Hacker News Reader

Is there a corresponding ISO control for this?

There probably is but ISO certs are just paperwork filed. Reality is different.

Sure. But then again you need a framework to approximate reality. ISO isn’t perfect by any means. But it’s a start.

What do you use?

ISO 9001 + 27001 :(

At least falls under 31000's framework for identifying and dealing with risk