Establishes the processes for identifying, managing, and demonstrating compliance with legal, regulatory, and contractual obligations, ensuring the organization meets all applicable requirements.
Manages the identification, tracking, and reporting of compliance requirements and the organization's status against them.
Regulatory requirements are becoming more complex and numerous, making it difficult to maintain a complete inventory of obligations and demonstrate ongoing compliance.
| Control ID | Control Name | Category & Type | Criticality | Status | Requirements | Action |
|---|---|---|---|---|---|---|
| CMP-001 | Compliance Program Management Establishes a comprehensive compliance p... |
Administrative
Detective
|
High | Active | 📋 10 Reqs | View → |
| CMP-002 | Control Compliance Monitoring Establishes continuous monitoring of sec... |
Operational
Detective
|
High | Active | 📋 10 Reqs | View → |
| CMP-003 | Compliance Evidence Management Establishes processes for identifying, c... |
Administrative
Detective
|
High | Active | 📋 10 Reqs | View → |
| CMP-004 | Non-Compliance Management Establishes processes to identify, docum... |
Administrative
Detective
|
High | Active | 📋 10 Reqs | View → |
| CMP-005 | Compliance Reporting Establishes regular reporting processes... |
Administrative
Detective
|
High | Active | 📋 10 Reqs | View → |
| CMP-006 | Regulatory Change Management Establishes systematic processes to iden... |
Administrative
Detective
|
Critical | Active | 📋 10 Reqs | View → |
| CMP-007 | Compliance Obligation Mapping Establishes comprehensive mapping of app... |
Administrative
Detective
|
High | Active | 📋 10 Reqs | View → |
The following requirements dictate specific audit evidence criteria and testing steps mapped directly under the controls of this domain.
| REQUIREMENT ID | REQUIREMENT TITLE & DETAILS | MAPPED CONTROL | TYPICAL OWNER | ACTION |
|---|---|---|---|---|
| CMP-001-R001 | Compliance Program Framework The organization shall establish a compl... | CMP-001 Compliance Program Management | Chief Compliance Officer, Compliance Management | View ↗ |
| CMP-001-R002 | Compliance Governance The organization shall establish governa... | CMP-001 Compliance Program Management | Chief Compliance Officer, Compliance Management | View ↗ |
| CMP-001-R003 | Compliance Scope The organization shall define and mainta... | CMP-001 Compliance Program Management | Chief Compliance Officer, Compliance Management | View ↗ |
| CMP-001-R004 | Compliance Roles and Responsibilities The organization shall clearly define an... | CMP-001 Compliance Program Management | Chief Compliance Officer, Compliance Management | View ↗ |
| CMP-001-R005 | Compliance Planning The organization shall conduct formal pl... | CMP-001 Compliance Program Management | Chief Compliance Officer, Compliance Management | View ↗ |
| CMP-001-R006 | Compliance Program Execution The organization shall execute the compl... | CMP-001 Compliance Program Management | Chief Compliance Officer, Compliance Management | View ↗ |
| CMP-001-R007 | Compliance Resource Management The organization shall manage resources... | CMP-001 Compliance Program Management | Chief Compliance Officer, Compliance Management | View ↗ |
| CMP-001-R008 | Compliance Performance Monitoring The organization shall monitor the perfo... | CMP-001 Compliance Program Management | Chief Compliance Officer, Compliance Management | View ↗ |
| CMP-001-R009 | Compliance Program Review The organization shall conduct periodic... | CMP-001 Compliance Program Management | Chief Compliance Officer, Compliance Management | View ↗ |
| CMP-001-R010 | Compliance Program Continuous Improvement The organization shall drive ongoing enh... | CMP-001 Compliance Program Management | Chief Compliance Officer, Compliance Management, Control Owners | View ↗ |
| CMP-002-R001 | Compliance Monitoring Framework The organization shall establish a compl... | CMP-002 Control Compliance Monitoring | Chief Compliance Officer, Compliance Management, Control Owners | View ↗ |
