ISO 27001:2022 – Control Mapping

This page shows which Wombat controls cover which requirements of ISO 27001:2022.

Framework Control	Requirement	Wombat Controls	Severity	Pillar	Category
A.5.3 – Segregation of duties	A.5.3 – Segregation of duties	WAF-SOV-060	🔴	Sovereign Cloud	identity-access
A.5.10 – Acceptable use of information	A.5.10 – Acceptable use of information	WAF-SEC-030	🟠	Security	identity-access
A.5.12 – Classification of information	A.5.12 – Classification of information	WAF-SEC-130 · WAF-SOV-010	🟠	Security, Sovereign Cloud	identity-access
A.5.13 – Labelling of information	A.5.13 – Labelling of information	WAF-SEC-130	🟠	Security	identity-access
A.5.15 – Access control	A.5.15 – Access control	WAF-AGN-020 · WAF-SEC-010 · WAF-SEC-020	🔴 🟠	Agentic, Security	agentic-governance, identity-access
A.5.17 – Authentication information	A.5.17 – Authentication information	WAF-AGN-010 · WAF-SEC-010 · WAF-SEC-060	🔴 🟠	Agentic, Security	identity-access
A.5.18 – Access rights	A.5.18 – Access rights	WAF-SEC-020	🔴	Security	identity-access
A.5.19 – Information security in supplier relationships	A.5.19 – Information security in supplier relationships	WAF-SEC-110 · WAF-SOV-080 · WAF-SOV-120	🟠 🟡	Security, Sovereign Cloud	container-security, data-governance, logging-monitoring
A.5.20 – Addressing information security in supplier agreements	A.5.20 – Addressing information security in supplier agreements	WAF-SOV-080	🟡	Sovereign Cloud	logging-monitoring
A.5.20 – Addressing information security in supplier agreements (including exit)	A.5.20 – Addressing information security in supplier agreements (including exit)	WAF-SOV-100	🟡	Sovereign Cloud	logging-monitoring
A.5.20 – Addressing information security within supplier agreements	A.5.20 – Addressing information security within supplier agreements	WAF-SEC-110	🟠	Security	container-security
A.5.21 – Managing information security in the ICT supply chain	A.5.21 – Managing information security in the ICT supply chain	WAF-SEC-110 · WAF-SOV-080	🟠 🟡	Security, Sovereign Cloud	container-security, logging-monitoring
A.5.24 – Information security incident management planning	A.5.24 – Information security incident management planning	WAF-SEC-100	🟡	Security	identity-access
A.5.25 – Assessment and decision on information security events	A.5.25 – Assessment and decision on information security events	WAF-SEC-100	🟡	Security	identity-access
A.5.26 – Response to information security incidents	A.5.26 – Response to information security incidents	WAF-SEC-080 · WAF-SEC-100 · WAF-SOV-070	🟠 🟡	Security, Sovereign Cloud	identity-access
A.5.27 – Learning from information security incidents	A.5.27 – Learning from information security incidents	WAF-SEC-100	🟡	Security	identity-access
A.5.28 – Collection of evidence	A.5.28 – Collection of evidence	WAF-SEC-100	🟡	Security	identity-access
A.5.29 – Information security during disruption	A.5.29 – Information security during disruption	WAF-SOV-020 · WAF-SOV-030	🔴 🟠	Sovereign Cloud	identity-access, logging-monitoring
A.5.33 – Protection of records	A.5.33 – Protection of records	WAF-SOV-010	🟠	Sovereign Cloud	identity-access
A.5.34 – Privacy and PII protection	A.5.34 – Privacy and PII protection	WAF-SOV-010	🟠	Sovereign Cloud	identity-access
A.5.36 – Compliance with policies, rules and standards	A.5.36 – Compliance with policies, rules and standards	WAF-SEC-090	🟡	Security	identity-access
A.5.37 – Documented operating procedures	A.5.37 – Documented operating procedures	WAF-SEC-090	🟡	Security	identity-access
A.8.1 – Information security roles and responsibilities	A.8.1 – Information security roles and responsibilities	WAF-AGN-030 · WAF-AGN-040 · WAF-AGN-060 · WAF-AGN-070 · WAF-AGN-100	🟠 🟡 🟢	Agentic	logging-monitoring, reliability-design
A.8.2 – Privileged access rights	A.8.2 – Privileged access rights	WAF-AGN-010 · WAF-AGN-020 · WAF-AGN-030 · WAF-AGN-040 · WAF-AGN-050 · WAF-AGN-060 · WAF-AGN-070 · WAF-AGN-080 · WAF-AGN-090 · WAF-AGN-100 · WAF-SEC-010 · WAF-SEC-020 · WAF-SOV-060	🔴 🟠 🟡 🟢	Agentic, Security, Sovereign Cloud	agentic-governance, identity-access, logging-monitoring, reliability-design
A.8.3 – Information access restriction	A.8.3 – Information access restriction	WAF-AGN-020 · WAF-AGN-050 · WAF-AGN-080 · WAF-AGN-110 · WAF-SEC-020 · WAF-SOV-060	🔴 🟠	Agentic, Security, Sovereign Cloud	agentic-governance, identity-access, logging-monitoring
A.8.5 – Secure authentication	A.8.5 – Secure authentication	WAF-AGN-010 · WAF-SEC-010 · WAF-SEC-060	🔴 🟠	Agentic, Security	identity-access
