COBIT:2019 (COBIT2019) - Universal Control Library

Framework Overview

COBIT2019 · Full Framework Profile

Purpose & Objective

Help enterprises create value from information and technology while balancing benefits, risk and resource use. It supports governance accountability, alignment of IT with business goals, performance measurement and coordinated management of technology-related risks.

Scope

Applies across enterprise information and technology, not only cybersecurity or the IT department. It can cover governance structures, processes, information flows, services, people, skills, infrastructure and supplier relationships, tailored to enterprise strategy, size, regulatory context and risk profile.

Key Focus Areas

Structure & Domains

Certification & Assessment

Official Source

COBIT2019 · Reference

Visit Official Source

Associated Compliance Domains

29 Mapped Domains in Framework

Click any domain to explore its controls, requirements, and implementation guidance.

Domain ID	Code	Domain Name	Business Owner	Controls	Status	Action
DOM-001	GOV	Governance	Board / CISO	8	Active	View Domain →
DOM-002	POL	Policy & Document Management	Compliance	4	Active	View Domain →
DOM-003	RSK	Risk Management	Chief Risk Officer	9	Active	View Domain →
DOM-004	CMP	Compliance Management	Compliance Officer	7	Active	View Domain →
DOM-005	REG	Regulatory Change Management	Compliance	6	Active	View Domain →
DOM-006	IAM	Identity & Access Management	IAM Team	8	Active	View Domain →
DOM-007	AST	Asset Management	IT Operations	8	Active	View Domain →
DOM-008	DAT	Data Protection & Privacy	Data Protection Officer	16	Active	View Domain →
DOM-009	CRY	Cryptography & Key Management	Security Team	5	Active	View Domain →
DOM-010	NET	Network Security	Network Security	8	Active	View Domain →
DOM-011	END	Endpoint Security	Endpoint Security	6	Active	View Domain →
DOM-012	CLD	Cloud Security	Cloud Security	10	Active	View Domain →
DOM-013	CFG	Secure Configuration Management	IT Operations	6	Active	View Domain →
DOM-014	VUL	Vulnerability & Patch Management	Vulnerability Management	8	Active	View Domain →
DOM-015	APP	Application Security	Application Security	12	Active	View Domain →
DOM-016	ARC	Security Architecture	Enterprise Architecture	6	Active	View Domain →
DOM-017	OPS	IT Operations & Service Management	IT Operations	7	Active	View Domain →
DOM-018	SOC	Security Operations & Monitoring	SOC	4	Active	View Domain →
DOM-019	THR	Threat Intelligence & Threat Management	Threat Intelligence Team	4	Active	View Domain →
DOM-020	INC	Incident Management	Incident Response Team	7	Active	View Domain →
DOM-021	BCM	Business Continuity & Disaster Recovery	BCM Team	6	Active	View Domain →
DOM-022	OPR	Operational Resilience	Business Resilience	6	Active	View Domain →
DOM-023	PHY	Physical & Environmental Security	Facilities Security	6	Active	View Domain →
DOM-024	TPR	Third-Party & Supply Chain Security	Vendor Risk Management	6	Active	View Domain →
DOM-025	HRS	Human Resource Security	Human Resources	4	Active	View Domain →
DOM-026	SAT	Security Awareness & Training	Security Awareness Team	4	Active	View Domain →
DOM-027	AIG	AI Governance & Model Security	AI Governance Committee	6	Active	View Domain →
DOM-028	AUD	Audit & Assurance	Internal Audit	7	Active	View Domain →
DOM-029	EXC	Exception Management	Risk & Compliance	2	Active	View Domain →

Associated Controls Catalog

196 Active Controls in Framework

Control ID	Control Name	Category & Type	Criticality	Status	Requirements	Action
GOV-001	Information Security Governance Establishes the foundational governance structures, accounta...	Administrative Detective	Critical	Active	📋 12 Reqs	View →
GOV-002	Security Charter Creates the foundational governing document establishing the...	Administrative Detective	High	Active	📋 12 Reqs	View →
GOV-003	Governance Committees Establishes formal governance committees with defined charte...	Administrative Preventive	Critical	Active	📋 12 Reqs	View →
GOV-004	Executive Oversight & Reporting Establishes processes and reporting frameworks to provide ex...	Administrative Detective	High	Active	📋 12 Reqs	View →
GOV-005	Information Security Program Management Establishes program management capabilities including strate...	Administrative Detective	High	Active	📋 12 Reqs	View →
GOV-006	Security Program Continuous Improvement Establishes a structured continuous improvement process usin...	Administrative Corrective	High	Active	📋 12 Reqs	View →
GOV-007	Security Integration into Business & Technology Initiatives Establishes processes to embed security, privacy, resilience...	Administrative Preventive	High	Active	📋 12 Reqs	View →
GOV-008	Enterprise Control Library Management Establishes a centralized, governed library of security and...	Administrative Detective	High	Active	📋 12 Reqs	View →
POL-001	Policy Management Establishes a governed lifecycle for creating, approving, ma...	Administrative Preventive	High	Active	📋 8 Reqs	View →
POL-002	Policy Communication & Awareness Establishes processes to communicate security policies to al...	Administrative Preventive	Medium	Active	📋 7 Reqs	View →
POL-003	Policy Review & Update Establishes periodic review and update processes to ensure p...	Administrative Detective	Medium	Active	📋 7 Reqs	View →
POL-004	Acceptable Use Policy (AUP) Establishes and enforces an Acceptable Use Policy defining p...	Administrative Preventive	Medium	Active	📋 8 Reqs	View →
RSK-001	Risk Management Framework Establishes a comprehensive risk management framework with m...	Administrative Detective	Critical	Active	📋 10 Reqs	View →
RSK-002	Risk Register Establishes and maintains a centralized risk register docume...	Administrative Detective	High	Active	📋 10 Reqs	View →
RSK-003	Risk Assessment Conducts regular risk assessments using structured methodolo...	Administrative Detective	Critical	Active	📋 10 Reqs	View →
RSK-004	Risk Treatment & Response Establishes structured risk treatment processes to select an...	Operational Corrective	Critical	Active	📋 10 Reqs	View →
RSK-005	Risk Monitoring & Reporting Establishes continuous monitoring of risk status, treatment...	Operational Detective	High	Active	📋 10 Reqs	View →
RSK-006	Risk Appetite Definition Establishes and communicates organizational risk appetite st...	Administrative Preventive	High	Active	📋 10 Reqs	View →
RSK-007	Key Risk Indicators (KRIs) Establishes, monitors, and reports on Key Risk Indicators pr...	Administrative Detective	High	Active	📋 10 Reqs	View →
RSK-008	Risk Acceptance & Exception Management Establishes formal governance for risk acceptance and policy...	Administrative Detective	High	Active	📋 10 Reqs	View →
RSK-009	Scenario Analysis Establishes processes to develop and analyze risk scenarios...	Administrative Corrective	High	Active	📋 10 Reqs	View →
CMP-001	Compliance Program Management Establishes a comprehensive compliance program with governan...	Administrative Detective	High	Active	📋 10 Reqs	View →
CMP-002	Control Compliance Monitoring Establishes continuous monitoring of security control compli...	Operational Detective	High	Active	📋 10 Reqs	View →
CMP-003	Compliance Evidence Management Establishes processes for identifying, collecting, validatin...	Administrative Detective	High	Active	📋 10 Reqs	View →
CMP-004	Non-Compliance Management Establishes processes to identify, document, classify, analy...	Administrative Detective	High	Active	📋 10 Reqs	View →
CMP-005	Compliance Reporting Establishes regular reporting processes to communicate compl...	Administrative Detective	High	Active	📋 10 Reqs	View →
CMP-006	Regulatory Change Management Establishes systematic processes to identify, monitor, asses...	Administrative Detective	Critical	Active	📋 10 Reqs	View →
CMP-007	Compliance Obligation Mapping Establishes comprehensive mapping of applicable obligations...	Administrative Detective	High	Active	📋 10 Reqs	View →
IAM-001	Identity & Account Lifecycle Management Establishes comprehensive identity lifecycle management incl...	Administrative Preventive	High	Active	📋 12 Reqs	View →
IAM-002	Authentication Management Establishes and enforces strong authentication policies and...	Technical Preventive	Critical	Active	📋 10 Reqs	View →
IAM-003	Privileged Access Management Establishes comprehensive privileged access management inclu...	Technical Detective	Critical	Active	📋 10 Reqs	View →
IAM-004	Authorization Management Establishes role-based access control, least privilege enfor...	Technical Preventive	Critical	Active	📋 10 Reqs	View →
IAM-005	Access Reviews (Certifications) Establishes regular access review and certification processe...	Technical Detective	High	Active	📋 10 Reqs	View →
IAM-006	Federation & Single Sign-On (SSO) Establishes identity federation and Single Sign-On capabilit...	Technical Preventive	High	Active	📋 10 Reqs	View →
IAM-007	Access Control for APIs Establishes comprehensive API access controls including auth...	Technical Detective	High	Active	📋 10 Reqs	View →
IAM-008	Non-Human Identity Management Establishes comprehensive management of non-human identities...	Technical Preventive	High	Active	📋 10 Reqs	View →
AST-001	Asset Inventory Management Establishes a comprehensive, governed asset inventory includ...	Administrative Preventive	High	Active	📋 10 Reqs	View →
AST-002	Asset Classification & Criticality Establishes consistent asset classification and criticality...	Administrative Detective	High	Active	📋 10 Reqs	View →
AST-003	Asset Ownership Establishes clear ownership assignments and accountabilities...	Administrative Preventive	High	Active	📋 10 Reqs	View →
AST-004	Asset Lifecycle Management Establishes complete asset lifecycle management from acquisi...	Administrative Preventive	High	Active	📋 10 Reqs	View →
AST-005	Secure Asset Disposal & Reuse Establishes secure processes for asset disposal, data saniti...	Administrative Preventive	High	Active	📋 10 Reqs	View →
AST-006	Authorized & Approved Assets Establishes and maintains approved inventories of authorized...	Administrative Preventive	High	Active	📋 10 Reqs	View →
AST-007	Automated Asset Discovery & Unauthorized Asset Detection Establishes automated asset discovery, continuous identifica...	Technical Detective	High	Active	📋 10 Reqs	View →
AST-008	Software License Management Establishes comprehensive software license management includ...	Administrative Detective	Medium	Active	📋 10 Reqs	View →
DAT-001	Data Protection & Privacy Strategy Establishes enterprise data protection and privacy strategy...	Administrative Preventive	Critical	Active	📋 10 Reqs	View →
DAT-002	Data Discovery Establishes automated and manual processes to discover, iden...	Technical Detective	High	Active	📋 10 Reqs	View →
DAT-003	Data Classification & Handling Establishes a data classification framework with defined cat...	Administrative Preventive	High	Active	📋 10 Reqs	View →
DAT-004	Data Retention & Disposal Establishes data retention schedules, archival processes, di...	Technical Preventive	Critical	Active	📋 10 Reqs	View →
DAT-005	Data Ownership & Stewardship Establishes clear data ownership and stewardship assignments...	Technical Preventive	High	Active	📋 10 Reqs	View →
DAT-006	Data Flow Mapping, Inventory & Lineage Establishes comprehensive data flow mapping, data inventory,...	Administrative Preventive	High	Active	📋 10 Reqs	View →
DAT-007	Data Subject Rights Management Establishes processes for receiving, validating, fulfilling,...	Administrative Detective	High	Active	📋 10 Reqs	View →
DAT-008	Consent Management Establishes comprehensive consent management including colle...	Administrative Detective	High	Active	📋 10 Reqs	View →
DAT-009	Cross-Border Data Transfer Establishes governance for cross-border data transfers inclu...	Technical Detective	High	Active	📋 10 Reqs	View →
DAT-010	Privacy Notices Establishes processes for developing, publishing, maintainin...	Technical Preventive	High	Active	📋 10 Reqs	View →
DAT-011	Privacy by Design Establishes processes to integrate privacy requirements, con...	Technical Preventive	High	Active	📋 10 Reqs	View →
DAT-012	Data Protection Impact Assessment (DPIA) Establishes formal DPIA processes for scoping, assessing, do...	Technical Detective	Critical	Active	📋 10 Reqs	View →
DAT-013	Record of Processing Activities (ROPA) Establishes and maintains a complete, accurate Record of Pro...	Technical Preventive	High	Active	📋 10 Reqs	View →
DAT-014	Data Loss Prevention (DLP) Establishes Data Loss Prevention controls including policy d...	Technical Detective	Critical	Active	📋 10 Reqs	View →
DAT-015	Data Integrity Establishes data integrity controls including protection, va...	Technical Detective	Critical	Active	📋 10 Reqs	View →
DAT-016	Data Masking & Anonymization Establishes data masking and anonymization processes for pro...	Technical Detective	High	Active	📋 10 Reqs	View →
CRY-001	Cryptographic Governance Establishes enterprise cryptographic governance including po...	Technical Detective	Critical	Active	📋 10 Reqs	View →
CRY-002	Data-at-Rest Encryption Establishes encryption controls for data at rest including i...	Technical Detective	Critical	Active	📋 10 Reqs	View →
CRY-003	Data-in-Transit Encryption Establishes encryption for data in transit including secure...	Technical Detective	Critical	Active	📋 10 Reqs	View →
CRY-004	Cryptographic Key Management Establishes comprehensive cryptographic key management inclu...	Technical Corrective	Critical	Active	📋 10 Reqs	View →
CRY-005	Digital Certificate Management Establishes comprehensive digital certificate management inc...	Technical Detective	High	Active	📋 10 Reqs	View →
NET-001	Secure Network Architecture Establishes secure network architecture with defense-in-dept...	Technical Detective	Critical	Active	📋 10 Reqs	View →
NET-002	Network Segmentation & Traffic Control Establishes network segmentation, security zones, firewall r...	Technical Detective	Critical	Active	📋 10 Reqs	View →
NET-003	Intrusion Detection & Prevention Establishes intrusion detection and prevention capabilities...	Technical Detective	Critical	Active	📋 10 Reqs	View →
NET-004	Network Access Control (NAC) Establishes Network Access Control for device authentication...	Technical Detective	Critical	Active	📋 10 Reqs	View →
NET-005	Secure Remote Access Establishes secure remote access including user authenticati...	Technical Detective	Critical	Active	📋 10 Reqs	View →
NET-006	Wireless Network Security Establishes wireless network security including authenticati...	Technical Detective	High	Active	📋 10 Reqs	View →
NET-007	Network Monitoring & Visibility Establishes network monitoring and visibility including tele...	Technical Corrective	High	Active	📋 10 Reqs	View →
NET-008	Voice & Video Communication Security Establishes security controls for voice, video, and unified...	Technical Detective	High	Active	📋 10 Reqs	View →
END-001	Endpoint Protection Establishes comprehensive endpoint protection including malw...	Technical Detective	Critical	Active	📋 10 Reqs	View →
END-002	Endpoint Detection & Response (EDR) Establishes Endpoint Detection and Response capabilities inc...	Technical Corrective	Critical	Active	📋 10 Reqs	View →
END-003	Mobile Device & Application Management Establishes mobile device and application management includi...	Technical Detective	High	Active	📋 10 Reqs	View →
END-004	Endpoint Encryption Establishes endpoint encryption including requirements defin...	Technical Corrective	Critical	Active	📋 10 Reqs	View →
END-005	Endpoint Application Control Establishes endpoint application control including approved...	Technical Detective	High	Active	📋 10 Reqs	View →
END-006	Removable Media & Peripheral Control Establishes controls for removable media and peripherals inc...	Technical Detective	High	Active	📋 10 Reqs	View →
CLD-001	Cloud Security Governance Establishes cloud security governance including framework, s...	Technical Detective	Critical	Active	📋 10 Reqs	View →
CLD-002	Cloud Shared Responsibility Management Establishes shared responsibility model documentation includ...	Technical Detective	High	Active	📋 10 Reqs	View →
CLD-003	Secure Cloud Configuration Establishes secure cloud configuration baselines, standards,...	Technical Detective	High	Active	📋 10 Reqs	View →
CLD-004	Cloud Identity & Access Management Establishes cloud identity and access management including i...	Technical Detective	Critical	Active	📋 10 Reqs	View →
CLD-005	Cloud Network Security Establishes cloud network security including segmentation, s...	Technical Detective	Critical	Active	📋 10 Reqs	View →
CLD-006	Cloud Data Protection Establishes cloud data protection including encryption, acce...	Technical Corrective	Critical	Active	📋 10 Reqs	View →
CLD-007	Cloud Workload & Container Security Establishes cloud workload security including container secu...	Technical Detective	Critical	Active	📋 10 Reqs	View →
CLD-008	Cloud Security Monitoring Establishes cloud security monitoring including logging, eve...	Technical Corrective	High	Active	📋 10 Reqs	View →
CLD-009	Cloud Incident Response Establishes cloud incident response including detection, inv...	Technical Corrective	High	Active	📋 10 Reqs	View →
CLD-010	Cloud Data Portability & Interoperability Establishes cloud data portability including export manageme...	Technical Preventive	High	Active	📋 10 Reqs	View →
CFG-001	Secure Configuration Baseline Establishes secure configuration baselines including definit...	Technical Detective	Critical	Active	📋 10 Reqs	View →
CFG-002	Configuration Compliance Monitoring Establishes configuration compliance monitoring including as...	Technical Corrective	High	Active	📋 10 Reqs	View →
CFG-003	Configuration Automation & Deployment Establishes configuration automation including automated dep...	Technical Detective	High	Active	📋 10 Reqs	View →
CFG-004	Configuration Hardening Establishes configuration hardening including standards defi...	Technical Detective	Critical	Active	📋 10 Reqs	View →
CFG-005	Configuration Change Control Establishes configuration change control including request m...	Technical Detective	High	Active	📋 10 Reqs	View →
CFG-006	Configuration Exception Management Establishes configuration exception management including req...	Technical Detective	High	Active	📋 10 Reqs	View →
VUL-001	Vulnerability Management Strategy Establishes enterprise vulnerability management strategy inc...	Administrative Detective	Critical	Active	📋 10 Reqs	View →
VUL-002	Vulnerability Assessment & Scanning Establishes vulnerability assessment including scan planning...	Technical Detective	Critical	Active	📋 10 Reqs	View →
VUL-003	Vulnerability Prioritization Establishes vulnerability prioritization including risk asse...	Technical Preventive	High	Active	📋 10 Reqs	View →
VUL-004	Vulnerability Intelligence Establishes vulnerability intelligence including source mana...	Technical Detective	High	Active	📋 10 Reqs	View →
VUL-005	Patch Management Establishes patch management including identification, asses...	Technical Corrective	Critical	Active	📋 10 Reqs	View →
VUL-006	Vulnerability Reporting & SLA Management Establishes vulnerability reporting and SLA management inclu...	Administrative Detective	High	Active	📋 10 Reqs	View →
VUL-007	Vulnerability Exception Management Establishes vulnerability exception management including req...	Administrative Corrective	High	Active	📋 10 Reqs	View →
VUL-008	Exposure Analytics Establishes exposure analytics including data collection, tr...	Technical Detective	High	Active	📋 10 Reqs	View →
APP-001	Application Security Program Establishes enterprise application security program includin...	Administrative Detective	Critical	Active	📋 10 Reqs	View →
APP-002	Application Inventory Establishes application inventory including registration, cl...	Administrative Detective	High	Active	📋 10 Reqs	View →
APP-003	Secure Software Development Lifecycle (SSDLC) Establishes SSDLC including security requirements, design re...	Administrative Detective	Critical	Active	📋 10 Reqs	View →
APP-004	Secure Coding Practices Establishes secure coding practices including standards, dev...	Technical Detective	High	Active	📋 10 Reqs	View →
APP-005	Application Security Testing Establishes application security testing including SAST, DAS...	Technical Detective	Critical	Active	📋 10 Reqs	View →
APP-006	DevSecOps Establishes DevSecOps including CI/CD security, pipeline sec...	Technical Detective	High	Active	📋 10 Reqs	View →
APP-007	Software Supply Chain Security Establishes software supply chain security including SBOM ma...	Technical Detective	Critical	Active	📋 10 Reqs	View →
APP-008	API Security Establishes API security including authentication, authoriza...	Technical Detective	Critical	Active	📋 10 Reqs	View →
APP-009	Secrets Management Establishes secrets management including inventory, secure s...	Technical Detective	Critical	Active	📋 10 Reqs	View →
APP-010	Software Release & Deployment Security Establishes secure release and deployment including release...	Technical Detective	High	Active	📋 10 Reqs	View →
APP-011	Application Security Incident Response Establishes application security incident response including...	Technical Corrective	High	Active	📋 10 Reqs	View →
APP-012	Application Risk Assessment Establishes application risk assessment including risk ident...	Administrative Detective	Critical	Active	📋 10 Reqs	View →
ARC-001	Security Architecture Framework Establishes enterprise security architecture framework inclu...	Administrative Detective	Critical	Active	📋 10 Reqs	View →
ARC-002	Architecture Governance Establishes architecture governance including approval, role...	Administrative Detective	Critical	Active	📋 10 Reqs	View →
ARC-003	Threat Modeling Establishes threat modeling including threat identification,...	Administrative Detective	High	Active	📋 10 Reqs	View →
ARC-004	Security Design & Architecture Reviews Establishes security design and architecture reviews includi...	Administrative Detective	High	Active	📋 10 Reqs	View →
ARC-005	Secure Engineering Principles Establishes secure engineering principles including design p...	Administrative Detective	High	Active	📋 10 Reqs	View →
ARC-006	Zero Trust Architecture Establishes Zero Trust Architecture including identity-centr...	Technical Detective	Critical	Active	📋 10 Reqs	View →
OPS-001	Change & Release Management Establishes change and release management including request...	Operational Detective	High	Active	📋 10 Reqs	View →
OPS-002	Operational Monitoring & Service Health Establishes operational monitoring including health monitori...	Operational Detective	High	Active	📋 10 Reqs	View →
OPS-003	Service Availability Management Establishes service availability management including availa...	Operational Detective	High	Active	📋 10 Reqs	View →
OPS-004	Capacity & Performance Management Establishes capacity and performance management including ca...	Operational Detective	High	Active	📋 10 Reqs	View →
OPS-005	System Maintenance Management Establishes system maintenance including preventive maintena...	Operational Detective	High	Active	📋 10 Reqs	View →
OPS-006	End-of-Life & Technology Lifecycle Management Establishes end-of-life management including inventory revie...	Operational Detective	High	Active	📋 10 Reqs	View →
OPS-007	Batch Processing & Job Management Establishes batch processing and job management including sc...	Operational Corrective	Medium	Active	📋 10 Reqs	View →
SOC-001	Security Operations Center (SOC) Management Establishes SOC governance including roles, operating model,...	Administrative Detective	Critical	Active	📋 10 Reqs	View →
SOC-002	Security Threat Detection Establishes threat detection including use cases, rule manag...	Technical Detective	Critical	Active	📋 10 Reqs	View →
SOC-003	Security Automation & Orchestration (SOAR) Establishes SOAR including automated playbooks, workflow orc...	Technical Corrective	High	Active	📋 10 Reqs	View →
SOC-004	Threat Hunting Establishes threat hunting including planning, hypothesis de...	Technical Detective	High	Active	📋 10 Reqs	View →
THR-001	Threat Intelligence Management Establishes threat intelligence management including source...	Operational Detective	Critical	Active	📋 10 Reqs	View →
THR-002	Attack Surface Management Establishes attack surface management including asset discov...	Operational Detective	Critical	Active	📋 10 Reqs	View →
THR-003	Insider Threat Management Establishes insider threat management including risk identif...	Operational Corrective	High	Active	📋 10 Reqs	View →
THR-004	Adversary Simulation & Security Validation Establishes adversary simulation including penetration testi...	Operational Detective	High	Active	📋 10 Reqs	View →
INC-001	Incident Response Program Establishes incident response program including governance,...	Operational Corrective	Critical	Active	📋 10 Reqs	View →
INC-002	Incident Response Preparedness Establishes incident response preparedness including team, p...	Operational Preventive	High	Active	📋 10 Reqs	View →
INC-003	Incident Detection, Analysis & Reporting Establishes incident detection and analysis including identi...	Operational Detective	Critical	Active	📋 10 Reqs	View →
INC-004	Incident Containment, Eradication & Recovery Establishes containment and recovery including containment s...	Operational Corrective	Critical	Active	📋 10 Reqs	View →
INC-005	Post-Incident Review & Continuous Improvement Establishes post-incident review including root cause analys...	Operational Corrective	High	Active	📋 10 Reqs	View →
INC-006	Crisis Communication Management Establishes crisis communication including internal communic...	Operational Corrective	High	Active	📋 10 Reqs	View →
INC-007	Regulatory & External Incident Notification Establishes regulatory and external notification including r...	Operational Corrective	Critical	Active	📋 10 Reqs	View →
BCM-001	Business Continuity & Disaster Recovery (BCDR) Program Establishes BCDR program including governance, scope, roles,...	Operational Preventive	Critical	Active	📋 10 Reqs	View →
BCM-002	Business Continuity & Disaster Recovery Planning Establishes BCDR planning including business continuity plan...	Operational Preventive	Critical	Active	📋 10 Reqs	View →
BCM-003	Business Impact Analysis (BIA) Establishes BIA including critical process identification, d...	Operational Detective	High	Active	📋 10 Reqs	View →
BCM-004	BCDR Testing & Exercising Establishes BCDR testing including tabletop exercises, techn...	Operational Detective	High	Active	📋 10 Reqs	View →
BCM-005	Backup & Recovery Management Establishes backup and recovery including backup strategy, s...	Operational Corrective	Critical	Active	📋 10 Reqs	View →
BCM-006	Recovery Infrastructure Management Establishes recovery infrastructure including alternate proc...	Operational Corrective	Critical	Active	📋 10 Reqs	View →
OPR-001	Operational Resilience Program Establishes operational resilience program including framewo...	Operational Corrective	Critical	Active	📋 10 Reqs	View →
OPR-002	Critical Business Service Management Establishes critical business service management including i...	Operational Detective	Critical	Active	📋 10 Reqs	View →
OPR-003	Operational Dependency Management Establishes dependency management including identification,...	Operational Detective	High	Active	📋 10 Reqs	View →
OPR-004	Impact Tolerance & Criticality Management Establishes impact tolerance management including criticalit...	Operational Detective	Critical	Active	📋 10 Reqs	View →
OPR-005	Operational Resilience Testing Establishes resilience testing including scenario testing, s...	Operational Corrective	Critical	Active	📋 10 Reqs	View →
OPR-006	Third-Party & Supply Chain Resilience Establishes third-party resilience including criticality ass...	Operational Detective	High	Active	📋 10 Reqs	View →
PHY-001	Physical Security & Facility Access Management Establishes physical security including facility access auth...	Physical Detective	Critical	Active	📋 10 Reqs	View →
PHY-002	Environmental & Infrastructure Protection Establishes environmental protection including power protect...	Physical Detective	High	Active	📋 10 Reqs	View →
PHY-003	Data Center & Critical Facility Security Establishes critical facility security including restricted...	Physical Detective	Critical	Active	📋 10 Reqs	View →
PHY-004	Sensitive Asset & Equipment Protection Establishes equipment protection including inventory, physic...	Physical Detective	High	Active	📋 10 Reqs	View →
PHY-005	Physical Media Handling & Secure Disposal Establishes physical media handling including media classifi...	Physical Corrective	High	Active	📋 10 Reqs	View →
PHY-006	Physical Emergency Preparedness & Response Establishes emergency preparedness including emergency proce...	Physical Corrective	High	Active	📋 10 Reqs	View →
TPR-001	Third-Party Risk Management Program Establishes TPRM program including governance, scope, classi...	Administrative Detective	Critical	Active	📋 10 Reqs	View →
TPR-002	Third-Party Risk Assessment & Due Diligence Establishes third-party due diligence including vendor risk...	Administrative Detective	Critical	Active	📋 10 Reqs	View →
TPR-003	Third-Party Contract & Compliance Management Establishes third-party contract management including contra...	Administrative Detective	High	Active	📋 10 Reqs	View →
TPR-004	Third-Party Continuous Monitoring & Assurance Establishes third-party monitoring including continuous risk...	Operational Detective	High	Active	📋 10 Reqs	View →
TPR-005	Third-Party Lifecycle & Offboarding Management Establishes third-party lifecycle management including onboa...	Administrative Preventive	High	Active	📋 10 Reqs	View →
TPR-006	Third-Party Concentration Risk Management Establishes concentration risk management including critical...	Administrative Detective	High	Active	📋 10 Reqs	View →
HRS-001	Personnel Screening & Verification Establishes personnel screening including screening policy,...	Administrative Detective	High	Active	📋 10 Reqs	View →
HRS-002	Confidentiality & Employment Obligations Establishes confidentiality and employment obligations inclu...	Administrative Detective	High	Active	📋 10 Reqs	View →
HRS-003	Personnel Lifecycle Security Management Establishes personnel lifecycle security including recruitme...	Administrative Preventive	High	Active	📋 10 Reqs	View →
HRS-004	Employee Code of Conduct & Ethics Establishes code of conduct including ethical behavior, secu...	Administrative Detective	Medium	Active	📋 10 Reqs	View →
SAT-001	Security Awareness Program Establishes security awareness program including framework,...	Administrative Detective	High	Active	📋 10 Reqs	View →
SAT-002	Security Culture Management Establishes security culture management including culture as...	Administrative Detective	Medium	Active	📋 10 Reqs	View →
SAT-003	Role-Based Security & Compliance Training Establishes role-based training including role-based securit...	Administrative Detective	High	Active	📋 10 Reqs	View →
SAT-004	Security Awareness Exercises & Simulations Establishes security awareness exercises including phishing...	Operational Detective	Medium	Active	📋 10 Reqs	View →
AIG-001	AI Governance & Oversight Establishes AI governance including framework, committee, po...	Administrative Detective	Critical	Active	📋 10 Reqs	View →
AIG-002	AI Risk & Impact Management Establishes AI risk management including risk assessment, im...	Administrative Detective	High	Active	📋 10 Reqs	View →
AIG-003	AI Asset & Lifecycle Management Establishes AI lifecycle management including inventory, cla...	Administrative Detective	High	Active	📋 10 Reqs	View →
AIG-004	Responsible AI Management Establishes responsible AI including principles, transparenc...	Administrative Detective	High	Active	📋 10 Reqs	View →
AIG-005	AI Security & Operational Resilience Establishes AI security including adversarial protection, pr...	Administrative Corrective	Critical	Active	📋 10 Reqs	View →
AIG-006	AI Performance Monitoring & Continuous Improvement Establishes AI performance monitoring including performance...	Operational Detective	High	Active	📋 10 Reqs	View →
AUD-001	Audit & Assurance Program Establishes audit program including governance, planning, au...	Operational Detective	Critical	Active	📋 10 Reqs	View →
AUD-002	Internal Audit Management Establishes internal audit including risk-based planning, sc...	Operational Detective	High	Active	📋 10 Reqs	View →
AUD-003	Independent Assessment & External Assurance Establishes external assurance including assessor independen...	Operational Detective	High	Active	📋 10 Reqs	View →
AUD-004	Control Assurance & Validation Establishes control assurance including design effectiveness...	Operational Detective	Critical	Active	📋 10 Reqs	View →
AUD-005	Control Self-Assessment (CSA) Establishes CSA including framework, control owner responsib...	Operational Detective	High	Active	📋 10 Reqs	View →
AUD-006	Attestation & Certification Management Establishes attestation and certification including certific...	Operational Detective	Medium	Active	📋 10 Reqs	View →
AUD-007	Audit Findings & Remediation Management Establishes audit findings management including findings reg...	Operational Corrective	High	Active	📋 10 Reqs	View →
EXC-001	Exception Management Program Establishes exception management program including governanc...	Administrative Corrective	Critical	Active	📋 10 Reqs	View →
EXC-002	Exception Lifecycle Management Establishes exception lifecycle including request, risk asse...	Administrative Corrective	High	Active	📋 10 Reqs	View →
REG-001	Regulatory Change Governance & Oversight Defines governance structures, roles, approval authority, es...	Administrative Detective	Critical	Active	📋 6 Reqs	View →
REG-002	Automated Regulatory Monitoring & Intelligence Establishes automated monitoring of authoritative federal, s...	Technical Detective	Critical	Active	📋 6 Reqs	View →
REG-003	Regulatory Change Impact Assessment Requires structured impact analysis covering applicability,...	Administrative Detective	Critical	Active	📋 6 Reqs	View →
REG-004	Regulatory Obligations & Control Alignment Maintains an authoritative obligations repository linking re...	Administrative Preventive	Critical	Active	📋 6 Reqs	View →
REG-005	Regulatory Change Workflow & Audit Trail Provides workflow-based routing, ownership assignment, due d...	Operational Detective	High	Active	📋 6 Reqs	View →
REG-006	Regulatory Change Validation & Continuous Monitoring Requires post-implementation validation, control testing, ev...	Operational Detective	Critical	Active	📋 6 Reqs	View →

Compliance Requirements & Audit Crosswalk

1944 Specific Audit Clauses

The following requirements dictate specific audit evidence criteria and testing steps mapped directly under the controls of this framework.