| CMP-002-R002 | Compliance Assessment Planning The organization shall conduct formal pl... | CMP-002 Control Compliance Monitoring | Chief Compliance Officer, Compliance Management, Control Owners | View ↗ |
| CMP-002-R003 | Control Compliance Assessment The organization shall conduct regular a... | CMP-002 Control Compliance Monitoring | Chief Compliance Officer, Compliance Management, Control Owners | View ↗ |
| CMP-002-R004 | Compliance Gap Identification The organization shall identify complian... | CMP-002 Control Compliance Monitoring | Chief Compliance Officer, Compliance Management, Control Owners | View ↗ |
| CMP-002-R005 | Compliance Status Tracking The organization shall track the status... | CMP-002 Control Compliance Monitoring | Chief Compliance Officer, Compliance Management, Control Owners | View ↗ |
| CMP-002-R006 | Compliance Exception Identification The organization shall identify and docu... | CMP-002 Control Compliance Monitoring | Chief Compliance Officer, Compliance Management, Control Owners | View ↗ |
| CMP-002-R007 | Compliance Monitoring Reporting The organization shall report on complia... | CMP-002 Control Compliance Monitoring | Chief Compliance Officer, Compliance Management, Control Owners | View ↗ |
| CMP-002-R008 | Compliance Escalation The organization shall establish escalat... | CMP-002 Control Compliance Monitoring | Chief Compliance Officer, Compliance Management, Control Owners | View ↗ |
| CMP-002-R009 | Compliance Monitoring Review The organization shall conduct periodic... | CMP-002 Control Compliance Monitoring | Chief Compliance Officer, Compliance Management, Control Owners | View ↗ |
| CMP-002-R010 | Compliance Monitoring Improvement The organization shall drive ongoing enh... | CMP-002 Control Compliance Monitoring | Compliance Management, Control Owners, Records Management | View ↗ |
| CMP-003-R001 | Evidence Management Framework The organization shall establish an evid... | CMP-003 Compliance Evidence Management | Compliance Management, Control Owners, Records Management | View ↗ |
| CMP-003-R002 | Evidence Identification The organization shall identify the evid... | CMP-003 Compliance Evidence Management | Compliance Management, Control Owners, Records Management | View ↗ |
| CMP-003-R003 | Evidence Collection The organization shall collect complianc... | CMP-003 Compliance Evidence Management | Compliance Management, Control Owners, Records Management | View ↗ |
| CMP-003-R004 | Evidence Validation The organization shall validate complian... | CMP-003 Compliance Evidence Management | Compliance Management, Control Owners, Records Management | View ↗ |
| CMP-003-R005 | Evidence Classification The organization shall establish classif... | CMP-003 Compliance Evidence Management | Compliance Management, Control Owners, Records Management | View ↗ |
| CMP-003-R006 | Evidence Repository Management The organization shall establish and mai... | CMP-003 Compliance Evidence Management | Compliance Management, Control Owners, Records Management | View ↗ |
| CMP-003-R007 | Evidence Protection The organization shall protect complianc... | CMP-003 Compliance Evidence Management | Compliance Management, Control Owners, Records Management | View ↗ |
| CMP-003-R008 | Evidence Availability The organization shall ensure compliance... | CMP-003 Compliance Evidence Management | Compliance Management, Control Owners, Records Management | View ↗ |
| CMP-003-R009 | Evidence Review The organization shall conduct periodic... | CMP-003 Compliance Evidence Management | Compliance Management, Control Owners, Records Management | View ↗ |
| CMP-003-R010 | Evidence Lifecycle Management The organization shall maintain lifecycl... | CMP-003 Compliance Evidence Management | Chief Compliance Officer, Compliance Management, Risk Owners | View ↗ |
| CMP-004-R001 | Non-Compliance Identification The organization shall identify instance... | CMP-004 Non-Compliance Management | Chief Compliance Officer, Compliance Management, Risk Owners | View ↗ |
| CMP-004-R002 | Non-Compliance Recording The organization shall record identified... | CMP-004 Non-Compliance Management | Chief Compliance Officer, Compliance Management, Risk Owners | View ↗ |