A.8.7 – Protection against malware	A.8.7 – Protection against malware	WAF-SEC-120 · WAF-SEC-150	🟠	Security	container-security, identity-access
A.8.8 – Management of technical vulnerabilities	A.8.8 – Management of technical vulnerabilities	WAF-SEC-070 · WAF-SEC-090 · WAF-SEC-120 · WAF-SEC-150	🟠 🟡	Security	container-security, identity-access
A.8.9 – Configuration management	A.8.9 – Configuration management	WAF-SEC-140	🟠	Security	network-security
A.8.10 – Information deletion	A.8.10 – Information deletion	WAF-SEC-130 · WAF-SOV-010 · WAF-SOV-020 · WAF-SOV-100	🔴 🟠 🟡	Security, Sovereign Cloud	identity-access, logging-monitoring
A.8.11 – Data masking	A.8.11 – Data masking	WAF-SEC-130	🟠	Security	identity-access
A.8.13 – Information backup	A.8.13 – Information backup	WAF-REL-040 · WAF-REL-130 · WAF-SOV-030	🔴 🟠	Reliability, Sovereign Cloud	backup-recovery, logging-monitoring, secret-management
A.8.14 – Redundancy of information processing facilities	A.8.14 – Redundancy of information processing facilities	WAF-REL-130	🟠	Reliability	backup-recovery
A.8.15 – Logging	A.8.15 – Logging	WAF-SEC-080 · WAF-SEC-160 · WAF-SOV-040 · WAF-SOV-070	🟠	Security, Sovereign Cloud	identity-access, logging-monitoring, network-security
A.8.16 – Monitoring activities	A.8.16 – Monitoring activities	WAF-SEC-080 · WAF-SEC-140 · WAF-SEC-160 · WAF-SOV-040 · WAF-SOV-070	🟠	Security, Sovereign Cloud	identity-access, logging-monitoring, network-security
A.8.19 – Installation of software on operational systems	A.8.19 – Installation of software on operational systems	WAF-SEC-070 · WAF-SEC-120	🟠 🟡	Security	container-security, identity-access
A.8.20 – Networks security	A.8.20 – Networks security	WAF-SEC-040 · WAF-SEC-050 · WAF-SOV-090	🟠	Security, Sovereign Cloud	identity-access, network-security
A.8.21 – Security of network services	A.8.21 – Security of network services	WAF-SEC-040 · WAF-SEC-050 · WAF-SOV-090	🟠	Security, Sovereign Cloud	identity-access, network-security
A.8.22 – Segregation of networks	A.8.22 – Segregation of networks	WAF-SEC-050 · WAF-SEC-120 · WAF-SOV-090	🟠	Security, Sovereign Cloud	identity-access, network-security
A.8.23 – Data leakage prevention	A.8.23 – Data leakage prevention	WAF-AGN-040	🟠	Agentic	logging-monitoring
A.8.23 – Web filtering	A.8.23 – Web filtering	WAF-SEC-140	🟠	Security	network-security
A.8.24 – Use of cryptography	A.8.24 – Use of cryptography	WAF-SEC-030 · WAF-SEC-040 · WAF-SEC-060 · WAF-SEC-130 · WAF-SOV-050 · WAF-SOV-110	🔴 🟠	Security, Sovereign Cloud	encryption-key-management, identity-access
A.8.25 – Secure development life cycle	A.8.25 – Secure development life cycle	WAF-SOV-050	🔴	Sovereign Cloud	encryption-key-management
A.8.27 – Secure system architecture	A.8.27 – Secure system architecture	WAF-AGN-110	🟠	Agentic	agentic-governance
A.8.30 – Outsourced development	A.8.30 – Outsourced development	WAF-SEC-110	🟠	Security	container-security
A.8.32 – Change management	A.8.32 – Change management	WAF-SEC-070	🟡	Security	container-security
A.12.1 – Control of operational software	A.12.1 – Control of operational software	WAF-AGN-090	🟡	Agentic	logging-monitoring
A.13.1.1 – Control of information in sessions	A.13.1.1 – Control of information in sessions	WAF-AGN-050 · WAF-AGN-080	🟠	Agentic	identity-access, logging-monitoring
A.15.1 – Information security in supplier relationships	A.15.1 – Information security in supplier relationships	WAF-REL-080	🟡	Reliability	reliability-design
A.16.1 – Management of information security incidents and improvements	A.16.1 – Management of information security incidents and improvements	WAF-REL-060	🟠	Reliability	logging-monitoring
A.17.1 – Information security continuity	A.17.1 – Information security continuity	WAF-REL-010 · WAF-REL-030 · WAF-REL-040 · WAF-REL-050 · WAF-REL-080 · WAF-REL-100 · WAF-REL-110	🔴 🟠 🟡	Reliability	data-governance, logging-monitoring, network-encryption, reliability-design, secret-management
A.17.1.3 – Verify, review and evaluate information security continuity	A.17.1.3 – Verify, review and evaluate information security continuity	WAF-REL-070 · WAF-REL-090	🟠 🟡	Reliability	backup-recovery, logging-monitoring
A.17.2 – Redundancies	A.17.2 – Redundancies	WAF-REL-010 · WAF-REL-020 · WAF-REL-030	🔴 🟠	Reliability	logging-monitoring, network-encryption
6.1.2 – Information security risk assessment	6.1.2 – Information security risk assessment	WAF-REL-100	🟡	Reliability	reliability-design