REQUIREMENT ID	REQUIREMENT TITLE & DETAILS	MAPPED CONTROL	TYPICAL OWNER	ACTION
GOV-001-R001	Governance Framework The organization shall establish and maintain a formal governance framework for...	GOV-001 Information Security Governanc...	CISO, Governance Committee, Board of Directors, Risk Management	View ↗
GOV-001-R002	Governance Charter The organization shall establish and maintain a formal charter for the informati...	GOV-001 Information Security Governanc...	CISO, Board of Directors, CEO, Governance Committee, Legal	View ↗
GOV-001-R003	Governance Principles The organization shall define and document the core governance principles that g...	GOV-001 Information Security Governanc...	CISO, Governance Committee, Privacy Officer, Legal, Executive Leadership	View ↗
GOV-001-R004	Governance Scope The organization shall define and maintain a documented scope for the informatio...	GOV-001 Information Security Governanc...	CISO, Governance Committee, Enterprise Architecture, Asset Owners, Business Unit Leaders	View ↗
GOV-001-R005	Governance Authority The organization shall establish a formal governance authority for information s...	GOV-001 Information Security Governanc...	CISO, Board of Directors, CEO, Legal	View ↗
GOV-001-R006	Governance Accountability The organization shall assign accountability for the information security and pr...	GOV-001 Information Security Governanc...	CISO, CEO, Board of Directors, Compliance Committee, Risk Committee	View ↗
GOV-001-R007	Governance Decision-Making The organization shall maintain formal decision-making processes for information...	GOV-001 Information Security Governanc...	CISO, Governance Committee, Risk Committee, Compliance, Legal	View ↗
GOV-001-R008	Governance Oversight The organization shall implement formal oversight mechanisms, including governan...	GOV-001 Information Security Governanc...	Board of Directors, Audit Committee, Risk Committee, CISO, Independent Advisors	View ↗
GOV-001-R009	Governance Performance The organization shall measure the effectiveness and efficiency of the governanc...	GOV-001 Information Security Governanc...	CISO, Governance Committee, Board of Directors, Audit Committee	View ↗
GOV-001-R010	Governance Review The organization shall periodically review the governance function to ensure it...	GOV-001 Information Security Governanc...	CISO, Internal Audit, Board of Directors, Governance Committee	View ↗
GOV-001-R011	Governance Reporting The organization shall provide timely and relevant governance information to sta...	GOV-001 Information Security Governanc...	CISO, Board of Directors, Executive Leadership, Audit Committee	View ↗
GOV-001-R012	Governance Continuous Improvement The organization shall drive ongoing enhancement of the governance function thro...	GOV-001 Information Security Governanc...	CISO, Governance Committee, Internal Audit, Risk Management	View ↗
GOV-002-R001	Charter Establishment The organization shall establish a formal Information Security Charter that defi...	GOV-002 Security Charter	CISO, CEO, Board of Directors, Legal, Compliance	View ↗
GOV-002-R002	Charter Purpose The Information Security Charter shall clearly articulate the purpose of the inf...	GOV-002 Security Charter	CISO, CEO, Board of Directors, Communications	View ↗
GOV-002-R003	Charter Scope The Information Security Charter shall define the governance scope, organization...	GOV-002 Security Charter	CISO, CEO, Legal, Business Unit Leaders	View ↗
GOV-002-R004	Charter Authority The Information Security Charter shall articulate the full extent of the securit...	GOV-002 Security Charter	CISO, Board of Directors, CEO, Legal	View ↗
GOV-002-R005	Charter Governance Mandate The Information Security Charter shall define the security function's governance...	GOV-002 Security Charter	CISO, Board of Directors, Governance Committee, Risk Committee	View ↗
GOV-002-R006	Charter Executive Sponsorship The Information Security Charter shall be sponsored by a senior executive with t...	GOV-002 Security Charter	CEO, CISO, Board of Directors	View ↗
GOV-002-R007	Charter Approval The Information Security Charter shall be formally approved by the highest level...	GOV-002 Security Charter	Board of Directors, CEO, CISO	View ↗
GOV-002-R008	Charter Communication The organization shall communicate the Information Security Charter to relevant...	GOV-002 Security Charter	CISO, Communications, HR, Legal, Compliance	View ↗
GOV-002-R009	Charter Accessibility The organization shall ensure the Information Security Charter is readily availa...	GOV-002 Security Charter	CISO, IT Operations, Legal, Compliance	View ↗
GOV-002-R010	Charter Review The organization shall periodically review the Information Security Charter to e...	GOV-002 Security Charter	CISO, Board of Directors, Legal, Compliance	View ↗
GOV-002-R011	Charter Maintenance The organization shall maintain the Information Security Charter through a forma...	GOV-002 Security Charter	CISO, Legal, Compliance, Board of Directors	View ↗
GOV-002-R012	Charter Alignment The organization shall ensure the Information Security Charter is aligned with a...	GOV-002 Security Charter	CISO, Legal, Corporate Governance, Board of Directors	View ↗
GOV-003-R001	Committee Establishment The organization shall establish formal governance committees with responsibilit...	GOV-003 Governance Committees	CISO, Executive Leadership, Board of Directors, Business Unit Leaders	View ↗
GOV-003-R002	Committee Charter The organization shall develop and maintain a formal charter for each governance...	GOV-003 Governance Committees	Committee Chair, CISO, Governance Committee	View ↗
GOV-003-R003	Committee Scope The charter for each governance committee shall clearly define the scope of the...	GOV-003 Governance Committees	Committee Chair, CISO, Governance Committee	View ↗
GOV-003-R004	Committee Membership The organization shall define and document membership requirements for each gove...	GOV-003 Governance Committees	CISO, Governance Committee, Human Resources	View ↗
GOV-003-R005	Committee Roles and Authority The organization shall clearly define the roles and authority of committee membe...	GOV-003 Governance Committees	Committee Chair, CISO, Governance Committee	View ↗
GOV-003-R006	Committee Meeting Management The organization shall establish effective meeting management processes for each...	GOV-003 Governance Committees	Committee Chair, Committee Secretary, CISO	View ↗
GOV-003-R007	Committee Decision Making The organization shall maintain formal decision-making processes for each govern...	GOV-003 Governance Committees	Committee Chair, Committee Secretary, CISO	View ↗
GOV-003-R008	Committee Reporting The organization shall ensure each governance committee receives the information...	GOV-003 Governance Committees	CISO, Committee Secretary, Report Owners	View ↗
GOV-003-R009	Committee Escalation The organization shall establish escalation processes for each governance commit...	GOV-003 Governance Committees	Committee Chair, CISO, Executive Leadership, Board of Directors	View ↗
GOV-003-R010	Committee Performance Review The organization shall conduct periodic performance reviews of each governance c...	GOV-003 Governance Committees	Governance Committee, Internal Audit, CISO	View ↗
GOV-003-R011	Committee Records Management The organization shall maintain records management processes for each governance...	GOV-003 Governance Committees	Committee Secretary, Records Management, Legal, CISO	View ↗
GOV-003-R012	Committee Continuous Improvement The organization shall drive ongoing enhancement of each governance committee th...	GOV-003 Governance Committees	Committee Chair, CISO, Internal Audit	View ↗
GOV-004-R001	Executive Oversight Framework The organization shall establish an executive oversight framework that defines h...	GOV-004 Executive Oversight & Reportin...	Board of Directors, CEO, CISO, Audit Committee	View ↗
GOV-004-R002	Board Oversight Responsibilities The organization shall define and document the board of directors' responsibilit...	GOV-004 Executive Oversight & Reportin...	Board of Directors, CEO, CISO, Corporate Governance	View ↗
GOV-004-R003	Executive Management Oversight The organization shall define and document executive management's responsibiliti...	GOV-004 Executive Oversight & Reportin...	CEO, CISO, Executive Leadership, Audit Committee	View ↗
GOV-004-R004	Governance Review Meetings The organization shall conduct regular governance review meetings between execut...	GOV-004 Executive Oversight & Reportin...	Board of Directors, CEO, CISO, Audit Committee	View ↗
GOV-004-R005	Executive Reporting Framework The organization shall establish an executive reporting framework that defines h...	GOV-004 Executive Oversight & Reportin...	CISO, Board of Directors, Executive Leadership, Audit Committee	View ↗
GOV-004-R006	Reporting Content and Information Quality The organization shall define content requirements for executive and board repor...	GOV-004 Executive Oversight & Reportin...	CISO, Board of Directors, Executive Leadership	View ↗
GOV-004-R007	Reporting Frequency and Timeliness The organization shall establish reporting frequency and timeliness requirements...	GOV-004 Executive Oversight & Reportin...	CISO, Board of Directors, Executive Leadership	View ↗
GOV-004-R008	Governance Performance Reporting The organization shall provide executive leadership and the board with regular r...	GOV-004 Executive Oversight & Reportin...	CISO, Board of Directors, Executive Leadership, Internal Audit	View ↗
GOV-004-R009	Strategic Risk and Issue Reporting The organization shall provide executive leadership and the board with regular r...	GOV-004 Executive Oversight & Reportin...	CISO, Board of Directors, Risk Committee, Executive Leadership	View ↗
GOV-004-R010	Executive Decision Support The organization shall provide executive leadership and the board with informati...	GOV-004 Executive Oversight & Reportin...	CISO, Board of Directors, Executive Leadership, Internal Audit	View ↗
GOV-004-R011	Oversight Records and Action Tracking The organization shall maintain comprehensive records of executive oversight and...	GOV-004 Executive Oversight & Reportin...	CISO, Governance Committee, Records Management	View ↗
GOV-004-R012	Oversight and Reporting Continuous Improvement The organization shall drive ongoing enhancement of executive oversight and repo...	GOV-004 Executive Oversight & Reportin...	CISO, Board of Directors, Executive Leadership	View ↗
GOV-005-R001	Program Management Framework The organization shall establish a program management framework for the informat...	GOV-005 Information Security Program M...	CISO, Security Program Manager, Project Management	View ↗
GOV-005-R002	Program Planning The organization shall conduct formal planning for the information security prog...	GOV-005 Information Security Program M...	CISO, Security Program Manager, Project Management	View ↗
GOV-005-R003	Program Execution The organization shall execute the information security program in accordance wi...	GOV-005 Information Security Program M...	CISO, Security Program Manager, Project Managers	View ↗
GOV-005-R004	Program Resource Management The organization shall manage resources for the information security program, in...	GOV-005 Information Security Program M...	CISO, Security Program Manager, Human Resources	View ↗
GOV-005-R005	Program Budget Management The organization shall manage the information security program budget, including...	GOV-005 Information Security Program M...	CISO, Security Program Manager, Finance	View ↗
GOV-005-R006	Program Staffing The organization shall ensure the information security program is appropriately...	GOV-005 Information Security Program M...	CISO, Security Program Manager, Human Resources	View ↗
GOV-005-R007	Program Prioritization The organization shall maintain prioritization processes for the information sec...	GOV-005 Information Security Program M...	CISO, Security Program Manager, Risk Management	View ↗
GOV-005-R008	Program Coordination The organization shall maintain coordination processes for the information secur...	GOV-005 Information Security Program M...	CISO, Security Program Manager, Business Unit Leaders	View ↗
GOV-005-R009	Program Dependency Management The organization shall maintain dependency management processes for the informat...	GOV-005 Information Security Program M...	CISO, Security Program Manager, Project Management	View ↗
GOV-005-R010	Program Performance Monitoring The organization shall monitor the performance of the information security progr...	GOV-005 Information Security Program M...	CISO, Security Program Manager, Performance Management	View ↗
GOV-005-R011	Program Review The organization shall conduct periodic reviews of the information security prog...	GOV-005 Information Security Program M...	CISO, Security Program Manager, Internal Audit	View ↗
GOV-005-R012	Program Continuous Improvement The organization shall drive ongoing enhancement of the information security pro...	GOV-005 Information Security Program M...	CISO, Security Program Manager, Security Teams	View ↗
GOV-006-R001	Improvement Framework The organization shall establish a continuous improvement framework for the info...	GOV-006 Security Program Continuous Im...	CISO, Security Program Manager, Quality Management	View ↗
GOV-006-R002	Improvement Identification The organization shall systematically identify improvement opportunities for the...	GOV-006 Security Program Continuous Im...	CISO, Security Program Manager, Security Teams	View ↗
GOV-006-R003	Improvement Prioritization The organization shall prioritize improvement opportunities for the information...	GOV-006 Security Program Continuous Im...	CISO, Security Program Manager, Risk Management	View ↗
GOV-006-R004	Improvement Planning The organization shall develop formal plans for implementing approved improvemen...	GOV-006 Security Program Continuous Im...	CISO, Security Program Manager, Project Managers	View ↗
GOV-006-R005	Improvement Approval The organization shall establish approval processes for improvement initiatives...	GOV-006 Security Program Continuous Im...	CISO, Security Program Manager, Governance Committee	View ↗
GOV-006-R006	Improvement Implementation The organization shall implement approved improvements to the information securi...	GOV-006 Security Program Continuous Im...	CISO, Security Program Manager, Project Managers	View ↗
GOV-006-R007	Improvement Monitoring The organization shall monitor improvement initiatives to the information securi...	GOV-006 Security Program Continuous Im...	CISO, Security Program Manager, Project Managers	View ↗
GOV-006-R008	Improvement Measurement The organization shall measure the effectiveness of implemented improvements to...	GOV-006 Security Program Continuous Im...	CISO, Security Program Manager, Performance Management	View ↗
GOV-006-R009	Lessons Learned Integration The organization shall capture and integrate lessons learned from incidents, aud...	GOV-006 Security Program Continuous Im...	CISO, Security Program Manager, Incident Response, Audit	View ↗
GOV-006-R010	Improvement Reporting The organization shall report on improvement initiatives to the information secu...	GOV-006 Security Program Continuous Im...	CISO, Security Program Manager, Governance Committee	View ↗
GOV-006-R011	Improvement Review The organization shall conduct periodic reviews of the continuous improvement pr...	GOV-006 Security Program Continuous Im...	CISO, Security Program Manager, Quality Management	View ↗
GOV-006-R012	Improvement Effectiveness The organization shall evaluate the overall effectiveness of the continuous impr...	GOV-006 Security Program Continuous Im...	CISO, Security Program Manager, Internal Audit	View ↗
GOV-007-R001	Integration Framework The organization shall establish a framework for integrating information securit...	GOV-007 Security Integration into Busi...	CISO, Security Architects, IT Leadership, Project Management	View ↗
GOV-007-R002	Business Initiative Integration The organization shall ensure information security governance requirements are i...	GOV-007 Security Integration into Busi...	CISO, Business Leaders, Security Architects, Project Management	View ↗
GOV-007-R003	Technology Initiative Integration The organization shall ensure information security governance requirements are i...	GOV-007 Security Integration into Busi...	CISO, IT Leadership, Security Architects, Project Management	View ↗
GOV-007-R004	Security Participation The organization shall ensure the information security function participates in...	GOV-007 Security Integration into Busi...	CISO, Security Architects, IT Leadership, Project Management	View ↗
GOV-007-R005	Planning Integration The organization shall ensure information security governance requirements are a...	GOV-007 Security Integration into Busi...	CISO, Security Architects, IT Leadership, Project Management	View ↗
GOV-007-R006	Governance Review The organization shall conduct governance reviews of business and technology ini...	GOV-007 Security Integration into Busi...	CISO, Security Architects, Governance Committee	View ↗
GOV-007-R007	Security Acceptance Criteria The organization shall define and apply security acceptance criteria for busines...	GOV-007 Security Integration into Busi...	CISO, Security Architects, IT Leadership, Quality Assurance	View ↗
GOV-007-R008	Integration Monitoring The organization shall monitor the integration of information security governanc...	GOV-007 Security Integration into Busi...	CISO, Security Architects, Project Management	View ↗
GOV-007-R009	Executive Escalation The organization shall establish escalation processes for addressing situations...	GOV-007 Security Integration into Busi...	CISO, Security Architects, Governance Committee	View ↗
GOV-007-R010	Integration Reporting The organization shall report on the integration of information security governa...	GOV-007 Security Integration into Busi...	CISO, Security Architects, Governance Committee	View ↗
GOV-007-R011	Integration Review The organization shall conduct periodic reviews of the security integration proc...	GOV-007 Security Integration into Busi...	CISO, Security Architects, IT Leadership	View ↗
GOV-007-R012	Integration Continuous Improvement The organization shall drive ongoing enhancement of the security integration int...	GOV-007 Security Integration into Busi...	CISO, Security Architects, IT Leadership	View ↗
GOV-008-R001	Control Library Framework The organization shall establish a framework for the enterprise control library...	GOV-008 Enterprise Control Library Man...	CISO, Control Owners, Compliance, Security Architects	View ↗
GOV-008-R002	Control Definition Standards The organization shall establish definition standards for controls in the enterp...	GOV-008 Enterprise Control Library Man...	CISO, Control Owners, Compliance, Security Architects	View ↗
GOV-008-R003	Control Classification The organization shall establish classification schemas for controls in the ente...	GOV-008 Enterprise Control Library Man...	CISO, Control Owners, Compliance, Security Architects	View ↗
GOV-008-R004	Control Ownership The organization shall assign explicit ownership for each control in the enterpr...	GOV-008 Enterprise Control Library Man...	CISO, Control Owners, Compliance	View ↗
GOV-008-R005	Control Change Management The organization shall maintain change governance processes for controls in the...	GOV-008 Enterprise Control Library Man...	CISO, Control Owners, Compliance, Governance Committee	View ↗
GOV-008-R006	Control Lifecycle Management The organization shall maintain lifecycle management processes for controls in t...	GOV-008 Enterprise Control Library Man...	CISO, Control Owners, Compliance	View ↗
GOV-008-R007	Control Relationships The organization shall maintain relationship mapping between controls in the ent...	GOV-008 Enterprise Control Library Man...	CISO, Control Owners, Compliance	View ↗
GOV-008-R008	Control Reuse The organization shall promote the reuse of controls in the enterprise control l...	GOV-008 Enterprise Control Library Man...	CISO, Control Owners, Compliance	View ↗
GOV-008-R009	Control Quality Management The organization shall maintain quality management processes for controls in the...	GOV-008 Enterprise Control Library Man...	CISO, Control Owners, Compliance, Quality Assurance	View ↗
GOV-008-R010	Control Library Review The organization shall conduct periodic reviews of the enterprise control librar...	GOV-008 Enterprise Control Library Man...	CISO, Control Owners, Compliance, Internal Audit	View ↗
GOV-008-R011	Control Library Reporting The organization shall report on the enterprise control library, providing visib...	GOV-008 Enterprise Control Library Man...	CISO, Control Owners, Compliance, Governance Committee	View ↗
GOV-008-R012	Control Library Continuous Improvement The organization shall drive ongoing enhancement of the enterprise control libra...	GOV-008 Enterprise Control Library Man...	CISO, Control Owners, Compliance	View ↗
POL-001-R001	Policy Framework Establishment Establish and maintain a formal information security policy framework approved b...	POL-001 Policy Management	Chief Information Security Officer (CISO), Compliance, Policy Governance Committee, Legal	View ↗
POL-001-R002	Policy Ownership Assignment Define policy ownership and accountability for every policy document.	POL-001 Policy Management	Policy Owner, CISO, Business Unit Leaders, Compliance	View ↗
POL-001-R003	Policy Development Criteria Develop policies based on legal, regulatory, contractual, and business requireme...	POL-001 Policy Management	Policy Owner, Compliance Officer, Legal, CISO, Risk Management	View ↗
POL-001-R004	Supporting Standards and Procedures Maintain documented standards and procedures supporting each policy where applic...	POL-001 Policy Management	Policy Owner, Security Engineering, IT Operations, Compliance	View ↗
POL-001-R005	Centralized Policy Repository Store policies in a centralized, controlled repository with version history.	POL-001 Policy Management	Policy Governance, Compliance, Document Management, CISO	View ↗
POL-001-R006	Policy Document Metadata Ensure policy documents include approval date, effective date, review date, vers...	POL-001 Policy Management	Policy Owner, Policy Governance, Compliance, Document Management	View ↗
POL-001-R007	Policy Integrity Protection Protect policy documents from unauthorized modification or deletion.	POL-001 Policy Management	Policy Governance, Document Management, IT Security, CISO	View ↗
POL-001-R008	Policy Archival and Retirement Retire obsolete policies using a documented archival process.	POL-001 Policy Management	Policy Owner, Policy Governance, Compliance, Records Management	View ↗
POL-002-R001	Policy Communication Communicate all approved policies to applicable personnel before enforcement.	POL-002 Policy Communication & Awarene...	Policy Owner, Security Awareness, HR, Communications	View ↗
POL-002-R002	Policy Acknowledgement Obtain documented acknowledgement from personnel that policies have been read an...	POL-002 Policy Communication & Awarene...	HR, Security Awareness, Policy Owner, Compliance	View ↗
POL-002-R003	Role-Based Policy Communication Provide role-based policy communication where specialized responsibilities exist...	POL-002 Policy Communication & Awarene...	Policy Owner, Security Awareness, HR, Business Unit Managers	View ↗
POL-002-R004	Policy Accessibility Make current policy documents readily accessible to authorized users.	POL-002 Policy Communication & Awarene...	Policy Governance, Document Management, IT, Policy Owners	View ↗
POL-002-R005	Policy Change Notification Notify affected stakeholders whenever policy changes are published.	POL-002 Policy Communication & Awarene...	Policy Owner, Security Awareness, Communications, Compliance	View ↗
POL-002-R006	Policy Acknowledgement Tracking Track policy acknowledgement completion and escalate non-compliance.	POL-002 Policy Communication & Awarene...	Security Awareness, HR, Policy Owner, Compliance	View ↗
POL-002-R007	Policy Awareness Integration Integrate policy awareness into onboarding and periodic awareness programs.	POL-002 Policy Communication & Awarene...	HR, Security Awareness, Policy Owners, CISO	View ↗
POL-003-R001	Periodic Policy Review Review all security policies at least annually or after significant business, le...	POL-003 Policy Review & Update	Policy Owner, CISO, Compliance, Legal, Risk Management	View ↗
POL-003-R002	Event-Driven Policy Review Trigger out-of-cycle reviews following major incidents, audit findings, or regul...	POL-003 Policy Review & Update	Policy Owner, CISO, Incident Management, Compliance, Internal Audit	View ↗
POL-003-R003	Policy Revision Documentation Document review outcomes, approvals, and revision history.	POL-003 Policy Review & Update	Policy Owner, Policy Governance, Compliance, Document Management	View ↗
POL-003-R004	Policy Effectiveness Assessment Validate policy effectiveness through compliance monitoring and audit feedback.	POL-003 Policy Review & Update	Policy Owner, Compliance, Internal Audit, CISO, Control Owners	View ↗
POL-003-R005	Policy Withdrawal and Archival Ensure superseded policies are formally withdrawn and archived.	POL-003 Policy Review & Update	Policy Owner, Policy Governance, Document Management, Compliance	View ↗
POL-003-R006	Policy Approval Management Maintain evidence of management approval for all revised policies.	POL-003 Policy Review & Update	Policy Governance, CISO, Compliance, Executive Approver	View ↗
POL-003-R007	Policy Alignment Verification Verify supporting standards and procedures remain aligned with updated policies.	POL-003 Policy Review & Update	Policy Owner, Security Engineering, IT Operations, Compliance	View ↗
POL-004-R001	Acceptable Use Requirements Define acceptable use requirements for organizational information assets.	POL-004 Acceptable Use Policy (AUP)	Policy Owner, CISO, HR, Legal, IT	View ↗
POL-004-R002	Prohibited Activities Specify prohibited activities involving systems, networks, internet, email, and...	POL-004 Acceptable Use Policy (AUP)	CISO, Policy Owner, Legal, HR, IT Security	View ↗
POL-004-R003	User Security Responsibilities Define user responsibilities for protecting organizational information.	POL-004 Acceptable Use Policy (AUP)	Policy Owner, CISO, HR, Security Awareness, Business Unit Managers	View ↗
POL-004-R004	Acceptable Use Acknowledgement Require users to acknowledge the Acceptable Use Policy before receiving access.	POL-004 Acceptable Use Policy (AUP)	HR, IAM, Policy Owner, IT Access Management	View ↗
POL-004-R005	Remote Work and BYOD Requirements Include requirements for remote work, BYOD, and mobile device usage where applic...	POL-004 Acceptable Use Policy (AUP)	Policy Owner, CISO, HR, Legal, Endpoint/IAM Teams	View ↗
POL-004-R006	Policy Violation Management Define consequences for policy violations and disciplinary actions.	POL-004 Acceptable Use Policy (AUP)	HR, Policy Owner, Legal, CISO, Employee Relations	View ↗
POL-004-R007	Acceptable Use Policy Review Periodically review and update the AUP to address emerging technologies and thre...	POL-004 Acceptable Use Policy (AUP)	Policy Owner, CISO, IT, HR, Legal, Compliance	View ↗
POL-004-R008	Acceptable Use Compliance Monitoring Monitor compliance with acceptable use requirements where legally permissible.	POL-004 Acceptable Use Policy (AUP)	CISO, Security Operations, Privacy Officer, Legal, HR	View ↗
RSK-001-R001	Risk Governance Framework The organization shall establish a risk governance framework for information sec...	RSK-001 Risk Management Framework	CISO, Risk Management, Governance Committee	View ↗
RSK-001-R002	Risk Management Methodology The organization shall establish a formal risk management methodology that defin...	RSK-001 Risk Management Framework	CISO, Risk Management, Compliance	View ↗
RSK-001-R003	Risk Scope The organization shall define and maintain a documented scope for the risk manag...	RSK-001 Risk Management Framework	CISO, Risk Management, Business Leaders	View ↗
RSK-001-R004	Risk Classification The organization shall establish a risk classification schema for consistent cat...	RSK-001 Risk Management Framework	CISO, Risk Management, Compliance	View ↗
RSK-001-R005	Risk Criteria The organization shall establish risk criteria that define thresholds for risk a...	RSK-001 Risk Management Framework	CISO, Risk Management, Governance Committee	View ↗
RSK-001-R006	Risk Roles and Responsibilities The organization shall clearly define and document the roles and responsibilitie...	RSK-001 Risk Management Framework	CISO, Risk Management, Business Leaders	View ↗
RSK-001-R007	Risk Documentation The organization shall maintain comprehensive documentation of the risk manageme...	RSK-001 Risk Management Framework	CISO, Risk Management, Compliance	View ↗
RSK-001-R008	Risk Communication The organization shall ensure relevant risk information is shared with appropria...	RSK-001 Risk Management Framework	CISO, Risk Management, Governance Committee	View ↗
RSK-001-R009	Framework Review The organization shall conduct periodic reviews of the risk management framework...	RSK-001 Risk Management Framework	CISO, Risk Management, Internal Audit	View ↗
RSK-001-R010	Framework Continuous Improvement The organization shall drive ongoing enhancement of the risk management framewor...	RSK-001 Risk Management Framework	CISO, Risk Management, Quality Management	View ↗
RSK-002-R001	Register Establishment The organization shall establish and maintain a centralized risk register that p...	RSK-002 Risk Register	CISO, Risk Management, Risk Owners	View ↗
RSK-002-R002	Risk Recording The organization shall record identified risks in the risk register in a consist...	RSK-002 Risk Register	Risk Owners, Risk Management, CISO	View ↗
RSK-002-R003	Risk Ownership The organization shall assign explicit ownership for each risk recorded in the r...	RSK-002 Risk Register	CISO, Risk Management, Risk Owners	View ↗
RSK-002-R004	Risk Categorization The organization shall apply consistent categorization to all risks recorded in...	RSK-002 Risk Register	Risk Owners, Risk Management	View ↗
RSK-002-R005	Risk Prioritization The organization shall apply consistent prioritization to all risks recorded in...	RSK-002 Risk Register	Risk Owners, Risk Management	View ↗
RSK-002-R006	Register Maintenance The organization shall maintain the risk register to ensure risk data remains cu...	RSK-002 Risk Register	Risk Owners, Risk Management	View ↗
RSK-002-R007	Relationship Mapping The organization shall maintain relationship mapping between risks recorded in t...	RSK-002 Risk Register	Risk Owners, Risk Management, Control Owners	View ↗
RSK-002-R008	Register Review The organization shall conduct periodic reviews of the risk register to ensure i...	RSK-002 Risk Register	CISO, Risk Management, Internal Audit	View ↗
RSK-002-R009	Register Reporting The organization shall report on the risk register, providing visibility into ri...	RSK-002 Risk Register	CISO, Risk Management, Governance Committee	View ↗
RSK-002-R010	Register Continuous Improvement The organization shall drive ongoing enhancement of the risk register through a...	RSK-002 Risk Register	CISO, Risk Management, Quality Management	View ↗
RSK-003-R001	Assessment Planning The organization shall conduct formal planning for risk assessments, defining th...	RSK-003 Risk Assessment	Chief Risk Officer, Risk Management, CISO	View ↗
RSK-003-R002	Risk Identification The organization shall conduct systematic risk identification activities to iden...	RSK-003 Risk Assessment	Risk Management, Risk Owners, CISO	View ↗
RSK-003-R003	Risk Analysis The organization shall conduct risk analysis to understand the nature, sources,...	RSK-003 Risk Assessment	Risk Management, Risk Analysts, Risk Owners	View ↗
RSK-003-R004	Risk Evaluation The organization shall conduct risk evaluation to compare estimated risks agains...	RSK-003 Risk Assessment	Risk Management, Risk Owner, CISO	View ↗
RSK-003-R005	Risk Scoring The organization shall apply consistent risk scoring methodologies to quantify a...	RSK-003 Risk Assessment	Risk Management, Risk Analysts, CISO	View ↗
RSK-003-R006	Impact Assessment The organization shall conduct impact assessments to evaluate the potential cons...	RSK-003 Risk Assessment	Risk Management, Business Unit Leaders, Risk Owners	View ↗
RSK-003-R007	Likelihood Assessment The organization shall conduct likelihood assessments to evaluate the probabilit...	RSK-003 Risk Assessment	Risk Management, Risk Analysts, Security Operations	View ↗
RSK-003-R008	Residual Risk Assessment The organization shall conduct residual risk assessments to evaluate the level o...	RSK-003 Risk Assessment	Risk Owners, Risk Management, CISO	View ↗
RSK-003-R009	Assessment Review The organization shall conduct periodic reviews of risk assessment activities to...	RSK-003 Risk Assessment	Chief Risk Officer, Risk Management, Internal Audit	View ↗
RSK-003-R010	Assessment Documentation The organization shall maintain comprehensive documentation of risk assessment a...	RSK-003 Risk Assessment	Risk Management, Risk Owners, Compliance	View ↗
RSK-004-R001	Treatment Strategy The organization shall define risk treatment strategies that articulate the appr...	RSK-004 Risk Treatment & Response	Risk Owners, Risk Management, CISO	View ↗
RSK-004-R002	Treatment Planning The organization shall develop formal plans for implementing risk treatment stra...	RSK-004 Risk Treatment & Response	Risk Owners, Risk Management, Control Owners	View ↗
RSK-004-R003	Treatment Approval The organization shall establish approval processes for risk treatment plans, de...	RSK-004 Risk Treatment & Response	Chief Risk Officer, Risk Governance Committee, Risk Owners	View ↗
RSK-004-R004	Treatment Implementation The organization shall implement approved risk treatment measures in accordance...	RSK-004 Risk Treatment & Response	Risk Owners, Control Owners, IT/Security Operations	View ↗
RSK-004-R005	Treatment Tracking The organization shall track risk treatment activities to monitor progress again...	RSK-004 Risk Treatment & Response	Risk Management, Risk Owners	View ↗
RSK-004-R006	Residual Risk Validation The organization shall validate residual risk levels following the implementatio...	RSK-004 Risk Treatment & Response	Risk Owners, Risk Management, Control Owners	View ↗
RSK-004-R007	Treatment Review The organization shall conduct periodic reviews of risk treatment activities to...	RSK-004 Risk Treatment & Response	Risk Management, Risk Owners, CISO	View ↗
RSK-004-R008	Treatment Effectiveness The organization shall evaluate the overall effectiveness of risk treatment stra...	RSK-004 Risk Treatment & Response	Risk Management, Risk Owners, Control Owners	View ↗
RSK-004-R009	Treatment Reporting The organization shall report on risk treatment activities, providing visibility...	RSK-004 Risk Treatment & Response	Chief Risk Officer, Risk Management	View ↗
RSK-004-R010	Treatment Continuous Improvement The organization shall drive ongoing enhancement of risk treatment activities th...	RSK-004 Risk Treatment & Response	Risk Management, CISO, Quality Management	View ↗
RSK-005-R001	Monitoring Framework The organization shall establish a monitoring framework for information security...	RSK-005 Risk Monitoring & Reporting	Chief Risk Officer, Risk Management, CISO	View ↗
RSK-005-R002	Risk Monitoring The organization shall maintain ongoing risk monitoring processes that track the...	RSK-005 Risk Monitoring & Reporting	Risk Owners, Risk Management	View ↗
RSK-005-R003	Risk Trend Analysis The organization shall conduct risk trend analysis to identify patterns, changes...	RSK-005 Risk Monitoring & Reporting	Risk Management, Risk Analytics, CISO	View ↗
RSK-005-R004	Risk Escalation The organization shall establish escalation processes for risks that exceed esta...	RSK-005 Risk Monitoring & Reporting	Chief Risk Officer, Risk Management, Risk Owners	View ↗
RSK-005-R005	Management Reporting The organization shall provide management with regular reports on the status of...	RSK-005 Risk Monitoring & Reporting	Chief Risk Officer, Risk Management	View ↗
RSK-005-R006	Executive Reporting The organization shall provide executive leadership and the board with regular r...	RSK-005 Risk Monitoring & Reporting	Chief Risk Officer, CISO, Board Risk Committee	View ↗
RSK-005-R007	Monitoring Review The organization shall conduct periodic reviews of risk monitoring activities to...	RSK-005 Risk Monitoring & Reporting	Risk Management, Internal Audit, CISO	View ↗
RSK-005-R008	Monitoring Records The organization shall maintain comprehensive records of risk monitoring activit...	RSK-005 Risk Monitoring & Reporting	Risk Management, Compliance	View ↗
RSK-005-R009	Monitoring Effectiveness The organization shall evaluate the overall effectiveness of risk monitoring act...	RSK-005 Risk Monitoring & Reporting	Risk Management, Risk Analytics, CISO	View ↗
RSK-005-R010	Monitoring Continuous Improvement The organization shall drive ongoing enhancement of risk monitoring activities t...	RSK-005 Risk Monitoring & Reporting	Risk Management, CISO, Quality Management	View ↗
RSK-006-R001	Appetite Framework The organization shall establish a risk appetite framework that defines the stru...	RSK-006 Risk Appetite Definition	Chief Risk Officer, Board Risk Committee, CISO	View ↗
RSK-006-R002	Appetite Statement The organization shall develop a formal risk appetite statement that articulates...	RSK-006 Risk Appetite Definition	Board of Directors, Chief Risk Officer, CISO	View ↗
RSK-006-R003	Appetite Approval The organization shall ensure the risk appetite statement and any material chang...	RSK-006 Risk Appetite Definition	Board Risk Committee, Chief Risk Officer	View ↗
RSK-006-R004	Appetite Communication The organization shall communicate the risk appetite statement to all levels of...	RSK-006 Risk Appetite Definition	Chief Risk Officer, Risk Management, Business Leaders	View ↗
RSK-006-R005	Threshold Definition The organization shall define risk thresholds that translate the risk appetite s...	RSK-006 Risk Appetite Definition	Chief Risk Officer, Risk Management, CISO	View ↗
RSK-006-R006	Threshold Monitoring The organization shall monitor risk levels against defined thresholds to identif...	RSK-006 Risk Appetite Definition	Risk Management, Risk Owners, CISO	View ↗
RSK-006-R007	Breach Escalation The organization shall establish escalation processes for situations where risk...	RSK-006 Risk Appetite Definition	Chief Risk Officer, CISO, Risk Governance Committee	View ↗
RSK-006-R008	Appetite Review The organization shall conduct periodic reviews of the risk appetite statement a...	RSK-006 Risk Appetite Definition	Chief Risk Officer, Board Risk Committee, CISO	View ↗
RSK-006-R009	Appetite Reporting The organization shall report on risk appetite, providing visibility into the or...	RSK-006 Risk Appetite Definition	Chief Risk Officer, Risk Management	View ↗
RSK-006-R010	Appetite Continuous Improvement The organization shall drive ongoing enhancement of risk appetite definition and...	RSK-006 Risk Appetite Definition	Chief Risk Officer, Risk Management, Board Risk Committee	View ↗
RSK-007-R001	KRI Framework The organization shall establish a framework for key risk indicators that define...	RSK-007 Key Risk Indicators (KRIs)	Chief Risk Officer, Risk Management, CISO	View ↗
RSK-007-R002	KRI Definition The organization shall define key risk indicators that provide early warning of...	RSK-007 Key Risk Indicators (KRIs)	Risk Management, Risk Owners, Risk Analytics	View ↗
RSK-007-R003	KRI Thresholds The organization shall define thresholds for each key risk indicator that trigge...	RSK-007 Key Risk Indicators (KRIs)	Risk Management, Risk Owners, CISO	View ↗
RSK-007-R004	KRI Monitoring The organization shall monitor KRI data to track changes in risk levels and iden...	RSK-007 Key Risk Indicators (KRIs)	Risk Management, Risk Analytics, Risk Owners	View ↗
RSK-007-R005	KRI Analysis The organization shall analyze KRI data to identify patterns, trends, and root c...	RSK-007 Key Risk Indicators (KRIs)	Risk Analytics, Risk Management, Risk Owners	View ↗
RSK-007-R006	KRI Reporting The organization shall report on key risk indicators, providing visibility into...	RSK-007 Key Risk Indicators (KRIs)	Chief Risk Officer, Risk Management	View ↗
RSK-007-R007	KRI Escalation The organization shall establish escalation processes for situations where KRIs...	RSK-007 Key Risk Indicators (KRIs)	Risk Management, Risk Owners, CISO	View ↗
RSK-007-R008	KRI Review The organization shall conduct periodic reviews of key risk indicators to ensure...	RSK-007 Key Risk Indicators (KRIs)	Risk Management, Risk Analytics, CISO	View ↗
RSK-007-R009	KRI Effectiveness The organization shall evaluate the overall effectiveness of key risk indicators...	RSK-007 Key Risk Indicators (KRIs)	Risk Management, Risk Analytics	View ↗
RSK-007-R010	KRI Continuous Improvement The organization shall drive ongoing enhancement of key risk indicators through...	RSK-007 Key Risk Indicators (KRIs)	Risk Management, CISO, Quality Management	View ↗
RSK-008-R001	Acceptance Framework The organization shall establish a risk acceptance and exception management fram...	RSK-008 Risk Acceptance & Exception Ma...	Chief Risk Officer, Risk Management, CISO	View ↗
RSK-008-R002	Acceptance Criteria The organization shall define criteria for accepting risks or granting exception...	RSK-008 Risk Acceptance & Exception Ma...	Chief Risk Officer, Risk Management, Compliance	View ↗
RSK-008-R003	Exception Request The organization shall establish a formal process for submitting exception reque...	RSK-008 Risk Acceptance & Exception Ma...	Risk Management, Control Owners, Compliance	View ↗
RSK-008-R004	Business Justification The organization shall require all risk acceptance and exception requests includ...	RSK-008 Risk Acceptance & Exception Ma...	Business Unit Owner, Risk Owner, Risk Management	View ↗
RSK-008-R005	Risk Evaluation The organization shall conduct risk evaluations for all risk acceptance and exce...	RSK-008 Risk Acceptance & Exception Ma...	Risk Management, Risk Owner, CISO	View ↗
RSK-008-R006	Approval Workflow The organization shall maintain a formal approval workflow for risk acceptance a...	RSK-008 Risk Acceptance & Exception Ma...	Risk Governance Committee, Chief Risk Officer, Risk Owners	View ↗
RSK-008-R007	Acceptance Documentation The organization shall maintain comprehensive documentation of all risk acceptan...	RSK-008 Risk Acceptance & Exception Ma...	Risk Management, Compliance	View ↗
RSK-008-R008	Exception Monitoring The organization shall monitor approved risk acceptances and exceptions, trackin...	RSK-008 Risk Acceptance & Exception Ma...	Risk Management, Risk Owners, Control Owners	View ↗
RSK-008-R009	Periodic Review The organization shall conduct periodic reviews of approved risk acceptances and...	RSK-008 Risk Acceptance & Exception Ma...	Risk Management, Risk Owners, Compliance	View ↗
RSK-008-R010	Exception Closure The organization shall establish processes for closing risk acceptances and exce...	RSK-008 Risk Acceptance & Exception Ma...	Risk Owners, Risk Management, Control Owners	View ↗
RSK-009-R001	Scenario Framework The organization shall establish a scenario analysis framework that defines the...	RSK-009 Scenario Analysis	Chief Risk Officer, Risk Management, CISO	View ↗
RSK-009-R002	Scenario Identification The organization shall identify risk scenarios that represent plausible risk eve...	RSK-009 Scenario Analysis	Risk Management, Business Continuity, CISO	View ↗
RSK-009-R003	Scenario Development The organization shall develop detailed risk scenarios that describe the sequenc...	RSK-009 Scenario Analysis	Risk Management, Business Unit Leaders, CISO	View ↗
RSK-009-R004	Impact Analysis The organization shall conduct impact analyses for developed risk scenarios, ass...	RSK-009 Scenario Analysis	Risk Management, Business Continuity, Business Unit Leaders	View ↗
RSK-009-R005	Likelihood Evaluation The organization shall conduct likelihood evaluations for developed risk scenari...	RSK-009 Scenario Analysis	Risk Management, Risk Analysts, Security Operations	View ↗
RSK-009-R006	Response Planning The organization shall develop response plans for high-priority risk scenarios,...	RSK-009 Scenario Analysis	Incident Response, Business Continuity, Risk Management	View ↗
RSK-009-R007	Scenario Review The organization shall conduct periodic reviews of developed risk scenarios to e...	RSK-009 Scenario Analysis	Risk Management, Business Continuity, CISO	View ↗
RSK-009-R008	Lessons Learned The organization shall capture and integrate lessons learned from scenario analy...	RSK-009 Scenario Analysis	Risk Management, Business Continuity, Incident Response	View ↗
RSK-009-R009	Scenario Reporting The organization shall report on scenario analysis, providing visibility into sc...	RSK-009 Scenario Analysis	Chief Risk Officer, Risk Management, CISO	View ↗
RSK-009-R010	Scenario Continuous Improvement The organization shall drive ongoing enhancement of scenario analysis through a...	RSK-009 Scenario Analysis	Chief Compliance Officer, Compliance Management	View ↗
CMP-001-R001	Compliance Program Framework The organization shall establish a compliance program framework that defines the...	CMP-001 Compliance Program Management	Chief Compliance Officer, Compliance Management	View ↗
CMP-001-R002	Compliance Governance The organization shall establish governance structures for the compliance progra...	CMP-001 Compliance Program Management	Chief Compliance Officer, Compliance Management	View ↗
CMP-001-R003	Compliance Scope The organization shall define and maintain a documented scope for the compliance...	CMP-001 Compliance Program Management	Chief Compliance Officer, Compliance Management	View ↗
CMP-001-R004	Compliance Roles and Responsibilities The organization shall clearly define and document the roles and responsibilitie...	CMP-001 Compliance Program Management	Chief Compliance Officer, Compliance Management	View ↗
CMP-001-R005	Compliance Planning The organization shall conduct formal planning for compliance management activit...	CMP-001 Compliance Program Management	Chief Compliance Officer, Compliance Management	View ↗
CMP-001-R006	Compliance Program Execution The organization shall execute the compliance program in accordance with approve...	CMP-001 Compliance Program Management	Chief Compliance Officer, Compliance Management	View ↗
CMP-001-R007	Compliance Resource Management The organization shall manage resources for the compliance program, including id...	CMP-001 Compliance Program Management	Chief Compliance Officer, Compliance Management	View ↗
CMP-001-R008	Compliance Performance Monitoring The organization shall monitor the performance of the compliance program to trac...	CMP-001 Compliance Program Management	Chief Compliance Officer, Compliance Management	View ↗
CMP-001-R009	Compliance Program Review The organization shall conduct periodic reviews of the compliance program to ass...	CMP-001 Compliance Program Management	Chief Compliance Officer, Compliance Management	View ↗
CMP-001-R010	Compliance Program Continuous Improvement The organization shall drive ongoing enhancement of the compliance program throu...	CMP-001 Compliance Program Management	Chief Compliance Officer, Compliance Management, Control Owners	View ↗
CMP-002-R001	Compliance Monitoring Framework The organization shall establish a compliance monitoring framework that defines...	CMP-002 Control Compliance Monitoring	Chief Compliance Officer, Compliance Management, Control Owners	View ↗
CMP-002-R002	Compliance Assessment Planning The organization shall conduct formal planning for compliance assessments, defin...	CMP-002 Control Compliance Monitoring	Chief Compliance Officer, Compliance Management, Control Owners	View ↗
CMP-002-R003	Control Compliance Assessment The organization shall conduct regular assessments of controls to verify complia...	CMP-002 Control Compliance Monitoring	Chief Compliance Officer, Compliance Management, Control Owners	View ↗
CMP-002-R004	Compliance Gap Identification The organization shall identify compliance gaps, including controls that are mis...	CMP-002 Control Compliance Monitoring	Chief Compliance Officer, Compliance Management, Control Owners	View ↗
CMP-002-R005	Compliance Status Tracking The organization shall track the status of compliance with applicable legal, reg...	CMP-002 Control Compliance Monitoring	Chief Compliance Officer, Compliance Management, Control Owners	View ↗
CMP-002-R006	Compliance Exception Identification The organization shall identify and document exceptions to compliance requiremen...	CMP-002 Control Compliance Monitoring	Chief Compliance Officer, Compliance Management, Control Owners	View ↗
CMP-002-R007	Compliance Monitoring Reporting The organization shall report on compliance monitoring, providing visibility int...	CMP-002 Control Compliance Monitoring	Chief Compliance Officer, Compliance Management, Control Owners	View ↗
CMP-002-R008	Compliance Escalation The organization shall establish escalation processes for significant compliance...	CMP-002 Control Compliance Monitoring	Chief Compliance Officer, Compliance Management, Control Owners	View ↗
CMP-002-R009	Compliance Monitoring Review The organization shall conduct periodic reviews of compliance monitoring activit...	CMP-002 Control Compliance Monitoring	Chief Compliance Officer, Compliance Management, Control Owners	View ↗
CMP-002-R010	Compliance Monitoring Improvement The organization shall drive ongoing enhancement of compliance monitoring activi...	CMP-002 Control Compliance Monitoring	Compliance Management, Control Owners, Records Management	View ↗
CMP-003-R001	Evidence Management Framework The organization shall establish an evidence management framework that defines t...	CMP-003 Compliance Evidence Management	Compliance Management, Control Owners, Records Management	View ↗
CMP-003-R002	Evidence Identification The organization shall identify the evidence required to demonstrate compliance...	CMP-003 Compliance Evidence Management	Compliance Management, Control Owners, Records Management	View ↗
CMP-003-R003	Evidence Collection The organization shall collect compliance evidence in a consistent, timely, and...	CMP-003 Compliance Evidence Management	Compliance Management, Control Owners, Records Management	View ↗
CMP-003-R004	Evidence Validation The organization shall validate compliance evidence to ensure its accuracy, comp...	CMP-003 Compliance Evidence Management	Compliance Management, Control Owners, Records Management	View ↗
CMP-003-R005	Evidence Classification The organization shall establish classification schemas for compliance evidence...	CMP-003 Compliance Evidence Management	Compliance Management, Control Owners, Records Management	View ↗
CMP-003-R006	Evidence Repository Management The organization shall establish and maintain a centralized repository for compl...	CMP-003 Compliance Evidence Management	Compliance Management, Control Owners, Records Management	View ↗
CMP-003-R007	Evidence Protection The organization shall protect compliance evidence from unauthorized access, mod...	CMP-003 Compliance Evidence Management	Compliance Management, Control Owners, Records Management	View ↗
CMP-003-R008	Evidence Availability The organization shall ensure compliance evidence is available to authorized par...	CMP-003 Compliance Evidence Management	Compliance Management, Control Owners, Records Management	View ↗
CMP-003-R009	Evidence Review The organization shall conduct periodic reviews of compliance evidence to ensure...	CMP-003 Compliance Evidence Management	Compliance Management, Control Owners, Records Management	View ↗
CMP-003-R010	Evidence Lifecycle Management The organization shall maintain lifecycle management processes for compliance ev...	CMP-003 Compliance Evidence Management	Chief Compliance Officer, Compliance Management, Risk Owners	View ↗
CMP-004-R001	Non-Compliance Identification The organization shall identify instances of non-compliance with applicable lega...	CMP-004 Non-Compliance Management	Chief Compliance Officer, Compliance Management, Risk Owners	View ↗
CMP-004-R002	Non-Compliance Recording The organization shall record identified non-compliance in a consistent and comp...	CMP-004 Non-Compliance Management	Chief Compliance Officer, Compliance Management, Risk Owners	View ↗
CMP-004-R003	Non-Compliance Classification The organization shall establish a classification schema for non-compliance that...	CMP-004 Non-Compliance Management	Chief Compliance Officer, Compliance Management, Risk Owners	View ↗
CMP-004-R004	Root Cause Analysis The organization shall conduct root cause analysis for significant instances of...	CMP-004 Non-Compliance Management	Chief Compliance Officer, Compliance Management, Risk Owners	View ↗
CMP-004-R005	Corrective Action Planning The organization shall develop formal corrective action plans for addressing ide...	CMP-004 Non-Compliance Management	Chief Compliance Officer, Compliance Management, Risk Owners	View ↗
CMP-004-R006	Corrective Action Implementation The organization shall implement approved corrective actions in accordance with...	CMP-004 Non-Compliance Management	Audit & Compliance	View ↗
CMP-004-R007	Corrective Action Verification The organization shall verify that implemented corrective actions have effective...	CMP-004 Non-Compliance Management	Chief Compliance Officer, Compliance Management, Risk Owners	View ↗
CMP-004-R008	Non-Compliance Escalation The organization shall establish escalation processes for significant non-compli...	CMP-004 Non-Compliance Management	Chief Compliance Officer, Compliance Management, Risk Owners	View ↗
CMP-004-R009	Non-Compliance Reporting The organization shall report on non-compliance, providing visibility into non-c...	CMP-004 Non-Compliance Management	Chief Compliance Officer, Compliance Management, Risk Owners	View ↗
CMP-004-R010	Non-Compliance Closure The organization shall establish processes for closing non-compliance instances...	CMP-004 Non-Compliance Management	Chief Compliance Officer, Compliance Management, Risk Owners	View ↗
CMP-005-R001	Compliance Reporting Framework The organization shall establish a compliance reporting framework that defines t...	CMP-005 Compliance Reporting	Chief Compliance Officer, Compliance Management, Reporting Owners	View ↗
CMP-005-R002	Reporting Scope The organization shall define a documented scope for compliance reporting that i...	CMP-005 Compliance Reporting	Chief Compliance Officer, Compliance Management, Reporting Owners	View ↗
CMP-005-R003	Reporting Content The organization shall define content requirements for compliance reports, ensur...	CMP-005 Compliance Reporting	Chief Compliance Officer, Compliance Management, Reporting Owners	View ↗
CMP-005-R004	Reporting Frequency The organization shall establish reporting frequency requirements for compliance...	CMP-005 Compliance Reporting	Chief Compliance Officer, Compliance Management, Reporting Owners	View ↗
CMP-005-R005	Executive Compliance Reporting The organization shall provide executive leadership and the board with regular r...	CMP-005 Compliance Reporting	Chief Compliance Officer, Compliance Management, Reporting Owners	View ↗
CMP-005-R006	Regulatory Compliance Reporting The organization shall prepare and submit regulatory compliance reports to appli...	CMP-005 Compliance Reporting	Chief Compliance Officer, Compliance Management, Reporting Owners	View ↗
CMP-005-R007	Compliance Dashboard Reporting The organization shall develop and maintain compliance dashboards that provide s...	CMP-005 Compliance Reporting	Chief Compliance Officer, Compliance Management, Reporting Owners	View ↗