| CMP-004-R003 | Non-Compliance Classification The organization shall establish a class... | CMP-004 Non-Compliance Management | Chief Compliance Officer, Compliance Management, Risk Owners | View ↗ |
| CMP-004-R004 | Root Cause Analysis The organization shall conduct root caus... | CMP-004 Non-Compliance Management | Chief Compliance Officer, Compliance Management, Risk Owners | View ↗ |
| CMP-004-R005 | Corrective Action Planning The organization shall develop formal co... | CMP-004 Non-Compliance Management | Chief Compliance Officer, Compliance Management, Risk Owners | View ↗ |
| CMP-004-R006 | Corrective Action Implementation The organization shall implement approve... | CMP-004 Non-Compliance Management | Audit & Compliance | View ↗ |
| CMP-004-R007 | Corrective Action Verification The organization shall verify that imple... | CMP-004 Non-Compliance Management | Chief Compliance Officer, Compliance Management, Risk Owners | View ↗ |
| CMP-004-R008 | Non-Compliance Escalation The organization shall establish escalat... | CMP-004 Non-Compliance Management | Chief Compliance Officer, Compliance Management, Risk Owners | View ↗ |
| CMP-004-R009 | Non-Compliance Reporting The organization shall report on non-com... | CMP-004 Non-Compliance Management | Chief Compliance Officer, Compliance Management, Risk Owners | View ↗ |
| CMP-004-R010 | Non-Compliance Closure The organization shall establish process... | CMP-004 Non-Compliance Management | Chief Compliance Officer, Compliance Management, Risk Owners | View ↗ |
| CMP-005-R001 | Compliance Reporting Framework The organization shall establish a compl... | CMP-005 Compliance Reporting | Chief Compliance Officer, Compliance Management, Reporting Owners | View ↗ |
| CMP-005-R002 | Reporting Scope The organization shall define a document... | CMP-005 Compliance Reporting | Chief Compliance Officer, Compliance Management, Reporting Owners | View ↗ |
| CMP-005-R003 | Reporting Content The organization shall define content re... | CMP-005 Compliance Reporting | Chief Compliance Officer, Compliance Management, Reporting Owners | View ↗ |
| CMP-005-R004 | Reporting Frequency The organization shall establish reporti... | CMP-005 Compliance Reporting | Chief Compliance Officer, Compliance Management, Reporting Owners | View ↗ |
| CMP-005-R005 | Executive Compliance Reporting The organization shall provide executive... | CMP-005 Compliance Reporting | Chief Compliance Officer, Compliance Management, Reporting Owners | View ↗ |
| CMP-005-R006 | Regulatory Compliance Reporting The organization shall prepare and submi... | CMP-005 Compliance Reporting | Chief Compliance Officer, Compliance Management, Reporting Owners | View ↗ |
| CMP-005-R007 | Compliance Dashboard Reporting The organization shall develop and maint... | CMP-005 Compliance Reporting | Chief Compliance Officer, Compliance Management, Reporting Owners | View ↗ |
| CMP-005-R008 | Report Validation The organization shall validate complian... | CMP-005 Compliance Reporting | Chief Compliance Officer, Compliance Management, Reporting Owners | View ↗ |
| CMP-005-R009 | Reporting Review The organization shall conduct periodic... | CMP-005 Compliance Reporting | Chief Compliance Officer, Compliance Management, Reporting Owners | View ↗ |
| CMP-005-R010 | Reporting Continuous Improvement The organization shall drive ongoing enh... | CMP-005 Compliance Reporting | Chief Compliance Officer, Compliance Management, Reporting Owners | View ↗ |
| CMP-006-R001 | Regulatory Change Framework The organization shall establish a regul... | CMP-006 Regulatory Change Management | Compliance Management, Legal, Regulatory Affairs, Control Owners | View ↗ |
| CMP-006-R002 | Regulatory Change Identification The organization shall identify changes... | CMP-006 Regulatory Change Management | Compliance Management, Legal, Regulatory Affairs, Control Owners | View ↗ |
| CMP-006-R003 | Regulatory Change Monitoring The organization shall monitor regulator... | CMP-006 Regulatory Change Management | Compliance Management, Legal, Regulatory Affairs, Control Owners | View ↗ |
