In this episode of Secure and Simple Podcast, host Dejan Kosutic (Advisera) speaks with Aaron Lange (GRC Lab, TÜV SÜD auditor) about combining security controls across multiple standards and frameworks, including ISO 27001/27002, NIST Cybersecurity Framework, NIST SP 800-53 and 800-171, TISAX, C5, SOC 2, and sector-specific regimes like PCI DSS and CMMC. They clarify the difference between requirements and controls, and how to handle cross-mapping, gap analysis, scoping, and phased implementation when adding frameworks. They discuss how standards typically complement rather than contradict each other (e.g., NIS2 incident reporting timelines) and why starting with a generic ISMS like ISO 27001 before adding specific frameworks often works best, illustrated by a startup achieving ISO 27001 and then C5 attestation. They also examine the purpose and common shortcomings of the ISO 27001 Statement of Applicability and close with advice to avoid perfectionism, start, and iterate.
Podden och tillhörande omslagsbild på den här sidan tillhör
Dejan Kosutic. Innehållet i podden är skapat av Dejan Kosutic och inte av,
eller tillsammans med, Poddtoppen.