CMP-005-R008	Report Validation The organization shall validate compliance reports to ensure their accuracy, com...	CMP-005 Compliance Reporting	Chief Compliance Officer, Compliance Management, Reporting Owners	View ↗
CMP-005-R009	Reporting Review The organization shall conduct periodic reviews of compliance reporting activiti...	CMP-005 Compliance Reporting	Chief Compliance Officer, Compliance Management, Reporting Owners	View ↗
CMP-005-R010	Reporting Continuous Improvement The organization shall drive ongoing enhancement of compliance reporting through...	CMP-005 Compliance Reporting	Chief Compliance Officer, Compliance Management, Reporting Owners	View ↗
CMP-006-R001	Regulatory Change Framework The organization shall establish a regulatory change management framework that d...	CMP-006 Regulatory Change Management	Compliance Management, Legal, Regulatory Affairs, Control Owners	View ↗
CMP-006-R002	Regulatory Change Identification The organization shall identify changes in legal, regulatory, and contractual re...	CMP-006 Regulatory Change Management	Compliance Management, Legal, Regulatory Affairs, Control Owners	View ↗
CMP-006-R003	Regulatory Change Monitoring The organization shall monitor regulatory developments and changes to legal and...	CMP-006 Regulatory Change Management	Compliance Management, Legal, Regulatory Affairs, Control Owners	View ↗
CMP-006-R004	Impact Assessment The organization shall conduct impact assessments for identified regulatory chan...	CMP-006 Regulatory Change Management	Compliance Management, Legal, Regulatory Affairs, Control Owners	View ↗
CMP-006-R005	Change Prioritization The organization shall prioritize regulatory changes based on their impact, urge...	CMP-006 Regulatory Change Management	Compliance Management, Legal, Regulatory Affairs, Control Owners	View ↗
CMP-006-R006	Change Implementation Planning The organization shall develop formal plans for implementing changes required by...	CMP-006 Regulatory Change Management	Compliance Management, Legal, Regulatory Affairs, Control Owners	View ↗
CMP-006-R007	Compliance Update Management The organization shall update compliance documentation, controls, and processes...	CMP-006 Regulatory Change Management	Compliance Management, Legal, Regulatory Affairs, Control Owners	View ↗
CMP-006-R008	Regulatory Change Communication The organization shall communicate regulatory changes and their implications to...	CMP-006 Regulatory Change Management	Compliance Management, Legal, Regulatory Affairs, Control Owners	View ↗
CMP-006-R009	Regulatory Change Review The organization shall conduct periodic reviews of the regulatory change managem...	CMP-006 Regulatory Change Management	Compliance Management, Legal, Regulatory Affairs, Control Owners	View ↗
CMP-006-R010	Regulatory Change Effectiveness The organization shall evaluate the overall effectiveness of the regulatory chan...	CMP-006 Regulatory Change Management	Compliance Management, Legal, Regulatory Affairs, Control Owners	View ↗
CMP-007-R001	Obligation Identification The organization shall identify all legal, regulatory, and contractual complianc...	CMP-007 Compliance Obligation Mapping	Compliance Management, Control Owners, Legal	View ↗
CMP-007-R002	Obligation Classification The organization shall establish a classification schema for compliance obligati...	CMP-007 Compliance Obligation Mapping	Compliance Management, Control Owners, Legal	View ↗
CMP-007-R003	Control Mapping The organization shall maintain mappings between compliance obligations and the...	CMP-007 Compliance Obligation Mapping	Compliance Management, Control Owners, Legal	View ↗
CMP-007-R004	Mapping Validation The organization shall validate control mappings to ensure they accurately refle...	CMP-007 Compliance Obligation Mapping	Compliance Management, Control Owners, Legal	View ↗
CMP-007-R005	Gap Identification The organization shall use obligation mapping to identify gaps in control covera...	CMP-007 Compliance Obligation Mapping	Compliance Management, Control Owners, Legal	View ↗
CMP-007-R006	Mapping Maintenance The organization shall maintain obligation mappings to ensure they remain curren...	CMP-007 Compliance Obligation Mapping	Compliance Management, Control Owners, Legal	View ↗
CMP-007-R007	Mapping Traceability The organization shall maintain traceability between compliance obligations, con...	CMP-007 Compliance Obligation Mapping	Compliance Management, Control Owners, Legal	View ↗
CMP-007-R008	Mapping Reporting The organization shall report on obligation mappings, providing visibility into...	CMP-007 Compliance Obligation Mapping	Compliance Management, Control Owners, Legal	View ↗
CMP-007-R009	Mapping Review The organization shall conduct periodic reviews of obligation mappings to ensure...	CMP-007 Compliance Obligation Mapping	Compliance Management, Control Owners, Legal	View ↗
CMP-007-R010	Mapping Continuous Improvement The organization shall drive ongoing enhancement of obligation mapping through a...	CMP-007 Compliance Obligation Mapping	Compliance Management, Control Owners, Legal	View ↗
IAM-001-R001	Identity Registration The organization shall register identities of all individuals and entities requi...	IAM-001 Identity & Account Lifecycle M...	Identity & Access Management, HR, IT Operations, Application Owners	View ↗
IAM-001-R002	Identity Verification The organization shall verify the identity of individuals and entities before pr...	IAM-001 Identity & Account Lifecycle M...	Identity & Access Management, HR, IT Operations, Application Owners	View ↗
IAM-001-R003	Identity Provisioning The organization shall provision identities to organizational systems and applic...	IAM-001 Identity & Account Lifecycle M...	Identity & Access Management, HR, IT Operations, Application Owners	View ↗
IAM-001-R004	Account Provisioning The organization shall provision accounts for authenticated identities across or...	IAM-001 Identity & Account Lifecycle M...	Identity & Access Management, HR, IT Operations, Application Owners	View ↗
IAM-001-R005	Identity Modification The organization shall modify identity information when changes occur in an indi...	IAM-001 Identity & Account Lifecycle M...	Identity & Access Management, HR, IT Operations, Application Owners	View ↗
IAM-001-R006	Account Modification The organization shall modify accounts when changes occur in an individual's rol...	IAM-001 Identity & Account Lifecycle M...	Identity & Access Management, HR, IT Operations, Application Owners	View ↗
IAM-001-R007	Joiner Process The organization shall establish a formal joiner process that defines identity a...	IAM-001 Identity & Account Lifecycle M...	Identity & Access Management, HR, IT Operations, Application Owners	View ↗
IAM-001-R008	Mover Process The organization shall establish a formal mover process that defines identity an...	IAM-001 Identity & Account Lifecycle M...	Identity & Access Management, HR, IT Operations, Application Owners	View ↗
IAM-001-R009	Leaver Process The organization shall establish a formal leaver process that defines identity a...	IAM-001 Identity & Account Lifecycle M...	Identity & Access Management, HR, IT Operations, Application Owners	View ↗
IAM-001-R010	Identity Deactivation The organization shall deactivate identities when individuals leave the organiza...	IAM-001 Identity & Account Lifecycle M...	Identity & Access Management, HR, IT Operations, Application Owners	View ↗
IAM-001-R011	Account Deprovisioning The organization shall deprovision accounts when individuals leave the organizat...	IAM-001 Identity & Account Lifecycle M...	Identity & Access Management, HR, IT Operations, Application Owners	View ↗
IAM-001-R012	Lifecycle Monitoring The organization shall monitor identity and account lifecycle activities to ensu...	IAM-001 Identity & Account Lifecycle M...	Identity & Access Management, HR, IT Operations, Application Owners	View ↗
IAM-002-R001	Authentication Framework The organization shall establish an authentication framework that defines the st...	IAM-002 Authentication Management	Identity & Access Management, Security Architecture, CISO, System Owners	View ↗
IAM-002-R002	Authentication Methods The organization shall implement authentication methods that provide appropriate...	IAM-002 Authentication Management	Identity & Access Management, Security Architecture, CISO, System Owners	View ↗
IAM-002-R003	Multi-Factor Authentication The organization shall implement multi-factor authentication for access to sensi...	IAM-002 Authentication Management	Identity & Access Management, Security Architecture, CISO, System Owners	View ↗
IAM-002-R004	Passwordless Authentication The organization shall evaluate and implement passwordless authentication method...	IAM-002 Authentication Management	Identity & Access Management, Security Architecture, CISO, System Owners	View ↗
IAM-002-R005	Credential Management The organization shall manage authentication credentials throughout their lifecy...	IAM-002 Authentication Management	Identity & Access Management, Security Architecture, CISO, System Owners	View ↗
IAM-002-R006	Authentication Policies The organization shall establish authentication policies that define the require...	IAM-002 Authentication Management	Identity & Access Management, Security Architecture, CISO, System Owners	View ↗
IAM-002-R007	Adaptive Authentication The organization shall implement adaptive authentication capabilities that adjus...	IAM-002 Authentication Management	Identity & Access Management, Security Architecture, CISO, System Owners	View ↗
IAM-002-R008	Authentication Monitoring The organization shall monitor authentication activities to detect and respond t...	IAM-002 Authentication Management	Identity & Access Management, Security Architecture, CISO, System Owners	View ↗
IAM-002-R009	Authentication Review The organization shall conduct periodic reviews of authentication management act...	IAM-002 Authentication Management	Identity & Access Management, Security Architecture, CISO, System Owners	View ↗
IAM-002-R010	Authentication Continuous Improvement The organization shall drive ongoing enhancement of authentication management th...	IAM-002 Authentication Management	Identity & Access Management, Security Architecture, CISO, System Owners	View ↗
IAM-003-R001	PAM Framework The organization shall establish a privileged access management framework that d...	IAM-003 Privileged Access Management	PAM Team, Identity & Access Management, Security Operations, CISO	View ↗
IAM-003-R002	Privileged Account Identification The organization shall identify and document all privileged accounts and privile...	IAM-003 Privileged Access Management	PAM Team, Identity & Access Management, Security Operations, CISO	View ↗
IAM-003-R003	Privileged Access Provisioning The organization shall provision privileged access to authorized individuals and...	IAM-003 Privileged Access Management	PAM Team, Identity & Access Management, Security Operations, CISO	View ↗
IAM-003-R004	Session Management The organization shall manage privileged access sessions, including session moni...	IAM-003 Privileged Access Management	PAM Team, Identity & Access Management, Security Operations, CISO	View ↗
IAM-003-R005	Credential Vaulting The organization shall implement credential vaulting capabilities for privileged...	IAM-003 Privileged Access Management	PAM Team, Identity & Access Management, Security Operations, CISO	View ↗
IAM-003-R006	Just-In-Time Access The organization shall implement just-in-time access capabilities for privileged...	IAM-003 Privileged Access Management	PAM Team, Identity & Access Management, Security Operations, CISO	View ↗
IAM-003-R007	Privileged Access Monitoring The organization shall monitor privileged access activities to detect and respon...	IAM-003 Privileged Access Management	PAM Team, Identity & Access Management, Security Operations, CISO	View ↗
IAM-003-R008	Privileged Access Review The organization shall conduct periodic reviews of privileged access management...	IAM-003 Privileged Access Management	PAM Team, Identity & Access Management, Security Operations, CISO	View ↗
IAM-003-R009	Privileged Access Reporting The organization shall report on privileged access management, providing visibil...	IAM-003 Privileged Access Management	PAM Team, Identity & Access Management, Security Operations, CISO	View ↗
IAM-003-R010	Privileged Access Continuous Improvement The organization shall drive ongoing enhancement of privileged access management...	IAM-003 Privileged Access Management	PAM Team, Identity & Access Management, Security Operations, CISO	View ↗
IAM-004-R001	Authorization Framework The organization shall establish an authorization framework that defines the str...	IAM-004 Authorization Management	Identity & Access Management, Application Owners, Business Owners, CISO	View ↗
IAM-004-R002	Role Definition The organization shall define roles with associated access permissions that repr...	IAM-004 Authorization Management	Identity & Access Management, Application Owners, Business Owners, CISO	View ↗
IAM-004-R003	Least Privilege The organization shall enforce the principle of least privilege in all authoriza...	IAM-004 Authorization Management	Identity & Access Management, Application Owners, Business Owners, CISO	View ↗
IAM-004-R004	Role Assignment The organization shall assign roles to individuals based on job function, respon...	IAM-004 Authorization Management	Identity & Access Management, Application Owners, Business Owners, CISO	View ↗
IAM-004-R005	Access Approval The organization shall maintain formal approval processes for granting access pe...	IAM-004 Authorization Management	Identity & Access Management, Application Owners, Business Owners, CISO	View ↗
IAM-004-R006	Segregation of Duties The organization shall implement segregation of duties controls to prevent any i...	IAM-004 Authorization Management	Identity & Access Management, Application Owners, Business Owners, CISO	View ↗
IAM-004-R007	Authorization Review The organization shall conduct periodic reviews of authorization configurations...	IAM-004 Authorization Management	Identity & Access Management, Application Owners, Business Owners, CISO	View ↗
IAM-004-R008	Authorization Monitoring The organization shall monitor authorization activities to detect and respond to...	IAM-004 Authorization Management	Identity & Access Management, Application Owners, Business Owners, CISO	View ↗
IAM-004-R009	Authorization Reporting The organization shall report on authorization management, providing visibility...	IAM-004 Authorization Management	Identity & Access Management, Application Owners, Business Owners, CISO	View ↗
IAM-004-R010	Authorization Continuous Improvement The organization shall drive ongoing enhancement of authorization management thr...	IAM-004 Authorization Management	Identity & Access Management, Application Owners, Business Owners, CISO	View ↗
IAM-005-R001	Review Framework The organization shall establish an access review framework that defines the str...	IAM-005 Access Reviews (Certifications...	Identity & Access Management, Business Owners, Application Owners, Compliance	View ↗
IAM-005-R002	Review Scope The organization shall define a documented scope for access reviews that identif...	IAM-005 Access Reviews (Certifications...	Identity & Access Management, Business Owners, Application Owners, Compliance	View ↗
IAM-005-R003	Review Scheduling The organization shall establish a schedule for access reviews that defines the...	IAM-005 Access Reviews (Certifications...	Identity & Access Management, Business Owners, Application Owners, Compliance	View ↗
IAM-005-R004	Certification Process The organization shall maintain a formal certification process for access review...	IAM-005 Access Reviews (Certifications...	Identity & Access Management, Business Owners, Application Owners, Compliance	View ↗
IAM-005-R005	Exception Handling The organization shall handle exceptions identified during access reviews, inclu...	IAM-005 Access Reviews (Certifications...	Identity & Access Management, Business Owners, Application Owners, Compliance	View ↗
IAM-005-R006	Revocation The organization shall revoke access permissions identified as no longer require...	IAM-005 Access Reviews (Certifications...	Identity & Access Management, Business Owners, Application Owners, Compliance	View ↗
IAM-005-R007	Review Documentation The organization shall maintain comprehensive documentation of access review act...	IAM-005 Access Reviews (Certifications...	Identity & Access Management, Business Owners, Application Owners, Compliance	View ↗
IAM-005-R008	Review Reporting The organization shall report on access reviews, providing visibility into revie...	IAM-005 Access Reviews (Certifications...	Identity & Access Management, Business Owners, Application Owners, Compliance	View ↗
IAM-005-R009	Review Quality The organization shall ensure the quality of access reviews, including the consi...	IAM-005 Access Reviews (Certifications...	Identity & Access Management, Business Owners, Application Owners, Compliance	View ↗
IAM-005-R010	Access Review Continuous Improvement The organization shall drive ongoing enhancement of access reviews through a con...	IAM-005 Access Reviews (Certifications...	Identity & Access Management, Business Owners, Application Owners, Compliance	View ↗
IAM-006-R001	Federation Framework The organization shall establish a federation framework that defines the structu...	IAM-006 Federation & Single Sign-On (S...	Identity & Access Management, Security Architecture, Federation Administrators	View ↗
IAM-006-R002	Trust Relationships The organization shall establish and manage trust relationships with identity pr...	IAM-006 Federation & Single Sign-On (S...	Identity & Access Management, Security Architecture, Federation Administrators	View ↗
IAM-006-R003	Identity Federation The organization shall implement identity federation capabilities that enable us...	IAM-006 Federation & Single Sign-On (S...	Identity & Access Management, Security Architecture, Federation Administrators	View ↗
IAM-006-R004	SSO Configuration The organization shall configure single sign-on capabilities that enable users t...	IAM-006 Federation & Single Sign-On (S...	Identity & Access Management, Security Architecture, Federation Administrators	View ↗
IAM-006-R005	Federation Monitoring The organization shall monitor federation and SSO activities to detect and respo...	IAM-006 Federation & Single Sign-On (S...	Identity & Access Management, Security Architecture, Federation Administrators	View ↗
IAM-006-R006	Federation Security The organization shall maintain security controls for identity federation and SS...	IAM-006 Federation & Single Sign-On (S...	Identity & Access Management, Security Architecture, Federation Administrators	View ↗
IAM-006-R007	Federation Review The organization shall conduct periodic reviews of federation and SSO activities...	IAM-006 Federation & Single Sign-On (S...	Identity & Access Management, Security Architecture, Federation Administrators	View ↗
IAM-006-R008	Federation Reporting The organization shall report on federation and SSO management, providing visibi...	IAM-006 Federation & Single Sign-On (S...	Identity & Access Management, Security Architecture, Federation Administrators	View ↗
IAM-006-R009	Federation Maintenance The organization shall maintain federation and SSO configurations, ensuring they...	IAM-006 Federation & Single Sign-On (S...	Identity & Access Management, Security Architecture, Federation Administrators	View ↗
IAM-006-R010	Federation Continuous Improvement The organization shall drive ongoing enhancement of federation and SSO managemen...	IAM-006 Federation & Single Sign-On (S...	Identity & Access Management, Security Architecture, Federation Administrators	View ↗
IAM-007-R001	API Identity The organization shall manage identities for APIs and API consumers, ensuring al...	IAM-007 Access Control for APIs	API Security, Identity & Access Management, Application Security	View ↗
IAM-007-R002	API Authentication The organization shall implement authentication mechanisms for API access that p...	IAM-007 Access Control for APIs	API Security, Identity & Access Management, Application Security	View ↗
IAM-007-R003	API Authorization The organization shall implement authorization controls for API access that enfo...	IAM-007 Access Control for APIs	API Security, Identity & Access Management, Application Security	View ↗
IAM-007-R004	Token Management The organization shall manage API tokens and credentials throughout their lifecy...	IAM-007 Access Control for APIs	API Security, Identity & Access Management, Application Security	View ↗
IAM-007-R005	API Access Policies The organization shall establish API access policies that define the requirement...	IAM-007 Access Control for APIs	API Security, Identity & Access Management, Application Security	View ↗
IAM-007-R006	API Credential Protection The organization shall implement protection measures for API credentials to prev...	IAM-007 Access Control for APIs	API Security, Identity & Access Management, Application Security	View ↗
IAM-007-R007	API Monitoring The organization shall monitor API access activities to detect and respond to un...	IAM-007 Access Control for APIs	API Security, Identity & Access Management, Application Security	View ↗
IAM-007-R008	API Review The organization shall conduct periodic reviews of API access control activities...	IAM-007 Access Control for APIs	API Security, Identity & Access Management, Application Security	View ↗
IAM-007-R009	API Reporting The organization shall report on API access control, providing visibility into A...	IAM-007 Access Control for APIs	API Security, Identity & Access Management, Application Security	View ↗
IAM-007-R010	API Continuous Improvement The organization shall drive ongoing enhancement of API access control through a...	IAM-007 Access Control for APIs	API Security, Identity & Access Management, Application Security	View ↗
IAM-008-R001	Non-Human Identity Framework The organization shall establish a non-human identity management framework that...	IAM-008 Non-Human Identity Management	Identity & Access Management, Platform Engineering, DevSecOps, Security Operations	View ↗
IAM-008-R002	Identity Inventory The organization shall identify and maintain a comprehensive inventory of all no...	IAM-008 Non-Human Identity Management	Identity & Access Management, Platform Engineering, DevSecOps, Security Operations	View ↗
IAM-008-R003	Identity Ownership The organization shall assign explicit ownership for each non-human identity, de...	IAM-008 Non-Human Identity Management	Identity & Access Management, Platform Engineering, DevSecOps, Security Operations	View ↗
IAM-008-R004	Credential Management The organization shall manage credentials for non-human identities, including th...	IAM-008 Non-Human Identity Management	Identity & Access Management, Platform Engineering, DevSecOps, Security Operations	View ↗
IAM-008-R005	Secret Rotation The organization shall regularly rotate secrets used by non-human identities, in...	IAM-008 Non-Human Identity Management	Identity & Access Management, Platform Engineering, DevSecOps, Security Operations	View ↗
IAM-008-R006	Certificate Lifecycle The organization shall manage the lifecycle of certificates used by non-human id...	IAM-008 Non-Human Identity Management	Identity & Access Management, Platform Engineering, DevSecOps, Security Operations	View ↗
IAM-008-R007	Machine Identity Monitoring The organization shall monitor machine identity activities to detect and respond...	IAM-008 Non-Human Identity Management	Identity & Access Management, Platform Engineering, DevSecOps, Security Operations	View ↗
IAM-008-R008	Identity Review The organization shall conduct periodic reviews of non-human identities to ensur...	IAM-008 Non-Human Identity Management	Identity & Access Management, Platform Engineering, DevSecOps, Security Operations	View ↗
IAM-008-R009	Non-Human Identity Reporting The organization shall report on non-human identity management, providing visibi...	IAM-008 Non-Human Identity Management	Identity & Access Management, Platform Engineering, DevSecOps, Security Operations	View ↗
IAM-008-R010	Non-Human Identity Continuous Improvement The organization shall drive ongoing enhancement of non-human identity managemen...	IAM-008 Non-Human Identity Management	Identity & Access Management, Platform Engineering, DevSecOps, Security Operations	View ↗
AST-001-R001	Asset Inventory Framework The organization shall establish an asset inventory management framework that de...	AST-001 Asset Inventory Management	IT Asset Management, CISO, Asset Owners	View ↗
AST-001-R002	Asset Identification The organization shall identify all assets that require inclusion in the asset i...	AST-001 Asset Inventory Management	IT Asset Management, CISO, Asset Owners	View ↗
AST-001-R003	Asset Registration The organization shall register identified assets in the asset inventory, captur...	AST-001 Asset Inventory Management	IT Asset Management, CISO, Asset Owners	View ↗
AST-001-R004	Asset Attribute Management The organization shall manage asset attributes, ensuring asset information remai...	AST-001 Asset Inventory Management	IT Asset Management, CISO, Asset Owners	View ↗
AST-001-R005	Asset Inventory Maintenance The organization shall maintain the asset inventory, ensuring asset information...	AST-001 Asset Inventory Management	IT Asset Management, CISO, Asset Owners	View ↗
AST-001-R006	Asset Inventory Reconciliation The organization shall reconcile the asset inventory against physical assets, sy...	AST-001 Asset Inventory Management	IT Asset Management, CISO, Asset Owners	View ↗
AST-001-R007	Asset Inventory Validation The organization shall validate the accuracy and completeness of the asset inven...	AST-001 Asset Inventory Management	IT Asset Management, CISO, Asset Owners	View ↗
AST-001-R008	Asset Inventory Reporting The organization shall report on the asset inventory, providing visibility into...	AST-001 Asset Inventory Management	IT Asset Management, CISO, Asset Owners	View ↗
AST-001-R009	Asset Inventory Review The organization shall conduct periodic reviews of the asset inventory and inven...	AST-001 Asset Inventory Management	IT Asset Management, CISO, Asset Owners	View ↗
AST-001-R010	Asset Inventory Continuous Improvement The organization shall drive ongoing enhancement of asset inventory management t...	AST-001 Asset Inventory Management	IT Asset Management, CISO, Asset Owners	View ↗
AST-002-R001	Asset Classification Framework The organization shall establish an asset classification framework that defines...	AST-002 Asset Classification & Critica...	IT Asset Management, Information Security, Asset Owners	View ↗
AST-002-R002	Classification Criteria The organization shall define classification criteria that establish the basis f...	AST-002 Asset Classification & Critica...	IT Asset Management, Information Security, Asset Owners	View ↗
AST-002-R003	Asset Criticality Assessment The organization shall conduct criticality assessments for assets to determine t...	AST-002 Asset Classification & Critica...	IT Asset Management, Information Security, Asset Owners	View ↗
AST-002-R004	Asset Classification Assignment The organization shall assign classification levels to assets based on classific...	AST-002 Asset Classification & Critica...	IT Asset Management, Information Security, Asset Owners	View ↗
AST-002-R005	Asset Labeling The organization shall label assets with their assigned classifications, ensurin...	AST-002 Asset Classification & Critica...	IT Asset Management, Information Security, Asset Owners	View ↗
AST-002-R006	Classification Review The organization shall conduct periodic reviews of asset classifications to ensu...	AST-002 Asset Classification & Critica...	IT Asset Management, Information Security, Asset Owners	View ↗
AST-002-R007	Classification Change Management The organization shall manage changes to asset classifications, ensuring changes...	AST-002 Asset Classification & Critica...	IT Asset Management, Information Security, Asset Owners	View ↗
AST-002-R008	Classification Monitoring The organization shall monitor asset classification to ensure assets continue to...	AST-002 Asset Classification & Critica...	IT Asset Management, Information Security, Asset Owners	View ↗
AST-002-R009	Classification Reporting The organization shall report on asset classification, providing visibility into...	AST-002 Asset Classification & Critica...	IT Asset Management, Information Security, Asset Owners	View ↗
AST-002-R010	Classification Continuous Improvement The organization shall drive ongoing enhancement of asset classification through...	AST-002 Asset Classification & Critica...	IT Asset Management, Information Security, Asset Owners	View ↗
AST-003-R001	Asset Ownership Framework The organization shall establish an asset ownership framework that defines the s...	AST-003 Asset Ownership	IT Asset Management, Business Owners, Asset Owners	View ↗
AST-003-R002	Asset Owner Assignment The organization shall assign explicit ownership to all organizational assets, e...	AST-003 Asset Ownership	IT Asset Management, Business Owners, Asset Owners	View ↗
AST-003-R003	Ownership Responsibilities The organization shall clearly define and document the responsibilities of asset...	AST-003 Asset Ownership	IT Asset Management, Business Owners, Asset Owners	View ↗
AST-003-R004	Ownership Accountability The organization shall establish accountability for asset ownership, ensuring as...	AST-003 Asset Ownership	IT Asset Management, Business Owners, Asset Owners	View ↗
AST-003-R005	Ownership Transfer The organization shall transfer asset ownership when assets are reassigned, when...	AST-003 Asset Ownership	IT Asset Management, Business Owners, Asset Owners	View ↗
AST-003-R006	Ownership Validation The organization shall validate asset ownership to ensure ownership assignments...	AST-003 Asset Ownership	IT Asset Management, Business Owners, Asset Owners	View ↗
AST-003-R007	Ownership Review The organization shall conduct periodic reviews of asset ownership assignments t...	AST-003 Asset Ownership	IT Asset Management, Business Owners, Asset Owners	View ↗
AST-003-R008	Ownership Documentation The organization shall maintain comprehensive documentation of asset ownership a...	AST-003 Asset Ownership	IT Asset Management, Business Owners, Asset Owners	View ↗
AST-003-R009	Ownership Reporting The organization shall report on asset ownership, providing visibility into owne...	AST-003 Asset Ownership	IT Asset Management, Business Owners, Asset Owners	View ↗
AST-003-R010	Ownership Continuous Improvement The organization shall drive ongoing enhancement of asset ownership management t...	AST-003 Asset Ownership	IT Asset Management, Business Owners, Asset Owners	View ↗
AST-004-R001	Asset Lifecycle Framework The organization shall establish an asset lifecycle management framework that de...	AST-004 Asset Lifecycle Management	IT Asset Management, Procurement, IT Operations, Asset Owners	View ↗
AST-004-R002	Asset Acquisition and Procurement The organization shall acquire and procure assets in accordance with organizatio...	AST-004 Asset Lifecycle Management	IT Asset Management, Procurement, IT Operations, Asset Owners	View ↗
AST-004-R003	Asset Deployment The organization shall deploy assets, ensuring they are properly configured, sec...	AST-004 Asset Lifecycle Management	IT Asset Management, Procurement, IT Operations, Asset Owners	View ↗
AST-004-R004	Asset Configuration and Commissioning The organization shall configure and commission assets, ensuring they are config...	AST-004 Asset Lifecycle Management	IT Asset Management, Procurement, IT Operations, Asset Owners	View ↗
AST-004-R005	Asset Maintenance The organization shall maintain assets to ensure they remain functional, secure,...	AST-004 Asset Lifecycle Management	IT Asset Management, Procurement, IT Operations, Asset Owners	View ↗
AST-004-R006	Asset Relocation and Transfer The organization shall relocate and transfer assets securely, ensuring asset inf...	AST-004 Asset Lifecycle Management	IT Asset Management, Procurement, IT Operations, Asset Owners	View ↗
AST-004-R007	Asset Retirement The organization shall retire assets at the end of their useful life, ensuring t...	AST-004 Asset Lifecycle Management	IT Asset Management, Procurement, IT Operations, Asset Owners	View ↗
AST-004-R008	Asset Lifecycle Monitoring The organization shall monitor asset lifecycle activities to ensure assets are m...	AST-004 Asset Lifecycle Management	IT Asset Management, Procurement, IT Operations, Asset Owners	View ↗
AST-004-R009	Asset Lifecycle Review The organization shall conduct periodic reviews of asset lifecycle management ac...	AST-004 Asset Lifecycle Management	IT Asset Management, Procurement, IT Operations, Asset Owners	View ↗
AST-004-R010	Asset Lifecycle Continuous Improvement The organization shall drive ongoing enhancement of asset lifecycle management t...	AST-004 Asset Lifecycle Management	IT Asset Management, Procurement, IT Operations, Asset Owners	View ↗
AST-005-R001	Asset Disposal Framework The organization shall establish an asset disposal framework that defines the st...	AST-005 Secure Asset Disposal & Reuse	IT Asset Management, Information Security, Records Management	View ↗
AST-005-R002	Disposal Authorization The organization shall authorize the disposal of assets, ensuring disposal decis...	AST-005 Secure Asset Disposal & Reuse	IT Asset Management, Information Security, Records Management	View ↗
AST-005-R003	Secure Data Sanitization The organization shall securely sanitize data from assets before disposal or reu...	AST-005 Secure Asset Disposal & Reuse	IT Asset Management, Information Security, Records Management	View ↗
AST-005-R004	Secure Asset Destruction The organization shall securely destroy assets that cannot be reused or require...	AST-005 Secure Asset Disposal & Reuse	IT Asset Management, Information Security, Records Management	View ↗
AST-005-R005	Asset Reuse Management The organization shall manage the reuse of assets, ensuring reused assets are pr...	AST-005 Secure Asset Disposal & Reuse	IT Asset Management, Information Security, Records Management	View ↗
AST-005-R006	Chain of Custody Management The organization shall manage the chain of custody for assets during disposal, e...	AST-005 Secure Asset Disposal & Reuse	IT Asset Management, Information Security, Records Management	View ↗
AST-005-R007	Disposal Verification The organization shall verify that asset disposal activities have been completed...	AST-005 Secure Asset Disposal & Reuse	IT Asset Management, Information Security, Records Management	View ↗
AST-005-R008	Disposal Documentation The organization shall maintain comprehensive documentation of asset disposal ac...	AST-005 Secure Asset Disposal & Reuse	IT Asset Management, Information Security, Records Management	View ↗
AST-005-R009	Disposal Review The organization shall conduct periodic reviews of asset disposal activities to...	AST-005 Secure Asset Disposal & Reuse	IT Asset Management, Information Security, Records Management	View ↗
AST-005-R010	Disposal Continuous Improvement The organization shall drive ongoing enhancement of asset disposal and reuse thr...	AST-005 Secure Asset Disposal & Reuse	IT Asset Management, Information Security, Records Management	View ↗
AST-006-R001	Authorized Asset Framework The organization shall establish an authorized asset framework that defines the...	AST-006 Authorized & Approved Assets	IT Asset Management, CISO, IT Operations	View ↗
AST-006-R002	Approved Hardware Management The organization shall maintain an approved hardware list that identifies hardwa...	AST-006 Authorized & Approved Assets	IT Asset Management, CISO, IT Operations	View ↗
AST-006-R003	Approved Software Management The organization shall maintain an approved software list that identifies softwa...	AST-006 Authorized & Approved Assets	IT Asset Management, CISO, IT Operations	View ↗
AST-006-R004	Asset Authorization Process The organization shall authorize new assets for use, ensuring assets meet securi...	AST-006 Authorized & Approved Assets	IT Asset Management, CISO, IT Operations	View ↗
AST-006-R005	Unauthorized Asset Exception Management The organization shall manage exceptions when unauthorized assets are identified...	AST-006 Authorized & Approved Assets	IT Asset Management, CISO, IT Operations	View ↗
AST-006-R006	Approved Asset Repository The organization shall establish and maintain a repository of approved assets th...	AST-006 Authorized & Approved Assets	IT Asset Management, CISO, IT Operations	View ↗
AST-006-R007	Approved Asset Compliance Monitoring The organization shall monitor approved asset compliance, ensuring only approved...	AST-006 Authorized & Approved Assets	IT Asset Management, CISO, IT Operations	View ↗
AST-006-R008	Authorized Asset Review The organization shall conduct periodic reviews of authorized asset management a...	AST-006 Authorized & Approved Assets	IT Asset Management, CISO, IT Operations	View ↗
AST-006-R009	Authorized Asset Reporting The organization shall report on authorized asset management, providing visibili...	AST-006 Authorized & Approved Assets	IT Asset Management, CISO, IT Operations	View ↗
AST-006-R010	Authorized Asset Continuous Improvement The organization shall drive ongoing enhancement of authorized asset management...	AST-006 Authorized & Approved Assets	IT Asset Management, CISO, IT Operations	View ↗
AST-007-R001	Automated Discovery Framework The organization shall establish an automated asset discovery framework that def...	AST-007 Automated Asset Discovery & Un...	IT Asset Management, Security Operations, Network Operations	View ↗
AST-007-R002	Asset Discovery Configuration The organization shall configure automated asset discovery tools and processes t...	AST-007 Automated Asset Discovery & Un...	IT Asset Management, Security Operations, Network Operations	View ↗
AST-007-R003	Continuous Asset Discovery The organization shall conduct continuous automated discovery of assets to ensur...	AST-007 Automated Asset Discovery & Un...	IT Asset Management, Security Operations, Network Operations	View ↗
AST-007-R004	Unauthorized Asset Detection The organization shall use automated discovery to detect unauthorized assets in...	AST-007 Automated Asset Discovery & Un...	IT Asset Management, Security Operations, Network Operations	View ↗
AST-007-R005	Asset Reconciliation The organization shall reconcile discovered assets with the asset inventory, ens...	AST-007 Automated Asset Discovery & Un...	IT Asset Management, Security Operations, Network Operations	View ↗
AST-007-R006	Discovery Validation The organization shall validate automated discovery results to ensure their accu...	AST-007 Automated Asset Discovery & Un...	IT Asset Management, Security Operations, Network Operations	View ↗
AST-007-R007	Discovery Monitoring The organization shall monitor automated discovery activities to ensure discover...	AST-007 Automated Asset Discovery & Un...	IT Asset Management, Security Operations, Network Operations	View ↗
AST-007-R008	Discovery Reporting The organization shall report on automated discovery, providing visibility into...	AST-007 Automated Asset Discovery & Un...	IT Asset Management, Security Operations, Network Operations	View ↗
AST-007-R009	Discovery Review The organization shall conduct periodic reviews of automated discovery activitie...	AST-007 Automated Asset Discovery & Un...	IT Asset Management, Security Operations, Network Operations	View ↗
AST-007-R010	Discovery Continuous Improvement The organization shall drive ongoing enhancement of automated discovery through...	AST-007 Automated Asset Discovery & Un...	IT Asset Management, Security Operations, Network Operations	View ↗
AST-008-R001	Software License Management Framework The organization shall establish a software license management framework that de...	AST-008 Software License Management	IT Asset Management, Software Asset Management, Procurement	View ↗
AST-008-R002	License Inventory Management The organization shall maintain a comprehensive inventory of software licenses,...	AST-008 Software License Management	IT Asset Management, Software Asset Management, Procurement	View ↗
AST-008-R003	License Allocation and Assignment The organization shall allocate and assign software licenses to users, devices,...	AST-008 Software License Management	IT Asset Management, Software Asset Management, Procurement	View ↗
AST-008-R004	License Usage Monitoring The organization shall monitor software license usage, tracking actual usage aga...	AST-008 Software License Management	IT Asset Management, Software Asset Management, Procurement	View ↗
AST-008-R005	License Compliance Verification The organization shall periodically verify software license compliance to ensure...	AST-008 Software License Management	IT Asset Management, Software Asset Management, Procurement	View ↗
AST-008-R006	License Renewal Management The organization shall manage license renewals, ensuring licenses are renewed be...	AST-008 Software License Management	IT Asset Management, Software Asset Management, Procurement	View ↗
AST-008-R007	Vendor License Reconciliation The organization shall reconcile internal license records with vendor-provided l...	AST-008 Software License Management	IT Asset Management, Software Asset Management, Procurement	View ↗
AST-008-R008	License Reporting The organization shall report on software license management, providing visibili...	AST-008 Software License Management	IT Asset Management, Software Asset Management, Procurement	View ↗
AST-008-R009	License Review The organization shall conduct periodic reviews of software license management a...	AST-008 Software License Management	IT Asset Management, Software Asset Management, Procurement	View ↗
AST-008-R010	License Management Continuous Improvement The organization shall drive ongoing enhancement of software license management...	AST-008 Software License Management	IT Asset Management, Software Asset Management, Procurement	View ↗
DAT-001-R001	Data Protection & Privacy Framework The organization shall establish a data protection and privacy strategy framewor...	DAT-001 Data Protection & Privacy Stra...	Data Protection Officer, CISO, Privacy Governance Committee	View ↗
DAT-001-R002	Strategic Objectives The organization shall define strategic objectives for the data protection and p...	DAT-001 Data Protection & Privacy Stra...	Data Protection Officer, CISO, Privacy Governance Committee	View ↗
DAT-001-R003	Privacy Governance The organization shall establish privacy governance structures that provide over...	DAT-001 Data Protection & Privacy Stra...	Data Protection Officer, CISO, Privacy Governance Committee	View ↗
DAT-001-R004	Data Protection Roles & Responsibilities The organization shall clearly define and document the roles and responsibilitie...	DAT-001 Data Protection & Privacy Stra...	Data Protection Officer, CISO, Privacy Governance Committee	View ↗
DAT-001-R005	Strategy Implementation The organization shall execute the data protection and privacy strategy in accor...	DAT-001 Data Protection & Privacy Stra...	Data Protection Officer, CISO, Privacy Governance Committee	View ↗
DAT-001-R006	Privacy Risk Alignment The organization shall align data protection and privacy activities with the org...	DAT-001 Data Protection & Privacy Stra...	Data Protection Officer, CISO, Privacy Governance Committee	View ↗
DAT-001-R007	Strategy Communication The organization shall communicate the data protection and privacy strategy to a...	DAT-001 Data Protection & Privacy Stra...	Data Protection Officer, CISO, Privacy Governance Committee	View ↗
DAT-001-R008	Strategy Performance Monitoring The organization shall monitor the performance of the data protection and privac...	DAT-001 Data Protection & Privacy Stra...	Data Protection Officer, CISO, Privacy Governance Committee	View ↗
DAT-001-R009	Strategy Review The organization shall conduct periodic reviews of the data protection and priva...	DAT-001 Data Protection & Privacy Stra...	Data Protection Officer, CISO, Privacy Governance Committee	View ↗
DAT-001-R010	Strategy Continuous Improvement The organization shall drive ongoing enhancement of the data protection and priv...	DAT-001 Data Protection & Privacy Stra...	Data Protection Officer, CISO, Privacy Governance Committee	View ↗
DAT-002-R001	Data Discovery Framework The organization shall establish a data discovery framework that defines the str...	DAT-002 Data Discovery	Data Protection Officer, Data Governance Team, Data Owners	View ↗
DAT-002-R002	Discovery Scope The organization shall define a documented scope for data discovery activities t...	DAT-002 Data Discovery	Data Protection Officer, Data Governance Team, Data Owners	View ↗
DAT-002-R003	Data Discovery Configuration The organization shall configure data discovery tools and processes to appropria...	DAT-002 Data Discovery	Data Protection Officer, Data Governance Team, Data Owners	View ↗
DAT-002-R004	Data Discovery Execution The organization shall execute data discovery activities to identify and locate...	DAT-002 Data Discovery	Data Protection Officer, Data Governance Team, Data Owners	View ↗
DAT-002-R005	Sensitive Data Identification The organization shall use data discovery to identify specific instances of pers...	DAT-002 Data Discovery	Data Protection Officer, Data Governance Team, Data Owners	View ↗
DAT-002-R006	Discovery Validation The organization shall validate data discovery results to ensure their accuracy...	DAT-002 Data Discovery	Data Protection Officer, Data Governance Team, Data Owners	View ↗
DAT-002-R007	Discovery Monitoring The organization shall monitor data discovery activities to ensure discovery is...	DAT-002 Data Discovery	Data Protection Officer, Data Governance Team, Data Owners	View ↗
DAT-002-R008	Discovery Reporting The organization shall report on data discovery, providing visibility into disco...	DAT-002 Data Discovery	Data Protection Officer, Data Governance Team, Data Owners	View ↗
DAT-002-R009	Discovery Review The organization shall conduct periodic reviews of data discovery activities to...	DAT-002 Data Discovery	Data Protection Officer, Data Governance Team, Data Owners	View ↗
DAT-002-R010	Discovery Continuous Improvement The organization shall drive ongoing enhancement of data discovery through a con...	DAT-002 Data Discovery	Data Protection Officer, Data Governance Team, Data Owners	View ↗
DAT-003-R001	Data Classification Framework The organization shall establish a data classification framework that defines th...	DAT-003 Data Classification & Handling	Data Owners, Data Stewards, Data Protection Officer	View ↗
DAT-003-R002	Classification Criteria The organization shall define classification criteria that establish the basis f...	DAT-003 Data Classification & Handling	Data Owners, Data Stewards, Data Protection Officer	View ↗
DAT-003-R003	Data Classification Assignment The organization shall assign classification levels to data based on classificat...	DAT-003 Data Classification & Handling	Data Owners, Data Stewards, Data Protection Officer	View ↗
DAT-003-R004	Data Labeling The organization shall label data with its assigned classification, ensuring cla...	DAT-003 Data Classification & Handling	Data Owners, Data Stewards, Data Protection Officer	View ↗
DAT-003-R005	Data Handling Requirements The organization shall define data handling requirements for each data classific...	DAT-003 Data Classification & Handling	Data Owners, Data Stewards, Data Protection Officer	View ↗
DAT-003-R006	Classification Review The organization shall conduct periodic reviews of data classifications to ensur...	DAT-003 Data Classification & Handling	Data Owners, Data Stewards, Data Protection Officer	View ↗
DAT-003-R007	Classification Change Management The organization shall manage changes to data classifications, ensuring changes...	DAT-003 Data Classification & Handling	Data Owners, Data Stewards, Data Protection Officer	View ↗
DAT-003-R008	Classification Monitoring The organization shall monitor data classification to ensure data continues to b...	DAT-003 Data Classification & Handling	Data Owners, Data Stewards, Data Protection Officer	View ↗
DAT-003-R009	Classification Reporting The organization shall report on data classification, providing visibility into...	DAT-003 Data Classification & Handling	Data Owners, Data Stewards, Data Protection Officer	View ↗
DAT-003-R010	Classification Continuous Improvement The organization shall drive ongoing enhancement of data classification through...	DAT-003 Data Classification & Handling	Data Owners, Data Stewards, Data Protection Officer	View ↗
DAT-004-R001	Data Retention Framework The organization shall establish a data retention framework that defines the str...	DAT-004 Data Retention & Disposal	Data Protection Officer, Records Management, Legal, Data Owners	View ↗
DAT-004-R002	Retention Schedule Management The organization shall maintain retention schedules that define how long differe...	DAT-004 Data Retention & Disposal	Data Protection Officer, Records Management, Legal, Data Owners	View ↗
DAT-004-R003	Data Archival The organization shall archive data that is no longer actively used but must be...	DAT-004 Data Retention & Disposal	Data Protection Officer, Records Management, Legal, Data Owners	View ↗
DAT-004-R004	Data Disposal Authorization The organization shall authorize the disposal of data, ensuring disposal decisio...	DAT-004 Data Retention & Disposal	Data Protection Officer, Records Management, Legal, Data Owners	View ↗
DAT-004-R005	Secure Data Destruction The organization shall securely destroy data that has reached the end of its ret...	DAT-004 Data Retention & Disposal	Data Protection Officer, Records Management, Legal, Data Owners	View ↗
DAT-004-R006	Disposal Verification The organization shall verify that data disposal activities have been completed...	DAT-004 Data Retention & Disposal	Data Protection Officer, Records Management, Legal, Data Owners	View ↗
DAT-004-R007	Retention Compliance Monitoring The organization shall monitor retention and disposal activities to ensure compl...	DAT-004 Data Retention & Disposal	Data Protection Officer, Records Management, Legal, Data Owners	View ↗
DAT-004-R008	Retention Reporting The organization shall report on retention and disposal activities, providing vi...	DAT-004 Data Retention & Disposal	Data Protection Officer, Records Management, Legal, Data Owners	View ↗
DAT-004-R009	Retention Review The organization shall conduct periodic reviews of retention and disposal activi...	DAT-004 Data Retention & Disposal	Data Protection Officer, Records Management, Legal, Data Owners	View ↗
DAT-004-R010	Retention Continuous Improvement The organization shall drive ongoing enhancement of retention and disposal manag...	DAT-004 Data Retention & Disposal	Data Protection Officer, Records Management, Legal, Data Owners	View ↗
DAT-005-R001	Data Ownership Framework The organization shall establish a data ownership framework that defines the str...	DAT-005 Data Ownership & Stewardship	Data Owners, Data Stewards, Data Governance Committee	View ↗
DAT-005-R002	Data Owner Assignment The organization shall assign explicit data owners to all personal and sensitive...	DAT-005 Data Ownership & Stewardship	Data Owners, Data Stewards, Data Governance Committee	View ↗
DAT-005-R003	Data Steward Responsibilities The organization shall define and assign data stewards to support data owners in...	DAT-005 Data Ownership & Stewardship	Data Owners, Data Stewards, Data Governance Committee	View ↗
DAT-005-R004	Ownership Accountability The organization shall establish accountability for data ownership, ensuring dat...	DAT-005 Data Ownership & Stewardship	Data Owners, Data Stewards, Data Governance Committee	View ↗
DAT-005-R005	Ownership Transfer The organization shall transfer data ownership when organizational changes occur...	DAT-005 Data Ownership & Stewardship	Data Owners, Data Stewards, Data Governance Committee	View ↗
DAT-005-R006	Ownership Validation The organization shall validate data ownership to ensure ownership assignments r...	DAT-005 Data Ownership & Stewardship	Data Owners, Data Stewards, Data Governance Committee	View ↗
DAT-005-R007	Ownership Documentation The organization shall maintain comprehensive documentation of data ownership as...	DAT-005 Data Ownership & Stewardship	Data Owners, Data Stewards, Data Governance Committee	View ↗
DAT-005-R008	Ownership Reporting The organization shall report on data ownership, providing visibility into owner...	DAT-005 Data Ownership & Stewardship	Data Owners, Data Stewards, Data Governance Committee	View ↗
DAT-005-R009	Ownership Review The organization shall conduct periodic reviews of data ownership assignments to...	DAT-005 Data Ownership & Stewardship	Data Owners, Data Stewards, Data Governance Committee	View ↗
DAT-005-R010	Ownership Continuous Improvement The organization shall drive ongoing enhancement of data ownership and stewardsh...	DAT-005 Data Ownership & Stewardship	Data Owners, Data Stewards, Data Governance Committee	View ↗
DAT-006-R001	Data Inventory Framework The organization shall establish a data inventory framework that defines the str...	DAT-006 Data Flow Mapping, Inventory &...	Data Owners, Data Stewards, Data Governance Team	View ↗
DAT-006-R002	Data Flow Identification The organization shall identify data flows that describe how personal and sensit...	DAT-006 Data Flow Mapping, Inventory &...	Data Owners, Data Stewards, Data Governance Team	View ↗
DAT-006-R003	Data Inventory Management The organization shall maintain a comprehensive inventory of data assets, includ...	DAT-006 Data Flow Mapping, Inventory &...	Data Owners, Data Stewards, Data Governance Team	View ↗
DAT-006-R004	Data Flow Mapping The organization shall create and maintain data flow maps that document the move...	DAT-006 Data Flow Mapping, Inventory &...	Data Owners, Data Stewards, Data Governance Team	View ↗
DAT-006-R005	Data Lineage Documentation The organization shall document data lineage for personal and sensitive data, tr...	DAT-006 Data Flow Mapping, Inventory &...	Data Owners, Data Stewards, Data Governance Team	View ↗
DAT-006-R006	Data Flow Validation The organization shall validate data flow maps and data inventory to ensure thei...	DAT-006 Data Flow Mapping, Inventory &...	Data Owners, Data Stewards, Data Governance Team	View ↗
DAT-006-R007	Data Flow Monitoring The organization shall monitor data flows to ensure data movements are documente...	DAT-006 Data Flow Mapping, Inventory &...	Data Owners, Data Stewards, Data Governance Team	View ↗
DAT-006-R008	Data Flow Reporting The organization shall report on data flow mapping and inventory, providing visi...	DAT-006 Data Flow Mapping, Inventory &...	Data Owners, Data Stewards, Data Governance Team	View ↗
DAT-006-R009	Data Flow Review The organization shall conduct periodic reviews of data flow mapping and invento...	DAT-006 Data Flow Mapping, Inventory &...	Data Owners, Data Stewards, Data Governance Team	View ↗
DAT-006-R010	Data Flow Continuous Improvement The organization shall drive ongoing enhancement of data flow mapping, inventory...	DAT-006 Data Flow Mapping, Inventory &...	Data Owners, Data Stewards, Data Governance Team	View ↗
DAT-007-R001	Rights Management Framework The organization shall establish a data subject rights management framework that...	DAT-007 Data Subject Rights Management	Data Protection Officer, Privacy Operations, Legal	View ↗