Framework Control

Requirement

Wombat Controls

Severity

Pillar

Category

A.5.3 – Segregation of duties

WAF-SOV-060

🔴

Sovereign Cloud

identity-access

A.5.10 – Acceptable use of information

WAF-SEC-030

🟠

Security

identity-access

A.5.12 – Classification of information

WAF-SEC-130 · WAF-SOV-010

🟠

Security, Sovereign Cloud

identity-access

A.5.13 – Labelling of information

WAF-SEC-130

🟠

Security

identity-access

A.5.15 – Access control

WAF-AGN-020 · WAF-SEC-010 · WAF-SEC-020

🔴 🟠

Agentic, Security

agentic-governance, identity-access

A.5.17 – Authentication information

WAF-AGN-010 · WAF-SEC-010 · WAF-SEC-060

🔴 🟠

Agentic, Security

identity-access

A.5.18 – Access rights

WAF-SEC-020

🔴

Security

identity-access

A.5.19 – Information security in supplier relationships

WAF-SEC-110 · WAF-SOV-080 · WAF-SOV-120

🟠 🟡

Security, Sovereign Cloud

container-security, data-governance, logging-monitoring

A.5.20 – Addressing information security in supplier agreements

WAF-SOV-080

🟡

Sovereign Cloud

logging-monitoring

A.5.20 – Addressing information security in supplier agreements (including exit)

