Skip to content

Business Email Compromise

What is Business Email Compromise?

A sophisticated scam targeting organisations that conduct wire transfers or handle sensitive financial data. Attackers impersonate executives or trusted partners to trick employees into transferring funds or disclosing confidential information.

Information Security

Frameworks that govern business email compromise

PCI DSS v4.0View framework →ISO 27001:2022View framework →NIST Cybersecurity Framework 2.0View framework →

What the standards actually require on business email compromise

Requirements naming business email compromise across 4 standards, quoted from the control text.

Australian Information Security Manual1 control

Personnel dealing with banking details and payment requests are advised of what business email compromise is, how to manage such situations and how to report it.

ISM-1740 · Business email compromise awareness for payment staff →
CIS Controls v8.11 control

Teach staff to spot social engineering, including phishing, business email compromise, pretexting and tailgating. Implementation Groups: IG1, IG2 and IG3 (part of the IG1 essential cyber hygiene baseline, so every enterprise applies it). Asset type: Users.

cis-controls-v8-1::14.2 · Train Workforce Members to Recognize Social Engineering Attacks →
FFIEC IT Examination Handbook1 control

Customer awareness and education for retail and commercial account holders explains the protections Regulation E does and does not give and which online accounts it covers, states that the institution will never ask for log-in credentials by phone or email, li...

ffiec-it-examination-handbook::IS-II.C.16(a) · II.C.16(a) Customer Awareness (Information Security) →
ISO 37003:20251 control

Prevent technology-enabled fraud, which held term 3.25 defines as fraud against or by the organization that relies heavily on information technology and could not happen without it, covering cyber-enabled and cyber-dependent kinds and fraud enabled by artifici...

iso-37003-2025::8.2.9 · Preventing technology-enabled fraud →

Questions people ask about business email compromise

What is Business Email Compromise?
A sophisticated scam targeting organisations that conduct wire transfers or handle sensitive financial data. Attackers impersonate executives or trusted partners to trick employees into transferring funds or disclosing confidential information.
Why is Business Email Compromise important for compliance?
Business Email Compromise is a key concept in Information Security. Understanding business email compromise helps organizations meet regulatory requirements, reduce risk, and demonstrate due diligence during audits. Our compliance platform maps 1,016 frameworks with 316K cross-framework control mappings.
Which compliance frameworks address Business Email Compromise?
Business Email Compromise appears in the requirement text of Australian Information Security Manual, CIS Controls v8.1, FFIEC IT Examination Handbook, ISO 37003:2025. Across these standards we have identified 4 controls that name it directly, each linked to the control text on the compliance platform.
Where can I learn more about Business Email Compromise?
Explore our compliance framework pages to see how business email compromise applies across different standards and regulations. Our implementation guides provide step-by-step guidance, and the compliance platform offers AI-powered analysis of how this concept maps across 1,016 frameworks.

See how Business Email Compromise applies across compliance frameworks

Our platform maps 1,016 frameworks with 316K cross-framework control mappings. Explore how this concept is addressed across standards.

Explore on Platform
Written and maintained by Gerard Blokdyk, The Art of Service.