DAT-007-R002	Request Intake The organization shall receive data subject rights requests through accessible c...	DAT-007 Data Subject Rights Management	Data Protection Officer, Privacy Operations, Legal	View ↗
DAT-007-R003	Identity Verification The organization shall verify the identity of data subjects making rights reques...	DAT-007 Data Subject Rights Management	Data Protection Officer, Privacy Operations, Legal	View ↗
DAT-007-R004	Rights Request Processing The organization shall process data subject rights requests, including requests...	DAT-007 Data Subject Rights Management	Data Protection Officer, Privacy Operations, Legal	View ↗
DAT-007-R005	Response Management The organization shall respond to data subject rights requests, ensuring respons...	DAT-007 Data Subject Rights Management	Data Protection Officer, Privacy Operations, Legal	View ↗
DAT-007-R006	Request Tracking The organization shall track data subject rights requests from receipt through c...	DAT-007 Data Subject Rights Management	Data Protection Officer, Privacy Operations, Legal	View ↗
DAT-007-R007	Regulatory Compliance Monitoring The organization shall monitor data subject rights management to ensure complian...	DAT-007 Data Subject Rights Management	Data Protection Officer, Privacy Operations, Legal	View ↗
DAT-007-R008	Rights Reporting The organization shall report on data subject rights management, providing visib...	DAT-007 Data Subject Rights Management	Data Protection Officer, Privacy Operations, Legal	View ↗
DAT-007-R009	Rights Review The organization shall conduct periodic reviews of data subject rights managemen...	DAT-007 Data Subject Rights Management	Data Protection Officer, Privacy Operations, Legal	View ↗
DAT-007-R010	Rights Continuous Improvement The organization shall drive ongoing enhancement of data subject rights manageme...	DAT-007 Data Subject Rights Management	Data Protection Officer, Privacy Operations, Legal	View ↗
DAT-008-R001	Consent Management Framework The organization shall establish a consent management framework that defines the...	DAT-008 Consent Management	Data Protection Officer, Privacy Operations, Legal, Product Owners	View ↗
DAT-008-R002	Consent Collection The organization shall collect consent from data subjects in a manner that is in...	DAT-008 Consent Management	Data Protection Officer, Privacy Operations, Legal, Product Owners	View ↗
DAT-008-R003	Consent Recording The organization shall record consent decisions, ensuring consent records are ac...	DAT-008 Consent Management	Data Protection Officer, Privacy Operations, Legal, Product Owners	View ↗
DAT-008-R004	Consent Validation The organization shall validate the validity of consent, ensuring consent remain...	DAT-008 Consent Management	Data Protection Officer, Privacy Operations, Legal, Product Owners	View ↗
DAT-008-R005	Consent Withdrawal The organization shall process consent withdrawals, ensuring data subjects can e...	DAT-008 Consent Management	Data Protection Officer, Privacy Operations, Legal, Product Owners	View ↗
DAT-008-R006	Consent Lifecycle Management The organization shall manage the lifecycle of consent, from collection through...	DAT-008 Consent Management	Data Protection Officer, Privacy Operations, Legal, Product Owners	View ↗
DAT-008-R007	Consent Monitoring The organization shall monitor consent management to ensure consent is properly...	DAT-008 Consent Management	Data Protection Officer, Privacy Operations, Legal, Product Owners	View ↗
DAT-008-R008	Consent Reporting The organization shall report on consent management, providing visibility into c...	DAT-008 Consent Management	Data Protection Officer, Privacy Operations, Legal, Product Owners	View ↗
DAT-008-R009	Consent Review The organization shall conduct periodic reviews of consent management activities...	DAT-008 Consent Management	Data Protection Officer, Privacy Operations, Legal, Product Owners	View ↗
DAT-008-R010	Consent Continuous Improvement The organization shall drive ongoing enhancement of consent management through a...	DAT-008 Consent Management	Data Protection Officer, Privacy Operations, Legal, Product Owners	View ↗
DAT-009-R001	Cross-Border Transfer Framework The organization shall establish a cross-border data transfer framework that def...	DAT-009 Cross-Border Data Transfer	Data Protection Officer, Legal, Privacy Operations	View ↗
DAT-009-R002	Transfer Assessment The organization shall assess cross-border data transfers to evaluate compliance...	DAT-009 Cross-Border Data Transfer	Data Protection Officer, Legal, Privacy Operations	View ↗
DAT-009-R003	Transfer Authorization The organization shall authorize cross-border data transfers, ensuring transfers...	DAT-009 Cross-Border Data Transfer	Data Protection Officer, Legal, Privacy Operations	View ↗
DAT-009-R004	Transfer Safeguards The organization shall implement appropriate safeguards for cross-border data tr...	DAT-009 Cross-Border Data Transfer	Data Protection Officer, Legal, Privacy Operations	View ↗
DAT-009-R005	Transfer Documentation The organization shall maintain comprehensive documentation of cross-border data...	DAT-009 Cross-Border Data Transfer	Data Protection Officer, Legal, Privacy Operations	View ↗
DAT-009-R006	Transfer Monitoring The organization shall monitor cross-border data transfers to ensure transfers r...	DAT-009 Cross-Border Data Transfer	Data Protection Officer, Legal, Privacy Operations	View ↗
DAT-009-R007	Regulatory Compliance Verification The organization shall verify that cross-border data transfers comply with appli...	DAT-009 Cross-Border Data Transfer	Data Protection Officer, Legal, Privacy Operations	View ↗
DAT-009-R008	Transfer Reporting The organization shall report on cross-border data transfers, providing visibili...	DAT-009 Cross-Border Data Transfer	Data Protection Officer, Legal, Privacy Operations	View ↗
DAT-009-R009	Transfer Review The organization shall conduct periodic reviews of cross-border data transfer ma...	DAT-009 Cross-Border Data Transfer	Data Protection Officer, Legal, Privacy Operations	View ↗
DAT-009-R010	Transfer Continuous Improvement The organization shall drive ongoing enhancement of cross-border data transfer m...	DAT-009 Cross-Border Data Transfer	Data Protection Officer, Legal, Privacy Operations	View ↗
DAT-010-R001	Privacy Notice Framework The organization shall establish a privacy notice framework that defines the str...	DAT-010 Privacy Notices	Data Protection Officer, Legal, Communications, Product Owners	View ↗
DAT-010-R002	Notice Content Management The organization shall develop and maintain privacy notice content that accurate...	DAT-010 Privacy Notices	Data Protection Officer, Legal, Communications, Product Owners	View ↗
DAT-010-R003	Notice Publication The organization shall publish privacy notices in locations and formats that are...	DAT-010 Privacy Notices	Data Protection Officer, Legal, Communications, Product Owners	View ↗
DAT-010-R004	Notice Accessibility The organization shall ensure privacy notices are accessible to all data subject...	DAT-010 Privacy Notices	Data Protection Officer, Legal, Communications, Product Owners	View ↗
DAT-010-R005	Notice Updates The organization shall update privacy notices when changes occur in data process...	DAT-010 Privacy Notices	Data Protection Officer, Legal, Communications, Product Owners	View ↗
DAT-010-R006	Notice Communication The organization shall communicate privacy notices to data subjects through appr...	DAT-010 Privacy Notices	Data Protection Officer, Legal, Communications, Product Owners	View ↗
DAT-010-R007	Notice Compliance Monitoring The organization shall monitor privacy notice management to ensure notices remai...	DAT-010 Privacy Notices	Data Protection Officer, Legal, Communications, Product Owners	View ↗
DAT-010-R008	Notice Reporting The organization shall report on privacy notice management, providing visibility...	DAT-010 Privacy Notices	Data Protection Officer, Legal, Communications, Product Owners	View ↗
DAT-010-R009	Notice Review The organization shall conduct periodic reviews of privacy notices to ensure the...	DAT-010 Privacy Notices	Data Protection Officer, Legal, Communications, Product Owners	View ↗
DAT-010-R010	Notice Continuous Improvement The organization shall drive ongoing enhancement of privacy notice management th...	DAT-010 Privacy Notices	Data Protection Officer, Legal, Communications, Product Owners	View ↗
DAT-011-R001	Privacy by Design Framework The organization shall establish a privacy by design framework that defines the...	DAT-011 Privacy by Design	Data Protection Officer, Privacy Engineering, Application Owners	View ↗
DAT-011-R002	Privacy Requirements Identification The organization shall identify privacy requirements that must be addressed in t...	DAT-011 Privacy by Design	Data Protection Officer, Privacy Engineering, Application Owners	View ↗
DAT-011-R003	Privacy Design Assessment The organization shall conduct privacy design assessments to evaluate whether sy...	DAT-011 Privacy by Design	Data Protection Officer, Privacy Engineering, Application Owners	View ↗
DAT-011-R004	Privacy Control Integration The organization shall integrate privacy controls into systems, products, and se...	DAT-011 Privacy by Design	Data Protection Officer, Privacy Engineering, Application Owners	View ↗
DAT-011-R005	Privacy Validation The organization shall validate that systems, products, and services meet privac...	DAT-011 Privacy by Design	Data Protection Officer, Privacy Engineering, Application Owners	View ↗
DAT-011-R006	Design Change Management The organization shall manage changes to privacy design requirements and control...	DAT-011 Privacy by Design	Data Protection Officer, Privacy Engineering, Application Owners	View ↗
DAT-011-R007	Privacy Compliance Monitoring The organization shall monitor privacy by design activities to ensure privacy re...	DAT-011 Privacy by Design	Data Protection Officer, Privacy Engineering, Application Owners	View ↗
DAT-011-R008	Design Reporting The organization shall report on privacy by design, providing visibility into pr...	DAT-011 Privacy by Design	Data Protection Officer, Privacy Engineering, Application Owners	View ↗
DAT-011-R009	Design Review The organization shall conduct periodic reviews of privacy by design activities...	DAT-011 Privacy by Design	Data Protection Officer, Privacy Engineering, Application Owners	View ↗
DAT-011-R010	Design Continuous Improvement The organization shall drive ongoing enhancement of privacy by design through a...	DAT-011 Privacy by Design	Data Protection Officer, Privacy Engineering, Application Owners	View ↗
DAT-012-R001	DPIA Framework The organization shall establish a Data Protection Impact Assessment framework t...	DAT-012 Data Protection Impact Assessm...	Data Protection Officer, Privacy Risk, Legal, Business Owners	View ↗
DAT-012-R002	DPIA Scoping The organization shall scope DPIAs, identifying the processing activities, syste...	DAT-012 Data Protection Impact Assessm...	Data Protection Officer, Privacy Risk, Legal, Business Owners	View ↗
DAT-012-R003	Privacy Risk Assessment The organization shall conduct privacy risk assessments as part of DPIAs, identi...	DAT-012 Data Protection Impact Assessm...	Data Protection Officer, Privacy Risk, Legal, Business Owners	View ↗
DAT-012-R004	Risk Treatment Planning The organization shall develop risk treatment plans as part of DPIAs, defining m...	DAT-012 Data Protection Impact Assessm...	Data Protection Officer, Privacy Risk, Legal, Business Owners	View ↗
DAT-012-R005	DPIA Approval The organization shall approve DPIAs and associated risk treatment plans, ensuri...	DAT-012 Data Protection Impact Assessm...	Data Protection Officer, Privacy Risk, Legal, Business Owners	View ↗
DAT-012-R006	DPIA Documentation The organization shall maintain comprehensive documentation of DPIAs, including...	DAT-012 Data Protection Impact Assessm...	Data Protection Officer, Privacy Risk, Legal, Business Owners	View ↗
DAT-012-R007	DPIA Monitoring The organization shall monitor DPIAs to ensure treatment plans are implemented a...	DAT-012 Data Protection Impact Assessm...	Data Protection Officer, Privacy Risk, Legal, Business Owners	View ↗
DAT-012-R008	DPIA Reporting The organization shall report on DPIAs, providing visibility into assessment act...	DAT-012 Data Protection Impact Assessm...	Data Protection Officer, Privacy Risk, Legal, Business Owners	View ↗
DAT-012-R009	DPIA Review The organization shall conduct periodic reviews of DPIA activities to ensure the...	DAT-012 Data Protection Impact Assessm...	Data Protection Officer, Privacy Risk, Legal, Business Owners	View ↗
DAT-012-R010	DPIA Continuous Improvement The organization shall drive ongoing enhancement of DPIA management through a co...	DAT-012 Data Protection Impact Assessm...	Data Protection Officer, Privacy Risk, Legal, Business Owners	View ↗
DAT-013-R001	ROPA Framework The organization shall establish a Record of Processing Activities framework tha...	DAT-013 Record of Processing Activitie...	Data Protection Officer, Data Owners, Privacy Operations	View ↗
DAT-013-R002	Processing Activity Identification The organization shall identify all processing activities that involve personal...	DAT-013 Record of Processing Activitie...	Data Protection Officer, Data Owners, Privacy Operations	View ↗
DAT-013-R003	Processing Record Maintenance The organization shall maintain comprehensive records of processing activities,...	DAT-013 Record of Processing Activitie...	Data Protection Officer, Data Owners, Privacy Operations	View ↗
DAT-013-R004	Processing Activity Classification The organization shall establish classification schemas for processing activitie...	DAT-013 Record of Processing Activitie...	Data Protection Officer, Data Owners, Privacy Operations	View ↗
DAT-013-R005	Processing Record Validation The organization shall validate ROPA records to ensure their accuracy, completen...	DAT-013 Record of Processing Activitie...	Data Protection Officer, Data Owners, Privacy Operations	View ↗
DAT-013-R006	ROPA Maintenance The organization shall maintain ROPA records to ensure they remain current and r...	DAT-013 Record of Processing Activitie...	Data Protection Officer, Data Owners, Privacy Operations	View ↗
DAT-013-R007	ROPA Monitoring The organization shall monitor ROPA management to ensure records remain accurate...	DAT-013 Record of Processing Activitie...	Data Protection Officer, Data Owners, Privacy Operations	View ↗
DAT-013-R008	ROPA Reporting The organization shall report on ROPA, providing visibility into processing acti...	DAT-013 Record of Processing Activitie...	Data Protection Officer, Data Owners, Privacy Operations	View ↗
DAT-013-R009	ROPA Review The organization shall conduct periodic reviews of ROPA management activities to...	DAT-013 Record of Processing Activitie...	Data Protection Officer, Data Owners, Privacy Operations	View ↗
DAT-013-R010	ROPA Continuous Improvement The organization shall drive ongoing enhancement of ROPA management through a co...	DAT-013 Record of Processing Activitie...	Data Protection Officer, Data Owners, Privacy Operations	View ↗
DAT-014-R001	Data Loss Prevention Framework The organization shall establish a Data Loss Prevention framework that defines t...	DAT-014 Data Loss Prevention (DLP)	CISO, DLP Team, SOC, Data Protection Officer	View ↗
DAT-014-R002	DLP Policy Definition The organization shall define DLP policies that establish the requirements for p...	DAT-014 Data Loss Prevention (DLP)	CISO, DLP Team, SOC, Data Protection Officer	View ↗
DAT-014-R003	Sensitive Data Monitoring The organization shall monitor sensitive data to detect potential data leakage,...	DAT-014 Data Loss Prevention (DLP)	CISO, DLP Team, SOC, Data Protection Officer	View ↗
DAT-014-R004	Data Loss Prevention Controls The organization shall implement controls to prevent unauthorized disclosure and...	DAT-014 Data Loss Prevention (DLP)	CISO, DLP Team, SOC, Data Protection Officer	View ↗
DAT-014-R005	DLP Incident Management The organization shall manage DLP incidents, including the response, investigati...	DAT-014 Data Loss Prevention (DLP)	CISO, DLP Team, SOC, Data Protection Officer	View ↗
DAT-014-R006	DLP Exception Management The organization shall manage exceptions to DLP policies, ensuring deviations ar...	DAT-014 Data Loss Prevention (DLP)	CISO, DLP Team, SOC, Data Protection Officer	View ↗
DAT-014-R007	DLP Monitoring The organization shall monitor DLP activities to ensure controls are operating e...	DAT-014 Data Loss Prevention (DLP)	CISO, DLP Team, SOC, Data Protection Officer	View ↗
DAT-014-R008	DLP Reporting The organization shall report on DLP, providing visibility into DLP activities,...	DAT-014 Data Loss Prevention (DLP)	CISO, DLP Team, SOC, Data Protection Officer	View ↗
DAT-014-R009	DLP Review The organization shall conduct periodic reviews of DLP activities to ensure thei...	DAT-014 Data Loss Prevention (DLP)	CISO, DLP Team, SOC, Data Protection Officer	View ↗
DAT-014-R010	DLP Continuous Improvement The organization shall drive ongoing enhancement of DLP management through a con...	DAT-014 Data Loss Prevention (DLP)	CISO, DLP Team, SOC, Data Protection Officer	View ↗
DAT-015-R001	Data Integrity Framework The organization shall establish a data integrity framework that defines the str...	DAT-015 Data Integrity	Data Owners, Data Stewards, IT Operations, CISO	View ↗
DAT-015-R002	Integrity Protection Controls The organization shall implement controls to protect data integrity, preventing...	DAT-015 Data Integrity	Data Owners, Data Stewards, IT Operations, CISO	View ↗
DAT-015-R003	Data Validation The organization shall validate data integrity, ensuring data is accurate, compl...	DAT-015 Data Integrity	Data Owners, Data Stewards, IT Operations, CISO	View ↗
DAT-015-R004	Integrity Monitoring The organization shall monitor data integrity to detect unauthorized modificatio...	DAT-015 Data Integrity	Data Owners, Data Stewards, IT Operations, CISO	View ↗
DAT-015-R005	Integrity Verification The organization shall verify data integrity through periodic assessments and te...	DAT-015 Data Integrity	Data Owners, Data Stewards, IT Operations, CISO	View ↗
DAT-015-R006	Integrity Incident Management The organization shall manage data integrity incidents, including the detection,...	DAT-015 Data Integrity	Data Owners, Data Stewards, IT Operations, CISO	View ↗
DAT-015-R007	Integrity Assessment The organization shall conduct periodic assessments of data integrity to evaluat...	DAT-015 Data Integrity	Data Owners, Data Stewards, IT Operations, CISO	View ↗
DAT-015-R008	Integrity Reporting The organization shall report on data integrity, providing visibility into integ...	DAT-015 Data Integrity	Data Owners, Data Stewards, IT Operations, CISO	View ↗
DAT-015-R009	Integrity Review The organization shall conduct periodic reviews of data integrity management act...	DAT-015 Data Integrity	Data Owners, Data Stewards, IT Operations, CISO	View ↗
DAT-015-R010	Integrity Continuous Improvement The organization shall drive ongoing enhancement of data integrity management th...	DAT-015 Data Integrity	Data Owners, Data Stewards, IT Operations, CISO	View ↗
DAT-016-R001	Data Masking & Anonymization Framework The organization shall establish a data masking and anonymization framework that...	DAT-016 Data Masking & Anonymization	Data Protection Officer, Data Engineering, Application Owners, Security Engineering	View ↗
DAT-016-R002	Sensitive Data Identification The organization shall identify sensitive data that requires masking, anonymizat...	DAT-016 Data Masking & Anonymization	Data Protection Officer, Data Engineering, Application Owners, Security Engineering	View ↗
DAT-016-R003	Masking Requirements The organization shall define masking requirements that specify how sensitive da...	DAT-016 Data Masking & Anonymization	Data Protection Officer, Data Engineering, Application Owners, Security Engineering	View ↗
DAT-016-R004	Anonymization & Pseudonymization The organization shall implement anonymization and pseudonymization techniques t...	DAT-016 Data Masking & Anonymization	Data Protection Officer, Data Engineering, Application Owners, Security Engineering	View ↗
DAT-016-R005	Data Transformation Validation The organization shall validate that data masking, anonymization, and pseudonymi...	DAT-016 Data Masking & Anonymization	Data Protection Officer, Data Engineering, Application Owners, Security Engineering	View ↗
DAT-016-R006	Non-Production Data Protection The organization shall implement data masking and anonymization for non-producti...	DAT-016 Data Masking & Anonymization	Data Protection Officer, Data Engineering, Application Owners, Security Engineering	View ↗
DAT-016-R007	Masking Effectiveness Monitoring The organization shall monitor masking and anonymization activities to ensure da...	DAT-016 Data Masking & Anonymization	Data Protection Officer, Data Engineering, Application Owners, Security Engineering	View ↗
DAT-016-R008	Masking Reporting The organization shall report on masking and anonymization, providing visibility...	DAT-016 Data Masking & Anonymization	Data Protection Officer, Data Engineering, Application Owners, Security Engineering	View ↗
DAT-016-R009	Masking Review The organization shall conduct periodic reviews of data masking and anonymizatio...	DAT-016 Data Masking & Anonymization	Data Protection Officer, Data Engineering, Application Owners, Security Engineering	View ↗
DAT-016-R010	Masking Continuous Improvement The organization shall drive ongoing enhancement of data masking and anonymizati...	DAT-016 Data Masking & Anonymization	Data Protection Officer, Data Engineering, Application Owners, Security Engineering	View ↗
CRY-001-R001	Cryptographic Governance Framework The organization shall establish a cryptographic governance framework that defin...	CRY-001 Cryptographic Governance	CISO / Cryptography Governance Owner	View ↗
CRY-001-R002	Cryptographic Policy The organization shall establish a cryptographic policy that defines the require...	CRY-001 Cryptographic Governance	CISO / Security Policy Owner	View ↗
CRY-001-R003	Approved Cryptographic Standards The organization shall define and maintain a list of approved cryptographic stan...	CRY-001 Cryptographic Governance	Cryptography Engineering / Security Architecture	View ↗
CRY-001-R004	Roles & Responsibilities The organization shall clearly define and document the roles and responsibilitie...	CRY-001 Cryptographic Governance	CISO / Cryptography Governance Owner	View ↗
CRY-001-R005	Cryptographic Risk Assessment The organization shall conduct regular risk assessments of cryptographic control...	CRY-001 Cryptographic Governance	Information Security Risk Management	View ↗
CRY-001-R006	Cryptographic Compliance Monitoring The organization shall monitor cryptographic compliance to ensure cryptographic...	CRY-001 Cryptographic Governance	Cryptography Security Engineering	View ↗
CRY-001-R007	Governance Reporting The organization shall report on cryptographic governance, providing visibility...	CRY-001 Cryptographic Governance	CISO / Security Governance	View ↗
CRY-001-R008	Governance Review The organization shall conduct periodic reviews of cryptographic governance acti...	CRY-001 Cryptographic Governance	Cryptography Governance Committee	View ↗
CRY-001-R009	Exception Management The organization shall manage exceptions to cryptographic policies and standards...	CRY-001 Cryptographic Governance	Risk & Compliance / Cryptography Governance	View ↗
CRY-001-R010	Governance Continuous Improvement The organization shall drive ongoing enhancement of cryptographic governance thr...	CRY-001 Cryptographic Governance	CISO / Cryptography Governance Committee	View ↗
CRY-002-R001	Encryption Framework The organization shall establish a data-at-rest encryption framework that define...	CRY-002 Data-at-Rest Encryption	Data Security / Cryptography Engineering	View ↗
CRY-002-R002	Data Identification The organization shall identify data that requires encryption at rest based on i...	CRY-002 Data-at-Rest Encryption	Data Protection / Data Owners	View ↗
CRY-002-R003	Encryption Requirements The organization shall define encryption requirements for data-at-rest that spec...	CRY-002 Data-at-Rest Encryption	Cryptography Engineering / Data Security	View ↗
CRY-002-R004	Encryption Configuration The organization shall configure encryption controls for data-at-rest in accorda...	CRY-002 Data-at-Rest Encryption	Platform Engineering / Data Security	View ↗
CRY-002-R005	Encryption Validation The organization shall validate that data-at-rest encryption controls have been...	CRY-002 Data-at-Rest Encryption	Security Assurance / Platform Security	View ↗
CRY-002-R006	Encryption Monitoring The organization shall monitor data-at-rest encryption to ensure encryption cont...	CRY-002 Data-at-Rest Encryption	Security Operations / Network Security	View ↗
CRY-002-R007	Encryption Exception Management The organization shall manage exceptions to data-at-rest encryption requirements...	CRY-002 Data-at-Rest Encryption	Risk Management / Data Security	View ↗
CRY-002-R008	Encryption Reporting The organization shall report on data-at-rest encryption, providing visibility i...	CRY-002 Data-at-Rest Encryption	Network Security Governance	View ↗
CRY-002-R009	Encryption Review The organization shall conduct periodic reviews of data-at-rest encryption activ...	CRY-002 Data-at-Rest Encryption	Cryptography Governance / Internal Security Assurance	View ↗
CRY-002-R010	Encryption Continuous Improvement The organization shall drive ongoing enhancement of data-at-rest encryption thro...	CRY-002 Data-at-Rest Encryption	Cryptography Governance / Network Security	View ↗
CRY-003-R001	Transmission Encryption Framework The organization shall establish a data-in-transit encryption framework that def...	CRY-003 Data-in-Transit Encryption	Network Security / Cryptography Engineering	View ↗
CRY-003-R002	Secure Communication Requirements The organization shall define secure communication requirements that specify how...	CRY-003 Data-in-Transit Encryption	Network Security Architecture	View ↗
CRY-003-R003	Protocol Management The organization shall manage secure communication protocols, ensuring only appr...	CRY-003 Data-in-Transit Encryption	Network Security Engineering	View ↗
CRY-003-R004	Certificate Validation The organization shall validate digital certificates used in secure communicatio...	CRY-003 Data-in-Transit Encryption	PKI / Application Security	View ↗
CRY-003-R005	Secure Channel Management The organization shall manage secure communication channels, including the estab...	CRY-003 Data-in-Transit Encryption	Network Security / Platform Engineering	View ↗
CRY-003-R006	Encryption Monitoring The organization shall monitor data-in-transit encryption to ensure communicatio...	CRY-003 Data-in-Transit Encryption	Security Operations / Network Security	View ↗
CRY-003-R007	Communication Security Review The organization shall conduct periodic reviews of communication security to ass...	CRY-003 Data-in-Transit Encryption	Network Security Assurance	View ↗
CRY-003-R008	Encryption Reporting The organization shall report on data-in-transit encryption, providing visibilit...	CRY-003 Data-in-Transit Encryption	Network Security Governance	View ↗
CRY-003-R009	Encryption Assessment The organization shall conduct periodic assessments of data-in-transit encryptio...	CRY-003 Data-in-Transit Encryption	Security Assurance / Internal Audit	View ↗
CRY-003-R010	Encryption Continuous Improvement The organization shall drive ongoing enhancement of data-in-transit encryption t...	CRY-003 Data-in-Transit Encryption	Cryptography Governance / Network Security	View ↗
CRY-004-R001	Key Management Framework The organization shall establish a cryptographic key management framework that d...	CRY-004 Cryptographic Key Management	Cryptography Engineering / Key Management	View ↗
CRY-004-R002	Key Generation The organization shall generate cryptographic keys securely, ensuring keys are g...	CRY-004 Cryptographic Key Management	Key Management Team	View ↗
CRY-004-R003	Key Distribution The organization shall distribute cryptographic keys securely to authorized reci...	CRY-004 Cryptographic Key Management	Key Management / Cloud Security	View ↗
CRY-004-R004	Key Storage & Protection The organization shall store cryptographic keys securely, ensuring keys are prot...	CRY-004 Cryptographic Key Management	Key Management Team / Platform Security	View ↗
CRY-004-R005	Key Rotation The organization shall rotate cryptographic keys at defined intervals and in res...	CRY-004 Cryptographic Key Management	Key Management / Platform Engineering	View ↗
CRY-004-R006	Key Backup & Recovery The organization shall back up cryptographic keys securely and recover keys in t...	CRY-004 Cryptographic Key Management	Key Management / Business Continuity	View ↗
CRY-004-R007	Key Revocation & Destruction The organization shall revoke and destroy cryptographic keys when they are no lo...	CRY-004 Cryptographic Key Management	Key Management / Security Operations	View ↗
CRY-004-R008	Key Lifecycle Monitoring The organization shall monitor cryptographic key lifecycle activities to ensure...	CRY-004 Cryptographic Key Management	Key Management / Security Operations	View ↗
CRY-004-R009	Key Management Review The organization shall conduct periodic reviews of key management activities to...	CRY-004 Cryptographic Key Management	Cryptography Assurance / Key Management	View ↗
CRY-004-R010	Key Management Continuous Improvement The organization shall drive ongoing enhancement of key management through a con...	CRY-004 Cryptographic Key Management	Cryptography Engineering	View ↗
CRY-005-R001	Certificate Management Framework The organization shall establish a digital certificate management framework that...	CRY-005 Digital Certificate Management	PKI / Cryptography Governance	View ↗
CRY-005-R002	Certificate Issuance The organization shall issue digital certificates, ensuring certificates are iss...	CRY-005 Digital Certificate Management	PKI Administration / Security Engineering	View ↗
CRY-005-R003	Certificate Inventory The organization shall maintain a comprehensive inventory of digital certificate...	CRY-005 Digital Certificate Management	PKI / Infrastructure Security	View ↗
CRY-005-R004	Certificate Renewal The organization shall renew digital certificates before expiration, ensuring ce...	CRY-005 Digital Certificate Management	PKI / Platform Engineering	View ↗
CRY-005-R005	Certificate Revocation The organization shall revoke digital certificates when they are compromised, no...	CRY-005 Digital Certificate Management	PKI / Incident Response	View ↗
CRY-005-R006	Certificate Monitoring The organization shall monitor digital certificates to ensure certificates remai...	CRY-005 Digital Certificate Management	PKI / Security Operations	View ↗
CRY-005-R007	Certificate Trust Validation The organization shall validate the trustworthiness of digital certificates, ens...	CRY-005 Digital Certificate Management	PKI / Endpoint Security	View ↗
CRY-005-R008	Certificate Reporting The organization shall report on digital certificate management, providing visib...	CRY-005 Digital Certificate Management	PKI Governance	View ↗
CRY-005-R009	Certificate Review The organization shall conduct periodic reviews of digital certificate managemen...	CRY-005 Digital Certificate Management	PKI Assurance / Security Engineering	View ↗
CRY-005-R010	Certificate Continuous Improvement The organization shall drive ongoing enhancement of digital certificate manageme...	CRY-005 Digital Certificate Management	PKI / Cryptography Governance	View ↗
NET-001-R001	Secure Network Architecture The organization shall establish a secure network architecture framework that de...	NET-001 Secure Network Architecture	Network Security Architecture / Network Engineering	View ↗
NET-001-R002	Network Security Design The organization shall develop and maintain secure network designs that incorpor...	NET-001 Secure Network Architecture	Network Security Architecture / Network Engineering	View ↗
NET-001-R003	Network Trust Boundaries The organization shall define network trust boundaries that establish the securi...	NET-001 Secure Network Architecture	Network Security Architecture / Network Engineering	View ↗
NET-001-R004	Network Security Zones The organization shall define and implement network security zones that segregat...	NET-001 Secure Network Architecture	Network Security Architecture / Network Engineering	View ↗
NET-001-R005	Network Architecture Standards The organization shall define network architecture standards that specify the se...	NET-001 Secure Network Architecture	Network Security Architecture / Network Engineering	View ↗
NET-001-R006	Architecture Risk Assessment The organization shall conduct regular risk assessments of network architecture...	NET-001 Secure Network Architecture	Network Security Architecture / Network Engineering	View ↗
NET-001-R007	Architecture Monitoring The organization shall monitor network architecture to ensure network security c...	NET-001 Secure Network Architecture	Network Security Architecture / Network Engineering	View ↗
NET-001-R008	Architecture Reporting The organization shall report on network architecture, providing visibility into...	NET-001 Secure Network Architecture	Network Security Architecture / Network Engineering	View ↗
NET-001-R009	Architecture Review The organization shall conduct periodic reviews of network architecture to ensur...	NET-001 Secure Network Architecture	Network Security Architecture / Network Engineering	View ↗
NET-001-R010	Architecture Continuous Improvement The organization shall drive ongoing enhancement of network architecture through...	NET-001 Secure Network Architecture	Network Security Architecture / Network Engineering	View ↗
NET-002-R001	Segmentation Framework The organization shall establish a network segmentation framework that defines t...	NET-002 Network Segmentation & Traffic...	Network Security / Network Engineering	View ↗
NET-002-R002	Network Zone Management The organization shall manage network security zones, including the definition,...	NET-002 Network Segmentation & Traffic...	Network Security / Network Engineering	View ↗
NET-002-R003	Firewall Rule Management The organization shall manage firewall rules and network access control lists, e...	NET-002 Network Segmentation & Traffic...	Network Security / Network Engineering	View ↗
NET-002-R004	Traffic Control Policies The organization shall define and implement traffic control policies that specif...	NET-002 Network Segmentation & Traffic...	Network Security / Network Engineering	View ↗
NET-002-R005	Critical Asset Isolation The organization shall implement isolation controls for critical assets, ensurin...	NET-002 Network Segmentation & Traffic...	Network Security / Network Engineering	View ↗
NET-002-R006	Segmentation Validation The organization shall validate network segmentation to ensure segmentation cont...	NET-002 Network Segmentation & Traffic...	Network Security / Network Engineering	View ↗
NET-002-R007	Traffic Monitoring The organization shall monitor network traffic to detect unauthorized communicat...	NET-002 Network Segmentation & Traffic...	Network Security / Network Engineering	View ↗
NET-002-R008	Segmentation Reporting The organization shall report on network segmentation, providing visibility into...	NET-002 Network Segmentation & Traffic...	Network Security / Network Engineering	View ↗
NET-002-R009	Segmentation Review The organization shall conduct periodic reviews of network segmentation activiti...	NET-002 Network Segmentation & Traffic...	Network Security / Network Engineering	View ↗
NET-002-R010	Segmentation Continuous Improvement The organization shall drive ongoing enhancement of network segmentation through...	NET-002 Network Segmentation & Traffic...	Network Security / Network Engineering	View ↗
NET-003-R001	Detection Framework The organization shall establish an intrusion detection and prevention framework...	NET-003 Intrusion Detection & Preventi...	Security Operations / Network Security	View ↗
NET-003-R002	Detection Coverage The organization shall ensure intrusion detection and prevention capabilities pr...	NET-003 Intrusion Detection & Preventi...	Security Operations / Network Security	View ↗
NET-003-R003	Threat Detection Rules The organization shall establish and maintain threat detection rules that enable...	NET-003 Intrusion Detection & Preventi...	Security Operations / Network Security	View ↗
NET-003-R004	Intrusion Prevention The organization shall implement intrusion prevention capabilities that enable a...	NET-003 Intrusion Detection & Preventi...	Security Operations / Network Security	View ↗
NET-003-R005	Alert Management The organization shall manage alerts generated by intrusion detection and preven...	NET-003 Intrusion Detection & Preventi...	Security Operations / Network Security	View ↗
NET-003-R006	Detection Monitoring The organization shall monitor intrusion detection and prevention activities to...	NET-003 Intrusion Detection & Preventi...	Security Operations / Network Security	View ↗
NET-003-R007	Detection Validation The organization shall validate intrusion detection and prevention capabilities...	NET-003 Intrusion Detection & Preventi...	Security Operations / Network Security	View ↗
NET-003-R008	Detection Reporting The organization shall report on intrusion detection and prevention, providing v...	NET-003 Intrusion Detection & Preventi...	Security Operations / Network Security	View ↗
NET-003-R009	Detection Review The organization shall conduct periodic reviews of intrusion detection and preve...	NET-003 Intrusion Detection & Preventi...	Security Operations / Network Security	View ↗
NET-003-R010	Detection Continuous Improvement The organization shall drive ongoing enhancement of intrusion detection and prev...	NET-003 Intrusion Detection & Preventi...	Security Operations / Network Security	View ↗
NET-004-R001	NAC Framework The organization shall establish a Network Access Control framework that defines...	NET-004 Network Access Control (NAC)	Network Security / IAM	View ↗
NET-004-R002	Device Authentication The organization shall authenticate devices seeking access to the network, ensur...	NET-004 Network Access Control (NAC)	Network Security / IAM	View ↗
NET-004-R003	Device Authorization The organization shall authorize network access for authenticated devices, ensur...	NET-004 Network Access Control (NAC)	Network Security / IAM	View ↗
NET-004-R004	Device Compliance Assessment The organization shall assess the compliance of devices seeking network access w...	NET-004 Network Access Control (NAC)	Network Security / IAM	View ↗
NET-004-R005	Guest Network Access The organization shall provide guest network access to visitors, contractors, an...	NET-004 Network Access Control (NAC)	Network Security / IAM	View ↗
NET-004-R006	Access Enforcement The organization shall implement enforcement mechanisms for network access contr...	NET-004 Network Access Control (NAC)	Network Security / IAM	View ↗
NET-004-R007	NAC Monitoring The organization shall monitor Network Access Control activities to ensure acces...	NET-004 Network Access Control (NAC)	Network Security / IAM	View ↗
NET-004-R008	NAC Reporting The organization shall report on Network Access Control, providing visibility in...	NET-004 Network Access Control (NAC)	Network Security / IAM	View ↗
NET-004-R009	NAC Review The organization shall conduct periodic reviews of Network Access Control activi...	NET-004 Network Access Control (NAC)	Network Security / IAM	View ↗
NET-004-R010	NAC Continuous Improvement The organization shall drive ongoing enhancement of Network Access Control throu...	NET-004 Network Access Control (NAC)	Network Security / IAM	View ↗
NET-005-R001	Remote Access Framework The organization shall establish a secure remote access framework that defines t...	NET-005 Secure Remote Access	Network Security / IAM	View ↗
NET-005-R002	Remote User Authentication The organization shall authenticate users accessing organizational resources rem...	NET-005 Secure Remote Access	Network Security / IAM	View ↗
NET-005-R003	Remote Access Authorization The organization shall authorize remote access for authenticated users, ensuring...	NET-005 Secure Remote Access	Network Security / IAM	View ↗
NET-005-R004	Secure Communication Channels The organization shall establish secure communication channels for remote access...	NET-005 Secure Remote Access	Network Security / IAM	View ↗
NET-005-R005	Third-Party Remote Access The organization shall manage remote access by third parties, including vendors,...	NET-005 Secure Remote Access	Network Security / IAM	View ↗
NET-005-R006	Remote Session Monitoring The organization shall monitor remote access sessions to detect unauthorized act...	NET-005 Secure Remote Access	Network Security / IAM	View ↗
NET-005-R007	Remote Access Logging The organization shall maintain comprehensive logs of remote access activities,...	NET-005 Secure Remote Access	Network Security / IAM	View ↗
NET-005-R008	Remote Access Reporting The organization shall report on remote access, providing visibility into remote...	NET-005 Secure Remote Access	Network Security / IAM	View ↗
NET-005-R009	Remote Access Review The organization shall conduct periodic reviews of remote access activities to e...	NET-005 Secure Remote Access	Network Security / IAM	View ↗
NET-005-R010	Remote Access Continuous Improvement The organization shall drive ongoing enhancement of remote access through a cont...	NET-005 Secure Remote Access	Network Security / IAM	View ↗
NET-006-R001	Wireless Security Framework The organization shall establish a wireless network security framework that defi...	NET-006 Wireless Network Security	Network Security / Infrastructure	View ↗
NET-006-R002	Wireless Authentication The organization shall authenticate users and devices accessing wireless network...	NET-006 Wireless Network Security	Network Security / Infrastructure	View ↗
NET-006-R003	Wireless Encryption The organization shall implement encryption for wireless communications, ensurin...	NET-006 Wireless Network Security	Network Security / Infrastructure	View ↗
NET-006-R004	Wireless Access Control The organization shall implement access controls for wireless networks, ensuring...	NET-006 Wireless Network Security	Network Security / Infrastructure	View ↗
NET-006-R005	Wireless Network Segmentation The organization shall segment wireless networks to separate guest access, emplo...	NET-006 Wireless Network Security	Network Security / Infrastructure	View ↗
NET-006-R006	Wireless Monitoring The organization shall monitor wireless networks to detect unauthorized access,...	NET-006 Wireless Network Security	Network Security / Infrastructure	View ↗
NET-006-R007	Rogue Access Point Detection The organization shall detect rogue access points and unauthorized wireless devi...	NET-006 Wireless Network Security	Network Security / Infrastructure	View ↗
NET-006-R008	Wireless Reporting The organization shall report on wireless network security, providing visibility...	NET-006 Wireless Network Security	Network Security / Infrastructure	View ↗
NET-006-R009	Wireless Review The organization shall conduct periodic reviews of wireless network security act...	NET-006 Wireless Network Security	Network Security / Infrastructure	View ↗
NET-006-R010	Wireless Continuous Improvement The organization shall drive ongoing enhancement of wireless network security th...	NET-006 Wireless Network Security	Network Security / Infrastructure	View ↗
NET-007-R001	Network Monitoring Framework The organization shall establish a network monitoring and visibility framework t...	NET-007 Network Monitoring & Visibilit...	Network Security / SOC	View ↗
NET-007-R002	Network Telemetry Collection The organization shall collect network telemetry data from across the network en...	NET-007 Network Monitoring & Visibilit...	Network Security / SOC	View ↗
NET-007-R003	Traffic Visibility The organization shall ensure comprehensive visibility into network traffic, inc...	NET-007 Network Monitoring & Visibilit...	Network Security / SOC	View ↗
NET-007-R004	Anomaly Detection The organization shall detect network anomalies, including unusual traffic patte...	NET-007 Network Monitoring & Visibilit...	Network Security / SOC	View ↗
NET-007-R005	Network Performance Monitoring The organization shall monitor network performance to ensure network resources a...	NET-007 Network Monitoring & Visibilit...	Network Security / SOC	View ↗
NET-007-R006	Network Event Correlation The organization shall correlate network events from multiple sources to identif...	NET-007 Network Monitoring & Visibilit...	Network Security / SOC	View ↗
NET-007-R007	Network Alert Management The organization shall manage alerts generated by network monitoring systems, en...	NET-007 Network Monitoring & Visibilit...	Network Security / SOC	View ↗
NET-007-R008	Network Reporting The organization shall report on network monitoring, providing visibility into n...	NET-007 Network Monitoring & Visibilit...	Network Security / SOC	View ↗
NET-007-R009	Network Review The organization shall conduct periodic reviews of network monitoring and visibi...	NET-007 Network Monitoring & Visibilit...	Network Security / SOC	View ↗
NET-007-R010	Network Continuous Improvement The organization shall drive ongoing enhancement of network monitoring and visib...	NET-007 Network Monitoring & Visibilit...	Network Security / SOC	View ↗
NET-008-R001	Communication Security Framework The organization shall establish a voice and video communication security framew...	NET-008 Voice & Video Communication Se...	Network Security / Collaboration Services	View ↗
NET-008-R002	Voice & Video Authentication The organization shall authenticate users and systems participating in voice and...	NET-008 Voice & Video Communication Se...	Network Security / Collaboration Services	View ↗
NET-008-R003	Communication Encryption The organization shall implement encryption for voice and video communications,...	NET-008 Voice & Video Communication Se...	Network Security / Collaboration Services	View ↗
NET-008-R004	Communication Access Control The organization shall implement access controls for voice and video communicati...	NET-008 Voice & Video Communication Se...	Network Security / Collaboration Services	View ↗
NET-008-R005	Communication Session Protection The organization shall protect voice and video communication sessions, including...	NET-008 Voice & Video Communication Se...	Network Security / Collaboration Services	View ↗
NET-008-R006	Communication Monitoring The organization shall monitor voice and video communications to detect security...	NET-008 Voice & Video Communication Se...	Network Security / Collaboration Services	View ↗
NET-008-R007	Communication Incident Management The organization shall manage security incidents involving voice and video commu...	NET-008 Voice & Video Communication Se...	Network Security / Collaboration Services	View ↗
NET-008-R008	Communication Reporting The organization shall report on voice and video communication security, providi...	NET-008 Voice & Video Communication Se...	Network Security / Collaboration Services	View ↗
NET-008-R009	Communication Review The organization shall conduct periodic reviews of voice and video communication...	NET-008 Voice & Video Communication Se...	Network Security / Collaboration Services	View ↗
NET-008-R010	Communication Continuous Improvement The organization shall drive ongoing enhancement of voice and video communicatio...	NET-008 Voice & Video Communication Se...	Network Security / Collaboration Services	View ↗
END-001-R001	Endpoint Protection Policy The organization shall establish an endpoint protection framework that defines t...	END-001 Endpoint Protection	Endpoint Security, IT Operations, Security Operations, CISO	View ↗
END-001-R002	Endpoint Protection Deployment The organization shall deploy endpoint protection controls to all organizational...	END-001 Endpoint Protection	Endpoint Security, IT Operations, Security Operations, CISO	View ↗
END-001-R003	Malware Prevention The organization shall implement malware prevention controls on endpoint devices...	END-001 Endpoint Protection	Endpoint Security, IT Operations, Security Operations, CISO	View ↗
END-001-R004	Threat Prevention Configuration The organization shall configure endpoint protection controls in accordance with...	END-001 Endpoint Protection	Endpoint Security, IT Operations, Security Operations, CISO	View ↗
END-001-R005	Endpoint Protection Monitoring The organization shall monitor endpoint protection to ensure protection controls...	END-001 Endpoint Protection	Endpoint Security, IT Operations, Security Operations, CISO	View ↗
END-001-R006	Threat Detection Validation The organization shall validate endpoint threat detection capabilities to ensure...	END-001 Endpoint Protection	Endpoint Security, IT Operations, Security Operations, CISO	View ↗
END-001-R007	Protection Reporting The organization shall report on endpoint protection, providing visibility into...	END-001 Endpoint Protection	Endpoint Security, IT Operations, Security Operations, CISO	View ↗
END-001-R008	Protection Review The organization shall conduct periodic reviews of endpoint protection activitie...	END-001 Endpoint Protection	Endpoint Security, IT Operations, Security Operations, CISO	View ↗
END-001-R009	Exception Management The organization shall manage exceptions to endpoint protection requirements, en...	END-001 Endpoint Protection	Endpoint Security, IT Operations, Security Operations, CISO	View ↗
END-001-R010	Protection Continuous Improvement The organization shall drive ongoing enhancement of endpoint protection through...	END-001 Endpoint Protection	Endpoint Security, IT Operations, Security Operations, CISO	View ↗
END-002-R001	EDR Framework The organization shall establish an Endpoint Detection and Response framework th...	END-002 Endpoint Detection & Response...	Endpoint Security, IT Operations, Security Operations, CISO	View ↗
END-002-R002	Endpoint Telemetry Collection The organization shall collect comprehensive telemetry data from endpoint device...	END-002 Endpoint Detection & Response...	Endpoint Security, IT Operations, Security Operations, CISO	View ↗
END-002-R003	Threat Detection The organization shall implement threat detection capabilities for endpoint devi...	END-002 Endpoint Detection & Response...	Endpoint Security, IT Operations, Security Operations, CISO	View ↗
END-002-R004	Threat Investigation The organization shall investigate endpoint threats, including the analysis of t...	END-002 Endpoint Detection & Response...	Endpoint Security, IT Operations, Security Operations, CISO	View ↗
END-002-R005	Endpoint Response The organization shall respond to endpoint threats, including the containment of...	END-002 Endpoint Detection & Response...	Endpoint Security, IT Operations, Security Operations, CISO	View ↗
END-002-R006	Threat Hunting The organization shall establish proactive threat hunting capabilities to identi...	END-002 Endpoint Detection & Response...	Endpoint Security, IT Operations, Security Operations, CISO	View ↗
END-002-R007	EDR Monitoring The organization shall monitor EDR activities to ensure detection and response c...	END-002 Endpoint Detection & Response...	Endpoint Security, IT Operations, Security Operations, CISO	View ↗
END-002-R008	EDR Reporting The organization shall report on EDR, providing visibility into threat detection...	END-002 Endpoint Detection & Response...	Endpoint Security, IT Operations, Security Operations, CISO	View ↗
END-002-R009	EDR Review The organization shall conduct periodic reviews of EDR activities to ensure thei...	END-002 Endpoint Detection & Response...	Endpoint Security, IT Operations, Security Operations, CISO	View ↗
END-002-R010	EDR Continuous Improvement The organization shall drive ongoing enhancement of EDR through a continuous imp...	END-002 Endpoint Detection & Response...	Endpoint Security, IT Operations, Security Operations, CISO	View ↗
END-003-R001	Mobile Security Framework The organization shall establish a mobile device and application management fram...	END-003 Mobile Device & Application Ma...	Endpoint Security, IT Operations, Security Operations, CISO	View ↗
END-003-R002	Device Enrollment The organization shall enroll mobile devices into the organization's mobile mana...	END-003 Mobile Device & Application Ma...	Endpoint Security, IT Operations, Security Operations, CISO	View ↗
END-003-R003	Device Configuration Management The organization shall configure mobile devices in accordance with security requ...	END-003 Mobile Device & Application Ma...	Endpoint Security, IT Operations, Security Operations, CISO	View ↗
END-003-R004	Mobile Application Management The organization shall manage mobile applications, including the approval, distr...	END-003 Mobile Device & Application Ma...	Endpoint Security, IT Operations, Security Operations, CISO	View ↗
END-003-R005	Corporate Data Protection The organization shall protect corporate data on mobile devices, including data...	END-003 Mobile Device & Application Ma...	Endpoint Security, IT Operations, Security Operations, CISO	View ↗
END-003-R006	Mobile Compliance Monitoring The organization shall monitor mobile device compliance to ensure devices remain...	END-003 Mobile Device & Application Ma...	Endpoint Security, IT Operations, Security Operations, CISO	View ↗
END-003-R007	Mobile Incident Management The organization shall manage security incidents involving mobile devices, inclu...	END-003 Mobile Device & Application Ma...	Endpoint Security / IT Operations, Security Operations, CISO	View ↗
END-003-R008	Mobile Reporting The organization shall report on mobile device and application management, provi...	END-003 Mobile Device & Application Ma...	Endpoint Security / IT Operations, Security Operations, CISO	View ↗
END-003-R009	Mobile Review The organization shall conduct periodic reviews of mobile device and application...	END-003 Mobile Device & Application Ma...	Endpoint Security / IT Operations, Security Operations, CISO	View ↗
END-003-R010	Mobile Continuous Improvement The organization shall drive ongoing enhancement of mobile device and applicatio...	END-003 Mobile Device & Application Ma...	Endpoint Security / IT Operations, Security Operations, CISO	View ↗
END-004-R001	Endpoint Encryption Framework The organization shall establish an endpoint encryption framework that defines t...	END-004 Endpoint Encryption	Endpoint Security / IT Operations, Security Operations, CISO	View ↗
END-004-R002	Encryption Requirements The organization shall define encryption requirements for endpoint devices that...	END-004 Endpoint Encryption	Endpoint Security / IT Operations, Security Operations, CISO	View ↗
END-004-R003	Encryption Deployment The organization shall deploy encryption controls to endpoint devices in accorda...	END-004 Endpoint Encryption	Endpoint Security / IT Operations, Security Operations, CISO	View ↗
END-004-R004	Encryption Key Management Integration The organization shall integrate endpoint encryption with cryptographic key mana...	END-004 Endpoint Encryption	Endpoint Security / IT Operations, Security Operations, CISO	View ↗
END-004-R005	Encryption Status Monitoring The organization shall monitor endpoint encryption status to ensure encryption i...	END-004 Endpoint Encryption	Endpoint Security / IT Operations, Security Operations, CISO	View ↗
END-004-R006	Encryption Exception Management The organization shall manage exceptions to endpoint encryption requirements, en...	END-004 Endpoint Encryption	Endpoint Security / IT Operations, Security Operations, CISO	View ↗
END-004-R007	Encryption Reporting The organization shall report on endpoint encryption, providing visibility into...	END-004 Endpoint Encryption	Endpoint Security / IT Operations, Security Operations, CISO	View ↗