WAF-SOV-100

🟡

Sovereign Cloud

logging-monitoring

A.5.20 – Addressing information security within supplier agreements

WAF-SEC-110

🟠

Security

container-security

A.5.21 – Managing information security in the ICT supply chain

WAF-SEC-110 · WAF-SOV-080

🟠 🟡

Security, Sovereign Cloud

container-security, logging-monitoring

A.5.24 – Information security incident management planning

WAF-SEC-100

🟡

Security

identity-access

A.5.25 – Assessment and decision on information security events

WAF-SEC-100

🟡

Security

identity-access

A.5.26 – Response to information security incidents

WAF-SEC-080 · WAF-SEC-100 · WAF-SOV-070

🟠 🟡

Security, Sovereign Cloud

identity-access

A.5.27 – Learning from information security incidents

WAF-SEC-100

🟡

Security

identity-access

A.5.28 – Collection of evidence

WAF-SEC-100

🟡

Security

identity-access

A.5.29 – Information security during disruption

WAF-SOV-020 · WAF-SOV-030

🔴 🟠

Sovereign Cloud

identity-access, logging-monitoring

A.5.33 – Protection of records

WAF-SOV-010

🟠

Sovereign Cloud

identity-access

A.5.34 – Privacy and PII protection

WAF-SOV-010

🟠

Sovereign Cloud

identity-access

A.5.36 – Compliance with policies, rules and standards

WAF-SEC-090

🟡

Security

identity-access

A.5.37 – Documented operating procedures

WAF-SEC-090

🟡

Security

identity-access

A.8.1 – Information security roles and responsibilities

WAF-AGN-030 · WAF-AGN-040 · WAF-AGN-060 · WAF-AGN-070 · WAF-AGN-100

🟠 🟡 🟢

Agentic

logging-monitoring, reliability-design

A.8.2 – Privileged access rights

WAF-AGN-010 · WAF-AGN-020 · WAF-AGN-030 · WAF-AGN-040 · WAF-AGN-050 · WAF-AGN-060 · WAF-AGN-070 · WAF-AGN-080 · WAF-AGN-090 · WAF-AGN-100 · WAF-SEC-010 · WAF-SEC-020 · WAF-SOV-060

