation with the supervisory authority · Art.35 Data protection impact assessment · Art.36 Prior consultation · Art.37 Designation of the data protection officer · Art.38 Position of the data protection officer · Art.39 Tasks of the data protection officer

Operational processesArt.12 Transparent information, communication and modalities for the exercise of the rights of the data subject · Art.13 Information to be provided where personal data are collected from the data subject · Art.14 Information to be provided where personal data have not been obtained from the data subject · Art.15 Right of access by the data subject · Art.16 Right to rectification · Art.17 Right to erasure (‘right to be forgotten’) · Art.18 Right to restriction of processing · Art.19 Notification obligation regarding rectification or erasure of personal data or restriction of processing · Art.20 Right to data portability · Art.21 Right to object · Art.22 Automated individual decision-making, including profiling

Contracts and vendorsArt.28 Processor

Regulatory procedureArt.33 Notification of a personal data breach to the supervisory authority · Art.34 Communication of a personal data breach to the data subject · Art.44 General principle for transfers · Art.45 Transfers on the basis of an adequacy decision · Art.46 Transfers subject to appropriate safeguards · Art.47 Binding corporate rules · Art.48 Transfers or disclosures not authorised by Union law · Art.49 Derogations for specific situations

Toevan gives supporting evidence for 1 of these.

Organisational policyArt.5 Governance and organisation · Art.6 ICT risk management framework · Art.16 Simplified ICT risk management framework · Art.24 General requirements for the performance of digital operational resilience testing · Art.28 General principles · Art.29 Preliminary assessment of ICT concentration risk at entity level

Operational processesArt.11 Response and recovery · Art.13 Learning and evolving · Art.14 Communication · Art.17 ICT-related incident management process · Art.18 Classification of ICT-related incidents and cyber threats

Contracts and vendorsArt.30 Key contractual provisions

Regulatory procedureArt.15 Further harmonisation of ICT risk management tools, methods, processes and policies · Art.19 Reporting of major ICT-related incidents and voluntary notification of significant cyber threats · Art.20 Harmonisation of reporting content and templates · Art.21 Centralisation of reporting of major ICT-related incidents · Art.22 Supervisory feedback · Art.23 Operational or security payment-related incidents concerning credit institutions, payment institutions, account information service providers, and electronic money institutions · Art.45 Information-sharing arrangements on cyber threat information and intelligence

External assessmentArt.26 Advanced testing of ICT tools, systems and processes based on TLPT · Art.27 Requirements for testers for the carrying out of TLPT