END-004-R008	Encryption Review The organization shall conduct periodic reviews of endpoint encryption activitie...	END-004 Endpoint Encryption	Endpoint Security / IT Operations, Security Operations, CISO	View ↗
END-004-R009	Recovery Management The organization shall recover encrypted data and restore access in the event of...	END-004 Endpoint Encryption	Endpoint Security / IT Operations, Security Operations, CISO	View ↗
END-004-R010	Encryption Continuous Improvement The organization shall drive ongoing enhancement of endpoint encryption through...	END-004 Endpoint Encryption	Endpoint Security / IT Operations, Security Operations, CISO	View ↗
END-005-R001	Application Control Framework The organization shall establish an endpoint application control framework that...	END-005 Endpoint Application Control	Endpoint Security / IT Operations, Security Operations, CISO	View ↗
END-005-R002	Approved Application Management The organization shall maintain an approved application list that identifies app...	END-005 Endpoint Application Control	Endpoint Security / IT Operations, Security Operations, CISO	View ↗
END-005-R003	Application Allowlisting The organization shall implement application allowlisting controls that permit o...	END-005 Endpoint Application Control	Endpoint Security / IT Operations, Security Operations, CISO	View ↗
END-005-R004	Application Execution Control The organization shall control the execution of applications, including the prev...	END-005 Endpoint Application Control	Endpoint Security / IT Operations, Security Operations, CISO	View ↗
END-005-R005	Application Exception Management The organization shall manage exceptions to application control policies, ensuri...	END-005 Endpoint Application Control	Endpoint Security / IT Operations, Security Operations, CISO	View ↗
END-005-R006	Application Monitoring The organization shall monitor application control to ensure application allowli...	END-005 Endpoint Application Control	Endpoint Security / IT Operations, Security Operations, CISO	View ↗
END-005-R007	Application Compliance Reporting The organization shall report on application control, providing visibility into...	END-005 Endpoint Application Control	Endpoint Security / IT Operations, Security Operations, CISO	View ↗
END-005-R008	Application Review The organization shall conduct periodic reviews of application control activitie...	END-005 Endpoint Application Control	Endpoint Security / IT Operations, Security Operations, CISO	View ↗
END-005-R009	Unauthorized Application Detection The organization shall detect unauthorized applications installed or executed on...	END-005 Endpoint Application Control	Endpoint Security / IT Operations, Security Operations, CISO	View ↗
END-005-R010	Application Control Continuous Improvement The organization shall drive ongoing enhancement of application control through...	END-005 Endpoint Application Control	Endpoint Security / IT Operations, Security Operations, CISO	View ↗
END-006-R001	Removable Media Framework The organization shall establish a removable media and peripheral control framew...	END-006 Removable Media & Peripheral C...	Endpoint Security / IT Operations, Security Operations, CISO	View ↗
END-006-R002	Device Authorization The organization shall authorize removable media and peripheral devices for use...	END-006 Removable Media & Peripheral C...	Endpoint Security / IT Operations, Security Operations, CISO	View ↗
END-006-R003	Peripheral Access Control The organization shall control access to peripheral devices, including USB ports...	END-006 Removable Media & Peripheral C...	Endpoint Security / IT Operations, Security Operations, CISO	View ↗
END-006-R004	Media Usage Restrictions The organization shall implement restrictions on the use of removable media, inc...	END-006 Removable Media & Peripheral C...	Endpoint Security / IT Operations, Security Operations, CISO	View ↗
END-006-R005	Media Activity Monitoring The organization shall monitor removable media activities, including device conn...	END-006 Removable Media & Peripheral C...	Endpoint Security / IT Operations, Security Operations, CISO	View ↗
END-006-R006	Exception Management The organization shall manage exceptions to removable media and peripheral contr...	END-006 Removable Media & Peripheral C...	Endpoint Security, IT Operations, Security Operations, CISO	View ↗
END-006-R007	Media Audit Logging The organization shall maintain comprehensive audit logs of removable media acti...	END-006 Removable Media & Peripheral C...	Endpoint Security / IT Operations, Security Operations, CISO	View ↗
END-006-R008	Media Reporting The organization shall report on removable media and peripheral control, providi...	END-006 Removable Media & Peripheral C...	Endpoint Security / IT Operations, Security Operations, CISO	View ↗
END-006-R009	Media Review The organization shall conduct periodic reviews of removable media and periphera...	END-006 Removable Media & Peripheral C...	Endpoint Security / IT Operations, Security Operations, CISO	View ↗
END-006-R010	Media Continuous Improvement The organization shall drive ongoing enhancement of removable media and peripher...	END-006 Removable Media & Peripheral C...	Endpoint Security / IT Operations, Security Operations, CISO	View ↗
CLD-001-R001	Cloud Governance Framework The organization shall establish a cloud security governance framework that defi...	CLD-001 Cloud Security Governance	CISO / Cloud Security Governance	View ↗
CLD-001-R002	Cloud Security Strategy The organization shall define a cloud security strategy that articulates the app...	CLD-001 Cloud Security Governance	CISO / Cloud Security Governance	View ↗
CLD-001-R003	Cloud Policies & Standards The organization shall establish cloud security policies and standards that spec...	CLD-001 Cloud Security Governance	CISO / Cloud Security Governance	View ↗
CLD-001-R004	Roles & Responsibilities The organization shall clearly define and document the roles and responsibilitie...	CLD-001 Cloud Security Governance	CISO / Cloud Security Governance	View ↗
CLD-001-R005	Cloud Risk Governance The organization shall integrate cloud security risks into the enterprise risk m...	CLD-001 Cloud Security Governance	CISO / Cloud Security Governance	View ↗
CLD-001-R006	Governance Monitoring The organization shall monitor cloud security governance to ensure governance co...	CLD-001 Cloud Security Governance	CISO / Cloud Security Governance	View ↗
CLD-001-R007	Governance Reporting The organization shall report on cloud security governance, providing visibility...	CLD-001 Cloud Security Governance	CISO / Cloud Security Governance	View ↗
CLD-001-R008	Governance Review The organization shall conduct periodic reviews of cloud security governance act...	CLD-001 Cloud Security Governance	CISO / Cloud Security Governance	View ↗
CLD-001-R009	Exception Management The organization shall manage exceptions to cloud security policies and standard...	CLD-001 Cloud Security Governance	CISO / Cloud Security Governance	View ↗
CLD-001-R010	Governance Continuous Improvement The organization shall drive ongoing enhancement of cloud security governance th...	CLD-001 Cloud Security Governance	CISO / Cloud Security Governance	View ↗
CLD-002-R001	Shared Responsibility Framework The organization shall establish a shared responsibility management framework th...	CLD-002 Cloud Shared Responsibility Ma...	Cloud Security / Third-Party Risk Management	View ↗
CLD-002-R002	Responsibility Definition The organization shall clearly define and document the division of security resp...	CLD-002 Cloud Shared Responsibility Ma...	Cloud Security / Third-Party Risk Management	View ↗
CLD-002-R003	Provider Responsibility Validation The organization shall validate that cloud service providers are fulfilling thei...	CLD-002 Cloud Shared Responsibility Ma...	Cloud Security / Third-Party Risk Management	View ↗
CLD-002-R004	Customer Responsibility Management The organization shall manage its own security responsibilities in cloud environ...	CLD-002 Cloud Shared Responsibility Ma...	Cloud Security / Third-Party Risk Management	View ↗
CLD-002-R005	Responsibility Communication The organization shall communicate shared responsibility definitions to all rele...	CLD-002 Cloud Shared Responsibility Ma...	Cloud Security / Third-Party Risk Management	View ↗
CLD-002-R006	Responsibility Monitoring The organization shall monitor shared responsibility management to ensure both p...	CLD-002 Cloud Shared Responsibility Ma...	Cloud Security / Third-Party Risk Management	View ↗
CLD-002-R007	Responsibility Documentation The organization shall maintain comprehensive documentation of shared responsibi...	CLD-002 Cloud Shared Responsibility Ma...	Cloud Security / Third-Party Risk Management	View ↗
CLD-002-R008	Responsibility Review The organization shall conduct periodic reviews of shared responsibility managem...	CLD-002 Cloud Shared Responsibility Ma...	Cloud Security / Third-Party Risk Management	View ↗
CLD-002-R009	Responsibility Reporting The organization shall report on shared responsibility management, providing vis...	CLD-002 Cloud Shared Responsibility Ma...	Cloud Security / Third-Party Risk Management	View ↗
CLD-002-R010	Continuous Improvement The organization shall drive ongoing enhancement of shared responsibility manage...	CLD-002 Cloud Shared Responsibility Ma...	Cloud Security / Third-Party Risk Management	View ↗
CLD-003-R001	Configuration Framework The organization shall establish a secure cloud configuration framework that def...	CLD-003 Secure Cloud Configuration	Cloud Security Engineering / Cloud Platform Team	View ↗
CLD-003-R002	Secure Baselines The organization shall define secure configuration baselines for all cloud servi...	CLD-003 Secure Cloud Configuration	Cloud Security Engineering / Cloud Platform Team	View ↗
CLD-003-R003	Configuration Standards The organization shall define cloud configuration standards that specify the sec...	CLD-003 Secure Cloud Configuration	Cloud Security Engineering / Cloud Platform Team	View ↗
CLD-003-R004	Configuration Validation The organization shall validate cloud configurations against secure baselines an...	CLD-003 Secure Cloud Configuration	Cloud Security Engineering / Cloud Platform Team	View ↗
CLD-003-R005	Configuration Monitoring The organization shall monitor cloud configurations to detect configuration chan...	CLD-003 Secure Cloud Configuration	Cloud Security Engineering / Cloud Platform Team	View ↗
CLD-003-R006	Configuration Drift Detection The organization shall detect configuration drift where cloud configurations dev...	CLD-003 Secure Cloud Configuration	Cloud Security Engineering / Cloud Platform Team	View ↗
CLD-003-R007	Exception Management The organization shall manage exceptions to cloud configuration standards and ba...	CLD-003 Secure Cloud Configuration	Cloud Security Engineering / Cloud Platform Team	View ↗
CLD-003-R008	Configuration Reporting The organization shall report on cloud configuration, providing visibility into...	CLD-003 Secure Cloud Configuration	Cloud Security Engineering / Cloud Platform Team	View ↗
CLD-003-R009	Configuration Review The organization shall conduct periodic reviews of cloud configuration activitie...	CLD-003 Secure Cloud Configuration	Cloud Security Engineering / Cloud Platform Team	View ↗
CLD-003-R010	Continuous Improvement The organization shall drive ongoing enhancement of cloud configuration through...	CLD-003 Secure Cloud Configuration	Cloud Security Engineering / Cloud Platform Team	View ↗
CLD-004-R001	Cloud IAM Framework The organization shall establish a cloud identity and access management framewor...	CLD-004 Cloud Identity & Access Manage...	Cloud IAM Team	View ↗
CLD-004-R002	Cloud Identity Management The organization shall manage identities in cloud environments, including user i...	CLD-004 Cloud Identity & Access Manage...	Cloud IAM Team	View ↗
CLD-004-R003	Authentication Management The organization shall authenticate users accessing cloud services, ensuring onl...	CLD-004 Cloud Identity & Access Manage...	Cloud IAM Team	View ↗
CLD-004-R004	Authorization Management The organization shall authorize access to cloud resources, ensuring users are g...	CLD-004 Cloud Identity & Access Manage...	Cloud IAM Team	View ↗
CLD-004-R005	Privileged Access Management The organization shall manage privileged access in cloud environments, including...	CLD-004 Cloud Identity & Access Manage...	Cloud IAM Team	View ↗
CLD-004-R006	Federation Management The organization shall manage identity federation with cloud service providers,...	CLD-004 Cloud Identity & Access Manage...	Cloud IAM Team	View ↗
CLD-004-R007	Access Monitoring The organization shall monitor cloud access to detect unauthorized access, suspi...	CLD-004 Cloud Identity & Access Manage...	Cloud IAM Team	View ↗
CLD-004-R008	IAM Reporting The organization shall report on cloud IAM, providing visibility into identity s...	CLD-004 Cloud Identity & Access Manage...	Cloud IAM Team	View ↗
CLD-004-R009	IAM Review The organization shall conduct periodic reviews of cloud IAM activities to ensur...	CLD-004 Cloud Identity & Access Manage...	Cloud IAM Team	View ↗
CLD-004-R010	Continuous Improvement The organization shall drive ongoing enhancement of cloud IAM through a continuo...	CLD-004 Cloud Identity & Access Manage...	Cloud IAM Team	View ↗
CLD-005-R001	Network Security Framework The organization shall establish a cloud network security framework that defines...	CLD-005 Cloud Network Security	Cloud Network Security Team	View ↗
CLD-005-R002	Network Segmentation The organization shall implement network segmentation in cloud environments, sep...	CLD-005 Cloud Network Security	Cloud Network Security Team	View ↗
CLD-005-R003	Security Groups & Firewalls The organization shall implement security groups, network firewalls, and other n...	CLD-005 Cloud Network Security	Cloud Network Security Team	View ↗
CLD-005-R004	Secure Connectivity The organization shall establish secure connectivity between on-premises and clo...	CLD-005 Cloud Network Security	Cloud Network Security Team	View ↗
CLD-005-R005	Traffic Protection The organization shall implement traffic protection controls in cloud environmen...	CLD-005 Cloud Network Security	Cloud Network Security Team	View ↗
CLD-005-R006	Network Monitoring The organization shall monitor cloud networks to detect network anomalies, secur...	CLD-005 Cloud Network Security	Cloud Network Security Team	View ↗
CLD-005-R007	Network Logging The organization shall maintain comprehensive network logs for cloud environment...	CLD-005 Cloud Network Security	Cloud Network Security Team	View ↗
CLD-005-R008	Network Reporting The organization shall report on cloud network security, providing visibility in...	CLD-005 Cloud Network Security	Cloud Network Security Team	View ↗
CLD-005-R009	Network Review The organization shall conduct periodic reviews of cloud network security activi...	CLD-005 Cloud Network Security	Cloud Network Security Team	View ↗
CLD-005-R010	Continuous Improvement The organization shall drive ongoing enhancement of cloud network security throu...	CLD-005 Cloud Network Security	Cloud Network Security Team	View ↗
CLD-006-R001	Data Protection Framework The organization shall establish a cloud data protection framework that defines...	CLD-006 Cloud Data Protection	Data Protection / Cloud Security Team	View ↗
CLD-006-R002	Cloud Encryption The organization shall implement encryption for data stored in cloud environment...	CLD-006 Cloud Data Protection	Data Protection / Cloud Security Team	View ↗
CLD-006-R003	Data Access Protection The organization shall implement access controls for cloud data, ensuring only a...	CLD-006 Cloud Data Protection	Data Protection / Cloud Security Team	View ↗
CLD-006-R004	Cloud Backup Protection The organization shall protect cloud backups and ensure backup data is encrypted...	CLD-006 Cloud Data Protection	Data Protection / Cloud Security Team	View ↗
CLD-006-R005	Data Recovery The organization shall recover data from cloud backups in the event of data loss...	CLD-006 Cloud Data Protection	Data Protection / Cloud Security Team	View ↗
CLD-006-R006	Data Monitoring The organization shall monitor cloud data to detect unauthorized access, data le...	CLD-006 Cloud Data Protection	Data Protection / Cloud Security Team	View ↗
CLD-006-R007	Data Compliance The organization shall ensure cloud data processing complies with applicable leg...	CLD-006 Cloud Data Protection	Data Protection / Cloud Security Team	View ↗
CLD-006-R008	Data Reporting The organization shall report on cloud data protection, providing visibility int...	CLD-006 Cloud Data Protection	Data Protection / Cloud Security Team	View ↗
CLD-006-R009	Data Review The organization shall conduct periodic reviews of cloud data protection activit...	CLD-006 Cloud Data Protection	Data Protection / Cloud Security Team	View ↗
CLD-006-R010	Continuous Improvement The organization shall drive ongoing enhancement of cloud data protection throug...	CLD-006 Cloud Data Protection	Data Protection / Cloud Security Team	View ↗
CLD-007-R001	Workload Security Framework The organization shall establish a cloud workload security framework that define...	CLD-007 Cloud Workload & Container Sec...	Cloud Security Engineering / DevSecOps	View ↗
CLD-007-R002	Container Security The organization shall implement security controls for containerized workloads,...	CLD-007 Cloud Workload & Container Sec...	Cloud Security Engineering / DevSecOps	View ↗
CLD-007-R003	Kubernetes Security The organization shall implement security controls for Kubernetes environments,...	CLD-007 Cloud Workload & Container Sec...	Cloud Security Engineering / DevSecOps	View ↗
CLD-007-R004	Serverless Security The organization shall implement security controls for serverless functions and...	CLD-007 Cloud Workload & Container Sec...	Cloud Security Engineering / DevSecOps	View ↗
CLD-007-R005	Image Security The organization shall implement security controls for container images, ensurin...	CLD-007 Cloud Workload & Container Sec...	Cloud Security Engineering / DevSecOps	View ↗
CLD-007-R006	Runtime Protection The organization shall implement runtime protection for cloud workloads, includi...	CLD-007 Cloud Workload & Container Sec...	Cloud Security Engineering / DevSecOps	View ↗
CLD-007-R007	Workload Monitoring The organization shall monitor cloud workloads to detect security issues, perfor...	CLD-007 Cloud Workload & Container Sec...	Cloud Security Engineering / DevSecOps	View ↗
CLD-007-R008	Security Reporting The organization shall report on cloud workload security, providing visibility i...	CLD-007 Cloud Workload & Container Sec...	Cloud Security Engineering / DevSecOps	View ↗
CLD-007-R009	Workload Review The organization shall conduct periodic reviews of cloud workload security activ...	CLD-007 Cloud Workload & Container Sec...	Cloud Security Engineering / DevSecOps	View ↗
CLD-007-R010	Continuous Improvement The organization shall drive ongoing enhancement of cloud workload and container...	CLD-007 Cloud Workload & Container Sec...	Cloud Security Engineering / DevSecOps	View ↗
CLD-008-R001	Monitoring Framework The organization shall establish a cloud security monitoring framework that defi...	CLD-008 Cloud Security Monitoring	SOC / Cloud Security Monitoring Team	View ↗
CLD-008-R002	Cloud Logging The organization shall log cloud activities comprehensively, including user acti...	CLD-008 Cloud Security Monitoring	SOC / Cloud Security Monitoring Team	View ↗
CLD-008-R003	Security Event Collection The organization shall collect security events from cloud services, including se...	CLD-008 Cloud Security Monitoring	SOC / Cloud Security Monitoring Team	View ↗
CLD-008-R004	Threat Detection The organization shall implement threat detection capabilities for cloud environ...	CLD-008 Cloud Security Monitoring	SOC / Cloud Security Monitoring Team	View ↗
CLD-008-R005	Alert Management The organization shall manage security alerts generated by cloud monitoring syst...	CLD-008 Cloud Security Monitoring	SOC / Cloud Security Monitoring Team	View ↗
CLD-008-R006	Continuous Monitoring The organization shall continuously monitor cloud environments to detect securit...	CLD-008 Cloud Security Monitoring	SOC / Cloud Security Monitoring Team	View ↗
CLD-008-R007	Monitoring Reporting The organization shall report on cloud security monitoring, providing visibility...	CLD-008 Cloud Security Monitoring	SOC / Cloud Security Monitoring Team	View ↗
CLD-008-R008	Monitoring Review The organization shall conduct periodic reviews of cloud security monitoring act...	CLD-008 Cloud Security Monitoring	SOC / Cloud Security Monitoring Team	View ↗
CLD-008-R009	Monitoring Validation The organization shall validate cloud security monitoring capabilities to ensure...	CLD-008 Cloud Security Monitoring	SOC / Cloud Security Monitoring Team	View ↗
CLD-008-R010	Continuous Improvement The organization shall drive ongoing enhancement of cloud security monitoring th...	CLD-008 Cloud Security Monitoring	SOC / Cloud Security Monitoring Team	View ↗
CLD-009-R001	Cloud IR Framework The organization shall establish a cloud incident response framework that define...	CLD-009 Cloud Incident Response	Incident Response / Cloud Security Team	View ↗
CLD-009-R002	Incident Detection The organization shall detect security incidents in cloud environments using mon...	CLD-009 Cloud Incident Response	Incident Response / Cloud Security Team	View ↗
CLD-009-R003	Incident Investigation The organization shall investigate cloud security incidents, including the colle...	CLD-009 Cloud Incident Response	Incident Response / Cloud Security Team	View ↗
CLD-009-R004	Incident Containment The organization shall contain cloud security incidents, including the isolation...	CLD-009 Cloud Incident Response	Incident Response / Cloud Security Team	View ↗
CLD-009-R005	Incident Recovery The organization shall recover from cloud security incidents, including the rest...	CLD-009 Cloud Incident Response	Incident Response / Cloud Security Team	View ↗
CLD-009-R006	Cloud Forensics The organization shall establish forensic capabilities for investigating cloud s...	CLD-009 Cloud Incident Response	Incident Response / Cloud Security Team	View ↗
CLD-009-R007	Incident Communication The organization shall communicate cloud security incidents to relevant stakehol...	CLD-009 Cloud Incident Response	Incident Response / Cloud Security Team	View ↗
CLD-009-R008	Incident Reporting The organization shall report on cloud security incidents, providing visibility...	CLD-009 Cloud Incident Response	Incident Response / Cloud Security Team	View ↗
CLD-009-R009	Incident Review The organization shall conduct periodic reviews of cloud incident response activ...	CLD-009 Cloud Incident Response	Incident Response / Cloud Security Team	View ↗
CLD-009-R010	Continuous Improvement The organization shall drive ongoing enhancement of cloud incident response thro...	CLD-009 Cloud Incident Response	Incident Response / Cloud Security Team	View ↗
CLD-010-R001	Portability Framework The organization shall establish a cloud data portability and interoperability f...	CLD-010 Cloud Data Portability & Inter...	Cloud Architecture / Data Governance Team	View ↗
CLD-010-R002	Data Export Management The organization shall export data from cloud environments in a secure and stand...	CLD-010 Cloud Data Portability & Inter...	Cloud Architecture / Data Governance Team	View ↗
CLD-010-R003	Secure Data Migration The organization shall securely migrate data between cloud environments, ensurin...	CLD-010 Cloud Data Portability & Inter...	Cloud Architecture / Data Governance Team	View ↗
CLD-010-R004	Interoperability Standards The organization shall define and adhere to interoperability standards that enab...	CLD-010 Cloud Data Portability & Inter...	Cloud Architecture / Data Governance Team	View ↗
CLD-010-R005	Exit Strategy Management The organization shall develop and maintain exit strategies for cloud service re...	CLD-010 Cloud Data Portability & Inter...	Cloud Architecture / Data Governance Team	View ↗
CLD-010-R006	Migration Validation The organization shall validate that data migrations have been completed success...	CLD-010 Cloud Data Portability & Inter...	Cloud Architecture / Data Governance Team	View ↗
CLD-010-R007	Portability Monitoring The organization shall monitor data portability and interoperability to ensure c...	CLD-010 Cloud Data Portability & Inter...	Cloud Architecture / Data Governance Team	View ↗
CLD-010-R008	Portability Reporting The organization shall report on data portability and interoperability, providin...	CLD-010 Cloud Data Portability & Inter...	Cloud Architecture / Data Governance Team	View ↗
CLD-010-R009	Portability Review The organization shall conduct periodic reviews of data portability and interope...	CLD-010 Cloud Data Portability & Inter...	Cloud Architecture / Data Governance Team	View ↗
CLD-010-R010	Continuous Improvement The organization shall drive ongoing enhancement of cloud data portability and i...	CLD-010 Cloud Data Portability & Inter...	Cloud Architecture / Data Governance Team	View ↗
CFG-001-R001	Configuration Baseline Framework The organization shall establish a secure configuration baseline framework that...	CFG-001 Secure Configuration Baseline	IT Operations / Security Engineering	View ↗
CFG-001-R002	Baseline Definition The organization shall define secure configuration baselines for all system type...	CFG-001 Secure Configuration Baseline	IT Operations / Security Engineering	View ↗
CFG-001-R003	Baseline Approval The organization shall approve secure configuration baselines, ensuring baseline...	CFG-001 Secure Configuration Baseline	IT Operations / Security Engineering	View ↗
CFG-001-R004	Baseline Documentation The organization shall maintain comprehensive documentation of secure configurat...	CFG-001 Secure Configuration Baseline	IT Operations / Security Engineering	View ↗
CFG-001-R005	Baseline Distribution The organization shall distribute secure configuration baselines to all relevant...	CFG-001 Secure Configuration Baseline	IT Operations / Security Engineering	View ↗
CFG-001-R006	Baseline Maintenance The organization shall maintain secure configuration baselines, ensuring baselin...	CFG-001 Secure Configuration Baseline	IT Operations / Security Engineering	View ↗
CFG-001-R007	Baseline Validation The organization shall validate that secure configuration baselines are effectiv...	CFG-001 Secure Configuration Baseline	IT Operations / Security Engineering	View ↗
CFG-001-R008	Baseline Reporting The organization shall report on secure configuration baselines, providing visib...	CFG-001 Secure Configuration Baseline	IT Operations / Security Engineering	View ↗
CFG-001-R009	Baseline Review The organization shall conduct periodic reviews of secure configuration baseline...	CFG-001 Secure Configuration Baseline	IT Operations / Security Engineering	View ↗
CFG-001-R010	Baseline Continuous Improvement The organization shall drive ongoing enhancement of secure configuration baselin...	CFG-001 Secure Configuration Baseline	IT Operations / Security Engineering	View ↗
CFG-002-R001	Compliance Monitoring Framework The organization shall establish a configuration compliance monitoring framework...	CFG-002 Configuration Compliance Monit...	Security Engineering / System Administration	View ↗
CFG-002-R002	Configuration Assessment The organization shall regularly assess system configurations to verify complian...	CFG-002 Configuration Compliance Monit...	Security Engineering / System Administration	View ↗
CFG-002-R003	Configuration Drift Detection The organization shall detect configuration drift where system configurations de...	CFG-002 Configuration Compliance Monit...	Security Engineering / System Administration	View ↗
CFG-002-R004	Compliance Validation The organization shall validate configuration compliance to ensure systems are p...	CFG-002 Configuration Compliance Monit...	Security Engineering / System Administration	View ↗
CFG-002-R005	Non-Compliance Identification The organization shall identify non-compliant configurations, including deviatio...	CFG-002 Configuration Compliance Monit...	Security Engineering / System Administration	View ↗
CFG-002-R006	Compliance Monitoring The organization shall continuously monitor configuration compliance to ensure c...	CFG-002 Configuration Compliance Monit...	Security Engineering / System Administration	View ↗
CFG-002-R007	Compliance Reporting The organization shall report on configuration compliance, providing visibility...	CFG-002 Configuration Compliance Monit...	Security Engineering / System Administration	View ↗
CFG-002-R008	Compliance Review The organization shall conduct periodic reviews of configuration compliance moni...	CFG-002 Configuration Compliance Monit...	Security Engineering / System Administration	View ↗
CFG-002-R009	Corrective Action Tracking The organization shall track corrective actions for non-compliant configurations...	CFG-002 Configuration Compliance Monit...	Security Engineering / System Administration	View ↗
CFG-002-R010	Continuous Improvement The organization shall drive ongoing enhancement of configuration compliance mon...	CFG-002 Configuration Compliance Monit...	Security Engineering / System Administration	View ↗
CFG-003-R001	Automation Framework The organization shall establish a configuration automation and deployment frame...	CFG-003 Configuration Automation & Dep...	Security Engineering / Security Operations	View ↗
CFG-003-R002	Automated Configuration Deployment The organization shall implement automated processes for deploying secure config...	CFG-003 Configuration Automation & Dep...	Security Engineering / Security Operations	View ↗
CFG-003-R003	Automated Configuration Enforcement The organization shall implement automated enforcement of secure configurations,...	CFG-003 Configuration Automation & Dep...	Security Engineering / Security Operations	View ↗
CFG-003-R004	Golden Image Management The organization shall manage golden images that serve as secure configuration t...	CFG-003 Configuration Automation & Dep...	Security Engineering / Security Operations	View ↗
CFG-003-R005	Configuration Provisioning The organization shall provision secure configurations to new systems and servic...	CFG-003 Configuration Automation & Dep...	Security Engineering / Security Operations	View ↗
CFG-003-R006	Automated Remediation The organization shall implement automated remediation of configuration issues,...	CFG-003 Configuration Automation & Dep...	Security Engineering / Security Operations	View ↗
CFG-003-R007	Automation Monitoring The organization shall monitor configuration automation to ensure automation pro...	CFG-003 Configuration Automation & Dep...	Security Engineering / Security Operations	View ↗
CFG-003-R008	Automation Reporting The organization shall report on configuration automation, providing visibility...	CFG-003 Configuration Automation & Dep...	Security Engineering / Security Operations	View ↗
CFG-003-R009	Automation Review The organization shall conduct periodic reviews of configuration automation and...	CFG-003 Configuration Automation & Dep...	Security Engineering / Security Operations	View ↗
CFG-003-R010	Automation Continuous Improvement The organization shall drive ongoing enhancement of configuration automation thr...	CFG-003 Configuration Automation & Dep...	Security Engineering / Security Operations	View ↗
CFG-004-R001	Hardening Framework The organization shall establish a configuration hardening framework that define...	CFG-004 Configuration Hardening	DevOps / Platform Engineering	View ↗
CFG-004-R002	Hardening Standards The organization shall define hardening standards that specify the security meas...	CFG-004 Configuration Hardening	DevOps / Platform Engineering	View ↗
CFG-004-R003	Platform Hardening The organization shall implement hardening measures on all systems and platforms...	CFG-004 Configuration Hardening	DevOps / Platform Engineering	View ↗
CFG-004-R004	Hardening Validation The organization shall validate that hardening measures have been applied correc...	CFG-004 Configuration Hardening	DevOps / Platform Engineering	View ↗
CFG-004-R005	Hardening Maintenance The organization shall maintain hardening measures, ensuring systems remain hard...	CFG-004 Configuration Hardening	DevOps / Platform Engineering	View ↗
CFG-004-R006	Hardening Monitoring The organization shall monitor hardening measures to ensure hardening status is...	CFG-004 Configuration Hardening	DevOps / Platform Engineering	View ↗
CFG-004-R007	Hardening Exception Management The organization shall manage exceptions to hardening requirements, ensuring dev...	CFG-004 Configuration Hardening	DevOps / Platform Engineering	View ↗
CFG-004-R008	Hardening Reporting The organization shall report on hardening activities, providing visibility into...	CFG-004 Configuration Hardening	DevOps / Platform Engineering	View ↗
CFG-004-R009	Hardening Review The organization shall conduct periodic reviews of hardening activities to ensur...	CFG-004 Configuration Hardening	DevOps / Platform Engineering	View ↗
CFG-004-R010	Hardening Continuous Improvement The organization shall drive ongoing enhancement of hardening through a continuo...	CFG-004 Configuration Hardening	DevOps / Platform Engineering	View ↗
CFG-005-R001	Configuration Change Framework The organization shall establish a configuration change control framework that d...	CFG-005 Configuration Change Control	System Administration / Security Engineering	View ↗
CFG-005-R002	Change Request Management The organization shall manage change requests for configuration changes, ensurin...	CFG-005 Configuration Change Control	System Administration / Security Engineering	View ↗
CFG-005-R003	Change Impact Assessment The organization shall conduct impact assessments for proposed configuration cha...	CFG-005 Configuration Change Control	System Administration / Security Engineering	View ↗
CFG-005-R004	Change Approval The organization shall approve configuration changes, ensuring changes are autho...	CFG-005 Configuration Change Control	System Administration / Security Engineering	View ↗
CFG-005-R005	Configuration Implementation The organization shall implement approved configuration changes, ensuring change...	CFG-005 Configuration Change Control	System Administration / Security Engineering	View ↗
CFG-005-R006	Configuration Validation The organization shall validate that implemented configuration changes have been...	CFG-005 Configuration Change Control	System Administration / Security Engineering	View ↗
CFG-005-R007	Change Documentation The organization shall maintain comprehensive documentation of configuration cha...	CFG-005 Configuration Change Control	System Administration / Security Engineering	View ↗
CFG-005-R008	Change Monitoring The organization shall monitor configuration changes to ensure changes are imple...	CFG-005 Configuration Change Control	System Administration / Security Engineering	View ↗
CFG-005-R009	Change Review The organization shall conduct periodic reviews of configuration change control...	CFG-005 Configuration Change Control	System Administration / Security Engineering	View ↗
CFG-005-R010	Change Continuous Improvement The organization shall drive ongoing enhancement of configuration change control...	CFG-005 Configuration Change Control	System Administration / Security Engineering	View ↗
CFG-006-R001	Exception Management Framework The organization shall establish a configuration exception management framework...	CFG-006 Configuration Exception Manage...	IT Operations / Change Management	View ↗
CFG-006-R002	Exception Request The organization shall submit exception requests for deviations from configurati...	CFG-006 Configuration Exception Manage...	IT Operations / Change Management	View ↗
CFG-006-R003	Risk Assessment The organization shall conduct risk assessments for exception requests to evalua...	CFG-006 Configuration Exception Manage...	IT Operations / Change Management	View ↗
CFG-006-R004	Exception Approval The organization shall approve exception requests, ensuring exceptions are autho...	CFG-006 Configuration Exception Manage...	IT Operations / Change Management	View ↗
CFG-006-R005	Exception Documentation The organization shall maintain comprehensive documentation of exception request...	CFG-006 Configuration Exception Manage...	IT Operations / Change Management	View ↗
CFG-006-R006	Exception Monitoring The organization shall monitor approved exceptions, including monitoring of exce...	CFG-006 Configuration Exception Manage...	IT Operations / Change Management	View ↗
CFG-006-R007	Exception Renewal The organization shall renew exceptions before expiration, ensuring exceptions r...	CFG-006 Configuration Exception Manage...	IT Operations / Change Management	View ↗
CFG-006-R008	Exception Reporting The organization shall report on exception management, providing visibility into...	CFG-006 Configuration Exception Manage...	IT Operations / Change Management	View ↗
CFG-006-R009	Exception Review The organization shall conduct periodic reviews of exception management activiti...	CFG-006 Configuration Exception Manage...	IT Operations / Change Management	View ↗
CFG-006-R010	Exception Closure The organization shall close exceptions when they are no longer required, when c...	CFG-006 Configuration Exception Manage...	IT Operations / Change Management	View ↗
VUL-001-R001	Vulnerability Management Framework The organization shall establish a vulnerability management framework that defin...	VUL-001 Vulnerability Management Strat...	CISO / Vulnerability Management Team	View ↗
VUL-001-R002	Vulnerability Governance The organization shall establish governance structures for vulnerability managem...	VUL-001 Vulnerability Management Strat...	CISO / Vulnerability Management Team	View ↗
VUL-001-R003	Risk-Based Methodology The organization shall establish a risk-based methodology for vulnerability mana...	VUL-001 Vulnerability Management Strat...	CISO / Vulnerability Management Team	View ↗
VUL-001-R004	Roles & Responsibilities The organization shall clearly define and document the roles and responsibilitie...	VUL-001 Vulnerability Management Strat...	CISO / Vulnerability Management Team	View ↗
VUL-001-R005	Vulnerability Scope The organization shall define a documented scope for vulnerability management ac...	VUL-001 Vulnerability Management Strat...	CISO / Vulnerability Management Team	View ↗
VUL-001-R006	Program Monitoring The organization shall monitor vulnerability management activities to ensure the...	VUL-001 Vulnerability Management Strat...	CISO / Vulnerability Management Team	View ↗
VUL-001-R007	Program Reporting The organization shall report on vulnerability management, providing visibility...	VUL-001 Vulnerability Management Strat...	CISO / Vulnerability Management Team	View ↗
VUL-001-R008	Program Review The organization shall conduct periodic reviews of vulnerability management acti...	VUL-001 Vulnerability Management Strat...	CISO / Vulnerability Management Team	View ↗
VUL-001-R009	Exception Governance The organization shall establish governance processes for managing exceptions to...	VUL-001 Vulnerability Management Strat...	CISO / Vulnerability Management Team	View ↗
VUL-001-R010	Program Continuous Improvement The organization shall drive ongoing enhancement of vulnerability management thr...	VUL-001 Vulnerability Management Strat...	CISO / Vulnerability Management Team	View ↗
VUL-002-R001	Assessment Framework The organization shall establish a vulnerability assessment framework that defin...	VUL-002 Vulnerability Assessment & Sca...	Vulnerability Management / Security Engineering	View ↗
VUL-002-R002	Scan Planning The organization shall conduct formal planning for vulnerability scans, defining...	VUL-002 Vulnerability Assessment & Sca...	Vulnerability Management / Security Engineering	View ↗
VUL-002-R003	Scan Execution The organization shall execute vulnerability scans in accordance with approved s...	VUL-002 Vulnerability Assessment & Sca...	Vulnerability Management / Security Engineering	View ↗
VUL-002-R004	Vulnerability Identification The organization shall use vulnerability scans to identify vulnerabilities in sy...	VUL-002 Vulnerability Assessment & Sca...	Vulnerability Management / Security Engineering	View ↗
VUL-002-R005	Risk Prioritization The organization shall prioritize identified vulnerabilities based on their seve...	VUL-002 Vulnerability Assessment & Sca...	Vulnerability Management / Security Engineering	View ↗
VUL-002-R006	Scan Validation The organization shall validate vulnerability scan results to ensure their accur...	VUL-002 Vulnerability Assessment & Sca...	Vulnerability Management / Security Engineering	View ↗
VUL-002-R007	Scan Monitoring The organization shall monitor vulnerability scanning activities to ensure scans...	VUL-002 Vulnerability Assessment & Sca...	Vulnerability Management / Security Engineering	View ↗
VUL-002-R008	Assessment Reporting The organization shall report on vulnerability assessments, providing visibility...	VUL-002 Vulnerability Assessment & Sca...	Vulnerability Management / Security Engineering	View ↗
VUL-002-R009	Assessment Review The organization shall conduct periodic reviews of vulnerability assessment acti...	VUL-002 Vulnerability Assessment & Sca...	Vulnerability Management / Security Engineering	View ↗
VUL-002-R010	Assessment Continuous Improvement The organization shall drive ongoing enhancement of vulnerability assessment thr...	VUL-002 Vulnerability Assessment & Sca...	Vulnerability Management / Security Engineering	View ↗
VUL-003-R001	VUL-003 Remediation Framework	VUL-003 Vulnerability Prioritization	A security analyst validates a critical server vulnerability against the installed software version before opening a high-priority remediation ticket.	View ↗
VUL-003-R002	VUL-003 Vulnerability Triage	VUL-003 Vulnerability Prioritization	A security analyst validates a critical server vulnerability against the installed software version before opening a high-priority remediation ticket.	View ↗
VUL-003-R003	VUL-003 Remediation Planning	VUL-003 Vulnerability Prioritization	A security analyst validates a critical server vulnerability against the installed software version before opening a high-priority remediation ticket.	View ↗
VUL-003-R004	VUL-003 Remediation Implementation	VUL-003 Vulnerability Prioritization	A security analyst validates a critical server vulnerability against the installed software version before opening a high-priority remediation ticket.	View ↗
VUL-003-R005	VUL-003 Remediation Tracking	VUL-003 Vulnerability Prioritization	A security analyst validates a critical server vulnerability against the installed software version before opening a high-priority remediation ticket.	View ↗
VUL-003-R006	VUL-003 Verification Testing	VUL-003 Vulnerability Prioritization	A security analyst validates a critical server vulnerability against the installed software version before opening a high-priority remediation ticket.	View ↗
VUL-003-R007	VUL-003 Exception Governance	VUL-003 Vulnerability Prioritization	A security analyst validates a critical server vulnerability against the installed software version before opening a high-priority remediation ticket.	View ↗
VUL-003-R008	VUL-003 Remediation Reporting	VUL-003 Vulnerability Prioritization	A security analyst validates a critical server vulnerability against the installed software version before opening a high-priority remediation ticket.	View ↗
VUL-003-R009	VUL-003 Remediation Review	VUL-003 Vulnerability Prioritization	A security analyst validates a critical server vulnerability against the installed software version before opening a high-priority remediation ticket.	View ↗
VUL-003-R010	VUL-003 Remediation Continuous Improvement	VUL-003 Vulnerability Prioritization	A security analyst validates a critical server vulnerability against the installed software version before opening a high-priority remediation ticket.	View ↗
VUL-004-R001	VUL-004 Patch Management Framework	VUL-004 Vulnerability Intelligence	A critical internet-facing payment system vulnerability is prioritized ahead of a higher-scoring issue on an isolated test server.	View ↗
VUL-004-R002	VUL-004 Patch Identification	VUL-004 Vulnerability Intelligence	A critical internet-facing payment system vulnerability is prioritized ahead of a higher-scoring issue on an isolated test server.	View ↗
VUL-004-R003	VUL-004 Patch Assessment	VUL-004 Vulnerability Intelligence	A critical internet-facing payment system vulnerability is prioritized ahead of a higher-scoring issue on an isolated test server.	View ↗
VUL-004-R004	VUL-004 Patch Prioritization	VUL-004 Vulnerability Intelligence	A critical internet-facing payment system vulnerability is prioritized ahead of a higher-scoring issue on an isolated test server.	View ↗
VUL-004-R005	VUL-004 Patch Testing	VUL-004 Vulnerability Intelligence	A critical internet-facing payment system vulnerability is prioritized ahead of a higher-scoring issue on an isolated test server.	View ↗
VUL-004-R006	VUL-004 Patch Deployment	VUL-004 Vulnerability Intelligence	A critical internet-facing payment system vulnerability is prioritized ahead of a higher-scoring issue on an isolated test server.	View ↗
VUL-004-R007	VUL-004 Patch Compliance Monitoring	VUL-004 Vulnerability Intelligence	A critical internet-facing payment system vulnerability is prioritized ahead of a higher-scoring issue on an isolated test server.	View ↗
VUL-004-R008	VUL-004 Patch Reporting	VUL-004 Vulnerability Intelligence	A critical internet-facing payment system vulnerability is prioritized ahead of a higher-scoring issue on an isolated test server.	View ↗
VUL-004-R009	VUL-004 Patch Review	VUL-004 Vulnerability Intelligence	A critical internet-facing payment system vulnerability is prioritized ahead of a higher-scoring issue on an isolated test server.	View ↗
VUL-004-R010	VUL-004 Patch Continuous Improvement	VUL-004 Vulnerability Intelligence	A critical internet-facing payment system vulnerability is prioritized ahead of a higher-scoring issue on an isolated test server.	View ↗
VUL-005-R001	VUL-005 Vulnerability Reporting Framework	VUL-005 Patch Management	High-risk operating system vulnerabilities are patched through a controlled change process and verified by a follow-up scan.	View ↗
VUL-005-R002	VUL-005 Reporting Content	VUL-005 Patch Management	High-risk operating system vulnerabilities are patched through a controlled change process and verified by a follow-up scan.	View ↗
VUL-005-R003	VUL-005 Reporting Frequency	VUL-005 Patch Management	High-risk operating system vulnerabilities are patched through a controlled change process and verified by a follow-up scan.	View ↗
VUL-005-R004	VUL-005 Management Reporting	VUL-005 Patch Management	High-risk operating system vulnerabilities are patched through a controlled change process and verified by a follow-up scan.	View ↗
VUL-005-R005	VUL-005 Executive Reporting	VUL-005 Patch Management	High-risk operating system vulnerabilities are patched through a controlled change process and verified by a follow-up scan.	View ↗
VUL-005-R006	VUL-005 Vulnerability Metrics	VUL-005 Patch Management	High-risk operating system vulnerabilities are patched through a controlled change process and verified by a follow-up scan.	View ↗
VUL-005-R007	VUL-005 Report Validation	VUL-005 Patch Management	High-risk operating system vulnerabilities are patched through a controlled change process and verified by a follow-up scan.	View ↗
VUL-005-R008	VUL-005 Reporting Review	VUL-005 Patch Management	High-risk operating system vulnerabilities are patched through a controlled change process and verified by a follow-up scan.	View ↗
VUL-005-R009	VUL-005 Reporting Improvement	VUL-005 Patch Management	High-risk operating system vulnerabilities are patched through a controlled change process and verified by a follow-up scan.	View ↗
VUL-005-R010	VUL-005 Risk Communication	VUL-005 Patch Management	High-risk operating system vulnerabilities are patched through a controlled change process and verified by a follow-up scan.	View ↗
VUL-006-R001	Reporting Framework The organization shall establish a vulnerability reporting and SLA management fr...	VUL-006 Vulnerability Reporting & SLA...	Vulnerability Management / CISO	View ↗
VUL-006-R002	Remediation SLA Definition The organization shall define remediation SLAs that establish timeframes for rem...	VUL-006 Vulnerability Reporting & SLA...	Vulnerability Management / CISO	View ↗
VUL-006-R003	SLA Monitoring The organization shall monitor remediation SLAs to ensure vulnerabilities are re...	VUL-006 Vulnerability Reporting & SLA...	Vulnerability Management / CISO	View ↗
VUL-006-R004	Vulnerability Metrics The organization shall define and track vulnerability metrics that provide insig...	VUL-006 Vulnerability Reporting & SLA...	Vulnerability Management / CISO	View ↗
VUL-006-R005	Executive Reporting The organization shall provide executive leadership and the board with regular r...	VUL-006 Vulnerability Reporting & SLA...	Vulnerability Management / CISO	View ↗
VUL-006-R006	Operational Reporting The organization shall provide operational teams with regular reports on vulnera...	VUL-006 Vulnerability Reporting & SLA...	Vulnerability Management / CISO	View ↗
VUL-006-R007	KPI & Trend Analysis The organization shall conduct KPI and trend analysis to identify patterns, impr...	VUL-006 Vulnerability Reporting & SLA...	Vulnerability Management / CISO	View ↗
VUL-006-R008	Reporting Review The organization shall conduct periodic reviews of vulnerability reporting and S...	VUL-006 Vulnerability Reporting & SLA...	Vulnerability Management / CISO	View ↗
VUL-006-R009	Escalation Management The organization shall establish escalation processes for vulnerabilities that e...	VUL-006 Vulnerability Reporting & SLA...	Vulnerability Management / CISO	View ↗
VUL-006-R010	Reporting Continuous Improvement The organization shall establish a continuous improvement process for vulnerabil...	VUL-006 Vulnerability Reporting & SLA...	Vulnerability Management / CISO	View ↗
VUL-007-R001	Exception Management Framework The organization shall establish a vulnerability exception management framework...	VUL-007 Vulnerability Exception Manage...	Vulnerability Management / Threat Intelligence	View ↗
VUL-007-R002	Exception Request The organization shall submit exception requests for vulnerabilities that cannot...	VUL-007 Vulnerability Exception Manage...	Vulnerability Management / Threat Intelligence	View ↗
VUL-007-R003	Risk Assessment The organization shall conduct risk assessments for vulnerability exception requ...	VUL-007 Vulnerability Exception Manage...	Vulnerability Management / Threat Intelligence	View ↗
VUL-007-R004	Exception Approval The organization shall approve vulnerability exception requests, ensuring except...	VUL-007 Vulnerability Exception Manage...	Vulnerability Management / Threat Intelligence	View ↗
VUL-007-R005	Compensating Controls The organization shall require implementation of compensating controls for appro...	VUL-007 Vulnerability Exception Manage...	Vulnerability Management / Threat Intelligence	View ↗
VUL-007-R006	Exception Monitoring The organization shall monitor approved vulnerability exceptions, including comp...	VUL-007 Vulnerability Exception Manage...	Vulnerability Management / Threat Intelligence	View ↗
VUL-007-R007	Exception Renewal The organization shall renew vulnerability exceptions before expiration, ensurin...	VUL-007 Vulnerability Exception Manage...	Vulnerability Management / Threat Intelligence	View ↗
VUL-007-R008	Exception Reporting The organization shall report on vulnerability exception management, providing v...	VUL-007 Vulnerability Exception Manage...	Vulnerability Management / Threat Intelligence	View ↗
VUL-007-R009	Exception Review The organization shall conduct periodic reviews of vulnerability exception manag...	VUL-007 Vulnerability Exception Manage...	Vulnerability Management / Threat Intelligence	View ↗
VUL-007-R010	Exception Closure The organization shall close vulnerability exceptions when vulnerabilities are r...	VUL-007 Vulnerability Exception Manage...	Vulnerability Management / Threat Intelligence	View ↗
VUL-008-R001	Exposure Analytics Framework The organization shall establish an exposure analytics framework that defines th...	VUL-008 Exposure Analytics	Risk & Compliance / System Owner	View ↗
VUL-008-R002	Exposure Data Collection The organization shall collect exposure data from multiple sources, including vu...	VUL-008 Exposure Analytics	Risk & Compliance / System Owner	View ↗
VUL-008-R003	Risk Trend Analysis The organization shall conduct risk trend analysis to identify patterns, changes...	VUL-008 Exposure Analytics	Risk & Compliance / System Owner	View ↗
VUL-008-R004	Attack Surface Analysis The organization shall conduct attack surface analysis to identify and assess ex...	VUL-008 Exposure Analytics	Risk & Compliance / System Owner	View ↗
VUL-008-R005	Exposure Scoring The organization shall apply exposure scoring methodologies to quantify and comp...	VUL-008 Exposure Analytics	Risk & Compliance / System Owner	View ↗
VUL-008-R006	Executive Dashboards The organization shall develop and maintain executive dashboards that provide le...	VUL-008 Exposure Analytics	Risk & Compliance / System Owner	View ↗
VUL-008-R007	Analytics Reporting The organization shall report on exposure analytics, providing visibility into e...	VUL-008 Exposure Analytics	Risk & Compliance / System Owner	View ↗
VUL-008-R008	Analytics Review The organization shall conduct periodic reviews of exposure analytics activities...	VUL-008 Exposure Analytics	Risk & Compliance / System Owner	View ↗
VUL-008-R009	Predictive Analysis The organization shall establish predictive analysis capabilities to forecast fu...	VUL-008 Exposure Analytics	Risk & Compliance / System Owner	View ↗
VUL-008-R010	Analytics Continuous Improvement The organization shall establish a continuous improvement process for exposure a...	VUL-008 Exposure Analytics	Risk & Compliance / System Owner	View ↗
APP-001-R001	Application Security Governance The organization shall establish an application security governance program that...	APP-001 Application Security Program	CISO / Application Security Team	View ↗
APP-001-R002	Security Program Scope The organization shall define a documented scope for the application security pr...	APP-001 Application Security Program	CISO / Application Security Team	View ↗
APP-001-R003	Roles & Responsibilities The organization shall clearly define and document the roles and responsibilitie...	APP-001 Application Security Program	CISO / Application Security Team	View ↗
APP-001-R004	Security Policies The organization shall establish application security policies that define the s...	APP-001 Application Security Program	CISO / Application Security Team	View ↗
APP-001-R005	Security Metrics The organization shall define and track application security metrics that provid...	APP-001 Application Security Program	CISO / Application Security Team	View ↗
APP-001-R006	Program Monitoring The organization shall monitor application security program activities to ensure...	APP-001 Application Security Program	CISO / Application Security Team	View ↗
APP-001-R007	Executive Reporting The organization shall provide executive leadership and the board with regular r...	APP-001 Application Security Program	CISO / Application Security Team	View ↗
APP-001-R008	Program Review The organization shall conduct periodic reviews of application security program...	APP-001 Application Security Program	CISO / Application Security Team	View ↗