🔴 🟠 🟡 🟢

Agentic, Security, Sovereign Cloud

agentic-governance, identity-access, logging-monitoring, reliability-design

A.8.3 – Information access restriction

WAF-AGN-020 · WAF-AGN-050 · WAF-AGN-080 · WAF-AGN-110 · WAF-SEC-020 · WAF-SOV-060

🔴 🟠

Agentic, Security, Sovereign Cloud

agentic-governance, identity-access, logging-monitoring

A.8.5 – Secure authentication

WAF-AGN-010 · WAF-SEC-010 · WAF-SEC-060

🔴 🟠

Agentic, Security

identity-access

A.8.7 – Protection against malware

WAF-SEC-120 · WAF-SEC-150

🟠

Security

container-security, identity-access

A.8.8 – Management of technical vulnerabilities

WAF-SEC-070 · WAF-SEC-090 · WAF-SEC-120 · WAF-SEC-150

🟠 🟡

Security

container-security, identity-access

A.8.9 – Configuration management

WAF-SEC-140

🟠

Security

network-security

A.8.10 – Information deletion

WAF-SEC-130 · WAF-SOV-010 · WAF-SOV-020 · WAF-SOV-100

🔴 🟠 🟡

Security, Sovereign Cloud

identity-access, logging-monitoring

A.8.11 – Data masking

WAF-SEC-130

🟠

Security

identity-access

A.8.13 – Information backup

WAF-REL-040 · WAF-REL-130 · WAF-SOV-030

🔴 🟠

Reliability, Sovereign Cloud

backup-recovery, logging-monitoring, secret-management

A.8.14 – Redundancy of information processing facilities

WAF-REL-130

🟠

Reliability

backup-recovery

A.8.15 – Logging

WAF-SEC-080 · WAF-SEC-160 · WAF-SOV-040 · WAF-SOV-070

🟠

Security, Sovereign Cloud

identity-access, logging-monitoring, network-security

A.8.16 – Monitoring activities

WAF-SEC-080 · WAF-SEC-140 · WAF-SEC-160 · WAF-SOV-040 · WAF-SOV-070

🟠

Security, Sovereign Cloud

identity-access, logging-monitoring, network-security

A.8.19 – Installation of software on operational systems

WAF-SEC-070 · WAF-SEC-120

🟠 🟡

Security

container-security, identity-access

A.8.20 – Networks security

WAF-SEC-040 · WAF-SEC-050 · WAF-SOV-090

🟠

Security, Sovereign Cloud

identity-access, network-security

A.8.21 – Security of network services

WAF-SEC-040 · WAF-SEC-050 · WAF-SOV-090

🟠

Security, Sovereign Cloud

identity-access, network-security

A.8.22 – Segregation of networks

WAF-SEC-050 · WAF-SEC-120 · WAF-SOV-090

🟠

Security, Sovereign Cloud

identity-access, network-security

A.8.23 – Data leakage prevention

WAF-AGN-040

🟠

Agentic

logging-monitoring

A.8.23 – Web filtering

WAF-SEC-140

🟠

Security

network-security

A.8.24 – Use of cryptography

WAF-SEC-030 · WAF-SEC-040 · WAF-SEC-060 · WAF-SEC-130 · WAF-SOV-050 · WAF-SOV-110

🔴 🟠

Security, Sovereign Cloud

encryption-key-management, identity-access

A.8.25 – Secure development life cycle

WAF-SOV-050

🔴

Sovereign Cloud

encryption-key-management

A.8.27 – Secure system architecture

WAF-AGN-110

🟠

Agentic

agentic-governance

A.8.30 – Outsourced development

WAF-SEC-110

🟠

Security

container-security

A.8.32 – Change management

WAF-SEC-070

🟡

Security

container-security

A.12.1 – Control of operational software

WAF-AGN-090

🟡

Agentic

logging-monitoring

A.13.1.1 – Control of information in sessions

WAF-AGN-050 · WAF-AGN-080

🟠

Agentic

identity-access, logging-monitoring

A.15.1 – Information security in supplier relationships

WAF-REL-080

🟡

Reliability

reliability-design

A.16.1 – Management of information security incidents and improvements

WAF-REL-060

🟠

Reliability

logging-monitoring

A.17.1 – Information security continuity

WAF-REL-010 · WAF-REL-030 · WAF-REL-040 · WAF-REL-050 · WAF-REL-080 · WAF-REL-100 · WAF-REL-110

🔴 🟠 🟡

Reliability

data-governance, logging-monitoring, network-encryption, reliability-design, secret-management

A.17.1.3 – Verify, review and evaluate information security continuity

WAF-REL-070 · WAF-REL-090

🟠 🟡

Reliability

backup-recovery, logging-monitoring

A.17.2 – Redundancies

WAF-REL-010 · WAF-REL-020 · WAF-REL-030

🔴 🟠

Reliability

logging-monitoring, network-encryption

6.1.2 – Information security risk assessment

WAF-REL-100

🟡

Reliability

reliability-design

ISO 27001:2022 – Control Mapping

See also