← Frameworks / ISAE 3402 / Control Mappings

ISAE 3402 Assurance Reports on Controls at a Service Organisation

International assurance engagement standard for reporting on controls at service organisations relevant to user entities' financial reporting. Defines Type I (design suitability) and Type II (design and operating effectiveness) report structures covering management assertions, control objectives, control activities, subservice organisation management, and complementary user entity controls (CUECs). Widely used by cloud providers, data centres, payment processors, and outsourcing firms. Equivalent to SSAE 18 / SOC 1 in the US.

Controls: 96

Total Mappings: 131

Publisher: IAASB (International Auditing and Assurance Standards Board) Version: 2011 (revised 2022)

ISAE 3402 → SP 800-53 SP 800-53 → ISAE 3402 Coverage Analysis

AC (9) AU (7) CA (8) CM (10) CP (4) IA (4) IR (2) PE (10) PL (4) PM (8) PS (2) RA (4) SA (7) SC (5) SI (6) SR (6)

AC Access Control

Control	Name	ISAE 3402 References
AC-01	Policy and Procedures	Clause 4
AC-02	Account Management	Clause 4
AC-03	Access Enforcement	Clause 4
AC-04	Information Flow Enforcement	Clause 4
AC-05	Separation of Duties	Clause 4
AC-06	Least Privilege	Clause 4
AC-17	Remote Access	Clause 4
AC-20	Use of External Systems	Clause 7Clause 8
AC-21	Information Sharing	Clause 8

AU Audit and Accountability

Control	Name	ISAE 3402 References
AU-01	Policy and Procedures	Clause 4
AU-02	Event Logging	Clause 4
AU-03	Content of Audit Records	Clause 4
AU-06	Audit Record Review, Analysis, and Reporting	Clause 4Clause 6Clause 10
AU-07	Audit Record Reduction and Report Generation	Clause 10
AU-12	Audit Record Generation	Clause 4
AU-16	Cross-organizational Audit Logging	Clause 6

CA Security Assessment and Authorization

Control	Name	ISAE 3402 References
CA-01	Policy and Procedures	Clause 1Clause 3
CA-02	Control Assessments	Clause 2Clause 3Clause 5Clause 6Clause 10
CA-03	Information Exchange	Clause 7Clause 8
CA-04	Security Certification	Clause 6
CA-05	Plan of Action and Milestones	Clause 2Clause 5Clause 10
CA-06	Authorization	Clause 1Clause 2Clause 3
CA-07	Continuous Monitoring	Clause 2Clause 5Clause 6Clause 10
CA-08	Penetration Testing	Clause 6

CM Configuration Management

Control	Name	ISAE 3402 References
CM-01	Policy and Procedures	Clause 4
CM-02	Baseline Configuration	Clause 4Clause 9
CM-03	Configuration Change Control	Clause 4
CM-04	Impact Analyses	Clause 4
CM-05	Access Restrictions for Change	Clause 4
CM-06	Configuration Settings	Clause 4
CM-07	Least Functionality	Clause 4
CM-08	System Component Inventory	Clause 9
CM-12	Information Location	Clause 9
CM-13	Data Action Mapping	Clause 9

CP Contingency Planning

Control	Name	ISAE 3402 References
CP-01	Policy and Procedures	Clause 4
CP-02	Contingency Plan	Clause 4
CP-09	System Backup	Clause 4
CP-10	System Recovery and Reconstitution	Clause 4

IA Identification and Authentication

Control	Name	ISAE 3402 References
IA-01	Policy and Procedures	Clause 4
IA-02	Identification and Authentication (Organizational Users)	Clause 4
IA-04	Identifier Management	Clause 4
IA-05	Authenticator Management	Clause 4

IR Incident Response

Control	Name	ISAE 3402 References
IR-06	Incident Reporting	Clause 10
IR-07	Incident Response Assistance	Clause 10

PE Physical and Environmental Protection

Control	Name	ISAE 3402 References
PE-01	Policy and Procedures	Clause 4
PE-02	Physical Access Authorizations	Clause 4
PE-03	Physical Access Control	Clause 4
PE-06	Monitoring Physical Access	Clause 4
PE-09	Power Equipment and Cabling	Clause 4
PE-10	Emergency Shutoff	Clause 4
PE-11	Emergency Power	Clause 4
PE-12	Emergency Lighting	Clause 4
PE-13	Fire Protection	Clause 4
PE-14	Environmental Controls	Clause 4

PL Planning

Control	Name	ISAE 3402 References
PL-01	Policy and Procedures	Clause 1
PL-02	System Security and Privacy Plans	Clause 1Clause 2Clause 3Clause 8Clause 9
PL-04	Rules of Behavior	Clause 2
PL-08	Security and Privacy Architectures	Clause 9

PM Program Management

Control	Name	ISAE 3402 References
PM-01	Information Security Program Plan	Clause 1Clause 2Clause 3
PM-05	System Inventory	Clause 1Clause 9
PM-06	Measures of Performance	Clause 5Clause 6Clause 10
PM-07	Enterprise Architecture	Clause 9
PM-09	Risk Management Strategy	Clause 1Clause 2Clause 3Clause 8
PM-11	Mission and Business Process Definition	Clause 1Clause 3
PM-14	Testing, Training, and Monitoring	Clause 5
PM-30	Supply Chain Risk Management Strategy	Clause 7

PS Personnel Security

Control	Name	ISAE 3402 References
PS-01	Policy and Procedures	Clause 9
PS-02	Position Risk Designation	Clause 9

RA Risk Assessment

Control	Name	ISAE 3402 References
RA-01	Policy and Procedures	Clause 1Clause 3
RA-02	Security Categorization	Clause 1Clause 3
RA-03	Risk Assessment	Clause 1Clause 3
RA-09	Criticality Analysis	Clause 3

SA System and Services Acquisition

Control	Name	ISAE 3402 References
SA-03	System Development Life Cycle	Clause 4
SA-04	Acquisition Process	Clause 7
SA-05	System Documentation	Clause 9
SA-09	External System Services	Clause 7Clause 8
SA-10	Developer Configuration Management	Clause 4
SA-11	Developer Testing and Evaluation	Clause 4
SA-17	Developer Security and Privacy Architecture and Design	Clause 9

SC System and Communications Protection

Control	Name	ISAE 3402 References
SC-07	Boundary Protection	Clause 4
SC-08	Transmission Confidentiality and Integrity	Clause 4
SC-12	Cryptographic Key Establishment and Management	Clause 4
SC-13	Cryptographic Protection	Clause 4
SC-28	Protection of Information at Rest	Clause 4

SI System and Information Integrity

Control	Name	ISAE 3402 References
SI-02	Flaw Remediation	Clause 4
SI-03	Malicious Code Protection	Clause 4
SI-04	System Monitoring	Clause 4
SI-07	Software, Firmware, and Information Integrity	Clause 4
SI-10	Information Input Validation	Clause 4
SI-12	Information Management and Retention	Clause 4

SR Supply Chain Risk Management

Control	Name	ISAE 3402 References
SR-01	Policy and Procedures	Clause 7Clause 8
SR-02	Supply Chain Risk Management Plan	Clause 7
SR-03	Supply Chain Controls and Processes	Clause 7
SR-05	Acquisition Strategies, Tools, and Methods	Clause 7
SR-06	Supplier Assessments and Reviews	Clause 7
SR-07	Supply Chain Operations Security	Clause 8