RG 1058/2025 → ISO 27001:2022 — VASP Control Crosswalk

Argentina’s Virtual Asset Service Provider framework (CNV RG 1058/2025) mapped article-by-article to ISO/IEC 27001:2022 controls — turning the regulatory text into an operational control set: for each article, a control objective, the associated controls, the ISO/IEC 27001:2022 reference, and the technical services it touches.

Most Argentine regulatory matrices focus on the BCRA (banking and payments). This one covers the CNV crypto / VASP perimeter and adds the layer that makes it actionable — the mapping to an international control standard a VASP is likely already implementing.

Sample — 5 of 40+ mapped articles

Article	Pillar	Control objective	Associated controls	ISO/IEC 27001:2022
Art. 3	Supervision	Determine when a foreign VASP must register and fall under local oversight	Contact-criteria analysis; contract review; advertising controls	A.5.5 Contact with authorities · A.5.31 Legal & regulatory requirements
Art. 9	Solvency	Ensure VASPs’ financial stability (minimum net worth by category)	Capital controls; financial audit; periodic balance-sheet updates	A.5.31 Legal & regulatory requirements · A.5.4 Management responsibilities
Art. 12	IT Security	Protect the integrity and availability of systems and data	IT policies; contingency plans; backup & recovery procedures	A.8.25 Secure development life cycle · A.8.13 Information backup · A.8.16 Monitoring activities
Art. 13	Cybersecurity	Prevent, detect, and mitigate cybersecurity incidents	SOC / monitoring; SIEM; IDS/IPS; DLP/EDR; access control; IR plan	A.5.24–A.5.26 Incident management · A.8.16 Monitoring activities · A.8.7 Protection against malware
Art. 18	Custody	Prevent commingling of funds and protect client asset rights	Segregated bank accounts; up-to-date records; authorized PSPs	A.5.31 Legal & regulatory requirements · A.5.33 Protection of records

The full crosswalk includes

• All 40+ articles of RG 1058/2025, across every pillar (compliance, supervision, governance, solvency, IT security, cybersecurity, custody, AML, and more).
• A control objective and associated controls for each article.
• The mapped ISO/IEC 27001:2022 Annex A control(s).
• The impacted technical services per article.
• Maintained and updated as the framework evolves.

A working tool for VASPs preparing for CNV registration, and for the security and compliance teams that have to turn the regulation into audit-ready controls.

---

Get the full crosswalk. Available as a paid deliverable, with an optional walkthrough. → andres.x.cortes@gmail.com · linkedin.com/in/andresxcortes