Published:

2025-09-04

Updated:

2026-11-12

ISO 27001 and NIST CSF: Control Mapping Checklist

How to map ISO 27001:2022 Annex A controls to NIST CSF 2.0: the versions to use, where mappings come from, a tracking worksheet, and where peers report thin coverage.

What is an ISO 27001 to NIST CSF control mapping?

A control mapping lines up the controls in ISO/IEC 27001:2022 with the Functions, Categories, and Subcategories of NIST CSF 2.0, so one set of evidence can answer both frameworks. The ISO side is a management system standard with an Annex A of controls. The NIST side is a taxonomy of outcomes that does not say how to achieve them. That difference is why a mapping is needed and why it cannot be assumed. “A control mapping is a set of judgments, and each judgment needs a named source, a version, and a reviewer.” A team gets the most value by treating the mapping as a worksheet with one row per control, where each row records the matching CSF identifiers, how close the match is, who owns the control, and where the evidence sits. The result supports audits, gap analysis, and reporting to leadership without keeping two separate programs.

Which versions of ISO 27001 and the NIST CSF should a team map?

Map ISO/IEC 27001:2022 and NIST CSF 2.0, and check every source for the version it names. The 2022 edition of ISO 27001 draws on ISO/IEC 27002:2022, which SGS reports has 93 controls grouped in four themes, against 114 controls in the 2013 edition. CSF 2.0 added the Govern Function, shifted large parts of Identify there, and created new Protect Categories, so identifiers from version 1.1 can point to the wrong place. “A mapping written for the 2013 edition of ISO 27001 or version 1.1 of the CSF does not line up with the current numbering.” The 2013 transition ended on October 31, 2025, so any certification work now rests on the 2022 edition. When a row cites a control number with an A. prefix, or a CSF identifier that starts with PR.AC, treat it as a signal that the worksheet predates the current versions and needs rebuilding from a current source.

Where does a mapping come from, and how far can a team trust it?

NIST does not publish an official ISO 27001 to CSF mapping. Its Online Informative References catalog lists two ISO/IEC 27001:2022 to CSF 2.0 entries, and both come from developers outside NIST. NIST says it does not check non-NIST mappings for accuracy and that being listed is not an endorsement. One entry presents itself as a starting point and is not comprehensive. The other is flagged as comprehensive, which still leaves the judgment about fit with the organization using it. “Neither framework tells an organization which mapping to trust, so the organization has to record which one it used.” A team should choose one source, record its entry number, version, and posted date, review a sample of rows with the people who run the controls, and keep a list of rows where the match was judged partial.

What columns does a control mapping worksheet need?

A useful worksheet keeps each row traceable and testable. Start with the Annex A control number and name, then add the CSF 2.0 Function, Category, and Subcategory, and a relationship rating of full, partial, or none. Record the mapping source and its version so a reviewer can see where the row came from. Add implementation status, an owner with a backup, a link to evidence, the date it was last tested, and a review trigger. The status column can later inform a CSF Current Profile, which describes where an organization stands today. Two further lists belong beside the worksheet: CSF Subcategories that no Annex A control reaches, and Annex A controls that no Subcategory reaches. Each gap needs an owner and a decision, such as accept, close, or document an alternative.

Where do healthcare organizations report the thinnest NIST CSF 2.0 coverage?

Censinet’s 2025 benchmarking study surveyed 69 healthcare and payer organizations and found average self-reported coverage strongest in Respond at 85% and weakest in Govern and Identify at 64% each. Two Categories trailed every other: Asset Management at 53% and Supply Chain Risk Management at 52%, compared with 73% across the remaining Categories. Supply chain risk management changed Functions in version 2.0, so older worksheets place it under the wrong heading and understate how much ownership sits with governance teams. Whatever order the team chooses, it should record the reason for the order, so the sequence can be explained later. A mapping team can use these figures to sequence its work, starting with the Categories where peers report the least coverage and where ownership crosses departments. The scores are annual self-reported readings and do not show whether an organization meets either framework.

How should a team keep a mapping current and prove that it works?