| CMP-006-R004 | Impact Assessment The organization shall conduct impact as... | CMP-006 Regulatory Change Management | Compliance Management, Legal, Regulatory Affairs, Control Owners | View ↗ |
| CMP-006-R005 | Change Prioritization The organization shall prioritize regula... | CMP-006 Regulatory Change Management | Compliance Management, Legal, Regulatory Affairs, Control Owners | View ↗ |
| CMP-006-R006 | Change Implementation Planning The organization shall develop formal pl... | CMP-006 Regulatory Change Management | Compliance Management, Legal, Regulatory Affairs, Control Owners | View ↗ |
| CMP-006-R007 | Compliance Update Management The organization shall update compliance... | CMP-006 Regulatory Change Management | Compliance Management, Legal, Regulatory Affairs, Control Owners | View ↗ |
| CMP-006-R008 | Regulatory Change Communication The organization shall communicate regul... | CMP-006 Regulatory Change Management | Compliance Management, Legal, Regulatory Affairs, Control Owners | View ↗ |
| CMP-006-R009 | Regulatory Change Review The organization shall conduct periodic... | CMP-006 Regulatory Change Management | Compliance Management, Legal, Regulatory Affairs, Control Owners | View ↗ |
| CMP-006-R010 | Regulatory Change Effectiveness The organization shall evaluate the over... | CMP-006 Regulatory Change Management | Compliance Management, Legal, Regulatory Affairs, Control Owners | View ↗ |
| CMP-007-R001 | Obligation Identification The organization shall identify all lega... | CMP-007 Compliance Obligation Mapping | Compliance Management, Control Owners, Legal | View ↗ |
| CMP-007-R002 | Obligation Classification The organization shall establish a class... | CMP-007 Compliance Obligation Mapping | Compliance Management, Control Owners, Legal | View ↗ |
| CMP-007-R003 | Control Mapping The organization shall maintain mappings... | CMP-007 Compliance Obligation Mapping | Compliance Management, Control Owners, Legal | View ↗ |
| CMP-007-R004 | Mapping Validation The organization shall validate control... | CMP-007 Compliance Obligation Mapping | Compliance Management, Control Owners, Legal | View ↗ |
| CMP-007-R005 | Gap Identification The organization shall use obligation ma... | CMP-007 Compliance Obligation Mapping | Compliance Management, Control Owners, Legal | View ↗ |
| CMP-007-R006 | Mapping Maintenance The organization shall maintain obligati... | CMP-007 Compliance Obligation Mapping | Compliance Management, Control Owners, Legal | View ↗ |
| CMP-007-R007 | Mapping Traceability The organization shall maintain traceabi... | CMP-007 Compliance Obligation Mapping | Compliance Management, Control Owners, Legal | View ↗ |
| CMP-007-R008 | Mapping Reporting The organization shall report on obligat... | CMP-007 Compliance Obligation Mapping | Compliance Management, Control Owners, Legal | View ↗ |
| CMP-007-R009 | Mapping Review The organization shall conduct periodic... | CMP-007 Compliance Obligation Mapping | Compliance Management, Control Owners, Legal | View ↗ |
| CMP-007-R010 | Mapping Continuous Improvement The organization shall drive ongoing enh... | CMP-007 Compliance Obligation Mapping | Compliance Management, Control Owners, Legal | View ↗ |
| Framework Code | Framework Name & Description | Family / Category | Version | Action |
|---|---|---|---|---|
| MAPPED | ISO 37301 Crosswalk regulatory baseline mapped under ASPIA UCL. | Standard | Baseline | — |
| NIST-CSF | NIST CSF (ID.GV-2) The NIST Cybersecurity Framework provide... |
NIST
Framework
|
v2 | View → |
| COBIT2019 | COBIT (APO13) COBIT is an enterprise governance and ma... |
COBIT
Governance Framework
|
v2019 | View → |
| MAPPED | ISO 19600 Crosswalk regulatory baseline mapped under ASPIA UCL. | Standard | Baseline | — |
| MAPPED | FCPA Crosswalk regulatory baseline mapped under ASPIA UCL. | Standard | Baseline | — |
| GDPR | GDPR The General Data Protection Regulation i... |
EU
Regulation
|
vCurrent | View → |
| HIPAA | HIPAA HIPAA is a U.S. federal law supported by... |
US
Law
|
vCurrent | View → |
| MAPPED | SOX Crosswalk regulatory baseline mapped under ASPIA UCL. | Standard | Baseline | — |