Skip to content
Cyber Compliance

GDPR → NIST 800-53 crosswalk

A control-by-control mapping between General Data Protection Regulation (EU 2016/679) and NIST SP 800-53 Rev. 5. 7 mappings.

GDPRNIST 800-53RelationshipNotes
Art. 25
Data protection by design and by default
PM-1
Information security program plan
RelatedCurated
Gouvernance et politique de sécurité
Art. 30
Records of processing activities
CM-8
System component inventory
RelatedCurated
Inventaire des actifs et des données
Art. 32
Security of processing
SC-8
Transmission confidentiality and integrity
PartialCurated
Cryptographie et protection des données
Art. 32
Security of processing
SC-28
Protection of information at rest
PartialCurated
Cryptographie et protection des données
Art. 32
Security of processing
CP-9
System backup
RelatedCurated
Sauvegarde et restauration
Art. 33
Notification of a personal data breach to the supervisory authority
IR-4
Incident handling
RelatedCurated
Réponse aux incidents et notification des violations
Art. 33
Notification of a personal data breach to the supervisory authority
IR-6
Incident reporting
RelatedCurated
Réponse aux incidents et notification des violations

Mappings marked “Official” derive from standards-body informative references; “Curated” mappings are authored by Cyber Compliance and provided for guidance only.