APP-001-R009	Exception Management The organization shall manage exceptions to application security policies and re...	APP-001 Application Security Program	CISO / Application Security Team	View ↗
APP-001-R010	Continuous Improvement The organization shall establish a continuous improvement process for the applic...	APP-001 Application Security Program	CISO / Application Security Team	View ↗
APP-002-R001	Inventory Framework The organization shall establish an application inventory framework that defines...	APP-002 Application Inventory	Application Portfolio Management / Application Security	View ↗
APP-002-R002	Application Registration The organization shall register all applications in the application inventory, i...	APP-002 Application Inventory	Application Portfolio Management / Application Security	View ↗
APP-002-R003	Application Classification The organization shall apply classification schemas to applications to enable co...	APP-002 Application Inventory	Application Portfolio Management / Application Security	View ↗
APP-002-R004	Ownership Assignment The organization shall assign explicit ownership for each application in the inv...	APP-002 Application Inventory	Application Portfolio Management / Application Security	View ↗
APP-002-R005	Lifecycle Status The organization shall maintain lifecycle status information for each applicatio...	APP-002 Application Inventory	Application Portfolio Management / Application Security	View ↗
APP-002-R006	Inventory Validation The organization shall validate the application inventory to ensure its accuracy...	APP-002 Application Inventory	Application Portfolio Management / Application Security	View ↗
APP-002-R007	Inventory Monitoring The organization shall monitor the application inventory to ensure inventory dat...	APP-002 Application Inventory	Application Portfolio Management / Application Security	View ↗
APP-002-R008	Inventory Reporting The organization shall report on the application inventory, providing visibility...	APP-002 Application Inventory	Application Portfolio Management / Application Security	View ↗
APP-002-R009	Inventory Review The organization shall conduct periodic reviews of application inventory activit...	APP-002 Application Inventory	Application Portfolio Management / Application Security	View ↗
APP-002-R010	Continuous Improvement The organization shall establish a continuous improvement process for applicatio...	APP-002 Application Inventory	Application Portfolio Management / Application Security	View ↗
APP-003-R001	SSDLC Framework The organization shall establish a Secure Software Development Lifecycle framewo...	APP-003 Secure Software Development Li...	Application Security / Engineering	View ↗
APP-003-R002	Security Requirements The organization shall define security requirements for all software development...	APP-003 Secure Software Development Li...	Application Security / Engineering	View ↗
APP-003-R003	Secure Design Review The organization shall conduct secure design reviews for software development pr...	APP-003 Secure Software Development Li...	Application Security / Engineering	View ↗
APP-003-R004	Threat Modeling The organization shall conduct threat modeling for software development projects...	APP-003 Secure Software Development Li...	Application Security / Engineering	View ↗
APP-003-R005	Secure Development The organization shall implement secure development practices throughout the sof...	APP-003 Secure Software Development Li...	Application Security / Engineering	View ↗
APP-003-R006	Security Verification The organization shall conduct security verification activities during the devel...	APP-003 Secure Software Development Li...	Application Security / Engineering	View ↗
APP-003-R007	Security Validation The organization shall conduct security validation activities before application...	APP-003 Secure Software Development Li...	Application Security / Engineering	View ↗
APP-003-R008	Security Acceptance The organization shall establish security acceptance criteria for application re...	APP-003 Secure Software Development Li...	Application Security / Engineering	View ↗
APP-003-R009	SDLC Review The organization shall conduct periodic reviews of SSDLC activities to ensure th...	APP-003 Secure Software Development Li...	Application Security / Engineering	View ↗
APP-003-R010	Continuous Improvement The organization shall establish a continuous improvement process for the SSDLC,...	APP-003 Secure Software Development Li...	Application Security / Engineering	View ↗
APP-004-R001	Secure Coding Standards The organization shall define secure coding standards that specify the security...	APP-004 Secure Coding Practices	Engineering / Application Security	View ↗
APP-004-R002	Developer Training The organization shall provide secure coding training to all developers to ensur...	APP-004 Secure Coding Practices	Engineering / Application Security	View ↗
APP-004-R003	Code Review The organization shall conduct security-focused code reviews for all software de...	APP-004 Secure Coding Practices	Engineering / Application Security	View ↗
APP-004-R004	Static Analysis The organization shall implement static analysis tools and processes to automati...	APP-004 Secure Coding Practices	Engineering / Application Security	View ↗
APP-004-R005	Coding Exceptions The organization shall manage exceptions to secure coding standards, ensuring de...	APP-004 Secure Coding Practices	Engineering / Application Security	View ↗
APP-004-R006	Coding Validation The organization shall validate that secure coding practices have been followed...	APP-004 Secure Coding Practices	Engineering / Application Security	View ↗
APP-004-R007	Coding Metrics The organization shall define and track secure coding metrics that provide insig...	APP-004 Secure Coding Practices	Engineering / Application Security	View ↗
APP-004-R008	Coding Reporting The organization shall report on secure coding activities, providing visibility...	APP-004 Secure Coding Practices	Engineering / Application Security	View ↗
APP-004-R009	Coding Review The organization shall conduct periodic reviews of secure coding activities to e...	APP-004 Secure Coding Practices	Engineering / Application Security	View ↗
APP-004-R010	Continuous Improvement The organization shall establish a continuous improvement process for secure cod...	APP-004 Secure Coding Practices	Engineering / Application Security	View ↗
APP-005-R001	Security Testing Framework The organization shall establish an application security testing framework that...	APP-005 Application Security Testing	Application Security / QA	View ↗
APP-005-R002	SAST The organization shall implement Static Application Security Testing capabilitie...	APP-005 Application Security Testing	Application Security / QA	View ↗
APP-005-R003	DAST The organization shall implement Dynamic Application Security Testing capabiliti...	APP-005 Application Security Testing	Application Security / QA	View ↗
APP-005-R004	Interactive Testing (IAST) The organization shall implement Interactive Application Security Testing capabi...	APP-005 Application Security Testing	Application Security / QA	View ↗
APP-005-R005	Penetration Testing The organization shall conduct penetration testing of applications to identify v...	APP-005 Application Security Testing	Application Security / QA	View ↗
APP-005-R006	Vulnerability Validation The organization shall validate application security testing results to ensure t...	APP-005 Application Security Testing	Application Security / QA	View ↗
APP-005-R007	Test Reporting The organization shall report on application security testing, providing visibil...	APP-005 Application Security Testing	Application Security / QA	View ↗
APP-005-R008	Test Review The organization shall conduct periodic reviews of application security testing...	APP-005 Application Security Testing	Application Security / QA	View ↗
APP-005-R009	Remediation Verification The organization shall verify that identified vulnerabilities have been properly...	APP-005 Application Security Testing	Application Security / QA	View ↗
APP-005-R010	Continuous Improvement The organization shall establish a continuous improvement process for applicatio...	APP-005 Application Security Testing	Application Security / QA	View ↗
APP-006-R001	DevSecOps Framework The organization shall establish a DevSecOps framework that defines the structur...	APP-006 DevSecOps	DevSecOps / Platform Engineering	View ↗
APP-006-R002	CI/CD Security The organization shall implement security controls within CI/CD pipelines to ens...	APP-006 DevSecOps	DevSecOps / Platform Engineering	View ↗
APP-006-R003	Pipeline Security The organization shall secure CI/CD pipelines against unauthorized access, tampe...	APP-006 DevSecOps	DevSecOps / Platform Engineering	View ↗
APP-006-R004	Build Security The organization shall implement security controls for the build process, ensuri...	APP-006 DevSecOps	DevSecOps / Platform Engineering	View ↗
APP-006-R005	Artifact Security The organization shall implement security controls for build artifacts, includin...	APP-006 DevSecOps	DevSecOps / Platform Engineering	View ↗
APP-006-R006	Infrastructure as Code Security The organization shall implement security controls for Infrastructure as Code, e...	APP-006 DevSecOps	DevSecOps / Platform Engineering	View ↗
APP-006-R007	Pipeline Monitoring The organization shall monitor DevSecOps pipelines to ensure security controls a...	APP-006 DevSecOps	DevSecOps / Platform Engineering	View ↗
APP-006-R008	DevSecOps Reporting The organization shall report on DevSecOps, providing visibility into pipeline s...	APP-006 DevSecOps	DevSecOps / Platform Engineering	View ↗
APP-006-R009	Pipeline Review The organization shall conduct periodic reviews of DevSecOps activities to ensur...	APP-006 DevSecOps	DevSecOps / Platform Engineering	View ↗
APP-006-R010	Continuous Improvement The organization shall establish a continuous improvement process for DevSecOps,...	APP-006 DevSecOps	DevSecOps / Platform Engineering	View ↗
APP-007-R001	Supply Chain Framework The organization shall establish a software supply chain security framework that...	APP-007 Software Supply Chain Security	Application Security / DevSecOps	View ↗
APP-007-R002	SBOM Management The organization shall manage Software Bills of Materials for all applications a...	APP-007 Software Supply Chain Security	Application Security / DevSecOps	View ↗
APP-007-R003	Third-Party Component Management The organization shall manage third-party software components, ensuring componen...	APP-007 Software Supply Chain Security	Application Security / DevSecOps	View ↗
APP-007-R004	Open Source Security The organization shall manage open source software security, including vulnerabi...	APP-007 Software Supply Chain Security	Application Security / DevSecOps	View ↗
APP-007-R005	Dependency Management The organization shall manage software dependencies, including identification, t...	APP-007 Software Supply Chain Security	Application Security / DevSecOps	View ↗
APP-007-R006	Component Verification The organization shall verify the integrity and authenticity of software compone...	APP-007 Software Supply Chain Security	Application Security / DevSecOps	View ↗
APP-007-R007	Supply Chain Monitoring The organization shall monitor software supply chain security to identify vulner...	APP-007 Software Supply Chain Security	Application Security / DevSecOps	View ↗
APP-007-R008	Supply Chain Reporting The organization shall report on software supply chain security, providing visib...	APP-007 Software Supply Chain Security	Application Security / DevSecOps	View ↗
APP-007-R009	Supply Chain Review The organization shall conduct periodic reviews of software supply chain securit...	APP-007 Software Supply Chain Security	Application Security / DevSecOps	View ↗
APP-007-R010	Continuous Improvement The organization shall establish a continuous improvement process for software s...	APP-007 Software Supply Chain Security	Application Security / DevSecOps	View ↗
APP-008-R001	API Security Framework The organization shall establish an API security framework that defines the stru...	APP-008 API Security	API Security / Application Engineering	View ↗
APP-008-R002	API Authentication The organization shall implement authentication controls for all APIs, ensuring...	APP-008 API Security	API Security / Application Engineering	View ↗
APP-008-R003	API Authorization The organization shall implement authorization controls for all APIs, ensuring A...	APP-008 API Security	API Security / Application Engineering	View ↗
APP-008-R004	API Input Validation The organization shall implement input validation controls for all APIs to preve...	APP-008 API Security	API Security / Application Engineering	View ↗
APP-008-R005	API Rate Limiting The organization shall implement rate limiting controls for APIs to prevent deni...	APP-008 API Security	API Security / Application Engineering	View ↗
APP-008-R006	API Monitoring The organization shall monitor API activities to detect security incidents, perf...	APP-008 API Security	API Security / Application Engineering	View ↗
APP-008-R007	API Security Testing The organization shall conduct security testing of APIs to identify vulnerabilit...	APP-008 API Security	API Security / Application Engineering	View ↗
APP-008-R008	API Reporting The organization shall report on API security, providing visibility into API sta...	APP-008 API Security	API Security / Application Engineering	View ↗
APP-008-R009	API Review The organization shall conduct periodic reviews of API security activities to en...	APP-008 API Security	API Security / Application Engineering	View ↗
APP-008-R010	Continuous Improvement The organization shall establish a continuous improvement process for API securi...	APP-008 API Security	API Security / Application Engineering	View ↗
APP-009-R001	Secrets Governance The organization shall establish a secrets governance program that defines the s...	APP-009 Secrets Management	Application Security / Platform Engineering	View ↗
APP-009-R002	Secret Inventory The organization shall maintain a comprehensive inventory of all secrets used in...	APP-009 Secrets Management	Application Security / Platform Engineering	View ↗
APP-009-R003	Secure Storage The organization shall implement secure storage for secrets, ensuring secrets ar...	APP-009 Secrets Management	Application Security / Platform Engineering	View ↗
APP-009-R004	Secret Rotation The organization shall rotate secrets at defined intervals and in response to sp...	APP-009 Secrets Management	Application Security / Platform Engineering	View ↗
APP-009-R005	Secret Distribution The organization shall distribute secrets securely to authorized consumers, ensu...	APP-009 Secrets Management	Application Security / Platform Engineering	View ↗
APP-009-R006	Secret Monitoring The organization shall monitor secrets to detect unauthorized access, compromise...	APP-009 Secrets Management	Application Security / Platform Engineering	View ↗
APP-009-R007	Secret Audit The organization shall maintain comprehensive audit logs of secret activities, i...	APP-009 Secrets Management	Application Security / Platform Engineering	View ↗
APP-009-R008	Secret Reporting The organization shall report on secrets management, providing visibility into s...	APP-009 Secrets Management	Application Security / Platform Engineering	View ↗
APP-009-R009	Secret Review The organization shall conduct periodic reviews of secrets management activities...	APP-009 Secrets Management	Application Security / Platform Engineering	View ↗
APP-009-R010	Continuous Improvement The organization shall establish a continuous improvement process for secrets ma...	APP-009 Secrets Management	Application Security / Platform Engineering	View ↗
APP-010-R001	Release Security Framework The organization shall establish a software release and deployment security fram...	APP-010 Software Release & Deployment...	Product Management / Application Security / Risk Owner	View ↗
APP-010-R002	Release Approval The organization shall approve software releases, ensuring releases are authoriz...	APP-010 Software Release & Deployment...	Product Management / Application Security / Risk Owner	View ↗
APP-010-R003	Deployment Validation The organization shall validate that software deployments have been completed su...	APP-010 Software Release & Deployment...	Product Management / Application Security / Risk Owner	View ↗
APP-010-R004	Deployment Integrity The organization shall implement controls to ensure the integrity of software de...	APP-010 Software Release & Deployment...	Product Management / Application Security / Risk Owner	View ↗
APP-010-R005	Rollback Management The organization shall roll back software deployments in the event of security i...	APP-010 Software Release & Deployment...	Product Management / Application Security / Risk Owner	View ↗
APP-010-R006	Production Verification The organization shall conduct security verification of software in production e...	APP-010 Software Release & Deployment...	Product Management / Application Security / Risk Owner	View ↗
APP-010-R007	Deployment Monitoring The organization shall monitor software deployments to detect security issues, d...	APP-010 Software Release & Deployment...	Product Management / Application Security / Risk Owner	View ↗
APP-010-R008	Deployment Reporting The organization shall report on software release and deployment security, provi...	APP-010 Software Release & Deployment...	Product Management / Application Security / Risk Owner	View ↗
APP-010-R009	Deployment Review The organization shall conduct periodic reviews of software release and deployme...	APP-010 Software Release & Deployment...	Product Management / Application Security / Risk Owner	View ↗
APP-010-R010	Continuous Improvement The organization shall establish a continuous improvement process for software r...	APP-010 Software Release & Deployment...	Product Management / Application Security / Risk Owner	View ↗
APP-011-R001	Incident Response Framework The organization shall establish an application security incident response frame...	APP-011 Application Security Incident...	Product Management / Application Security / Risk Owner	View ↗
APP-011-R002	Application Incident Detection The organization shall detect security incidents in applications using monitorin...	APP-011 Application Security Incident...	Product Management / Application Security / Risk Owner	View ↗
APP-011-R003	Incident Investigation The organization shall investigate application security incidents, including col...	APP-011 Application Security Incident...	Product Management / Application Security / Risk Owner	View ↗
APP-011-R004	Containment The organization shall contain application security incidents, including isolati...	APP-011 Application Security Incident...	Product Management / Application Security / Risk Owner	View ↗
APP-011-R005	Recovery The organization shall recover from application security incidents, including re...	APP-011 Application Security Incident...	Product Management / Application Security / Risk Owner	View ↗
APP-011-R006	Root Cause Analysis The organization shall conduct root cause analysis for application security inci...	APP-011 Application Security Incident...	Product Management / Application Security / Risk Owner	View ↗
APP-011-R007	Incident Reporting The organization shall report on application security incidents, providing visib...	APP-011 Application Security Incident...	Product Management / Application Security / Risk Owner	View ↗
APP-011-R008	Lessons Learned The organization shall capture and integrate lessons learned from application se...	APP-011 Application Security Incident...	Product Management / Application Security / Risk Owner	View ↗
APP-011-R009	Incident Review The organization shall conduct periodic reviews of application security incident...	APP-011 Application Security Incident...	Product Management / Application Security / Risk Owner	View ↗
APP-011-R010	Continuous Improvement The organization shall establish a continuous improvement process for applicatio...	APP-011 Application Security Incident...	Product Management / Application Security / Risk Owner	View ↗
APP-012-R001	Risk Assessment Framework The organization shall establish an application risk assessment framework that d...	APP-012 Application Risk Assessment	Product Management / Application Security / Risk Owner	View ↗
APP-012-R002	Risk Identification The organization shall identify security risks associated with applications, inc...	APP-012 Application Risk Assessment	Product Management / Application Security / Risk Owner	View ↗
APP-012-R003	Threat Assessment The organization shall conduct threat assessments for applications to identify p...	APP-012 Application Risk Assessment	Product Management / Application Security / Risk Owner	View ↗
APP-012-R004	Business Impact Assessment The organization shall conduct business impact assessments for application risks...	APP-012 Application Risk Assessment	Product Management / Application Security / Risk Owner	View ↗
APP-012-R005	Risk Scoring The organization shall apply consistent risk scoring methodologies to quantify a...	APP-012 Application Risk Assessment	Product Management / Application Security / Risk Owner	View ↗
APP-012-R006	Risk Treatment The organization shall define and implement risk treatment strategies for applic...	APP-012 Application Risk Assessment	Product Management / Application Security / Risk Owner	View ↗
APP-012-R007	Risk Monitoring The organization shall monitor application security risks to ensure risks are tr...	APP-012 Application Risk Assessment	Product Management / Application Security / Risk Owner	View ↗
APP-012-R008	Risk Reporting The organization shall report on application risk assessment, providing visibili...	APP-012 Application Risk Assessment	Product Management / Application Security / Risk Owner	View ↗
APP-012-R009	Risk Review The organization shall conduct periodic reviews of application risk assessment a...	APP-012 Application Risk Assessment	Product Management / Application Security / Risk Owner	View ↗
APP-012-R010	Continuous Improvement The organization shall establish a continuous improvement process for applicatio...	APP-012 Application Risk Assessment	Product Management / Application Security / Risk Owner	View ↗
ARC-001-R001	Architecture Framework The organization shall establish a security architecture framework that defines...	ARC-001 Security Architecture Framewor...	Security Architecture, CISO, Enterprise Architecture	View ↗
ARC-001-R002	Security Principles The organization shall define security architecture principles that guide the de...	ARC-001 Security Architecture Framewor...	Security Architecture, CISO, Enterprise Architecture	View ↗
ARC-001-R003	Reference Architecture The organization shall develop a security reference architecture that provides a...	ARC-001 Security Architecture Framewor...	Security Architecture, CISO, Enterprise Architecture	View ↗
ARC-001-R004	Security Standards The organization shall define security standards that specify the technical requ...	ARC-001 Security Architecture Framewor...	Security Architecture, CISO, Enterprise Architecture	View ↗
ARC-001-R005	Security Patterns The organization shall develop a library of security patterns that provide reusa...	ARC-001 Security Architecture Framewor...	Security Architecture, CISO, Enterprise Architecture	View ↗
ARC-001-R006	Technology Roadmap The organization shall develop a security technology roadmap that outlines the p...	ARC-001 Security Architecture Framewor...	Security Architecture, CISO, Enterprise Architecture	View ↗
ARC-001-R007	Framework Governance The organization shall establish governance structures for the security architec...	ARC-001 Security Architecture Framewor...	Security Architecture, CISO, Enterprise Architecture	View ↗
ARC-001-R008	Framework Reporting The organization shall report on the security architecture framework, providing...	ARC-001 Security Architecture Framewor...	Security Architecture, CISO, Enterprise Architecture	View ↗
ARC-001-R009	Framework Review The organization shall conduct periodic reviews of the security architecture fra...	ARC-001 Security Architecture Framewor...	Security Architecture, CISO, Enterprise Architecture	View ↗
ARC-001-R010	Continuous Improvement The organization shall establish a continuous improvement process for the securi...	ARC-001 Security Architecture Framewor...	Security Architecture, CISO, Enterprise Architecture	View ↗
ARC-002-R001	Governance Framework The organization shall establish an architecture governance framework that defin...	ARC-002 Architecture Governance	Architecture Review Board, Security Architecture, CISO, Technology Leadership	View ↗
ARC-002-R002	Architecture Approval The organization shall approve security architecture designs and changes, ensuri...	ARC-002 Architecture Governance	Architecture Review Board, Security Architecture, CISO, Technology Leadership	View ↗
ARC-002-R003	Governance Roles & Responsibilities The organization shall clearly define and document the roles and responsibilitie...	ARC-002 Architecture Governance	Architecture Review Board, Security Architecture, CISO, Technology Leadership	View ↗
ARC-002-R004	Architecture Decision Management The organization shall manage architecture decisions, including the documentatio...	ARC-002 Architecture Governance	Architecture Review Board, Security Architecture, CISO, Technology Leadership	View ↗
ARC-002-R005	Architecture Exception Management The organization shall manage exceptions to architecture standards and approved...	ARC-002 Architecture Governance	Architecture Review Board, Security Architecture, CISO, Technology Leadership	View ↗
ARC-002-R006	Governance Monitoring The organization shall monitor architecture governance to ensure governance cont...	ARC-002 Architecture Governance	Architecture Review Board, Security Architecture, CISO, Technology Leadership	View ↗
ARC-002-R007	Governance Reporting The organization shall report on architecture governance, providing visibility i...	ARC-002 Architecture Governance	Architecture Review Board, Security Architecture, CISO, Technology Leadership	View ↗
ARC-002-R008	Governance Review The organization shall conduct periodic reviews of architecture governance activ...	ARC-002 Architecture Governance	Architecture Review Board, Security Architecture, CISO, Technology Leadership	View ↗
ARC-002-R009	Compliance Verification The organization shall verify compliance with architecture standards and approve...	ARC-002 Architecture Governance	Architecture Review Board, Security Architecture, CISO, Technology Leadership	View ↗
ARC-002-R010	Continuous Improvement The organization shall establish a continuous improvement process for architectu...	ARC-002 Architecture Governance	Architecture Review Board, Security Architecture, CISO, Technology Leadership	View ↗
ARC-003-R001	Threat Modeling Framework The organization shall establish a threat modeling framework that defines the st...	ARC-003 Threat Modeling	Security Architecture, Threat Modeling Team, Application Security	View ↗
ARC-003-R002	Threat Identification The organization shall identify security threats to systems, applications, and i...	ARC-003 Threat Modeling	Security Architecture, Threat Modeling Team, Application Security	View ↗
ARC-003-R003	Attack Surface Analysis The organization shall conduct attack surface analysis to identify and assess th...	ARC-003 Threat Modeling	Security Architecture, Threat Modeling Team, Application Security	View ↗
ARC-003-R004	Threat Risk Assessment The organization shall conduct risk assessments for identified threats to evalua...	ARC-003 Threat Modeling	Security Architecture, Threat Modeling Team, Application Security	View ↗
ARC-003-R005	Mitigation Planning The organization shall develop mitigation plans for identified threats, defining...	ARC-003 Threat Modeling	Security Architecture, Threat Modeling Team, Application Security	View ↗
ARC-003-R006	Threat Model Validation The organization shall validate threat models to ensure threats are accurately i...	ARC-003 Threat Modeling	Security Architecture, Threat Modeling Team, Application Security	View ↗
ARC-003-R007	Threat Monitoring The organization shall monitor threats to ensure threat information is current a...	ARC-003 Threat Modeling	Security Architecture, Threat Modeling Team, Application Security	View ↗
ARC-003-R008	Threat Reporting The organization shall report on threat modeling, providing visibility into iden...	ARC-003 Threat Modeling	Security Architecture, Threat Modeling Team, Application Security	View ↗
ARC-003-R009	Threat Review The organization shall conduct periodic reviews of threat modeling activities to...	ARC-003 Threat Modeling	Security Architecture, Threat Modeling Team, Application Security	View ↗
ARC-003-R010	Continuous Improvement The organization shall establish a continuous improvement process for threat mod...	ARC-003 Threat Modeling	Security Architecture, Threat Modeling Team, Application Security	View ↗
ARC-004-R001	Review Framework The organization shall establish a security design and architecture review frame...	ARC-004 Security Design & Architecture...	Security Architecture, Security Review Board, Solution Architects	View ↗
ARC-004-R002	Design Review The organization shall conduct security design reviews for new systems, applicat...	ARC-004 Security Design & Architecture...	Security Architecture, Security Review Board, Solution Architects	View ↗
ARC-004-R003	Architecture Review The organization shall conduct security architecture reviews for significant tec...	ARC-004 Security Design & Architecture...	Security Architecture, Security Review Board, Solution Architects	View ↗
ARC-004-R004	Security Requirement Validation The organization shall validate that security requirements have been properly ad...	ARC-004 Security Design & Architecture...	Security Architecture, Security Review Board, Solution Architects	View ↗
ARC-004-R005	Risk Assessment The organization shall conduct risk assessments during design and architecture r...	ARC-004 Security Design & Architecture...	Security Architecture, Security Review Board, Solution Architects	View ↗
ARC-004-R006	Review Approval The organization shall approve designs and architectures based on review finding...	ARC-004 Security Design & Architecture...	Security Architecture, Security Review Board, Solution Architects	View ↗
ARC-004-R007	Review Reporting The organization shall report on design and architecture reviews, providing visi...	ARC-004 Security Design & Architecture...	Security Architecture, Security Review Board, Solution Architects	View ↗
ARC-004-R008	Review Monitoring The organization shall monitor design and architecture reviews to ensure reviews...	ARC-004 Security Design & Architecture...	Security Architecture, Security Review Board, Solution Architects	View ↗
ARC-004-R009	Review Follow-up The organization shall follow up on review findings, ensuring identified issues...	ARC-004 Security Design & Architecture...	Security Architecture, Security Review Board, Solution Architects	View ↗
ARC-004-R010	Continuous Improvement The organization shall establish a continuous improvement process for design and...	ARC-004 Security Design & Architecture...	Security Architecture, Security Review Board, Solution Architects	View ↗
ARC-005-R001	Engineering Framework The organization shall establish a secure engineering framework that defines the...	ARC-005 Secure Engineering Principles	Engineering, DevSecOps, Security Architecture, Application Security	View ↗
ARC-005-R002	Secure Design Principles The organization shall define secure design principles that guide engineering ac...	ARC-005 Secure Engineering Principles	Engineering, DevSecOps, Security Architecture, Application Security	View ↗
ARC-005-R003	Engineering Standards The organization shall define engineering standards that specify the security re...	ARC-005 Secure Engineering Principles	Engineering, DevSecOps, Security Architecture, Application Security	View ↗
ARC-005-R004	Security by Design The organization shall implement security by design principles in all engineerin...	ARC-005 Secure Engineering Principles	Engineering, DevSecOps, Security Architecture, Application Security	View ↗
ARC-005-R005	Technology Integration The organization shall ensure security technologies and controls are properly in...	ARC-005 Secure Engineering Principles	Engineering, DevSecOps, Security Architecture, Application Security	View ↗
ARC-005-R006	Engineering Validation The organization shall validate that engineering solutions meet security require...	ARC-005 Secure Engineering Principles	Engineering, DevSecOps, Security Architecture, Application Security	View ↗
ARC-005-R007	Engineering Monitoring The organization shall monitor engineering activities to ensure secure engineeri...	ARC-005 Secure Engineering Principles	Engineering, DevSecOps, Security Architecture, Application Security	View ↗
ARC-005-R008	Engineering Reporting The organization shall report on secure engineering, providing visibility into e...	ARC-005 Secure Engineering Principles	Engineering, DevSecOps, Security Architecture, Application Security	View ↗
ARC-005-R009	Engineering Review The organization shall conduct periodic reviews of secure engineering activities...	ARC-005 Secure Engineering Principles	Engineering, DevSecOps, Security Architecture, Application Security	View ↗
ARC-005-R010	Continuous Improvement The organization shall establish a continuous improvement process for secure eng...	ARC-005 Secure Engineering Principles	Engineering, DevSecOps, Security Architecture, Application Security	View ↗
ARC-006-R001	Zero Trust Framework The organization shall establish a Zero Trust architecture framework that define...	ARC-006 Zero Trust Architecture	Zero Trust Architecture, IAM, Network Security, Security Operations	View ↗
ARC-006-R002	Identity-Centric Security The organization shall implement identity-centric security as the foundation of...	ARC-006 Zero Trust Architecture	Zero Trust Architecture, IAM, Network Security, Security Operations	View ↗
ARC-006-R003	Least Privilege Enforcement The organization shall enforce least privilege principles across all systems and...	ARC-006 Zero Trust Architecture	Zero Trust Architecture, IAM, Network Security, Security Operations	View ↗
ARC-006-R004	Micro-Segmentation The organization shall implement micro-segmentation to isolate workloads and lim...	ARC-006 Zero Trust Architecture	Zero Trust Architecture, IAM, Network Security, Security Operations	View ↗
ARC-006-R005	Continuous Verification The organization shall implement continuous verification of user identity, devic...	ARC-006 Zero Trust Architecture	Zero Trust Architecture, IAM, Network Security, Security Operations	View ↗
ARC-006-R006	Device Trust The organization shall evaluate and maintain device trust, ensuring only trusted...	ARC-006 Zero Trust Architecture	Zero Trust Architecture, IAM, Network Security, Security Operations	View ↗
ARC-006-R007	Zero Trust Monitoring The organization shall monitor Zero Trust architecture to ensure Zero Trust cont...	ARC-006 Zero Trust Architecture	Zero Trust Architecture, IAM, Network Security, Security Operations	View ↗
ARC-006-R008	Zero Trust Reporting The organization shall report on Zero Trust architecture, providing visibility i...	ARC-006 Zero Trust Architecture	Zero Trust Architecture, IAM, Network Security, Security Operations	View ↗
ARC-006-R009	Zero Trust Review The organization shall conduct periodic reviews of Zero Trust architecture activ...	ARC-006 Zero Trust Architecture	Zero Trust Architecture, IAM, Network Security, Security Operations	View ↗
ARC-006-R010	Continuous Improvement The organization shall establish a continuous improvement process for Zero Trust...	ARC-006 Zero Trust Architecture	Zero Trust Architecture, IAM, Network Security, Security Operations	View ↗
OPS-001-R001	Change Management Framework The organization shall establish a change and release management framework that...	OPS-001 Change & Release Management	IT Operations, Change Manager, Release Manager, CISO	View ↗
OPS-001-R002	Change Request Management The organization shall manage change requests, ensuring all changes are formally...	OPS-001 Change & Release Management	IT Operations, Change Manager, Release Manager, CISO	View ↗
OPS-001-R003	Change Risk Assessment The organization shall conduct risk assessments for proposed changes to evaluate...	OPS-001 Change & Release Management	IT Operations, Change Manager, Release Manager, CISO	View ↗
OPS-001-R004	Change Approval The organization shall approve changes, ensuring changes are authorized by appro...	OPS-001 Change & Release Management	IT Operations, Change Manager, Release Manager, CISO	View ↗
OPS-001-R005	Release Planning The organization shall plan releases, ensuring releases are planned with adequat...	OPS-001 Change & Release Management	IT Operations, Change Manager, Release Manager, CISO	View ↗
OPS-001-R006	Release Deployment The organization shall deploy releases into production environments, ensuring de...	OPS-001 Change & Release Management	IT Operations, Change Manager, Release Manager, CISO	View ↗
OPS-001-R007	Post-Implementation Review The organization shall conduct post-implementation reviews for significant chang...	OPS-001 Change & Release Management	IT Operations, Change Manager, Release Manager, CISO	View ↗
OPS-001-R008	Emergency Changes The organization shall manage emergency changes required to address urgent secur...	OPS-001 Change & Release Management	IT Operations, Change Manager, Release Manager, CISO	View ↗
OPS-001-R009	Change Reporting The organization shall report on change and release management, providing visibi...	OPS-001 Change & Release Management	IT Operations, Change Manager, Release Manager, CISO	View ↗
OPS-001-R010	Continuous Improvement The organization shall establish a continuous improvement process for change and...	OPS-001 Change & Release Management	IT Operations, Change Manager, Release Manager, CISO	View ↗
OPS-002-R001	Operational Monitoring Framework The organization shall establish an operational monitoring framework that define...	OPS-002 Operational Monitoring & Servi...	IT Operations, Security Operations, NOC, Service Owners	View ↗
OPS-002-R002	Health Monitoring The organization shall monitor the health of operational systems and services, i...	OPS-002 Operational Monitoring & Servi...	IT Operations, Security Operations, NOC, Service Owners	View ↗
OPS-002-R003	Performance Monitoring The organization shall monitor system performance, including response times, thr...	OPS-002 Operational Monitoring & Servi...	IT Operations, Security Operations, NOC, Service Owners	View ↗
OPS-002-R004	Alert Management The organization shall manage alerts generated by monitoring systems, ensuring a...	OPS-002 Operational Monitoring & Servi...	IT Operations, Security Operations, NOC, Service Owners	View ↗
OPS-002-R005	Event Monitoring The organization shall monitor operational events, including system events, secu...	OPS-002 Operational Monitoring & Servi...	IT Operations, Security Operations, NOC, Service Owners	View ↗
OPS-002-R006	Operational Dashboards The organization shall develop and maintain operational dashboards that provide...	OPS-002 Operational Monitoring & Servi...	IT Operations, Security Operations, NOC, Service Owners	View ↗
OPS-002-R007	Monitoring Review The organization shall conduct periodic reviews of operational monitoring activi...	OPS-002 Operational Monitoring & Servi...	IT Operations, Security Operations, NOC, Service Owners	View ↗
OPS-002-R008	Monitoring Reporting The organization shall report on operational monitoring, providing visibility in...	OPS-002 Operational Monitoring & Servi...	IT Operations, Security Operations, NOC, Service Owners	View ↗
OPS-002-R009	Escalation Management The organization shall escalate operational issues that require management atten...	OPS-002 Operational Monitoring & Servi...	IT Operations, Security Operations, NOC, Service Owners	View ↗
OPS-002-R010	Continuous Improvement The organization shall establish a continuous improvement process for operationa...	OPS-002 Operational Monitoring & Servi...	IT Operations, Security Operations, NOC, Service Owners	View ↗
OPS-003-R001	Availability Framework The organization shall establish a service availability management framework tha...	OPS-003 Service Availability Managemen...	IT Operations, Service Owners, Business Continuity, Service Management	View ↗
OPS-003-R002	Availability Objectives The organization shall define availability objectives for critical services and...	OPS-003 Service Availability Managemen...	IT Operations, Service Owners, Business Continuity, Service Management	View ↗
OPS-003-R003	Service Availability Monitoring The organization shall monitor the availability of critical services and systems...	OPS-003 Service Availability Managemen...	IT Operations, Service Owners, Business Continuity, Service Management	View ↗
OPS-003-R004	Availability Risk Assessment The organization shall conduct risk assessments for service availability to iden...	OPS-003 Service Availability Managemen...	IT Operations, Service Owners, Business Continuity, Service Management	View ↗
OPS-003-R005	Availability Reporting The organization shall report on service availability, providing visibility into...	OPS-003 Service Availability Managemen...	IT Operations, Service Owners, Business Continuity, Service Management	View ↗
OPS-003-R006	Service Restoration The organization shall restore services in the event of availability incidents,...	OPS-003 Service Availability Managemen...	IT Operations, Service Owners, Business Continuity, Service Management	View ↗
OPS-003-R007	Availability Review The organization shall conduct periodic reviews of service availability manageme...	OPS-003 Service Availability Managemen...	IT Operations, Service Owners, Business Continuity, Service Management	View ↗
OPS-003-R008	Availability Testing The organization shall regularly test availability capabilities, including failo...	OPS-003 Service Availability Managemen...	IT Operations, Service Owners, Business Continuity, Service Management	View ↗
OPS-003-R009	SLA Monitoring The organization shall monitor compliance with service level agreements related...	OPS-003 Service Availability Managemen...	IT Operations, Service Owners, Business Continuity, Service Management	View ↗
OPS-003-R010	Continuous Improvement The organization shall establish a continuous improvement process for service av...	OPS-003 Service Availability Managemen...	IT Operations, Service Owners, Business Continuity, Service Management	View ↗
OPS-004-R001	Capacity Management Framework The organization shall establish a capacity and performance management framework...	OPS-004 Capacity & Performance Managem...	IT Operations, Infrastructure Engineering, Cloud Operations, Service Owners	View ↗
OPS-004-R002	Capacity Planning The organization shall conduct capacity planning to ensure systems have adequate...	OPS-004 Capacity & Performance Managem...	IT Operations, Infrastructure Engineering, Cloud Operations, Service Owners	View ↗
OPS-004-R003	Performance Monitoring The organization shall monitor system performance, including response times, thr...	OPS-004 Capacity & Performance Managem...	IT Operations, Infrastructure Engineering, Cloud Operations, Service Owners	View ↗
OPS-004-R004	Workload Forecasting The organization shall forecast workload demands to anticipate capacity needs an...	OPS-004 Capacity & Performance Managem...	IT Operations, Infrastructure Engineering, Cloud Operations, Service Owners	View ↗
OPS-004-R005	Resource Optimization The organization shall optimize resource utilization to ensure efficient use of...	OPS-004 Capacity & Performance Managem...	IT Operations, Infrastructure Engineering, Cloud Operations, Service Owners	View ↗
OPS-004-R006	Auto-Scaling Management The organization shall manage auto-scaling capabilities to automatically adjust...	OPS-004 Capacity & Performance Managem...	IT Operations, Infrastructure Engineering, Cloud Operations, Service Owners	View ↗
OPS-004-R007	Capacity Reporting The organization shall report on capacity and performance management, providing...	OPS-004 Capacity & Performance Managem...	IT Operations, Infrastructure Engineering, Cloud Operations, Service Owners	View ↗
OPS-004-R008	Performance Review The organization shall conduct periodic reviews of capacity and performance mana...	OPS-004 Capacity & Performance Managem...	IT Operations, Infrastructure Engineering, Cloud Operations, Service Owners	View ↗
OPS-004-R009	Capacity Risk Assessment The organization shall conduct risk assessments for capacity to identify potenti...	OPS-004 Capacity & Performance Managem...	IT Operations, Infrastructure Engineering, Cloud Operations, Service Owners	View ↗
OPS-004-R010	Continuous Improvement The organization shall establish a continuous improvement process for capacity a...	OPS-004 Capacity & Performance Managem...	IT Operations, Infrastructure Engineering, Cloud Operations, Service Owners	View ↗
OPS-005-R001	Maintenance Framework The organization shall establish a system maintenance management framework that...	OPS-005 System Maintenance Management	IT Operations, Infrastructure Engineering, Application Operations, Change Management	View ↗
OPS-005-R002	Preventive Maintenance The organization shall conduct preventive maintenance to proactively identify an...	OPS-005 System Maintenance Management	IT Operations, Infrastructure Engineering, Application Operations, Change Management	View ↗
OPS-005-R003	Planned Maintenance The organization shall conduct planned maintenance activities, including the sch...	OPS-005 System Maintenance Management	IT Operations, Infrastructure Engineering, Application Operations, Change Management	View ↗
OPS-005-R004	Maintenance Scheduling The organization shall schedule maintenance activities to minimize business impa...	OPS-005 System Maintenance Management	IT Operations, Infrastructure Engineering, Application Operations, Change Management	View ↗
OPS-005-R005	Maintenance Validation The organization shall validate that maintenance activities have been completed...	OPS-005 System Maintenance Management	IT Operations, Infrastructure Engineering, Application Operations, Change Management	View ↗
OPS-005-R006	Maintenance Documentation The organization shall maintain comprehensive documentation of maintenance activ...	OPS-005 System Maintenance Management	IT Operations, Infrastructure Engineering, Application Operations, Change Management	View ↗
OPS-005-R007	Maintenance Reporting The organization shall report on maintenance activities, providing visibility in...	OPS-005 System Maintenance Management	IT Operations, Infrastructure Engineering, Application Operations, Change Management	View ↗
OPS-005-R008	Maintenance Review The organization shall conduct periodic reviews of maintenance activities to ens...	OPS-005 System Maintenance Management	IT Operations, Infrastructure Engineering, Application Operations, Change Management	View ↗
OPS-005-R009	Maintenance Exception Management The organization shall manage exceptions to maintenance requirements and schedul...	OPS-005 System Maintenance Management	IT Operations, Infrastructure Engineering, Application Operations, Change Management	View ↗
OPS-005-R010	Continuous Improvement The organization shall establish a continuous improvement process for maintenanc...	OPS-005 System Maintenance Management	IT Operations, Infrastructure Engineering, Application Operations, Change Management	View ↗
OPS-006-R001	Technology Lifecycle Framework The organization shall establish a technology lifecycle management framework tha...	OPS-006 End-of-Life & Technology Lifec...	IT Asset Management, IT Operations, Enterprise Architecture, Security Architecture	View ↗
OPS-006-R002	Technology Inventory Review The organization shall regularly review the technology inventory to identify ass...	OPS-006 End-of-Life & Technology Lifec...	IT Asset Management, IT Operations, Enterprise Architecture, Security Architecture	View ↗
OPS-006-R003	End-of-Life Identification The organization shall identify technology assets that have reached or are appro...	OPS-006 End-of-Life & Technology Lifec...	IT Asset Management, IT Operations, Enterprise Architecture, Security Architecture	View ↗
OPS-006-R004	Risk Assessment The organization shall conduct risk assessments for technology assets approachin...	OPS-006 End-of-Life & Technology Lifec...	IT Asset Management, IT Operations, Enterprise Architecture, Security Architecture	View ↗
OPS-006-R005	Technology Replacement Planning The organization shall develop plans for replacing technology assets that have r...	OPS-006 End-of-Life & Technology Lifec...	IT Asset Management, IT Operations, Enterprise Architecture, Security Architecture	View ↗
OPS-006-R006	Compensating Controls The organization shall implement compensating controls for technology assets tha...	OPS-006 End-of-Life & Technology Lifec...	IT Asset Management, IT Operations, Enterprise Architecture, Security Architecture	View ↗
OPS-006-R007	Lifecycle Monitoring The organization shall monitor technology lifecycle management to ensure assets...	OPS-006 End-of-Life & Technology Lifec...	IT Asset Management, IT Operations, Enterprise Architecture, Security Architecture	View ↗
OPS-006-R008	Lifecycle Reporting The organization shall report on technology lifecycle management, providing visi...	OPS-006 End-of-Life & Technology Lifec...	IT Asset Management, IT Operations, Enterprise Architecture, Security Architecture	View ↗
OPS-006-R009	Lifecycle Review The organization shall conduct periodic reviews of technology lifecycle manageme...	OPS-006 End-of-Life & Technology Lifec...	IT Asset Management, IT Operations, Enterprise Architecture, Security Architecture	View ↗
OPS-006-R010	Continuous Improvement The organization shall establish a continuous improvement process for technology...	OPS-006 End-of-Life & Technology Lifec...	IT Asset Management, IT Operations, Enterprise Architecture, Security Architecture	View ↗
OPS-007-R001	Batch Processing Framework The organization shall establish a batch processing and job management framework...	OPS-007 Batch Processing & Job Managem...	IT Operations, Application Operations, Job Scheduling Team, Data Operations	View ↗
OPS-007-R002	Job Scheduling The organization shall schedule batch jobs, ensuring jobs are scheduled appropri...	OPS-007 Batch Processing & Job Managem...	IT Operations, Application Operations, Job Scheduling Team, Data Operations	View ↗
OPS-007-R003	Job Authorization The organization shall authorize batch jobs, ensuring jobs are approved before e...	OPS-007 Batch Processing & Job Managem...	IT Operations, Application Operations, Job Scheduling Team, Data Operations	View ↗
OPS-007-R004	Job Execution Monitoring The organization shall monitor batch job execution, ensuring jobs complete succe...	OPS-007 Batch Processing & Job Managem...	IT Operations, Application Operations, Job Scheduling Team, Data Operations	View ↗
OPS-007-R005	Batch Failure Management The organization shall manage batch job failures, including the detection, inves...	OPS-007 Batch Processing & Job Managem...	IT Operations, Application Operations, Job Scheduling Team, Data Operations	View ↗
OPS-007-R006	Batch Logging The organization shall maintain comprehensive logs of batch processing activitie...	OPS-007 Batch Processing & Job Managem...	IT Operations, Application Operations, Job Scheduling Team, Data Operations	View ↗
OPS-007-R007	Batch Reporting The organization shall report on batch processing, providing visibility into job...	OPS-007 Batch Processing & Job Managem...	IT Operations, Application Operations, Job Scheduling Team, Data Operations	View ↗
OPS-007-R008	Batch Review The organization shall conduct periodic reviews of batch processing activities t...	OPS-007 Batch Processing & Job Managem...	IT Operations, Application Operations, Job Scheduling Team, Data Operations	View ↗
OPS-007-R009	Batch Recovery The organization shall recover from batch job failures, ensuring failed jobs can...	OPS-007 Batch Processing & Job Managem...	IT Operations, Application Operations, Job Scheduling Team, Data Operations	View ↗
OPS-007-R010	Continuous Improvement The organization shall establish a continuous improvement process for batch proc...	OPS-007 Batch Processing & Job Managem...	IT Operations, Application Operations, Job Scheduling Team, Data Operations	View ↗
SOC-001-R001	SOC Governance Framework The organization shall establish a Security Operations Center governance framewo...	SOC-001 Security Operations Center (SO...	SOC Manager / CISO	View ↗
SOC-001-R002	SOC Roles & Responsibilities The organization shall clearly define and document the roles and responsibilitie...	SOC-001 Security Operations Center (SO...	SOC Manager / CISO	View ↗
SOC-001-R003	SOC Operating Model The organization shall define the SOC operating model, including service deliver...	SOC-001 Security Operations Center (SO...	SOC Manager / CISO	View ↗
SOC-001-R004	SOC Service Management The organization shall manage SOC services, including service level agreements,...	SOC-001 Security Operations Center (SO...	SOC Manager / CISO	View ↗
SOC-001-R005	SOC Resource Management The organization shall manage SOC resources, including personnel, technology, an...	SOC-001 Security Operations Center (SO...	SOC Manager / CISO	View ↗
SOC-001-R006	SOC Performance Monitoring The organization shall monitor SOC performance, including operational metrics, s...	SOC-001 Security Operations Center (SO...	SOC Manager / CISO	View ↗
SOC-001-R007	SOC Metrics & Reporting The organization shall define and track SOC metrics that provide insight into op...	SOC-001 Security Operations Center (SO...	SOC Manager / CISO	View ↗
SOC-001-R008	SOC Review The organization shall conduct periodic reviews of SOC operations to ensure thei...	SOC-001 Security Operations Center (SO...	SOC Manager / CISO	View ↗
SOC-001-R009	SOC Maturity Assessment The organization shall conduct periodic maturity assessments of the SOC to evalu...	SOC-001 Security Operations Center (SO...	SOC Manager / CISO	View ↗
SOC-001-R010	Continuous Improvement The organization shall establish a continuous improvement process for SOC operat...	SOC-001 Security Operations Center (SO...	SOC Manager / CISO	View ↗
SOC-002-R001	Threat Detection Framework The organization shall establish a threat detection framework that defines the s...	SOC-002 Security Threat Detection	SOC / Security Engineering	View ↗
SOC-002-R002	Detection Use Cases The organization shall define threat detection use cases that describe the threa...	SOC-002 Security Threat Detection	SOC / Security Engineering	View ↗
SOC-002-R003	Detection Rules Management The organization shall manage threat detection rules, including the creation, te...	SOC-002 Security Threat Detection	SOC / Security Engineering	View ↗
SOC-002-R004	Behavioral Analytics The organization shall implement behavioral analytics capabilities to detect thr...	SOC-002 Security Threat Detection	SOC / Security Engineering	View ↗
SOC-002-R005	Network Traffic Analysis The organization shall implement network traffic analysis capabilities to detect...	SOC-002 Security Threat Detection	SOC / Security Engineering	View ↗
SOC-002-R006	Detection Validation The organization shall validate threat detection capabilities to ensure detectio...	SOC-002 Security Threat Detection	SOC / Security Engineering	View ↗
SOC-002-R007	Alert Prioritization The organization shall prioritize detection alerts to ensure the most critical t...	SOC-002 Security Threat Detection	SOC / Security Engineering	View ↗