Treat the worksheet as a living record and tie it to evidence. “A mapped control is only as strong as the evidence that shows it operating.” Link policies, configurations, test results, and tickets from the evidence column, and record when each control was last tested. Set review triggers before they are needed: a revised source mapping, an ISO amendment or new edition, a CSF release, a serious incident, or a large change to systems or vendors. When a trigger fires, revisit every row that depends on the change and update its status and test date. Ask the accountable program owner to sign off after each review, so the worksheet shows who confirmed it and when, and keep prior versions so an auditor can see how the mapping changed. Report the results to leadership on a regular schedule.

A control mapping lines up the controls in ISO/IEC 27001:2022 with the Functions, Categories, and Subcategories of the NIST Cybersecurity Framework (CSF) 2.0, so one body of evidence can answer both. Annex A of the 2022 edition lists 93 controls in four themes, and CSF 2.0 organizes its outcomes under six Functions [1][8][9]. Neither framework supplies a mapping on its own. NIST says the CSF does not prescribe how outcomes should be achieved, and it says informative references can be produced by NIST or another organization [1]. NIST's online catalog lists two ISO/IEC 27001:2022 to CSF 2.0 mappings, both submitted by non-NIST developers, and NIST states that it does not test the correctness of non-NIST mappings and that a listing does not imply NIST endorsement [3][4][5]. This checklist shows how to choose a mapping, record each decision, and keep the result current.

ISO/IEC 27001:2022 and NIST CSF 2.0 at a glance
Question	ISO/IEC 27001:2022	NIST CSF 2.0
What it is	Standard titled Information security management systems, Requirements [4]	A taxonomy of high-level cybersecurity outcomes [1]
Current edition	Published October 2022; Amendment 1, Climate action changes, published February 2024 [6][10]	Published February 26, 2024 [1]
Structure	Annex A: 93 controls in four themes [8][9]	Six Functions, each with Categories and Subcategories [1]
Says how to achieve outcomes?	Controls are listed in Annex A [9]	No; the CSF does not prescribe how outcomes should be achieved [1]
Certification	Certification to the 2013 edition ended after October 31, 2025 [10]	NIST does not offer certifications and has no plans for a conformity assessment program [2]
Use	Basis for an information security management system	Voluntary for most organizations [2]

Start With the Right Versions

ISO/IEC 27001:2022

ISO/IEC 27001:2022 was published in October 2022 [10]. Its Annex A draws its controls from ISO/IEC 27002:2022, which SGS reports has 93 controls against 114 in the 2013 edition, regrouped into four categories instead of 14 themes and 35 categories [8]. SGS counts 11 new controls and 24 controls formed by merging earlier ones [8]. Amendment 1, titled Climate action changes, was published in February 2024 [6]. Organizations certified to the 2013 edition had until October 31, 2025 to transition, and DQS states that certifications based on the 2013 edition expire or are withdrawn after that date [10][11]. The 2022 edition numbers its controls 5.1 to 5.37, 6.1 to 6.8, 7.1 to 7.14, and 8.1 to 8.34 [9].

ISO/IEC 27001:2022 Annex A themes and control numbering
Theme	Control numbers [9]	Controls [9]
Organizational	5.1 to 5.37	37
People	6.1 to 6.8	8
Physical	7.1 to 7.14	14
Technological	8.1 to 8.34	34
Total, 2022 edition	5.1 to 8.34	93
Total, 2013 edition [8]	14 themes and 35 categories	114

NIST CSF 2.0

NIST published CSF 2.0 on February 26, 2024 [1]. Its six Functions are Govern, Identify, Protect, Detect, Respond, and Recover, and the Core is arranged by Function, then Category, then Subcategory [1]. NIST's FAQ answers "No" to whether the CSF provides a checklist of what every organization should do, and it says NIST does not offer certifications of CSF-related products and has no plans for a conformity assessment program [2]. Most organizations use the CSF on a voluntary basis [2].

