ISO/IEC 27001 ↔ US Employment Law - Federal Baseline
3 canonical controls in Keel's library satisfy clauses ofboth ISO/IEC 27001 and US Employment Law - Federal Baseline. Implement each once, attach the evidence once, and it counts toward each standard. The overlap is the work you don't repeat.
Controls that satisfy both
| Canonical control | ISO/IEC 27001 clauses | US Employment Law - Federal Baseline clauses |
|---|---|---|
| Data retention & secure disposal Data is retained per policy and securely destroyed when no longer needed. | A.8.10 | us.wage-hour.recordkeeping, us.recordkeeping.eeo, us.recordkeeping.i9-retention |
| Personnel security (HR) Background screening, confidentiality agreements, and onboarding/offboarding security steps. | A.6.1, A.6.5 | us.hiring-onboarding.i9, us.hiring-onboarding.fcra-background, us.privacy.polygraph |
| Personal data privacy Personal data of employees and customers is protected with clear, honored privacy practices. | A.5.34 | us.privacy.electronic-monitoring |
Clause identifiers (ISO/IEC 27001 and US Employment Law - Federal Baseline) are referenced factually for mapping. Keel is not affiliated with or endorsed by the bodies that publish these standards. Control descriptions are Keel's own; a framework's full authored control count is on itsframework page.
Why this is one project, not two
On a crosswalk-native model, US Employment Law - Federal Baseline mostly lights up controls you already built forISO/IEC 27001. You're not re-uploading the same screenshot for a second audit. You apply the framework and see the genuine delta worth working. That's the whole idea behind collect once, comply everywhere.