SOC-002-R008	Detection Reporting The organization shall report on threat detection, providing visibility into det...	SOC-002 Security Threat Detection	SOC / Security Engineering	View ↗
SOC-002-R009	Detection Review The organization shall conduct periodic reviews of threat detection activities t...	SOC-002 Security Threat Detection	SOC / Security Engineering	View ↗
SOC-002-R010	Continuous Improvement The organization shall establish a continuous improvement process for threat det...	SOC-002 Security Threat Detection	SOC / Security Engineering	View ↗
SOC-003-R001	SOAR Governance Framework The organization shall establish a Security Orchestration, Automation, and Respo...	SOC-003 Security Automation & Orchestr...	SOC / Detection Engineering	View ↗
SOC-003-R002	Automated Playbooks The organization shall develop and maintain automated playbooks that define the...	SOC-003 Security Automation & Orchestr...	SOC / Detection Engineering	View ↗
SOC-003-R003	Workflow Orchestration The organization shall implement workflow orchestration capabilities that coordi...	SOC-003 Security Automation & Orchestr...	SOC / Detection Engineering	View ↗
SOC-003-R004	Automated Response Actions The organization shall implement automated response actions that enable rapid co...	SOC-003 Security Automation & Orchestr...	SOC / Detection Engineering	View ↗
SOC-003-R005	Integration Management The organization shall manage integrations between security tools and platforms...	SOC-003 Security Automation & Orchestr...	SOC / Detection Engineering	View ↗
SOC-003-R006	Automation Monitoring The organization shall monitor SOAR capabilities to ensure automation is operati...	SOC-003 Security Automation & Orchestr...	SOC / Detection Engineering	View ↗
SOC-003-R007	SOAR Performance Reporting The organization shall report on SOAR, providing visibility into automation effe...	SOC-003 Security Automation & Orchestr...	SOC / Detection Engineering	View ↗
SOC-003-R008	SOAR Review The organization shall conduct periodic reviews of SOAR activities to ensure the...	SOC-003 Security Automation & Orchestr...	SOC / Detection Engineering	View ↗
SOC-003-R009	Exception Management The organization shall manage exceptions to automated playbooks and workflows, e...	SOC-003 Security Automation & Orchestr...	SOC / Detection Engineering	View ↗
SOC-003-R010	Continuous Improvement The organization shall establish a continuous improvement process for SOAR, driv...	SOC-003 Security Automation & Orchestr...	SOC / Detection Engineering	View ↗
SOC-004-R001	Threat Hunting Framework The organization shall establish a threat hunting framework that defines the str...	SOC-004 Threat Hunting	SOC Analysts / Incident Response	View ↗
SOC-004-R002	Hunt Planning The organization shall conduct formal planning for threat hunting activities, de...	SOC-004 Threat Hunting	SOC Analysts / Incident Response	View ↗
SOC-004-R003	Threat Hypothesis Development The organization shall develop threat hypotheses to guide hunting activities, id...	SOC-004 Threat Hunting	SOC Analysts / Incident Response	View ↗
SOC-004-R004	Hunt Execution The organization shall execute threat hunting activities in accordance with hunt...	SOC-004 Threat Hunting	SOC Analysts / Incident Response	View ↗
SOC-004-R005	Threat Validation The organization shall validate threat hunting findings to ensure identified thr...	SOC-004 Threat Hunting	SOC Analysts / Incident Response	View ↗
SOC-004-R006	Hunt Documentation The organization shall maintain comprehensive documentation of threat hunting ac...	SOC-004 Threat Hunting	SOC Analysts / Incident Response	View ↗
SOC-004-R007	Hunt Reporting The organization shall report on threat hunting, providing visibility into hunti...	SOC-004 Threat Hunting	SOC Analysts / Incident Response	View ↗
SOC-004-R008	Lessons Learned The organization shall capture and integrate lessons learned from threat hunting...	SOC-004 Threat Hunting	SOC Analysts / Incident Response	View ↗
SOC-004-R009	Hunt Review The organization shall conduct periodic reviews of threat hunting activities to...	SOC-004 Threat Hunting	SOC Analysts / Incident Response	View ↗
SOC-004-R010	Continuous Improvement The organization shall establish a continuous improvement process for threat hun...	SOC-004 Threat Hunting	SOC Analysts / Incident Response	View ↗
THR-001-R001	Threat Intelligence Framework The organization shall establish a threat intelligence framework that defines th...	THR-001 Threat Intelligence Management	CISO / Threat Intelligence Team	View ↗
THR-001-R002	Intelligence Source Management The organization shall manage threat intelligence sources, including commercial...	THR-001 Threat Intelligence Management	CISO / Threat Intelligence Team	View ↗
THR-001-R003	Intelligence Collection The organization shall collect threat intelligence from identified sources, ensu...	THR-001 Threat Intelligence Management	CISO / Threat Intelligence Team	View ↗
THR-001-R004	Intelligence Analysis The organization shall analyze threat intelligence to produce actionable insight...	THR-001 Threat Intelligence Management	CISO / Threat Intelligence Team	View ↗
THR-001-R005	Intelligence Validation The organization shall validate threat intelligence to ensure its accuracy, reli...	THR-001 Threat Intelligence Management	CISO / Threat Intelligence Team	View ↗
THR-001-R006	Intelligence Dissemination The organization shall disseminate threat intelligence to relevant stakeholders,...	THR-001 Threat Intelligence Management	CISO / Threat Intelligence Team	View ↗
THR-001-R007	Intelligence Integration The organization shall integrate threat intelligence into security operations, i...	THR-001 Threat Intelligence Management	CISO / Threat Intelligence Team	View ↗
THR-001-R008	Intelligence Reporting The organization shall report on threat intelligence, providing visibility into...	THR-001 Threat Intelligence Management	CISO / Threat Intelligence Team	View ↗
THR-001-R009	Intelligence Review The organization shall conduct periodic reviews of threat intelligence activitie...	THR-001 Threat Intelligence Management	CISO / Threat Intelligence Team	View ↗
THR-001-R010	Continuous Improvement The organization shall establish a continuous improvement process for threat int...	THR-001 Threat Intelligence Management	CISO / Threat Intelligence Team	View ↗
THR-002-R001	ASM Framework The organization shall establish an Attack Surface Management framework that def...	THR-002 Attack Surface Management	Threat Intelligence Team / SOC	View ↗
THR-002-R002	Asset Discovery The organization shall discover assets that are part of the organization's attac...	THR-002 Attack Surface Management	Threat Intelligence Team / SOC	View ↗
THR-002-R003	External Attack Surface Discovery The organization shall discover and map the external attack surface, including i...	THR-002 Attack Surface Management	Threat Intelligence Team / SOC	View ↗
THR-002-R004	Internal Attack Surface Discovery The organization shall discover and map the internal attack surface, including i...	THR-002 Attack Surface Management	Threat Intelligence Team / SOC	View ↗
THR-002-R005	Exposure Assessment The organization shall conduct exposure assessments to evaluate the security pos...	THR-002 Attack Surface Management	Threat Intelligence Team / SOC	View ↗
THR-002-R006	Exposure Prioritization The organization shall prioritize exposures based on their severity, exploitabil...	THR-002 Attack Surface Management	Threat Intelligence Team / SOC	View ↗
THR-002-R007	Continuous Monitoring The organization shall continuously monitor the attack surface to detect changes...	THR-002 Attack Surface Management	Threat Intelligence Team / SOC	View ↗
THR-002-R008	Exposure Reporting The organization shall report on attack surface management, providing visibility...	THR-002 Attack Surface Management	Threat Intelligence Team / SOC	View ↗
THR-002-R009	Exposure Review The organization shall conduct periodic reviews of attack surface management act...	THR-002 Attack Surface Management	Threat Intelligence Team / SOC	View ↗
THR-002-R010	Continuous Improvement The organization shall establish a continuous improvement process for attack sur...	THR-002 Attack Surface Management	Threat Intelligence Team / SOC	View ↗
THR-003-R001	Insider Threat Framework The organization shall establish an insider threat management framework that def...	THR-003 Insider Threat Management	Threat Intelligence Analysts	View ↗
THR-003-R002	Insider Risk Identification The organization shall identify insider threat risks, including the detection of...	THR-003 Insider Threat Management	Threat Intelligence Analysts	View ↗
THR-003-R003	User Activity Monitoring The organization shall monitor user activity to detect potential insider threats...	THR-003 Insider Threat Management	Threat Intelligence Analysts	View ↗
THR-003-R004	Insider Investigation The organization shall investigate potential insider threats, including collecti...	THR-003 Insider Threat Management	Threat Intelligence Analysts	View ↗
THR-003-R005	Insider Response The organization shall respond to confirmed insider threats, including containme...	THR-003 Insider Threat Management	Threat Intelligence Analysts	View ↗
THR-003-R006	HR Coordination The organization shall coordinate insider threat activities with Human Resources...	THR-003 Insider Threat Management	Threat Intelligence Analysts	View ↗
THR-003-R007	Insider Reporting The organization shall report on insider threat management, providing visibility...	THR-003 Insider Threat Management	Threat Intelligence Analysts	View ↗
THR-003-R008	Insider Review The organization shall conduct periodic reviews of insider threat management act...	THR-003 Insider Threat Management	Threat Intelligence Analysts	View ↗
THR-003-R009	Insider Awareness The organization shall promote awareness of insider threats among employees and...	THR-003 Insider Threat Management	Threat Intelligence Analysts	View ↗
THR-003-R010	Continuous Improvement The organization shall establish a continuous improvement process for insider th...	THR-003 Insider Threat Management	Threat Intelligence Analysts	View ↗
THR-004-R001	Security Validation Framework The organization shall establish a security validation framework that defines th...	THR-004 Adversary Simulation & Securit...	Threat Intelligence Team / SOC	View ↗
THR-004-R002	Penetration Testing The organization shall conduct penetration testing of systems, applications, and...	THR-004 Adversary Simulation & Securit...	Threat Intelligence Team / SOC	View ↗
THR-004-R003	Red Team Exercises The organization shall conduct Red Team exercises to assess the effectiveness of...	THR-004 Adversary Simulation & Securit...	Threat Intelligence Team / SOC	View ↗
THR-004-R004	Purple Team Exercises The organization shall conduct Purple Team exercises to facilitate collaboration...	THR-004 Adversary Simulation & Securit...	Threat Intelligence Team / SOC	View ↗
THR-004-R005	Adversary Emulation The organization shall conduct adversary emulation to simulate the tactics, tech...	THR-004 Adversary Simulation & Securit...	Threat Intelligence Team / SOC	View ↗
THR-004-R006	Security Control Validation The organization shall validate the effectiveness of security controls through t...	THR-004 Adversary Simulation & Securit...	Threat Intelligence Team / SOC	View ↗
THR-004-R007	Validation Reporting The organization shall report on security validation activities, providing visib...	THR-004 Adversary Simulation & Securit...	Threat Intelligence Team / SOC	View ↗
THR-004-R008	Remediation Tracking The organization shall track remediation actions identified from adversary simul...	THR-004 Adversary Simulation & Securit...	Threat Intelligence Team / SOC	View ↗
THR-004-R009	Validation Review The organization shall conduct periodic reviews of security validation activitie...	THR-004 Adversary Simulation & Securit...	Threat Intelligence Team / SOC	View ↗
THR-004-R010	Continuous Improvement The organization shall establish a continuous improvement process for security v...	THR-004 Adversary Simulation & Securit...	Threat Intelligence Team / SOC	View ↗
INC-001-R001	Incident Response Governance The organization shall establish governance structures for the incident response...	INC-001 Incident Response Program	CISO, Incident Response Manager, Security Governance, Executive Management	View ↗
INC-001-R002	Incident Response Policy The organization shall establish an incident response policy that defines the re...	INC-001 Incident Response Program	CISO, Incident Response Manager, Security Governance, Executive Management	View ↗
INC-001-R003	Incident Response Plan The organization shall develop a comprehensive incident response plan that defin...	INC-001 Incident Response Program	CISO, Incident Response Manager, Security Governance, Executive Management	View ↗
INC-001-R004	Roles & Responsibilities The organization shall clearly define and document the roles and responsibilitie...	INC-001 Incident Response Program	CISO, Incident Response Manager, Security Governance, Executive Management	View ↗
INC-001-R005	Incident Classification The organization shall establish an incident classification schema that enables...	INC-001 Incident Response Program	CISO, Incident Response Manager, Security Governance, Executive Management	View ↗
INC-001-R006	Program Governance The organization shall establish governance processes for the incident response...	INC-001 Incident Response Program	CISO, Incident Response Manager, Security Governance, Executive Management	View ↗
INC-001-R007	Executive Reporting The organization shall provide executive leadership and the board with regular r...	INC-001 Incident Response Program	CISO, Incident Response Manager, Security Governance, Executive Management	View ↗
INC-001-R008	Program Review The organization shall conduct periodic reviews of the incident response program...	INC-001 Incident Response Program	CISO, Incident Response Manager, Security Governance, Executive Management	View ↗
INC-001-R009	Program Metrics The organization shall define and track key metrics for the incident response pr...	INC-001 Incident Response Program	CISO, Incident Response Manager, Security Governance, Executive Management	View ↗
INC-001-R010	Continuous Improvement The organization shall establish a continuous improvement process for the incide...	INC-001 Incident Response Program	CISO, Incident Response Manager, Security Governance, Executive Management	View ↗
INC-002-R001	Preparedness Framework The organization shall establish an incident response preparedness framework tha...	INC-002 Incident Response Preparedness	Incident Response Manager, Security Operations, IT Operations, Business Continuity	View ↗
INC-002-R002	Incident Response Team The organization shall establish a qualified incident response team with the ski...	INC-002 Incident Response Preparedness	Incident Response Manager, Security Operations, IT Operations, Business Continuity	View ↗
INC-002-R003	Incident Playbooks The organization shall develop and maintain incident playbooks that provide deta...	INC-002 Incident Response Preparedness	Incident Response Manager, Security Operations, IT Operations, Business Continuity	View ↗
INC-002-R004	Response Technologies The organization shall implement and maintain response technologies that enable...	INC-002 Incident Response Preparedness	Incident Response Manager, Security Operations, IT Operations, Business Continuity	View ↗
INC-002-R005	Communication Readiness The organization shall establish communication readiness capabilities to ensure...	INC-002 Incident Response Preparedness	Incident Response Manager, Security Operations, IT Operations, Business Continuity	View ↗
INC-002-R006	Tabletop Exercises The organization shall conduct regular tabletop exercises to test incident respo...	INC-002 Incident Response Preparedness	Incident Response Manager, Security Operations, IT Operations, Business Continuity	View ↗
INC-002-R007	Technical Simulations The organization shall conduct regular technical simulations to test incident re...	INC-002 Incident Response Preparedness	Incident Response Manager, Security Operations, IT Operations, Business Continuity	View ↗
INC-002-R008	Readiness Assessment The organization shall conduct readiness assessments to evaluate the organizatio...	INC-002 Incident Response Preparedness	Incident Response Manager, Security Operations, IT Operations, Business Continuity	View ↗
INC-002-R009	Preparedness Reporting The organization shall report on incident response preparedness, providing visib...	INC-002 Incident Response Preparedness	Incident Response Manager, Security Operations, IT Operations, Business Continuity	View ↗
INC-002-R010	Continuous Improvement The organization shall establish a continuous improvement process for incident r...	INC-002 Incident Response Preparedness	Incident Response Manager, Security Operations, IT Operations, Business Continuity	View ↗
INC-003-R001	Detection Framework The organization shall establish an incident detection framework that defines th...	INC-003 Incident Detection, Analysis &...	Security Operations, SOC, Incident Response Team, Threat Detection	View ↗
INC-003-R002	Incident Identification The organization shall identify potential security incidents through monitoring,...	INC-003 Incident Detection, Analysis &...	Security Operations, SOC, Incident Response Team, Threat Detection	View ↗
INC-003-R003	Incident Triage The organization shall triage potential security incidents to determine their va...	INC-003 Incident Detection, Analysis &...	Security Operations, SOC, Incident Response Team, Threat Detection	View ↗
INC-003-R004	Incident Classification The organization shall classify incidents according to the established incident...	INC-003 Incident Detection, Analysis &...	Security Operations, SOC, Incident Response Team, Threat Detection	View ↗
INC-003-R005	Incident Analysis The organization shall conduct analysis of security incidents to determine their...	INC-003 Incident Detection, Analysis &...	Security Operations, SOC, Incident Response Team, Threat Detection	View ↗
INC-003-R006	Incident Escalation The organization shall establish escalation processes for security incidents tha...	INC-003 Incident Detection, Analysis &...	Security Operations, SOC, Incident Response Team, Threat Detection	View ↗
INC-003-R007	Incident Documentation The organization shall maintain comprehensive documentation of incident detectio...	INC-003 Incident Detection, Analysis &...	Security Operations, SOC, Incident Response Team, Threat Detection	View ↗
INC-003-R008	Incident Reporting The organization shall report on security incidents, providing visibility into i...	INC-003 Incident Detection, Analysis &...	Security Operations, SOC, Incident Response Team, Threat Detection	View ↗
INC-003-R009	Detection Review The organization shall conduct periodic reviews of incident detection, analysis,...	INC-003 Incident Detection, Analysis &...	Security Operations, SOC, Incident Response Team, Threat Detection	View ↗
INC-003-R010	Continuous Improvement The organization shall establish a continuous improvement process for incident d...	INC-003 Incident Detection, Analysis &...	Security Operations, SOC, Incident Response Team, Threat Detection	View ↗
INC-004-R001	Containment Strategy The organization shall establish containment strategies that define the approach...	INC-004 Incident Containment, Eradicat...	Incident Response Team, IT Operations, Security Operations, System Owners	View ↗
INC-004-R002	Short-Term Containment The organization shall establish processes for short-term containment of securit...	INC-004 Incident Containment, Eradicat...	Incident Response Team, IT Operations, Security Operations, System Owners	View ↗
INC-004-R003	Long-Term Containment The organization shall establish processes for long-term containment of security...	INC-004 Incident Containment, Eradicat...	Incident Response Team, IT Operations, Security Operations, System Owners	View ↗
INC-004-R004	Threat Eradication The organization shall establish processes for eradicating threats from affected...	INC-004 Incident Containment, Eradicat...	Incident Response Team, IT Operations, Security Operations, System Owners	View ↗
INC-004-R005	System Recovery The organization shall establish processes for recovering systems and data affec...	INC-004 Incident Containment, Eradicat...	Incident Response Team, IT Operations, Security Operations, System Owners	View ↗
INC-004-R006	Recovery Validation The organization shall validate that recovery has been completed successfully an...	INC-004 Incident Containment, Eradicat...	Incident Response Team, IT Operations, Security Operations, System Owners	View ↗
INC-004-R007	Recovery Monitoring The organization shall monitor recovered systems to ensure they remain secure an...	INC-004 Incident Containment, Eradicat...	Incident Response Team, IT Operations, Security Operations, System Owners	View ↗
INC-004-R008	Recovery Reporting The organization shall report on containment, eradication, and recovery activiti...	INC-004 Incident Containment, Eradicat...	Incident Response Team, IT Operations, Security Operations, System Owners	View ↗
INC-004-R009	Recovery Review The organization shall conduct periodic reviews of containment, eradication, and...	INC-004 Incident Containment, Eradicat...	Incident Response Team, IT Operations, Security Operations, System Owners	View ↗
INC-004-R010	Continuous Improvement The organization shall establish a continuous improvement process for containmen...	INC-004 Incident Containment, Eradicat...	Incident Response Team, IT Operations, Security Operations, System Owners	View ↗
INC-005-R001	Post-Incident Review Framework The organization shall establish a post-incident review framework that defines t...	INC-005 Post-Incident Review & Continu...	Incident Response Manager, CISO, Risk Management, Process Owners	View ↗
INC-005-R002	Root Cause Analysis The organization shall conduct root cause analysis for significant security inci...	INC-005 Post-Incident Review & Continu...	Incident Response Manager, CISO, Risk Management, Process Owners	View ↗
INC-005-R003	Lessons Learned The organization shall capture and document lessons learned from security incide...	INC-005 Post-Incident Review & Continu...	Incident Response Manager, CISO, Risk Management, Process Owners	View ↗
INC-005-R004	Corrective Actions The organization shall identify and implement corrective actions to address issu...	INC-005 Post-Incident Review & Continu...	Incident Response Manager, CISO, Risk Management, Process Owners	View ↗
INC-005-R005	Preventive Actions The organization shall identify and implement preventive actions to reduce the l...	INC-005 Post-Incident Review & Continu...	Incident Response Manager, CISO, Risk Management, Process Owners	View ↗
INC-005-R006	Improvement Tracking The organization shall track post-incident improvement actions to ensure correct...	INC-005 Post-Incident Review & Continu...	Incident Response Manager, CISO, Risk Management, Process Owners	View ↗
INC-005-R007	Metrics Analysis The organization shall analyze incident metrics to identify trends, patterns, an...	INC-005 Post-Incident Review & Continu...	Incident Response Manager, CISO, Risk Management, Process Owners	View ↗
INC-005-R008	Executive Reporting The organization shall provide executive leadership and the board with regular r...	INC-005 Post-Incident Review & Continu...	Incident Response Manager, CISO, Risk Management, Process Owners	View ↗
INC-005-R009	Review Governance The organization shall establish governance processes for post-incident reviews...	INC-005 Post-Incident Review & Continu...	Incident Response Manager, CISO, Risk Management, Process Owners	View ↗
INC-005-R010	Continuous Improvement The organization shall establish a continuous improvement process for incident r...	INC-005 Post-Incident Review & Continu...	Incident Response Manager, CISO, Risk Management, Process Owners	View ↗
INC-006-R001	Crisis Communication Framework The organization shall establish a crisis communication framework that defines t...	INC-006 Crisis Communication Managemen...	Crisis Management, Communications, CISO, Legal, Executive Management	View ↗
INC-006-R002	Internal Communication The organization shall establish processes for internal communication during sec...	INC-006 Crisis Communication Managemen...	Crisis Management, Communications, CISO, Legal, Executive Management	View ↗
INC-006-R003	External Communication The organization shall establish processes for external communication during sec...	INC-006 Crisis Communication Managemen...	Crisis Management, Communications, CISO, Legal, Executive Management	View ↗
INC-006-R004	Media Management The organization shall establish processes for managing media inquiries and comm...	INC-006 Crisis Communication Managemen...	Crisis Management, Communications, CISO, Legal, Executive Management	View ↗
INC-006-R005	Executive Communication The organization shall establish processes for communicating with executive lead...	INC-006 Crisis Communication Managemen...	Crisis Management, Communications, CISO, Legal, Executive Management	View ↗
INC-006-R006	Stakeholder Communication The organization shall establish processes for communicating with key stakeholde...	INC-006 Crisis Communication Managemen...	Crisis Management, Communications, CISO, Legal, Executive Management	View ↗
INC-006-R007	Communication Approval The organization shall establish processes for approving communications during s...	INC-006 Crisis Communication Managemen...	Crisis Management, Communications, CISO, Legal, Executive Management	View ↗
INC-006-R008	Communication Monitoring The organization shall monitor communications during security incidents to ensur...	INC-006 Crisis Communication Managemen...	Crisis Management, Communications, CISO, Legal, Executive Management	View ↗
INC-006-R009	Communication Review The organization shall conduct periodic reviews of crisis communication activiti...	INC-006 Crisis Communication Managemen...	Crisis Management, Communications, CISO, Legal, Executive Management	View ↗
INC-006-R010	Continuous Improvement The organization shall establish a continuous improvement process for crisis com...	INC-006 Crisis Communication Managemen...	Crisis Management, Communications, CISO, Legal, Executive Management	View ↗
INC-007-R001	Notification Framework The organization shall establish a regulatory and external incident notification...	INC-007 Regulatory & External Incident...	Compliance, Legal, CISO, Incident Response, Privacy, Regulatory Affairs	View ↗
INC-007-R002	Regulatory Assessment The organization shall conduct regulatory assessments for security incidents to...	INC-007 Regulatory & External Incident...	Compliance, Legal, CISO, Incident Response, Privacy, Regulatory Affairs	View ↗
INC-007-R003	Notification Approval The organization shall approve regulatory and external notifications, ensuring n...	INC-007 Regulatory & External Incident...	Compliance, Legal, CISO, Incident Response, Privacy, Regulatory Affairs	View ↗
INC-007-R004	Regulatory Reporting The organization shall submit regulatory notifications and reports in accordance...	INC-007 Regulatory & External Incident...	Compliance, Legal, CISO, Incident Response, Privacy, Regulatory Affairs	View ↗
INC-007-R005	Customer Notification The organization shall notify customers affected by security incidents in accord...	INC-007 Regulatory & External Incident...	Compliance, Legal, CISO, Incident Response, Privacy, Regulatory Affairs	View ↗
INC-007-R006	Third-Party Notification The organization shall notify third parties affected by security incidents, incl...	INC-007 Regulatory & External Incident...	Compliance, Legal, CISO, Incident Response, Privacy, Regulatory Affairs	View ↗
INC-007-R007	Law Enforcement Coordination The organization shall coordinate with law enforcement and other authorities dur...	INC-007 Regulatory & External Incident...	Compliance, Legal, CISO, Incident Response, Privacy, Regulatory Affairs	View ↗
INC-007-R008	Notification Documentation The organization shall maintain comprehensive documentation of regulatory and ex...	INC-007 Regulatory & External Incident...	Compliance, Legal, CISO, Incident Response, Privacy, Regulatory Affairs	View ↗
INC-007-R009	Notification Review The organization shall conduct periodic reviews of regulatory and external notif...	INC-007 Regulatory & External Incident...	Compliance, Legal, CISO, Incident Response, Privacy, Regulatory Affairs	View ↗
INC-007-R010	Continuous Improvement The organization shall establish a continuous improvement process for regulatory...	INC-007 Regulatory & External Incident...	Compliance, Legal, CISO, Incident Response, Privacy, Regulatory Affairs	View ↗
BCM-001-R001	BCDR Governance Framework The organization shall establish a Business Continuity and Disaster Recovery gov...	BCM-001 Business Continuity & Disaster...	Business Continuity, Disaster Recovery, CISO, Executive Management	View ↗
BCM-001-R002	Program Scope The organization shall define a documented scope for the BCDR program that ident...	BCM-001 Business Continuity & Disaster...	Business Continuity, Disaster Recovery, CISO, Executive Management	View ↗
BCM-001-R003	Roles & Responsibilities The organization shall clearly define and document the roles and responsibilitie...	BCM-001 Business Continuity & Disaster...	Business Continuity, Disaster Recovery, CISO, Executive Management	View ↗
BCM-001-R004	BCDR Policy The organization shall establish a BCDR policy that defines the requirements, pr...	BCM-001 Business Continuity & Disaster...	Business Continuity, Disaster Recovery, CISO, Executive Management	View ↗
BCM-001-R005	Program Resources The organization shall ensure the BCDR program receives adequate resources, incl...	BCM-001 Business Continuity & Disaster...	Business Continuity, Disaster Recovery, CISO, Executive Management	View ↗
BCM-001-R006	Program Monitoring The organization shall monitor BCDR program activities to ensure the program is...	BCM-001 Business Continuity & Disaster...	Business Continuity, Disaster Recovery, CISO, Executive Management	View ↗
BCM-001-R007	Executive Reporting The organization shall provide executive leadership and the board with regular r...	BCM-001 Business Continuity & Disaster...	Business Continuity, Disaster Recovery, CISO, Executive Management	View ↗
BCM-001-R008	Program Review The organization shall conduct periodic reviews of the BCDR program to assess it...	BCM-001 Business Continuity & Disaster...	Business Continuity, Disaster Recovery, CISO, Executive Management	View ↗
BCM-001-R009	Program Metrics The organization shall define and track key metrics for the BCDR program that pr...	BCM-001 Business Continuity & Disaster...	Business Continuity, Disaster Recovery, CISO, Executive Management	View ↗
BCM-001-R010	Continuous Improvement The organization shall establish a continuous improvement process for the BCDR p...	BCM-001 Business Continuity & Disaster...	Business Continuity, Disaster Recovery, CISO, Executive Management	View ↗
BCM-002-R001	Planning Framework The organization shall establish a BCDR planning framework that defines the stru...	BCM-002 Business Continuity & Disaster...	Business Continuity, Disaster Recovery, IT Operations, Business Owners	View ↗
BCM-002-R002	Business Continuity Plan The organization shall develop a comprehensive business continuity plan that def...	BCM-002 Business Continuity & Disaster...	Business Continuity, Disaster Recovery, IT Operations, Business Owners	View ↗
BCM-002-R003	Disaster Recovery Plan The organization shall develop a comprehensive disaster recovery plan that defin...	BCM-002 Business Continuity & Disaster...	Business Continuity, Disaster Recovery, IT Operations, Business Owners	View ↗
BCM-002-R004	Recovery Procedures The organization shall develop and maintain detailed recovery procedures that pr...	BCM-002 Business Continuity & Disaster...	Business Continuity, Disaster Recovery, IT Operations, Business Owners	View ↗
BCM-002-R005	Plan Approval The organization shall approve BCDR plans and recovery procedures, ensuring plan...	BCM-002 Business Continuity & Disaster...	Business Continuity, Disaster Recovery, IT Operations, Business Owners	View ↗
BCM-002-R006	Plan Distribution The organization shall distribute BCDR plans and recovery procedures to all rele...	BCM-002 Business Continuity & Disaster...	Business Continuity, Disaster Recovery, IT Operations, Business Owners	View ↗
BCM-002-R007	Plan Maintenance The organization shall maintain BCDR plans and recovery procedures, ensuring pla...	BCM-002 Business Continuity & Disaster...	Business Continuity, Disaster Recovery, IT Operations, Business Owners	View ↗
BCM-002-R008	Plan Review The organization shall conduct periodic reviews of BCDR plans and recovery proce...	BCM-002 Business Continuity & Disaster...	Business Continuity, Disaster Recovery, IT Operations, Business Owners	View ↗
BCM-002-R009	Plan Accessibility The organization shall ensure BCDR plans and recovery procedures are accessible...	BCM-002 Business Continuity & Disaster...	Business Continuity, Disaster Recovery, IT Operations, Business Owners	View ↗
BCM-002-R010	Continuous Improvement The organization shall establish a continuous improvement process for BCDR plann...	BCM-002 Business Continuity & Disaster...	Business Continuity, Disaster Recovery, IT Operations, Business Owners	View ↗
BCM-003-R001	BIA Framework The organization shall establish a Business Impact Analysis framework that defin...	BCM-003 Business Impact Analysis (BIA)	Business Continuity, Business Owners, Risk Management, IT Recovery	View ↗
BCM-003-R002	Critical Business Process Identification The organization shall identify critical business processes that must be maintai...	BCM-003 Business Impact Analysis (BIA)	Business Continuity, Business Owners, Risk Management, IT Recovery	View ↗
BCM-003-R003	Dependency Analysis The organization shall conduct dependency analysis to identify the resources, sy...	BCM-003 Business Impact Analysis (BIA)	Business Continuity, Business Owners, Risk Management, IT Recovery	View ↗
BCM-003-R004	Business Impact Assessment The organization shall conduct business impact assessments to evaluate the conse...	BCM-003 Business Impact Analysis (BIA)	Business Continuity, Business Owners, Risk Management, IT Recovery	View ↗
BCM-003-R005	Recovery Time Objectives (RTO) The organization shall define Recovery Time Objectives for critical business pro...	BCM-003 Business Impact Analysis (BIA)	Business Continuity, Business Owners, Risk Management, IT Recovery	View ↗
BCM-003-R006	Recovery Point Objectives (RPO) The organization shall define Recovery Point Objectives for critical data and sy...	BCM-003 Business Impact Analysis (BIA)	Business Continuity, Business Owners, Risk Management, IT Recovery	View ↗
BCM-003-R007	Recovery Prioritization The organization shall establish recovery prioritization based on BIA results, d...	BCM-003 Business Impact Analysis (BIA)	Business Continuity, Business Owners, Risk Management, IT Recovery	View ↗
BCM-003-R008	BIA Reporting The organization shall report on BIA results, providing visibility into critical...	BCM-003 Business Impact Analysis (BIA)	Business Continuity, Business Owners, Risk Management, IT Recovery	View ↗
BCM-003-R009	BIA Review The organization shall conduct periodic reviews of BIA activities to ensure thei...	BCM-003 Business Impact Analysis (BIA)	Business Continuity, Business Owners, Risk Management, IT Recovery	View ↗
BCM-003-R010	Continuous Improvement The organization shall establish a continuous improvement process for Business I...	BCM-003 Business Impact Analysis (BIA)	Business Continuity, Business Owners, Risk Management, IT Recovery	View ↗
BCM-004-R001	Exercise Framework The organization shall establish a BCDR exercise framework that defines the stru...	BCM-004 BCDR Testing & Exercising	Business Continuity, Disaster Recovery, IT Operations, Exercise Coordinator	View ↗
BCM-004-R002	Tabletop Exercises The organization shall conduct regular tabletop exercises to test BCDR plans, pr...	BCM-004 BCDR Testing & Exercising	Business Continuity, Disaster Recovery, IT Operations, Exercise Coordinator	View ↗
BCM-004-R003	Technical Recovery Testing The organization shall conduct technical recovery testing to verify that IT syst...	BCM-004 BCDR Testing & Exercising	Business Continuity, Disaster Recovery, IT Operations, Exercise Coordinator	View ↗
BCM-004-R004	Disaster Recovery Exercises The organization shall conduct full disaster recovery exercises to test the orga...	BCM-004 BCDR Testing & Exercising	Business Continuity, Disaster Recovery, IT Operations, Exercise Coordinator	View ↗
BCM-004-R005	Business Continuity Exercises The organization shall conduct business continuity exercises to test the organiz...	BCM-004 BCDR Testing & Exercising	Business Continuity, Disaster Recovery, IT Operations, Exercise Coordinator	View ↗
BCM-004-R006	Test Result Validation The organization shall validate BCDR test and exercise results to ensure results...	BCM-004 BCDR Testing & Exercising	Business Continuity, Disaster Recovery, IT Operations, Exercise Coordinator	View ↗
BCM-004-R007	Lessons Learned The organization shall capture and document lessons learned from BCDR tests and...	BCM-004 BCDR Testing & Exercising	Business Continuity, Disaster Recovery, IT Operations, Exercise Coordinator	View ↗
BCM-004-R008	Corrective Action Tracking The organization shall track corrective actions identified from BCDR tests and e...	BCM-004 BCDR Testing & Exercising	Business Continuity, Disaster Recovery, IT Operations, Exercise Coordinator	View ↗
BCM-004-R009	Exercise Review The organization shall conduct periodic reviews of BCDR exercise activities to e...	BCM-004 BCDR Testing & Exercising	Business Continuity, Disaster Recovery, IT Operations, Exercise Coordinator	View ↗
BCM-004-R010	Continuous Improvement The organization shall establish a continuous improvement process for BCDR testi...	BCM-004 BCDR Testing & Exercising	Business Continuity, Disaster Recovery, IT Operations, Exercise Coordinator	View ↗
BCM-005-R001	Backup Strategy The organization shall establish a backup strategy that defines the approach for...	BCM-005 Backup & Recovery Management	Backup Administration, IT Operations, Storage Engineering, Disaster Recovery	View ↗
BCM-005-R002	Backup Scheduling The organization shall establish backup schedules that ensure data is backed up...	BCM-005 Backup & Recovery Management	Backup Administration, IT Operations, Storage Engineering, Disaster Recovery	View ↗
BCM-005-R003	Backup Protection The organization shall implement protection measures for backup data to ensure i...	BCM-005 Backup & Recovery Management	Backup Administration, IT Operations, Storage Engineering, Disaster Recovery	View ↗
BCM-005-R004	Backup Retention The organization shall establish backup retention policies that define how long...	BCM-005 Backup & Recovery Management	Backup Administration, IT Operations, Storage Engineering, Disaster Recovery	View ↗
BCM-005-R005	Backup Verification The organization shall verify that backups are complete, readable, and recoverab...	BCM-005 Backup & Recovery Management	Backup Administration, IT Operations, Storage Engineering, Disaster Recovery	View ↗
BCM-005-R006	Recovery Testing The organization shall conduct regular recovery testing to verify that data can...	BCM-005 Backup & Recovery Management	Backup Administration, IT Operations, Storage Engineering, Disaster Recovery	View ↗
BCM-005-R007	Data Restoration The organization shall restore data from backups in the event of data loss, corr...	BCM-005 Backup & Recovery Management	Backup Administration, IT Operations, Storage Engineering, Disaster Recovery	View ↗
BCM-005-R008	Recovery Reporting The organization shall report on backup and recovery activities, providing visib...	BCM-005 Backup & Recovery Management	Backup Administration, IT Operations, Storage Engineering, Disaster Recovery	View ↗
BCM-005-R009	Recovery Review The organization shall conduct periodic reviews of backup and recovery activitie...	BCM-005 Backup & Recovery Management	Backup Administration, IT Operations, Storage Engineering, Disaster Recovery	View ↗
BCM-005-R010	Continuous Improvement The organization shall establish a continuous improvement process for backup and...	BCM-005 Backup & Recovery Management	Backup Administration, IT Operations, Storage Engineering, Disaster Recovery	View ↗
BCM-006-R001	Recovery Infrastructure Framework The organization shall establish a recovery infrastructure framework that define...	BCM-006 Recovery Infrastructure Manage...	Disaster Recovery, Infrastructure Engineering, IT Operations, Facilities	View ↗
BCM-006-R002	Alternate Processing Site The organization shall establish an alternate processing site that can support c...	BCM-006 Recovery Infrastructure Manage...	Disaster Recovery, Infrastructure Engineering, IT Operations, Facilities	View ↗
BCM-006-R003	Alternate Storage Site The organization shall establish an alternate storage site for backup data and r...	BCM-006 Recovery Infrastructure Manage...	Disaster Recovery, Infrastructure Engineering, IT Operations, Facilities	View ↗
BCM-006-R004	Failover Capability The organization shall implement failover capabilities that enable the rapid tra...	BCM-006 Recovery Infrastructure Manage...	Disaster Recovery, Infrastructure Engineering, IT Operations, Facilities	View ↗
BCM-006-R005	High Availability The organization shall implement high availability capabilities for critical sys...	BCM-006 Recovery Infrastructure Manage...	Disaster Recovery, Infrastructure Engineering, IT Operations, Facilities	View ↗
BCM-006-R006	Recovery Resources The organization shall ensure the necessary resources, including personnel, equi...	BCM-006 Recovery Infrastructure Manage...	Disaster Recovery, Infrastructure Engineering, IT Operations, Facilities	View ↗
BCM-006-R007	Infrastructure Validation The organization shall validate that recovery infrastructure is operational and...	BCM-006 Recovery Infrastructure Manage...	Disaster Recovery, Infrastructure Engineering, IT Operations, Facilities	View ↗
BCM-006-R008	Recovery Monitoring The organization shall monitor recovery infrastructure to ensure systems remain...	BCM-006 Recovery Infrastructure Manage...	Disaster Recovery, Infrastructure Engineering, IT Operations, Facilities	View ↗
BCM-006-R009	Recovery Review The organization shall conduct periodic reviews of recovery infrastructure manag...	BCM-006 Recovery Infrastructure Manage...	Disaster Recovery, Infrastructure Engineering, IT Operations, Facilities	View ↗
BCM-006-R010	Continuous Improvement The organization shall establish a continuous improvement process for recovery i...	BCM-006 Recovery Infrastructure Manage...	Disaster Recovery, Infrastructure Engineering, IT Operations, Facilities	View ↗
OPR-001-R001	Operational Resilience Framework The organization shall establish an operational resilience framework that define...	OPR-001 Operational Resilience Program	Operational Resilience, Risk Management, Executive Management, CISO	View ↗
OPR-001-R002	Resilience Strategy The organization shall define an operational resilience strategy that articulate...	OPR-001 Operational Resilience Program	Operational Resilience, Risk Management, Executive Management, CISO	View ↗
OPR-001-R003	Governance Structure The organization shall establish governance structures for operational resilienc...	OPR-001 Operational Resilience Program	Operational Resilience, Risk Management, Executive Management, CISO	View ↗
OPR-001-R004	Roles & Responsibilities The organization shall clearly define and document the roles and responsibilitie...	OPR-001 Operational Resilience Program	Operational Resilience, Risk Management, Executive Management, CISO	View ↗
OPR-001-R005	Resilience Objectives The organization shall define resilience objectives that articulate the organiza...	OPR-001 Operational Resilience Program	Operational Resilience, Risk Management, Executive Management, CISO	View ↗
OPR-001-R006	Resilience Metrics The organization shall define and track key metrics for operational resilience t...	OPR-001 Operational Resilience Program	Operational Resilience, Risk Management, Executive Management, CISO	View ↗
OPR-001-R007	Performance Monitoring The organization shall monitor operational resilience performance to ensure resi...	OPR-001 Operational Resilience Program	Operational Resilience, Risk Management, Executive Management, CISO	View ↗
OPR-001-R008	Executive Reporting The organization shall provide executive leadership and the board with regular r...	OPR-001 Operational Resilience Program	Operational Resilience, Risk Management, Executive Management, CISO	View ↗
OPR-001-R009	Program Review The organization shall conduct periodic reviews of the operational resilience pr...	OPR-001 Operational Resilience Program	Operational Resilience, Risk Management, Executive Management, CISO	View ↗
OPR-001-R010	Continuous Improvement The organization shall establish a continuous improvement process for operationa...	OPR-001 Operational Resilience Program	Operational Resilience, Risk Management, Executive Management, CISO	View ↗
OPR-002-R001	Critical Service Identification The organization shall identify critical business services that are essential to...	OPR-002 Critical Business Service Mana...	Operational Resilience, Business Owners, Service Management	View ↗
OPR-002-R002	Business Service Classification The organization shall establish a classification schema for business services t...	OPR-002 Critical Business Service Mana...	Operational Resilience, Business Owners, Service Management	View ↗
OPR-002-R003	Service Ownership The organization shall assign explicit ownership for each critical business serv...	OPR-002 Critical Business Service Mana...	Operational Resilience, Business Owners, Service Management	View ↗
OPR-002-R004	Service Documentation The organization shall maintain comprehensive documentation for critical busines...	OPR-002 Critical Business Service Mana...	Operational Resilience, Business Owners, Service Management	View ↗
OPR-002-R005	Service Prioritization The organization shall establish service prioritization based on criticality ass...	OPR-002 Critical Business Service Mana...	Operational Resilience, Business Owners, Service Management	View ↗
OPR-002-R006	Critical Service Review The organization shall conduct periodic reviews of critical business service ide...	OPR-002 Critical Business Service Mana...	Operational Resilience, Business Owners, Service Management	View ↗
OPR-002-R007	Service Monitoring The organization shall monitor critical business services to ensure their contin...	OPR-002 Critical Business Service Mana...	Operational Resilience, Business Owners, Service Management	View ↗
OPR-002-R008	Service Reporting The organization shall report on critical business services, providing visibilit...	OPR-002 Critical Business Service Mana...	Operational Resilience, Business Owners, Service Management	View ↗
OPR-002-R009	Service Governance The organization shall establish governance processes for critical business serv...	OPR-002 Critical Business Service Mana...	Operational Resilience, Business Owners, Service Management	View ↗
OPR-002-R010	Continuous Improvement The organization shall establish a continuous improvement process for critical b...	OPR-002 Critical Business Service Mana...	Operational Resilience, Business Owners, Service Management	View ↗
OPR-003-R001	Dependency Identification The organization shall identify all dependencies that support critical business...	OPR-003 Operational Dependency Managem...	Operational Resilience, Enterprise Architecture, IT Operations, Third-Party Risk	View ↗
OPR-003-R002	Technology Dependency Mapping The organization shall map technology dependencies for critical business service...	OPR-003 Operational Dependency Managem...	Operational Resilience, Enterprise Architecture, IT Operations, Third-Party Risk	View ↗
OPR-003-R003	Third-Party Dependency Mapping The organization shall map third-party dependencies for critical business servic...	OPR-003 Operational Dependency Managem...	Operational Resilience, Enterprise Architecture, IT Operations, Third-Party Risk	View ↗
OPR-003-R004	People Dependency Mapping The organization shall map people dependencies for critical business services, i...	OPR-003 Operational Dependency Managem...	Operational Resilience, Enterprise Architecture, IT Operations, Third-Party Risk	View ↗
OPR-003-R005	Facility Dependency Mapping The organization shall map facility dependencies for critical business services,...	OPR-003 Operational Dependency Managem...	Operational Resilience, Enterprise Architecture, IT Operations, Third-Party Risk	View ↗
OPR-003-R006	Dependency Risk Assessment The organization shall conduct risk assessments for critical dependencies to eva...	OPR-003 Operational Dependency Managem...	Operational Resilience, Enterprise Architecture, IT Operations, Third-Party Risk	View ↗
OPR-003-R007	Dependency Monitoring The organization shall monitor critical dependencies to ensure their continued a...	OPR-003 Operational Dependency Managem...	Operational Resilience, Enterprise Architecture, IT Operations, Third-Party Risk	View ↗
OPR-003-R008	Dependency Reporting The organization shall report on dependency management, providing visibility int...	OPR-003 Operational Dependency Managem...	Operational Resilience, Enterprise Architecture, IT Operations, Third-Party Risk	View ↗
OPR-003-R009	Dependency Review The organization shall conduct periodic reviews of dependency management activit...	OPR-003 Operational Dependency Managem...	Operational Resilience, Enterprise Architecture, IT Operations, Third-Party Risk	View ↗
OPR-003-R010	Continuous Improvement The organization shall establish a continuous improvement process for dependency...	OPR-003 Operational Dependency Managem...	Operational Resilience, Enterprise Architecture, IT Operations, Third-Party Risk	View ↗
OPR-004-R001	Impact Tolerance Framework The organization shall establish an impact tolerance framework that defines the...	OPR-004 Impact Tolerance & Criticality...	Operational Resilience, Business Owners, Risk Management	View ↗
OPR-004-R002	Criticality Assessment The organization shall conduct criticality assessments for business services to...	OPR-004 Impact Tolerance & Criticality...	Operational Resilience, Business Owners, Risk Management	View ↗
OPR-004-R003	Impact Analysis The organization shall conduct impact analysis for critical business services to...	OPR-004 Impact Tolerance & Criticality...	Operational Resilience, Business Owners, Risk Management	View ↗
OPR-004-R004	Tolerance Approval The organization shall approve impact tolerance levels for critical business ser...	OPR-004 Impact Tolerance & Criticality...	Operational Resilience, Business Owners, Risk Management	View ↗
OPR-004-R005	Threshold Monitoring The organization shall monitor impact tolerance thresholds to ensure tolerance l...	OPR-004 Impact Tolerance & Criticality...	Operational Resilience, Business Owners, Risk Management	View ↗
OPR-004-R006	Exception Management The organization shall manage exceptions to impact tolerance levels, ensuring de...	OPR-004 Impact Tolerance & Criticality...	Operational Resilience, Business Owners, Risk Management	View ↗
OPR-004-R007	Tolerance Reporting The organization shall report on impact tolerance management, providing visibili...	OPR-004 Impact Tolerance & Criticality...	Operational Resilience, Business Owners, Risk Management	View ↗
OPR-004-R008	Tolerance Review The organization shall conduct periodic reviews of impact tolerance levels to en...	OPR-004 Impact Tolerance & Criticality...	Operational Resilience, Business Owners, Risk Management	View ↗
OPR-004-R009	Business Validation The organization shall validate impact tolerance levels with business stakeholde...	OPR-004 Impact Tolerance & Criticality...	Operational Resilience, Business Owners, Risk Management	View ↗
OPR-004-R010	Continuous Improvement The organization shall establish a continuous improvement process for impact tol...	OPR-004 Impact Tolerance & Criticality...	Operational Resilience, Business Owners, Risk Management	View ↗
OPR-005-R001	Testing Framework The organization shall establish an operational resilience testing framework tha...	OPR-005 Operational Resilience Testing	Operational Resilience, Business Continuity, IT Operations, Risk Management	View ↗
OPR-005-R002	Scenario Testing The organization shall conduct scenario-based resilience testing to evaluate the...	OPR-005 Operational Resilience Testing	Operational Resilience, Business Continuity, IT Operations, Risk Management	View ↗
OPR-005-R003	Stress Testing The organization shall conduct stress testing to evaluate the organization's res...	OPR-005 Operational Resilience Testing	Operational Resilience, Business Continuity, IT Operations, Risk Management	View ↗
OPR-005-R004	Simulation Exercises The organization shall conduct simulation exercises to test resilience procedure...	OPR-005 Operational Resilience Testing	Operational Resilience, Business Continuity, IT Operations, Risk Management	View ↗
OPR-005-R005	Recovery Validation The organization shall validate recovery capabilities to ensure services can be...	OPR-005 Operational Resilience Testing	Operational Resilience, Business Continuity, IT Operations, Risk Management	View ↗
OPR-005-R006	Test Result Analysis The organization shall analyze resilience test results to identify trends, patte...	OPR-005 Operational Resilience Testing	Operational Resilience, Business Continuity, IT Operations, Risk Management	View ↗
OPR-005-R007	Corrective Action Management The organization shall track corrective actions identified from resilience tests...	OPR-005 Operational Resilience Testing	Operational Resilience, Business Continuity, IT Operations, Risk Management	View ↗
OPR-005-R008	Testing Reporting The organization shall report on resilience testing, providing visibility into t...	OPR-005 Operational Resilience Testing	Operational Resilience, Business Continuity, IT Operations, Risk Management	View ↗
OPR-005-R009	Testing Review The organization shall conduct periodic reviews of resilience testing activities...	OPR-005 Operational Resilience Testing	Operational Resilience, Business Continuity, IT Operations, Risk Management	View ↗
OPR-005-R010	Continuous Improvement The organization shall establish a continuous improvement process for operationa...	OPR-005 Operational Resilience Testing	Operational Resilience, Business Continuity, IT Operations, Risk Management	View ↗
OPR-006-R001	Third-Party Resilience Framework The organization shall establish a third-party resilience framework that defines...	OPR-006 Third-Party & Supply Chain Res...	Third-Party Risk Management, Procurement, Operational Resilience, Business Owners	View ↗
OPR-006-R002	Supplier Criticality Assessment The organization shall conduct criticality assessments for suppliers and third-p...	OPR-006 Third-Party & Supply Chain Res...	Third-Party Risk Management, Procurement, Operational Resilience, Business Owners	View ↗
OPR-006-R003	Supply Chain Dependency Assessment The organization shall conduct assessments of supply chain dependencies to ident...	OPR-006 Third-Party & Supply Chain Res...	Third-Party Risk Management, Procurement, Operational Resilience, Business Owners	View ↗
OPR-006-R004	Third-Party Resilience Monitoring The organization shall monitor third-party resilience to ensure suppliers mainta...	OPR-006 Third-Party & Supply Chain Res...	Third-Party Risk Management, Procurement, Operational Resilience, Business Owners	View ↗