What changed between CSF 1.1 and CSF 2.0, per NIST
Area	Change [2]
Govern	New Function that emphasizes the role of cybersecurity governance
Identify	Much of Identify moved to the new Govern Function; new Category ID.IM, Improvement
Protect	Two new Categories, PR.PS (Platform Security) and PR.IR (Technology Infrastructure Resilience); PR.AC moved to PR.AA, revised, and re-sequenced
Content	NIST says no content was removed from 1.1 to 2.0
Supply chain risk management	Moved from Identify to Govern [12]
Crosswalk	The crosswalk between CSF 1.1 and CSF 2.0 is itself an informative reference

Why Older Mappings Need a Version Check

A mapping written for the 2013 edition of ISO 27001 or version 1.1 of the CSF does not line up with the current numbering. The 2022 control numbers start with a theme number from 5 to 8, and CSF 2.0 added the Govern Function and new Categories, so an older worksheet can point to identifiers that no longer exist or no longer mean the same thing [2][9]. Check the version named on any mapping before using a row from it.

Where a Mapping Comes From

NIST describes informative references as "mappings that indicate relationships between the Core and various standards," and notes that some are narrower in scope than a Subcategory [1]. It publishes them through the National Online Informative References (OLIR) catalog, where developers submit mappings, NIST conducts limited conformance testing against its template, each submission has a 30-day public comment period, and non-NIST mappings are not tested for correctness or endorsed [3]. In August 2026 NIST published SP 1347, a quick-start guide to using informative references and NIST's tools for them [7]. NIST's CSF 2.0 Reference Tool can export its data in JSON and Excel formats [2].

ISO/IEC 27001:2022 to CSF 2.0 entries in the NIST OLIR catalog
Detail	Entry 154 [4]	Entry 218 [5]
Status and version	Final, version 1.0.0	Final, version 1.0.0
Focal document	Cybersecurity Framework v2.0	Cybersecurity Framework v2.0
Posted	July 18, 2025	July 9, 2026
Submitter category	Private sector	Other (independent developer)
Authority	Non-Owner	Non-Owner
Marked comprehensive?	No	Yes
What the entry says	Establishes an initial mapping, intended to evolve over time	Maps ISO/IEC 27001:2022 controls to CSF 2.0 using the OLIR crosswalk template
NIST statement for non-NIST mappings [3]	NIST does not test correctness, and a listing does not imply NIST endorsement	NIST does not test correctness, and a listing does not imply NIST endorsement

A control mapping is a set of judgments, and each judgment needs a named source, a version, and a reviewer. Neither framework tells an organization which mapping to trust, so the organization has to record which one it used. The first entry in Table 4 describes itself as an initial mapping and is marked not comprehensive, which means a team using it should expect gaps and plan to fill them [4].

How to Map ISO 27001 Controls to NIST CSF

Step-by-Step Mapping Process

Assemble a small team that covers information security, compliance, privacy, and clinical or operational owners, since Annex A controls span organizational policy, people, physical security, and technology. Confirm that the worksheet names ISO/IEC 27001:2022 and CSF 2.0 and uses their current identifiers. Choose a source mapping and record its OLIR entry, version, and posted date. Take each Annex A control in turn, enter the Function, Category, and Subcategory the mapping assigns, and mark the relationship as full, partial, or none. Then work in the other direction: list CSF 2.0 Subcategories that no Annex A control reaches, and Annex A controls that no Subcategory reaches. Both lists are findings, and each needs an owner.

Tools and Techniques for Accurate Mapping

Use a spreadsheet as the system of record for the first pass, and export the CSF 2.0 Core from NIST's Reference Tool to avoid retyping identifiers [2]. Walk through two or three controls with the people who run them, such as remote access to the electronic health record or recovery of a clinical system, and check that the mapped Subcategory describes what they actually do. Prioritize by exposure. The Censinet benchmark data below show where peers report the thinnest coverage, which makes those Categories sensible places to begin [12].

Setting Milestones and Tracking Progress

Break the work into quarters by theme or by Function, and assign one owner per Function. Track four statuses for each row: not started, in progress, implemented, and validated. Record the date of the last test for each mapped control. A CSF Organizational Profile describes an organization's current and target cybersecurity posture, so the implementation status column in this worksheet can inform a Current Profile [1]. Review the worksheet on a fixed schedule and again when a trigger occurs.

The ISO 27001 to NIST CSF Control Mapping Checklist

Worksheet Structure and Key Columns

The worksheet works as both a planning tool and an audit trail. Each row represents one Annex A control, and the columns below keep the mapping traceable to its source.

