Control catalogues

Audhive ships two catalogues: ISO/IEC 27001:2022 and the Swiss ICT Minimum Standard 2023. You load one of them in the setup and adapt it to your organisation. Your own catalogues come in as CSV.

International

94Controls

ISO/IEC 27001:2022

The international standard for information security management systems (ISMS). Its Annex A lists the controls that certifications and many customer requirements are based on.

For whom: Organisations with an ISMS, certified to ISO 27001 or with customers who require it.
Structure: 4 themes as policies, each control with its Annex A number (e.g. 5.15).
Scope: 94 controls, as of ISO/IEC 27001:2022 including Amendment 1:2024.
Guidance: Implementation guidance per control based on ISO/IEC 27002:2022.

Organisational38 People8 Physical14 Technological34

An international standard – Audhive does not change it. ISO/IEC 27001 is published by ISO and IEC and protected by copyright. Audhive ships a prepared dataset for working with the framework: structure and numbering according to Annex A, a short description per control and Audhive’s own working aids (control objective, implementation text, expected documentation, guidance). It does not replace the standard. Only the text of the standard is authoritative; it is available from ISO or from the Swiss Association for Standardization (SNV). Audhive is not affiliated with ISO or IEC.

ISO/IEC 27001:2022 – iso.org Swiss Association for Standardization (SNV)

Switzerland

108Controls

ICT Minimum Standard 2023

The recommendation of the Swiss Federal Office for National Economic Supply (FONES/BWL) for stronger ICT resilience, maintained since 2024 by the Federal Office for Cybersecurity (FOCS/BACS). Written for operators of critical infrastructure, usable by any organisation. Structured along the NIST Cybersecurity Framework.

For whom: Swiss companies, SMEs and public bodies looking for a recognised, practical yardstick.
Structure: 5 functions as policies with 23 categories (e.g. ID.AM, PR.AC, DE.CM). Each control has a number such as PR.AC-1.
Scope: 108 controls, official texts in German, English, French and Italian.
ICT standard only?: The SEC Swiss Edition for SMEs – as a cloud subscription or an annual licence for your server.

Identify29 Protect39 Detect18 Respond16 Recover6

Numbers = controls per function as shipped with Audhive.

A public standard of the Swiss Confederation – Audhive does not change it. The ICT Minimum Standard was developed by FONES (BWL) and is now maintained by the Federal Office for Cybersecurity (BACS); it is freely available. Audhive ships a prepared, import-ready dataset: functions, categories and identifiers as in the standard, the measure texts as published (official wording) in German, English, French and Italian, plus Audhive’s own working aids (not part of the standard: title, control objective, expected documentation, guidance). Obvious errors in the official texts are corrected by Audhive and marked in the app as “Audhive correction”. The federal original is authoritative. Audhive is not a federal offering and is neither endorsed nor reviewed by FONES or the BACS.

ICT minimum standards – BACS (in German)Notice from FONES (in German)

The two catalogues compared
	ISO/IEC 27001:2022	ICT Minimum Standard 2023
Origin	International standard (ISO/IEC)	Recommendation of FONES, maintained by FOCS (Switzerland)
Grouping	4 themes	5 functions, 23 categories
Controls	94	108
Typical use	ISMS, certification, customer requirements	Assessment and audit for Swiss organisations
Languages in Audhive	English and German (in a French or Italian interface the texts appear in English)	German, English, French and Italian (official texts)
Original	Text of the standard for purchase from ISO or SNV	freely available from the BACS
In Audhive	Import-ready datasets: ICT measures in the official wording (obvious errors corrected and marked), ISO as a short description per control; plus Audhive’s own working aids. The standard itself remains authoritative.

Insights: ISO 27001 and the ICT Minimum Standard compared

Content per control

More than a list of titles

Every control comes with what you need for the audit. Auditors and owners know what is expected – and which evidence counts.

All fields can be edited. Your additions per tenant – responsibility and implementation – live in the Security Framework.

The “Source” column shows what comes from the standard and what from Audhive. The standard itself is not changed.

Security Framework: control with objective, control text, expected documentation and guidance

Fields per control with example PR.AC-1 from the ICT Minimum Standard
Field	Example: PR.AC-1 (ICT Minimum Standard)	Source
Policy / category	Protect · PR.AC Access Management	Structure and identifier of the standard
Title	Identity and Access Management	Audhive working aid
Control objective	A clearly defined procedure for granting and managing permissions and access data for users, devices and processes is in place.	Audhive working aid
Control	Establish a clearly defined procedure for granting and managing permissions and access data …	Measure text of the standard (official wording; obvious errors corrected and marked)
Expected documentation	Identity and access management (IAM) policy; user account lifecycle records; access provisioning workflow	Audhive working aid
Guidance	Follow the principle of least privilege. Implement role-based access control (RBAC) …	Audhive working aid

Rating

From catalogue to result

The catalogue is the starting point. Per tenant you select the relevant controls and rate them in the assessment.

1 · Control set

Per tenant you decide which controls apply. Coverage per policy shows what is in scope.

2 · Maturity level

In SEC mode you rate every control on six levels, plus design, effectiveness and risk.

3 · Status per policy

The radar chart shows actual against target per theme or function – in the report as achievement chart and statement of applicability.

Maturity levels in SEC mode (default)
Level	Meaning (default, adjustable under Admin › Settings › Master data)
0	Non-existent
1	Present but not documented or implemented
2	Documented
3	Reviewed
4	Managed with KPIs
5	Optimized

Insights: understanding maturity levels

Catalogues and modes

Which catalogue fits which mode

The two shipped catalogues are made for the security audit (SEC). Every policy applies to SEC, ICS or both modes – the control set only offers matching ones per tenant.

SEC

Security audit against ISO 27001 or the ICT Minimum Standard: maturity, risk, evidence, Security Framework.

ICS

Internal control system: controls by audit scope and effectiveness, plus questionnaires with signatures.

FULL

Both in one installation. Per tenant you decide: SEC, ICS or both.

SEC Swiss Edition

SEC mode, catalogue fixed to the ICT Minimum Standard 2023. For SMEs – cloud subscription or annual licence.

About the Swiss Edition

Own catalogues

Your framework, your additions

Own catalogue in the setup: one combined CSV file in the same format as the shipped catalogues.
Supplementary import: add new policies, references and controls to an existing library. Audhive checks the file first – required fields, lengths, references, duplicates – and never changes existing entries.
Multilingual: base texts in English, translations per field in German, French and Italian. With your own AI key Audhive translates at the push of a button.
Export: the whole library as CSV – in the same format as the import.

Supplementary import step by step

Supplementary import checked: rows, new, existing and faulty entries with row number and reason

See the catalogues in the demo

The demo contains an extract of the ICT Minimum Standard with fictitious tenants.

Try the demo Pricing