Adopt once. Map once. Test once.

93 Annex A controls + clauses 4–10

ISMS scope, interested parties, risk treatment, Statement of Applicability, internal audits and management review.

Implementation guidance

Pairs with ISO 27001 to document how each control is operated.

Trust Services Criteria

Security, availability, confidentiality, processing integrity and privacy criteria with evidence reuse.

Key controller and processor obligations

Lawful basis, data subject rights, breach notification, DPIAs, processor contracts and transfers.

Administrative, physical, technical safeguards

Access control, audit controls, transmission security and contingency planning.

12 requirement areas

Network security, data protection, access control, monitoring and testing.

23 categories across 6 functions

Govern, identify, protect, detect, respond and recover outcomes.

Selected control families

Access, audit, configuration, identity, incident response, risk and system protection.

18 control groups

Prioritised safeguards from asset inventory through penetration testing.

Article 21 measures

EU cybersecurity risk management obligations for essential and important entities.

ICT risk and resilience

Governance, protection, detection, recovery, testing and third-party risk.

8 mitigation strategies

ACSC-aligned mitigation strategies including MFA, patching and backups.

PIMS extension

Privacy information management controls for controllers and processors.

AI management system

AI policy, impact assessment, data governance, transparency and monitoring.