Control mapping worksheet columns and what to record
Column	What to record
Annex A control ID	The 2022 number, from 5.1 to 8.34 [9]
Control name and theme	Organizational, People, Physical, or Technological [9]
CSF 2.0 Function	Govern, Identify, Protect, Detect, Respond, or Recover [1]
CSF 2.0 Category and Subcategory	The identifiers as they appear in CSF 2.0, not CSF 1.1 [2]
Relationship	Full, partial, or none; some informative references are narrower than a Subcategory [1]
Mapping source and version	OLIR entry number, version, and posted date [3]
Implementation status	Not started, in progress, implemented, or validated
Owner	The person or team accountable, with a backup
Evidence	A link to the policy, configuration, test result, or ticket
Last test date	The date the control was last tested
Review trigger	The event or date that sends the row back for review

Pre-Mapping and Review Checks

Run these checks before you rely on a mapping and again at each review.

Control mapping checks before and after each review
Check	What to confirm
Versions	The worksheet names ISO/IEC 27001:2022 and CSF 2.0
Source	The OLIR entry, its developer category, status, and posted date are recorded [3]
Scope	The source mapping states whether it is comprehensive; entry 154 is marked not comprehensive [4]
Identifiers	No 2013 control numbers and no CSF 1.1 identifiers remain
Gaps in both directions	CSF Subcategories with no Annex A control, and Annex A controls with no Subcategory, each have an owner
Ownership	Each row names an owner and a backup
Evidence	Each implemented row links to evidence that shows the control operating
Testing	Each row carries a last test date
Review triggers	A new mapping version, ISO amendment or edition, CSF release, incident, or major system or vendor change sends rows back for review
Sign-off	The person accountable for the program has reviewed the worksheet

Using the Worksheet for Audits and Reviews

For an internal review, pick a sample of rows and confirm that the owner, evidence, and last test date are current. For an external audit, the worksheet shows an auditor which Annex A control answers which outcome and where the evidence sits. A mapped control is only as strong as the evidence that shows it operating. Keep policies, configurations, test results, and tickets linked from the evidence column and not described in it. When ISO publishes an amendment, NIST updates the Core, or the mapping source posts a new version, revisit every row that depends on the change.

What the Benchmark Data Show About Coverage

Censinet's 2025 Healthcare Cybersecurity Benchmarking Study surveyed 69 healthcare and payer organizations from September to December 2024, and the figures are self-reported averages and not audited results [12]. The study measures coverage of NIST CSF 2.0, and Respond averaged 85% while Govern and Identify averaged 64% each [12]. The two lowest Categories were Asset Management at 53% and Supply Chain Risk Management at 52%, against 73% for all other Categories combined [12].

NIST CSF 2.0 function coverage, 2025 benchmarking study
Function	Average coverage	Organizations (n)
Respond	85%	69
Recover	78%	69
Detect	74%	69
Protect	69%	69
Govern	64%	69
Identify	64%	69
Overall average	72%	69
Lowest Category: Asset Management (Identify)	53%	69
Lowest Category: Supply Chain Risk Management (Govern)	52%	69
All other Categories, aggregate	73%	69

These numbers help sequence the work. A mapping team can start with Asset Management and Supply Chain Risk Management, since both are low across peers and both depend on inventories and ownership that cross departments. In CSF 2.0, supply chain risk management moved from the Identify Function to the new Govern Function, so a worksheet built from version 1.1 places it in the wrong Function [12]. The scores describe peer coverage in one year and do not test whether any organization meets ISO/IEC 27001 or the CSF.

Key Considerations for Healthcare

Patient Data and Regulatory Overlap

A mapping between ISO/IEC 27001 and the CSF does not by itself show HIPAA compliance. The Security Rule is a separate set of requirements, and a HIPAA crosswalk is a separate exercise from this one. Keep a column or a second worksheet for it so the three sets of requirements are traceable without being merged.

Medical Devices and Third Parties

Asset inventories and third-party oversight are where the benchmark data show the most room to improve. In the HICP section of the same study, Network Connected Medical Device Security scored lowest at 48% (n=32) and has lagged the other practices for three consecutive years [12]. When you map controls that touch devices and vendors, name the clinical engineering, procurement, and security owners on the same row so the evidence has a home.

Maintaining Alignment Over Time

Set explicit review triggers: a new version of the mapping source, a new ISO amendment or edition, a new CSF release, a major incident, or a significant system or vendor change. Treat the worksheet as a living record with named owners and dated tests.

Using Technology for Control Mapping Governance

A spreadsheet can hold a mapping, but it does not keep findings, ownership, and status together as the program grows. Censinet includes assessment content aligned to frameworks that healthcare organizations use most, including the NIST Cybersecurity Framework, HICP, the HHS Cybersecurity Performance Goals, HITRUST CSF, ISO 27001, and SOC 2 [13]. Its enterprise risk capability consolidates findings in the Censinet Risk Register with defined ownership, status tracking, and longitudinal history, accepts findings from internal audits, penetration tests, annual risk analyses, and external consulting engagements, and supports peer benchmarking and executive, board, and audit reporting [13]. The mapping decisions themselves stay with the people who own the controls.

Conclusion

Key points

ISO/IEC 27001:2022 has 93 Annex A controls in four themes, and NIST CSF 2.0 has six Functions that include the new Govern Function. A mapping between them is a set of documented judgments. NIST lists two ISO/IEC 27001:2022 to CSF 2.0 mappings in its catalog, both from non-NIST developers and neither endorsed by NIST. Record the source and version of every mapping, check for gaps in both directions, and tie each row to an owner, evidence, and a test date.

Next steps

Confirm that your worksheet uses the 2022 and 2.0 identifiers. Choose a source mapping and record its OLIR entry and posted date. Start with Asset Management and Supply Chain Risk Management, then set review triggers for the rest.

References

National Institute of Standards and Technology. The NIST Cybersecurity Framework (CSF) 2.0, NIST CSWP 29 (February 26, 2024). https://csrc.nist.gov/pubs/cswp/29/the-nist-cybersecurity-framework-csf-20/final
National Institute of Standards and Technology. Cybersecurity Framework Frequently Asked Questions (no date shown). https://nist.gov/cyberframework/faqs
National Institute of Standards and Technology. CSF 2.0 Informative References (created February 15, 2024; updated November 9, 2026). https://www.nist.gov/cyberframework/informative-references
National Institute of Standards and Technology. National Online Informative References Program, ISO/IEC-27001:2022-to-Cybersecurity-Framework-v2.0 Informative Reference Details, entry 154 (posted July 18, 2025). https://csrc.nist.gov/projects/olir/informative-reference-catalog/details?referenceId=154
National Institute of Standards and Technology. National Online Informative References Program, ISO/IEC-27001:2022-to-NIST-Cybersecurity-Framework-v2.0 Informative Reference Details, entry 218 (posted July 9, 2026). https://csrc.nist.gov/projects/olir/informative-reference-catalog/details?referenceId=218
International Organization for Standardization. ISO/IEC 27001:2022/Amd 1:2024, Climate action changes (published February 2024). https://www.iso.org/standard/88435.html
National Institute of Standards and Technology. Cybersecurity Framework 2.0 Informative References Quick-Start Guide, SP 1347 (final release announced August 25, 2026). https://csrc.nist.gov/News/2026/csf-2-0-informative-references-qsg
SGS. Key Changes in ISO/IEC 27002:2022 (July 23, 2022). https://www.sgs.com/en/news/2022/07/key-changes-in-iso-iec-27002-2022
Bastion. ISO 27001 Annex A Controls (page updated October 2026). https://bastion.tech/learn/iso27001/annex-a-controls
DQS. Transition Requirements for ISO 27001:2022 (published August 12, 2022; updated May 25, 2023). https://www.dqsglobal.com/en/explore/blog/hk/transition-requirements-for-iso-27001-2022
Schellman. How to Prepare for ISO 27001:2022 (no date shown). https://www.schellman.com/blog/iso-certifications/prepare-for-iso-27001-2022
Censinet. 10 Insights from the 2025 Healthcare Cybersecurity Benchmarking Study (published April 4, 2025). https://censinet.com/perspectives/10-insights-from-cybersecurity-benchmarking-studies
Censinet. Enterprise Risk. https://censinet.com/capabilities/enterprise-risk