OPR-006-R005	Supplier Disruption Planning The organization shall plan for supplier disruptions, including identification o...	OPR-006 Third-Party & Supply Chain Res...	Third-Party Risk Management, Procurement, Operational Resilience, Business Owners	View ↗
OPR-006-R006	Contingency Planning The organization shall develop contingency plans for critical third-party servic...	OPR-006 Third-Party & Supply Chain Res...	Third-Party Risk Management, Procurement, Operational Resilience, Business Owners	View ↗
OPR-006-R007	Resilience Reporting The organization shall report on third-party resilience, providing visibility in...	OPR-006 Third-Party & Supply Chain Res...	Third-Party Risk Management, Procurement, Operational Resilience, Business Owners	View ↗
OPR-006-R008	Third-Party Review The organization shall conduct periodic reviews of third-party resilience manage...	OPR-006 Third-Party & Supply Chain Res...	Third-Party Risk Management, Procurement, Operational Resilience, Business Owners	View ↗
OPR-006-R009	Exit & Substitution Planning The organization shall develop exit and substitution plans for critical third-pa...	OPR-006 Third-Party & Supply Chain Res...	Third-Party Risk Management, Procurement, Operational Resilience, Business Owners	View ↗
OPR-006-R010	Continuous Improvement The organization shall establish a continuous improvement process for third-part...	OPR-006 Third-Party & Supply Chain Res...	Third-Party Risk Management, Procurement, Operational Resilience, Business Owners	View ↗
PHY-001-R001	Physical Security Governance The organization shall establish a physical security governance framework that d...	PHY-001 Physical Security & Facility A...	Physical Security, Facilities, Security Operations, HR	View ↗
PHY-001-R002	Facility Access Authorization The organization shall authorize facility access for personnel, contractors, and...	PHY-001 Physical Security & Facility A...	Physical Security, Facilities, Security Operations, HR	View ↗
PHY-001-R003	Physical Access Control The organization shall implement physical access controls to restrict entry to f...	PHY-001 Physical Security & Facility A...	Physical Security, Facilities, Security Operations, HR	View ↗
PHY-001-R004	Visitor Management The organization shall manage visitor access to facilities, including registrati...	PHY-001 Physical Security & Facility A...	Physical Security, Facilities, Security Operations, HR	View ↗
PHY-001-R005	Identification & Badging The organization shall implement identification and badging systems that enable...	PHY-001 Physical Security & Facility A...	Physical Security, Facilities, Security Operations, HR	View ↗
PHY-001-R006	Perimeter Security The organization shall implement perimeter security controls to protect faciliti...	PHY-001 Physical Security & Facility A...	Physical Security, Facilities, Security Operations, HR	View ↗
PHY-001-R007	Surveillance Monitoring The organization shall implement surveillance monitoring capabilities to detect...	PHY-001 Physical Security & Facility A...	Physical Security, Facilities, Security Operations, HR	View ↗
PHY-001-R008	Physical Access Review The organization shall conduct periodic reviews of physical access controls and...	PHY-001 Physical Security & Facility A...	Physical Security, Facilities, Security Operations, HR	View ↗
PHY-001-R009	Physical Access Logging The organization shall maintain comprehensive logs of physical access activities...	PHY-001 Physical Security & Facility A...	Physical Security, Facilities, Security Operations, HR	View ↗
PHY-001-R010	Continuous Improvement The organization shall establish a continuous improvement process for physical s...	PHY-001 Physical Security & Facility A...	Physical Security, Facilities, Security Operations, HR	View ↗
PHY-002-R001	Environmental Protection Framework The organization shall establish an environmental and infrastructure protection...	PHY-002 Environmental & Infrastructure...	Facilities, Physical Security, Infrastructure Operations, Business Continuity	View ↗
PHY-002-R002	Power Protection The organization shall implement power protection controls to ensure the availab...	PHY-002 Environmental & Infrastructure...	Facilities, Physical Security, Infrastructure Operations, Business Continuity	View ↗
PHY-002-R003	Cooling Management The organization shall implement cooling management controls to maintain appropr...	PHY-002 Environmental & Infrastructure...	Facilities, Physical Security, Infrastructure Operations, Business Continuity	View ↗
PHY-002-R004	Fire Detection The organization shall implement fire detection systems to provide early warning...	PHY-002 Environmental & Infrastructure...	Facilities, Physical Security, Infrastructure Operations, Business Continuity	View ↗
PHY-002-R005	Fire Suppression The organization shall implement fire suppression systems to control and extingu...	PHY-002 Environmental & Infrastructure...	Facilities, Physical Security, Infrastructure Operations, Business Continuity	View ↗
PHY-002-R006	Water Protection The organization shall implement water protection controls to prevent damage fro...	PHY-002 Environmental & Infrastructure...	Facilities, Physical Security, Infrastructure Operations, Business Continuity	View ↗
PHY-002-R007	Environmental Monitoring The organization shall monitor environmental conditions to ensure facilities and...	PHY-002 Environmental & Infrastructure...	Facilities, Physical Security, Infrastructure Operations, Business Continuity	View ↗
PHY-002-R008	Utility Redundancy The organization shall implement utility redundancy controls to ensure the avail...	PHY-002 Environmental & Infrastructure...	Facilities, Physical Security, Infrastructure Operations, Business Continuity	View ↗
PHY-002-R009	Environmental Review The organization shall conduct periodic reviews of environmental and infrastruct...	PHY-002 Environmental & Infrastructure...	Facilities, Physical Security, Infrastructure Operations, Business Continuity	View ↗
PHY-002-R010	Continuous Improvement The organization shall establish a continuous improvement process for environmen...	PHY-002 Environmental & Infrastructure...	Facilities, Physical Security, Infrastructure Operations, Business Continuity	View ↗
PHY-003-R001	Data Center Security Framework The organization shall establish a data center and critical facility security fr...	PHY-003 Data Center & Critical Facilit...	Data Center Operations, Physical Security, Facilities, IT Operations	View ↗
PHY-003-R002	Restricted Access The organization shall implement restricted access controls for data centers and...	PHY-003 Data Center & Critical Facilit...	Data Center Operations, Physical Security, Facilities, IT Operations	View ↗
PHY-003-R003	Server Room Protection The organization shall implement protection controls for server rooms and comput...	PHY-003 Data Center & Critical Facilit...	Data Center Operations, Physical Security, Facilities, IT Operations	View ↗
PHY-003-R004	Communication Room Security The organization shall implement security controls for communication rooms and t...	PHY-003 Data Center & Critical Facilit...	Data Center Operations, Physical Security, Facilities, IT Operations	View ↗
PHY-003-R005	Facility Monitoring The organization shall monitor data centers and critical facilities to ensure th...	PHY-003 Data Center & Critical Facilit...	Data Center Operations, Physical Security, Facilities, IT Operations	View ↗
PHY-003-R006	Physical Inspection The organization shall conduct regular physical inspections of data centers and...	PHY-003 Data Center & Critical Facilit...	Data Center Operations, Physical Security, Facilities, IT Operations	View ↗
PHY-003-R007	Critical Facility Review The organization shall conduct periodic reviews of critical facility security to...	PHY-003 Data Center & Critical Facilit...	Data Center Operations, Physical Security, Facilities, IT Operations	View ↗
PHY-003-R008	Security Logging The organization shall maintain comprehensive logs of security events in data ce...	PHY-003 Data Center & Critical Facilit...	Data Center Operations, Physical Security, Facilities, IT Operations	View ↗
PHY-003-R009	Compliance Review The organization shall conduct compliance reviews of data center and critical fa...	PHY-003 Data Center & Critical Facilit...	Data Center Operations, Physical Security, Facilities, IT Operations	View ↗
PHY-003-R010	Continuous Improvement The organization shall establish a continuous improvement process for data cente...	PHY-003 Data Center & Critical Facilit...	Data Center Operations, Physical Security, Facilities, IT Operations	View ↗
PHY-004-R001	Equipment Protection Framework The organization shall establish an equipment protection framework that defines...	PHY-004 Sensitive Asset & Equipment Pr...	IT Asset Management, Physical Security, Facilities, IT Operations	View ↗
PHY-004-R002	Equipment Inventory The organization shall maintain a comprehensive inventory of sensitive equipment...	PHY-004 Sensitive Asset & Equipment Pr...	IT Asset Management, Physical Security, Facilities, IT Operations	View ↗
PHY-004-R003	Physical Asset Protection The organization shall implement physical protection controls for sensitive equi...	PHY-004 Sensitive Asset & Equipment Pr...	IT Asset Management, Physical Security, Facilities, IT Operations	View ↗
PHY-004-R004	Tamper Protection The organization shall implement tamper protection controls for sensitive equipm...	PHY-004 Sensitive Asset & Equipment Pr...	IT Asset Management, Physical Security, Facilities, IT Operations	View ↗
PHY-004-R005	Equipment Relocation The organization shall relocate sensitive equipment and assets securely, ensurin...	PHY-004 Sensitive Asset & Equipment Pr...	IT Asset Management, Physical Security, Facilities, IT Operations	View ↗
PHY-004-R006	Equipment Inspection The organization shall conduct regular physical inspections of sensitive equipme...	PHY-004 Sensitive Asset & Equipment Pr...	IT Asset Management, Physical Security, Facilities, IT Operations	View ↗
PHY-004-R007	Theft Prevention The organization shall implement theft prevention measures for sensitive equipme...	PHY-004 Sensitive Asset & Equipment Pr...	IT Asset Management, Physical Security, Facilities, IT Operations	View ↗
PHY-004-R008	Asset Monitoring The organization shall monitor sensitive equipment to ensure continued protectio...	PHY-004 Sensitive Asset & Equipment Pr...	IT Asset Management, Physical Security, Facilities, IT Operations	View ↗
PHY-004-R009	Asset Review The organization shall conduct periodic reviews of equipment protection activiti...	PHY-004 Sensitive Asset & Equipment Pr...	IT Asset Management, Physical Security, Facilities, IT Operations	View ↗
PHY-004-R010	Continuous Improvement The organization shall establish a continuous improvement process for equipment...	PHY-004 Sensitive Asset & Equipment Pr...	IT Asset Management, Physical Security, Facilities, IT Operations	View ↗
PHY-005-R001	Media Classification The organization shall establish a classification schema for physical media that...	PHY-005 Physical Media Handling & Secu...	Records Management, IT Asset Management, Information Security, Physical Security	View ↗
PHY-005-R002	Media Storage The organization shall implement secure storage controls for physical media, ens...	PHY-005 Physical Media Handling & Secu...	Records Management, IT Asset Management, Information Security, Physical Security	View ↗
PHY-005-R003	Media Transportation The organization shall transport physical media securely, ensuring media is prot...	PHY-005 Physical Media Handling & Secu...	Records Management, IT Asset Management, Information Security, Physical Security	View ↗
PHY-005-R004	Media Reuse The organization shall reuse physical media securely, ensuring data is properly...	PHY-005 Physical Media Handling & Secu...	Records Management, IT Asset Management, Information Security, Physical Security	View ↗
PHY-005-R005	Media Destruction The organization shall physically destroy media that cannot be reused or require...	PHY-005 Physical Media Handling & Secu...	Records Management, IT Asset Management, Information Security, Physical Security	View ↗
PHY-005-R006	Disposal Authorization The organization shall authorize the disposal of physical media, ensuring dispos...	PHY-005 Physical Media Handling & Secu...	Records Management, IT Asset Management, Information Security, Physical Security	View ↗
PHY-005-R007	Disposal Verification The organization shall verify that media disposal activities have been completed...	PHY-005 Physical Media Handling & Secu...	Records Management, IT Asset Management, Information Security, Physical Security	View ↗
PHY-005-R008	Disposal Documentation The organization shall maintain comprehensive documentation of media disposal ac...	PHY-005 Physical Media Handling & Secu...	Records Management, IT Asset Management, Information Security, Physical Security	View ↗
PHY-005-R009	Media Review The organization shall conduct periodic reviews of media handling and disposal a...	PHY-005 Physical Media Handling & Secu...	Records Management, IT Asset Management, Information Security, Physical Security	View ↗
PHY-005-R010	Continuous Improvement The organization shall establish a continuous improvement process for physical m...	PHY-005 Physical Media Handling & Secu...	Records Management, IT Asset Management, Information Security, Physical Security	View ↗
PHY-006-R001	Emergency Preparedness Framework The organization shall establish a physical emergency preparedness framework tha...	PHY-006 Physical Emergency Preparednes...	Facilities, Physical Security, Business Continuity, Emergency Management	View ↗
PHY-006-R002	Emergency Procedures The organization shall establish emergency procedures for responding to physical...	PHY-006 Physical Emergency Preparednes...	Facilities, Physical Security, Business Continuity, Emergency Management	View ↗
PHY-006-R003	Evacuation Planning The organization shall develop evacuation plans for facilities, including evacua...	PHY-006 Physical Emergency Preparednes...	Facilities, Physical Security, Business Continuity, Emergency Management	View ↗
PHY-006-R004	Emergency Communication The organization shall establish emergency communication capabilities to ensure...	PHY-006 Physical Emergency Preparednes...	Facilities, Physical Security, Business Continuity, Emergency Management	View ↗
PHY-006-R005	Emergency Response Resources The organization shall ensure emergency response resources, including equipment,...	PHY-006 Physical Emergency Preparednes...	Facilities, Physical Security, Business Continuity, Emergency Management	View ↗
PHY-006-R006	Emergency Drills The organization shall conduct regular emergency drills to test emergency proced...	PHY-006 Physical Emergency Preparednes...	Facilities, Physical Security, Business Continuity, Emergency Management	View ↗
PHY-006-R007	Incident Coordination The organization shall coordinate emergency response activities, including the d...	PHY-006 Physical Emergency Preparednes...	Facilities, Physical Security, Business Continuity, Emergency Management	View ↗
PHY-006-R008	Recovery Activities The organization shall recover following physical emergencies, including damage...	PHY-006 Physical Emergency Preparednes...	Facilities, Physical Security, Business Continuity, Emergency Management	View ↗
PHY-006-R009	Emergency Review The organization shall conduct periodic reviews of emergency preparedness and re...	PHY-006 Physical Emergency Preparednes...	Facilities, Physical Security, Business Continuity, Emergency Management	View ↗
PHY-006-R010	Continuous Improvement The organization shall establish a continuous improvement process for physical e...	PHY-006 Physical Emergency Preparednes...	Facilities, Physical Security, Business Continuity, Emergency Management	View ↗
TPR-001-R001	TPRM Governance Framework The organization shall establish a Third-Party Risk Management governance framew...	TPR-001 Third-Party Risk Management Pr...	Third-Party Risk Management, Procurement, Risk Management, CISO	View ↗
TPR-001-R002	Program Scope The organization shall define a documented scope for the TPRM program that ident...	TPR-001 Third-Party Risk Management Pr...	Third-Party Risk Management, Procurement, Risk Management, CISO	View ↗
TPR-001-R003	Third-Party Classification The organization shall establish a classification schema for third-party relatio...	TPR-001 Third-Party Risk Management Pr...	Third-Party Risk Management, Procurement, Risk Management, CISO	View ↗
TPR-001-R004	Roles & Responsibilities The organization shall clearly define and document the roles and responsibilitie...	TPR-001 Third-Party Risk Management Pr...	Third-Party Risk Management, Procurement, Risk Management, CISO	View ↗
TPR-001-R005	Risk Governance The organization shall establish governance processes for third-party risk manag...	TPR-001 Third-Party Risk Management Pr...	Third-Party Risk Management, Procurement, Risk Management, CISO	View ↗
TPR-001-R006	Program Metrics The organization shall define and track key metrics for the TPRM program that pr...	TPR-001 Third-Party Risk Management Pr...	Third-Party Risk Management, Procurement, Risk Management, CISO	View ↗
TPR-001-R007	Executive Reporting The organization shall provide executive leadership and the board with regular r...	TPR-001 Third-Party Risk Management Pr...	Third-Party Risk Management, Procurement, Risk Management, CISO	View ↗
TPR-001-R008	Program Review The organization shall conduct periodic reviews of the TPRM program to assess it...	TPR-001 Third-Party Risk Management Pr...	Third-Party Risk Management, Procurement, Risk Management, CISO	View ↗
TPR-001-R009	Program Compliance The organization shall ensure the TPRM program complies with applicable legal, r...	TPR-001 Third-Party Risk Management Pr...	Third-Party Risk Management, Procurement, Risk Management, CISO	View ↗
TPR-001-R010	Continuous Improvement The organization shall establish a continuous improvement process for the TPRM p...	TPR-001 Third-Party Risk Management Pr...	Third-Party Risk Management, Procurement, Risk Management, CISO	View ↗
TPR-002-R001	Due Diligence Framework The organization shall establish a due diligence framework that defines the stru...	TPR-002 Third-Party Risk Assessment &...	Third-Party Risk Management, Information Security, Privacy, Finance, Compliance	View ↗
TPR-002-R002	Vendor Risk Assessment The organization shall conduct comprehensive risk assessments of third-party ven...	TPR-002 Third-Party Risk Assessment &...	Third-Party Risk Management, Information Security, Privacy, Finance, Compliance	View ↗
TPR-002-R003	Security Assessment The organization shall conduct security assessments of third-party vendors to ev...	TPR-002 Third-Party Risk Assessment &...	Third-Party Risk Management, Information Security, Privacy, Finance, Compliance	View ↗
TPR-002-R004	Privacy Assessment The organization shall conduct privacy assessments of third-party vendors to eva...	TPR-002 Third-Party Risk Assessment &...	Third-Party Risk Management, Information Security, Privacy, Finance, Compliance	View ↗
TPR-002-R005	Financial Assessment The organization shall conduct financial assessments of third-party vendors to e...	TPR-002 Third-Party Risk Assessment &...	Third-Party Risk Management, Information Security, Privacy, Finance, Compliance	View ↗
TPR-002-R006	Risk Scoring The organization shall apply risk scoring methodologies to quantify and prioriti...	TPR-002 Third-Party Risk Assessment &...	Third-Party Risk Management, Information Security, Privacy, Finance, Compliance	View ↗
TPR-002-R007	Risk Acceptance The organization shall accept third-party risks that exceed defined thresholds,...	TPR-002 Third-Party Risk Assessment &...	Third-Party Risk Management, Information Security, Privacy, Finance, Compliance	View ↗
TPR-002-R008	Assessment Reporting The organization shall report on third-party risk assessments, providing visibil...	TPR-002 Third-Party Risk Assessment &...	Third-Party Risk Management, Information Security, Privacy, Finance, Compliance	View ↗
TPR-002-R009	Assessment Review The organization shall conduct periodic reviews of third-party risk assessment a...	TPR-002 Third-Party Risk Assessment &...	Third-Party Risk Management, Information Security, Privacy, Finance, Compliance	View ↗
TPR-002-R010	Continuous Improvement The organization shall establish a continuous improvement process for third-part...	TPR-002 Third-Party Risk Assessment &...	Third-Party Risk Management, Information Security, Privacy, Finance, Compliance	View ↗
TPR-003-R001	Contract Requirements The organization shall establish contract requirements for third-party relations...	TPR-003 Third-Party Contract & Complia...	Procurement, Legal, Third-Party Risk Management, Compliance, Information Security	View ↗
TPR-003-R002	Security Clauses The organization shall include security clauses in third-party contracts that de...	TPR-003 Third-Party Contract & Complia...	Procurement, Legal, Third-Party Risk Management, Compliance, Information Security	View ↗
TPR-003-R003	Privacy Clauses The organization shall include privacy clauses in third-party contracts that def...	TPR-003 Third-Party Contract & Complia...	Procurement, Legal, Third-Party Risk Management, Compliance, Information Security	View ↗
TPR-003-R004	Audit Rights The organization shall include audit rights clauses in third-party contracts tha...	TPR-003 Third-Party Contract & Complia...	Procurement, Legal, Third-Party Risk Management, Compliance, Information Security	View ↗
TPR-003-R005	Regulatory Obligations The organization shall include regulatory compliance clauses in third-party cont...	TPR-003 Third-Party Contract & Complia...	Procurement, Legal, Third-Party Risk Management, Compliance, Information Security	View ↗
TPR-003-R006	SLA Management The organization shall establish and manage Service Level Agreements with third-...	TPR-003 Third-Party Contract & Complia...	Procurement, Legal, Third-Party Risk Management, Compliance, Information Security	View ↗
TPR-003-R007	Compliance Verification The organization shall verify third-party compliance with contractual obligation...	TPR-003 Third-Party Contract & Complia...	Procurement, Legal, Third-Party Risk Management, Compliance, Information Security	View ↗
TPR-003-R008	Contract Review The organization shall conduct periodic reviews of third-party contracts to ensu...	TPR-003 Third-Party Contract & Complia...	Procurement, Legal, Third-Party Risk Management, Compliance, Information Security	View ↗
TPR-003-R009	Contract Maintenance The organization shall maintain third-party contracts, including amendments, ren...	TPR-003 Third-Party Contract & Complia...	Procurement, Legal, Third-Party Risk Management, Compliance, Information Security	View ↗
TPR-003-R010	Continuous Improvement The organization shall establish a continuous improvement process for contract a...	TPR-003 Third-Party Contract & Complia...	Procurement, Legal, Third-Party Risk Management, Compliance, Information Security	View ↗
TPR-004-R001	Monitoring Framework The organization shall establish a third-party continuous monitoring framework t...	TPR-004 Third-Party Continuous Monitor...	Third-Party Risk Management, Security Operations, Procurement, Service Management	View ↗
TPR-004-R002	Continuous Risk Monitoring The organization shall continuously monitor third-party risks, including securit...	TPR-004 Third-Party Continuous Monitor...	Third-Party Risk Management, Security Operations, Procurement, Service Management	View ↗
TPR-004-R003	Security Performance Monitoring The organization shall monitor third-party security performance, including secur...	TPR-004 Third-Party Continuous Monitor...	Third-Party Risk Management, Security Operations, Procurement, Service Management	View ↗
TPR-004-R004	Incident Coordination The organization shall coordinate security incidents involving third-party vendo...	TPR-004 Third-Party Continuous Monitor...	Third-Party Risk Management, Security Operations, Procurement, Service Management	View ↗
TPR-004-R005	Fourth-Party Oversight The organization shall oversee fourth-party relationships, including subcontract...	TPR-004 Third-Party Continuous Monitor...	Third-Party Risk Management, Security Operations, Procurement, Service Management	View ↗
TPR-004-R006	Compliance Monitoring The organization shall monitor third-party compliance with legal, regulatory, an...	TPR-004 Third-Party Continuous Monitor...	Third-Party Risk Management, Security Operations, Procurement, Service Management	View ↗
TPR-004-R007	Performance Reporting The organization shall report on third-party performance monitoring, providing v...	TPR-004 Third-Party Continuous Monitor...	Third-Party Risk Management, Security Operations, Procurement, Service Management	View ↗
TPR-004-R008	Assurance Reviews The organization shall conduct periodic assurance reviews of third-party risk ma...	TPR-004 Third-Party Continuous Monitor...	Third-Party Risk Management, Security Operations, Procurement, Service Management	View ↗
TPR-004-R009	Monitoring Review The organization shall conduct periodic reviews of third-party monitoring activi...	TPR-004 Third-Party Continuous Monitor...	Third-Party Risk Management, Security Operations, Procurement, Service Management	View ↗
TPR-004-R010	Continuous Improvement The organization shall establish a continuous improvement process for third-part...	TPR-004 Third-Party Continuous Monitor...	Third-Party Risk Management, Security Operations, Procurement, Service Management	View ↗
TPR-005-R001	Vendor Onboarding The organization shall onboard third-party vendors and service providers, ensuri...	TPR-005 Third-Party Lifecycle & Offboa...	Third-Party Risk Management, Procurement, Legal, IT Operations, Information Security	View ↗
TPR-005-R002	Relationship Management The organization shall manage third-party relationships throughout the lifecycle...	TPR-005 Third-Party Lifecycle & Offboa...	Third-Party Risk Management, Procurement, Legal, IT Operations, Information Security	View ↗
TPR-005-R003	Change Management The organization shall manage changes in third-party relationships, including ch...	TPR-005 Third-Party Lifecycle & Offboa...	Third-Party Risk Management, Procurement, Legal, IT Operations, Information Security	View ↗
TPR-005-R004	Contract Renewal The organization shall manage third-party contract renewals, ensuring contracts...	TPR-005 Third-Party Lifecycle & Offboa...	Third-Party Risk Management, Procurement, Legal, IT Operations, Information Security	View ↗
TPR-005-R005	Vendor Termination The organization shall terminate third-party relationships, ensuring termination...	TPR-005 Third-Party Lifecycle & Offboa...	Third-Party Risk Management, Procurement, Legal, IT Operations, Information Security	View ↗
TPR-005-R006	Data Return The organization shall return organizational data by third parties at the end of...	TPR-005 Third-Party Lifecycle & Offboa...	Third-Party Risk Management, Procurement, Legal, IT Operations, Information Security	View ↗
TPR-005-R007	Data Destruction The organization shall ensure the destruction of organizational data by third pa...	TPR-005 Third-Party Lifecycle & Offboa...	Third-Party Risk Management, Procurement, Legal, IT Operations, Information Security	View ↗
TPR-005-R008	Access Revocation The organization shall revoke third-party access to organizational systems, faci...	TPR-005 Third-Party Lifecycle & Offboa...	Third-Party Risk Management, Procurement, Legal, IT Operations, Information Security	View ↗
TPR-005-R009	Offboarding Verification The organization shall verify that all offboarding activities have been complete...	TPR-005 Third-Party Lifecycle & Offboa...	Third-Party Risk Management, Procurement, Legal, IT Operations, Information Security	View ↗
TPR-005-R010	Continuous Improvement The organization shall establish a continuous improvement process for third-part...	TPR-005 Third-Party Lifecycle & Offboa...	Third-Party Risk Management, Procurement, Legal, IT Operations, Information Security	View ↗
TPR-006-R001	Concentration Risk Framework The organization shall establish a third-party concentration risk framework that...	TPR-006 Third-Party Concentration Risk...	Third-Party Risk Management, Enterprise Risk, Procurement, Operational Resilience	View ↗
TPR-006-R002	Critical Dependency Identification The organization shall identify critical dependencies on third-party vendors, in...	TPR-006 Third-Party Concentration Risk...	Third-Party Risk Management, Enterprise Risk, Procurement, Operational Resilience	View ↗
TPR-006-R003	Concentration Assessment The organization shall conduct concentration assessments to evaluate the level o...	TPR-006 Third-Party Concentration Risk...	Third-Party Risk Management, Enterprise Risk, Procurement, Operational Resilience	View ↗
TPR-006-R004	Geographic Concentration The organization shall assess geographic concentration risks, including the conc...	TPR-006 Third-Party Concentration Risk...	Third-Party Risk Management, Enterprise Risk, Procurement, Operational Resilience	View ↗
TPR-006-R005	Technology Concentration The organization shall assess technology concentration risks, including the conc...	TPR-006 Third-Party Concentration Risk...	Third-Party Risk Management, Enterprise Risk, Procurement, Operational Resilience	View ↗
TPR-006-R006	Mitigation Planning The organization shall develop mitigation plans for identified concentration ris...	TPR-006 Third-Party Concentration Risk...	Third-Party Risk Management, Enterprise Risk, Procurement, Operational Resilience	View ↗
TPR-006-R007	Concentration Monitoring The organization shall monitor concentration risks to ensure risks are tracked a...	TPR-006 Third-Party Concentration Risk...	Third-Party Risk Management, Enterprise Risk, Procurement, Operational Resilience	View ↗
TPR-006-R008	Concentration Reporting The organization shall report on concentration risk, providing visibility into c...	TPR-006 Third-Party Concentration Risk...	Third-Party Risk Management, Enterprise Risk, Procurement, Operational Resilience	View ↗
TPR-006-R009	Periodic Review The organization shall conduct periodic reviews of concentration risk management...	TPR-006 Third-Party Concentration Risk...	Third-Party Risk Management, Enterprise Risk, Procurement, Operational Resilience	View ↗
TPR-006-R010	Continuous Improvement The organization shall establish a continuous improvement process for third-part...	TPR-006 Third-Party Concentration Risk...	Third-Party Risk Management, Enterprise Risk, Procurement, Operational Resilience	View ↗
HRS-001-R001	Screening Policy The organization shall establish a personnel screening policy that defines the r...	HRS-001 Personnel Screening & Verifica...	Human Resources, Security, Legal, Compliance	View ↗
HRS-001-R002	Background Verification The organization shall conduct background verifications for all personnel prior...	HRS-001 Personnel Screening & Verifica...	Human Resources, Security, Legal, Compliance	View ↗
HRS-001-R003	Identity Verification The organization shall verify the identity of all personnel prior to employment...	HRS-001 Personnel Screening & Verifica...	Human Resources, Security, Legal, Compliance	View ↗
HRS-001-R004	Employment Eligibility The organization shall verify the employment eligibility of all personnel prior...	HRS-001 Personnel Screening & Verifica...	Human Resources, Security, Legal, Compliance	View ↗
HRS-001-R005	Screening Approval The organization shall approve personnel based on screening results, ensuring hi...	HRS-001 Personnel Screening & Verifica...	Human Resources, Security, Legal, Compliance	View ↗
HRS-001-R006	Re-screening Requirements The organization shall establish re-screening requirements for personnel, includ...	HRS-001 Personnel Screening & Verifica...	Human Resources, Security, Legal, Compliance	View ↗
HRS-001-R007	Screening Exceptions The organization shall manage exceptions to screening requirements, ensuring dev...	HRS-001 Personnel Screening & Verifica...	Human Resources, Security, Legal, Compliance	View ↗
HRS-001-R008	Screening Documentation The organization shall maintain comprehensive documentation of personnel screeni...	HRS-001 Personnel Screening & Verifica...	Human Resources, Security, Legal, Compliance	View ↗
HRS-001-R009	Screening Review The organization shall conduct periodic reviews of personnel screening activitie...	HRS-001 Personnel Screening & Verifica...	Human Resources, Security, Legal, Compliance	View ↗
HRS-001-R010	Continuous Improvement The organization shall establish a continuous improvement process for personnel...	HRS-001 Personnel Screening & Verifica...	Human Resources, Security, Legal, Compliance	View ↗
HRS-002-R001	Confidentiality Agreements The organization shall require all personnel to sign confidentiality agreements...	HRS-002 Confidentiality & Employment O...	Human Resources, Legal, Information Security, Compliance	View ↗
HRS-002-R002	Employment Obligations The organization shall define and document employment obligations for all person...	HRS-002 Confidentiality & Employment O...	Human Resources, Legal, Information Security, Compliance	View ↗
HRS-002-R003	Acceptable Use Acknowledgement The organization shall require all personnel to acknowledge and accept acceptabl...	HRS-002 Confidentiality & Employment O...	Human Resources, Legal, Information Security, Compliance	View ↗
HRS-002-R004	Intellectual Property Protection The organization shall require all personnel to acknowledge and agree to protect...	HRS-002 Confidentiality & Employment O...	Human Resources, Legal, Information Security, Compliance	View ↗
HRS-002-R005	Policy Acceptance The organization shall require all personnel to acknowledge and accept organizat...	HRS-002 Confidentiality & Employment O...	Human Resources, Legal, Information Security, Compliance	View ↗
HRS-002-R006	Periodic Renewal The organization shall periodically renew confidentiality agreements, acceptable...	HRS-002 Confidentiality & Employment O...	Human Resources, Legal, Information Security, Compliance	View ↗
HRS-002-R007	Obligation Monitoring The organization shall monitor compliance with confidentiality and employment ob...	HRS-002 Confidentiality & Employment O...	Human Resources, Legal, Information Security, Compliance	View ↗
HRS-002-R008	Documentation The organization shall maintain comprehensive documentation of confidentiality a...	HRS-002 Confidentiality & Employment O...	Human Resources, Legal, Information Security, Compliance	View ↗
HRS-002-R009	Obligation Review The organization shall conduct periodic reviews of confidentiality and employmen...	HRS-002 Confidentiality & Employment O...	Human Resources, Legal, Information Security, Compliance	View ↗
HRS-002-R010	Continuous Improvement The organization shall establish a continuous improvement process for confidenti...	HRS-002 Confidentiality & Employment O...	Human Resources, Legal, Information Security, Compliance	View ↗
HRS-003-R001	Recruitment Security The organization shall establish recruitment security processes that ensure secu...	HRS-003 Personnel Lifecycle Security M...	Human Resources, Information Security, Hiring Managers, IT Operations	View ↗
HRS-003-R002	Onboarding Security The organization shall establish onboarding security processes that ensure new p...	HRS-003 Personnel Lifecycle Security M...	Human Resources, Information Security, Hiring Managers, IT Operations	View ↗
HRS-003-R003	Security Responsibilities The organization shall ensure all personnel are aware of and accept their securi...	HRS-003 Personnel Lifecycle Security M...	Human Resources, Information Security, Hiring Managers, IT Operations	View ↗
HRS-003-R004	Job Description Security Requirements The organization shall include security requirements in job descriptions for all...	HRS-003 Personnel Lifecycle Security M...	Human Resources, Information Security, Hiring Managers, IT Operations	View ↗
HRS-003-R005	Role Change Management The organization shall manage security when personnel change roles or positions,...	HRS-003 Personnel Lifecycle Security M...	Human Resources, Information Security, Hiring Managers, IT Operations	View ↗
HRS-003-R006	Personnel Transfer Management The organization shall manage security when personnel transfer between departmen...	HRS-003 Personnel Lifecycle Security M...	Human Resources, Information Security, Hiring Managers, IT Operations	View ↗
HRS-003-R007	Termination Security The organization shall establish termination security processes that ensure secu...	HRS-003 Personnel Lifecycle Security M...	Human Resources, Information Security, Hiring Managers, IT Operations	View ↗
HRS-003-R008	Exit Activities The organization shall establish exit activities for departing personnel, includ...	HRS-003 Personnel Lifecycle Security M...	Human Resources, Information Security, Hiring Managers, IT Operations	View ↗
HRS-003-R009	Post-Employment Obligations The organization shall define and communicate post-employment obligations for de...	HRS-003 Personnel Lifecycle Security M...	Human Resources, Information Security, Hiring Managers, IT Operations	View ↗
HRS-003-R010	Continuous Improvement The organization shall establish a continuous improvement process for personnel...	HRS-003 Personnel Lifecycle Security M...	Human Resources, Information Security, Hiring Managers, IT Operations	View ↗
HRS-004-R001	Code of Conduct Framework The organization shall establish a code of conduct framework that defines the st...	HRS-004 Employee Code of Conduct & Eth...	Human Resources, Legal, Compliance, Information Security, Ethics/Compliance	View ↗
HRS-004-R002	Ethical Behaviour The organization shall define and communicate expectations for ethical behavior,...	HRS-004 Employee Code of Conduct & Eth...	Human Resources, Legal, Compliance, Information Security, Ethics/Compliance	View ↗
HRS-004-R003	Information Security Responsibilities The organization shall include information security responsibilities in the code...	HRS-004 Employee Code of Conduct & Eth...	Human Resources, Legal, Compliance, Information Security, Ethics/Compliance	View ↗
HRS-004-R004	Privacy Responsibilities The organization shall include privacy responsibilities in the code of conduct,...	HRS-004 Employee Code of Conduct & Eth...	Human Resources, Legal, Compliance, Information Security, Ethics/Compliance	View ↗
HRS-004-R005	Acceptable Behaviour The organization shall define acceptable behavior expectations in the code of co...	HRS-004 Employee Code of Conduct & Eth...	Human Resources, Legal, Compliance, Information Security, Ethics/Compliance	View ↗
HRS-004-R006	Policy Compliance The organization shall require all personnel to comply with organizational polic...	HRS-004 Employee Code of Conduct & Eth...	Human Resources, Legal, Compliance, Information Security, Ethics/Compliance	View ↗
HRS-004-R007	Violation Reporting The organization shall establish processes for reporting violations of the code...	HRS-004 Employee Code of Conduct & Eth...	Human Resources, Legal, Compliance, Information Security, Ethics/Compliance	View ↗
HRS-004-R008	Disciplinary Process The organization shall establish a disciplinary process for addressing violation...	HRS-004 Employee Code of Conduct & Eth...	Human Resources, Legal, Compliance, Information Security, Ethics/Compliance	View ↗
HRS-004-R009	Periodic Review The organization shall conduct periodic reviews of the code of conduct and ethic...	HRS-004 Employee Code of Conduct & Eth...	Human Resources, Legal, Compliance, Information Security, Ethics/Compliance	View ↗
HRS-004-R010	Continuous Improvement The organization shall establish a continuous improvement process for the code o...	HRS-004 Employee Code of Conduct & Eth...	Human Resources, Legal, Compliance, Information Security, Ethics/Compliance	View ↗
SAT-001-R001	Awareness Program Framework The organization shall establish a security awareness program framework that def...	SAT-001 Security Awareness Program	Security Awareness, Information Security, Human Resources, CISO	View ↗
SAT-001-R002	Awareness Strategy The organization shall define a security awareness strategy that articulates the...	SAT-001 Security Awareness Program	Security Awareness, Information Security, Human Resources, CISO	View ↗
SAT-001-R003	Awareness Content Management The organization shall develop and maintain security awareness content that is r...	SAT-001 Security Awareness Program	Security Awareness, Information Security, Human Resources, CISO	View ↗
SAT-001-R004	Awareness Communication The organization shall communicate security awareness messages to the workforce...	SAT-001 Security Awareness Program	Security Awareness, Information Security, Human Resources, CISO	View ↗
SAT-001-R005	Awareness Delivery The organization shall deliver security awareness content to the workforce throu...	SAT-001 Security Awareness Program	Security Awareness, Information Security, Human Resources, CISO	View ↗
SAT-001-R006	Participation Management The organization shall manage participation in security awareness activities, in...	SAT-001 Security Awareness Program	Security Awareness, Information Security, Human Resources, CISO	View ↗
SAT-001-R007	Awareness Metrics The organization shall define and track metrics for security awareness that prov...	SAT-001 Security Awareness Program	Security Awareness, Information Security, Human Resources, CISO	View ↗
SAT-001-R008	Executive Reporting The organization shall provide executive leadership and the board with regular r...	SAT-001 Security Awareness Program	Security Awareness, Information Security, Human Resources, CISO	View ↗
SAT-001-R009	Program Review The organization shall conduct periodic reviews of the security awareness progra...	SAT-001 Security Awareness Program	Security Awareness, Information Security, Human Resources, CISO	View ↗
SAT-001-R010	Continuous Improvement The organization shall establish a continuous improvement process for the securi...	SAT-001 Security Awareness Program	Security Awareness, Information Security, Human Resources, CISO	View ↗
SAT-002-R001	Culture Framework The organization shall establish a security culture framework that defines the s...	SAT-002 Security Culture Management	CISO, Security Awareness, Human Resources, Business Leadership	View ↗
SAT-002-R002	Culture Assessment The organization shall conduct regular assessments of security culture to evalua...	SAT-002 Security Culture Management	CISO, Security Awareness, Human Resources, Business Leadership	View ↗
SAT-002-R003	Behavioral Measurement The organization shall measure security behaviors across the workforce, includin...	SAT-002 Security Culture Management	CISO, Security Awareness, Human Resources, Business Leadership	View ↗
SAT-002-R004	Leadership Engagement The organization shall promote leadership engagement in security culture, ensuri...	SAT-002 Security Culture Management	CISO, Security Awareness, Human Resources, Business Leadership	View ↗
SAT-002-R005	Employee Participation The organization shall encourage and enable employee participation in security c...	SAT-002 Security Culture Management	CISO, Security Awareness, Human Resources, Business Leadership	View ↗
SAT-002-R006	Culture Metrics The organization shall define and track metrics for security culture that provid...	SAT-002 Security Culture Management	CISO, Security Awareness, Human Resources, Business Leadership	View ↗
SAT-002-R007	Improvement Initiatives The organization shall develop and implement improvement initiatives to address...	SAT-002 Security Culture Management	CISO, Security Awareness, Human Resources, Business Leadership	View ↗
SAT-002-R008	Culture Reporting The organization shall report on security culture, providing visibility into cul...	SAT-002 Security Culture Management	CISO, Security Awareness, Human Resources, Business Leadership	View ↗
SAT-002-R009	Periodic Review The organization shall conduct periodic reviews of security culture management a...	SAT-002 Security Culture Management	CISO, Security Awareness, Human Resources, Business Leadership	View ↗
SAT-002-R010	Continuous Improvement The organization shall establish a continuous improvement process for security c...	SAT-002 Security Culture Management	CISO, Security Awareness, Human Resources, Business Leadership	View ↗
SAT-003-R001	Training Framework The organization shall establish a role-based security and compliance training f...	SAT-003 Role-Based Security & Complian...	Security Training, Information Security, Compliance, Human Resources	View ↗
SAT-003-R002	Role-Based Training The organization shall develop and deliver role-based security training that add...	SAT-003 Role-Based Security & Complian...	Security Training, Information Security, Compliance, Human Resources	View ↗
SAT-003-R003	Privacy Training The organization shall provide training on privacy responsibilities and obligati...	SAT-003 Role-Based Security & Complian...	Security Training, Information Security, Compliance, Human Resources	View ↗
SAT-003-R004	Compliance Training The organization shall provide training on compliance obligations relevant to pe...	SAT-003 Role-Based Security & Complian...	Security Training, Information Security, Compliance, Human Resources	View ↗
SAT-003-R005	Insider Threat Awareness The organization shall provide insider threat awareness training to all personne...	SAT-003 Role-Based Security & Complian...	Security Training, Information Security, Compliance, Human Resources	View ↗
SAT-003-R006	Incident Reporting Training The organization shall provide training on incident reporting procedures to all...	SAT-003 Role-Based Security & Complian...	Security Training, Information Security, Compliance, Human Resources	View ↗
SAT-003-R007	Specialized Security Training The organization shall provide specialized security training for personnel with...	SAT-003 Role-Based Security & Complian...	Security Training, Information Security, Compliance, Human Resources	View ↗
SAT-003-R008	Training Records The organization shall maintain comprehensive records of security and compliance...	SAT-003 Role-Based Security & Complian...	Security Training, Information Security, Compliance, Human Resources	View ↗
SAT-003-R009	Training Effectiveness Review The organization shall conduct periodic reviews of training effectiveness to ens...	SAT-003 Role-Based Security & Complian...	Security Training, Information Security, Compliance, Human Resources	View ↗
SAT-003-R010	Continuous Improvement The organization shall establish a continuous improvement process for role-based...	SAT-003 Role-Based Security & Complian...	Security Training, Information Security, Compliance, Human Resources	View ↗
SAT-004-R001	Exercise Framework The organization shall establish a security awareness exercise framework that de...	SAT-004 Security Awareness Exercises &...	Security Awareness, Security Operations, Human Resources, CISO	View ↗
SAT-004-R002	Phishing Simulations The organization shall conduct regular phishing simulations to test and improve...	SAT-004 Security Awareness Exercises &...	Security Awareness, Security Operations, Human Resources, CISO	View ↗
SAT-004-R003	Social Engineering Exercises The organization shall conduct social engineering exercises to test and improve...	SAT-004 Security Awareness Exercises &...	Security Awareness, Security Operations, Human Resources, CISO	View ↗
SAT-004-R004	Security Awareness Drills The organization shall conduct security awareness drills to test and reinforce s...	SAT-004 Security Awareness Exercises &...	Security Awareness, Security Operations, Human Resources, CISO	View ↗
SAT-004-R005	Exercise Performance Measurement The organization shall measure performance in security awareness exercises, incl...	SAT-004 Security Awareness Exercises &...	Security Awareness, Security Operations, Human Resources, CISO	View ↗
SAT-004-R006	Corrective Actions The organization shall implement corrective actions based on exercise results, i...	SAT-004 Security Awareness Exercises &...	Security Awareness, Security Operations, Human Resources, CISO	View ↗
SAT-004-R007	Exercise Reporting The organization shall report on security awareness exercises, providing visibil...	SAT-004 Security Awareness Exercises &...	Security Awareness, Security Operations, Human Resources, CISO	View ↗
SAT-004-R008	Lessons Learned The organization shall capture and document lessons learned from security awaren...	SAT-004 Security Awareness Exercises &...	Security Awareness, Security Operations, Human Resources, CISO	View ↗
SAT-004-R009	Exercise Review The organization shall conduct periodic reviews of security awareness exercise a...	SAT-004 Security Awareness Exercises &...	Security Awareness, Security Operations, Human Resources, CISO	View ↗
SAT-004-R010	Continuous Improvement The organization shall establish a continuous improvement process for security a...	SAT-004 Security Awareness Exercises &...	Security Awareness, Security Operations, Human Resources, CISO	View ↗
AIG-001-R001	AI Governance Framework The organization shall establish an AI governance framework that defines the str...	AIG-001 AI Governance & Oversight	AI Governance Committee, Executive Leadership, CISO, Legal, Compliance, Risk, Ethics	View ↗
AIG-001-R002	AI Governance Committee The organization shall establish an AI governance committee with responsibility...	AIG-001 AI Governance & Oversight	AI Governance Committee, Executive Leadership, CISO, Legal, Compliance, Risk, Ethics	View ↗
AIG-001-R003	AI Policies The organization shall establish AI policies that define the requirements, princ...	AIG-001 AI Governance & Oversight	AI Governance Committee, Executive Leadership, CISO, Legal, Compliance, Risk, Ethics	View ↗
AIG-001-R004	AI Roles & Responsibilities The organization shall clearly define and document the roles and responsibilitie...	AIG-001 AI Governance & Oversight	AI Governance Committee, Executive Leadership, CISO, Legal, Compliance, Risk, Ethics	View ↗
AIG-001-R005	AI Decision Governance The organization shall establish governance processes for AI-related decisions,...	AIG-001 AI Governance & Oversight	AI Governance Committee, Executive Leadership, CISO, Legal, Compliance, Risk, Ethics	View ↗
AIG-001-R006	Executive Oversight The organization shall ensure executive leadership and the board provide active...	AIG-001 AI Governance & Oversight	AI Governance Committee, Executive Leadership, CISO, Legal, Compliance, Risk, Ethics	View ↗
AIG-001-R007	AI Compliance The organization shall ensure AI systems comply with applicable legal, regulator...	AIG-001 AI Governance & Oversight	AI Governance Committee, Executive Leadership, CISO, Legal, Compliance, Risk, Ethics	View ↗
AIG-001-R008	AI Reporting The organization shall report on AI governance, providing visibility into AI str...	AIG-001 AI Governance & Oversight	AI Governance Committee, Executive Leadership, CISO, Legal, Compliance, Risk, Ethics	View ↗
AIG-001-R009	AI Review The organization shall conduct periodic reviews of AI governance activities to e...	AIG-001 AI Governance & Oversight	AI Governance Committee, Executive Leadership, CISO, Legal, Compliance, Risk, Ethics	View ↗
AIG-001-R010	Continuous Improvement The organization shall establish a continuous improvement process for AI governa...	AIG-001 AI Governance & Oversight	AI Governance Committee, Executive Leadership, CISO, Legal, Compliance, Risk, Ethics	View ↗
AIG-002-R001	AI Risk Framework The organization shall establish an AI risk framework that defines the structure...	AIG-002 AI Risk & Impact Management	AI Risk Management, Enterprise Risk, Compliance, Privacy, AI Governance	View ↗
AIG-002-R002	AI Risk Assessment The organization shall conduct regular risk assessments of AI systems to identif...	AIG-002 AI Risk & Impact Management	AI Risk Management, Enterprise Risk, Compliance, Privacy, AI Governance	View ↗
AIG-002-R003	AI Impact Assessment The organization shall conduct impact assessments for AI systems to evaluate the...	AIG-002 AI Risk & Impact Management	AI Risk Management, Enterprise Risk, Compliance, Privacy, AI Governance	View ↗
AIG-002-R004	AI Risk Treatment The organization shall treat AI risks, including the implementation of controls,...	AIG-002 AI Risk & Impact Management	AI Risk Management, Enterprise Risk, Compliance, Privacy, AI Governance	View ↗
AIG-002-R005	AI Risk Acceptance The organization shall accept AI risks that exceed defined thresholds, ensuring...	AIG-002 AI Risk & Impact Management	AI Risk Management, Enterprise Risk, Compliance, Privacy, AI Governance	View ↗
AIG-002-R006	AI Risk Monitoring The organization shall monitor AI risks to ensure risks are tracked and changes...	AIG-002 AI Risk & Impact Management	AI Risk Management, Enterprise Risk, Compliance, Privacy, AI Governance	View ↗
AIG-002-R007	AI Risk Reporting The organization shall report on AI risk management, providing visibility into r...	AIG-002 AI Risk & Impact Management	AI Risk Management, Enterprise Risk, Compliance, Privacy, AI Governance	View ↗
AIG-002-R008	AI Risk Review The organization shall conduct periodic reviews of AI risk management activities...	AIG-002 AI Risk & Impact Management	AI Risk Management, Enterprise Risk, Compliance, Privacy, AI Governance	View ↗
AIG-002-R009	Regulatory Assessment The organization shall conduct regular assessments of AI regulatory requirements...	AIG-002 AI Risk & Impact Management	AI Risk Management, Enterprise Risk, Compliance, Privacy, AI Governance	View ↗
AIG-002-R010	Continuous Improvement The organization shall establish a continuous improvement process for AI risk an...	AIG-002 AI Risk & Impact Management	AI Risk Management, Enterprise Risk, Compliance, Privacy, AI Governance	View ↗
AIG-003-R001	AI Inventory The organization shall maintain a comprehensive inventory of all artificial inte...	AIG-003 AI Asset & Lifecycle Managemen...	AI Asset Management, AI Owners, Engineering, IT Operations, AI Governance	View ↗
AIG-003-R002	AI Asset Classification The organization shall establish a classification schema for AI assets that enab...	AIG-003 AI Asset & Lifecycle Managemen...	AI Asset Management, AI Owners, Engineering, IT Operations, AI Governance	View ↗
AIG-003-R003	AI Ownership The organization shall assign explicit ownership for each AI asset, defining the...	AIG-003 AI Asset & Lifecycle Managemen...	AI Asset Management, AI Owners, Engineering, IT Operations, AI Governance	View ↗
AIG-003-R004	AI Registration The organization shall register AI assets in the AI inventory, ensuring all requ...	AIG-003 AI Asset & Lifecycle Managemen...	AI Asset Management, AI Owners, Engineering, IT Operations, AI Governance	View ↗
AIG-003-R005	AI Version Management The organization shall manage versions of AI models and systems, ensuring change...	AIG-003 AI Asset & Lifecycle Managemen...	AI Asset Management, AI Owners, Engineering, IT Operations, AI Governance	View ↗
AIG-003-R006	AI Deployment The organization shall deploy AI models and systems in a controlled manner, ensu...	AIG-003 AI Asset & Lifecycle Managemen...	AI Asset Management, AI Owners, Engineering, IT Operations, AI Governance	View ↗
AIG-003-R007	AI Change Management The organization shall manage changes to AI models and systems, including change...	AIG-003 AI Asset & Lifecycle Managemen...	AI Asset Management, AI Owners, Engineering, IT Operations, AI Governance	View ↗
AIG-003-R008	AI Retirement The organization shall retire AI models and systems at the end of their useful l...	AIG-003 AI Asset & Lifecycle Managemen...	AI Asset Management, AI Owners, Engineering, IT Operations, AI Governance	View ↗
AIG-003-R009	Lifecycle Review The organization shall conduct periodic reviews of AI asset lifecycle management...	AIG-003 AI Asset & Lifecycle Managemen...	AI Asset Management, AI Owners, Engineering, IT Operations, AI Governance	View ↗
AIG-003-R010	Continuous Improvement The organization shall establish a continuous improvement process for AI asset a...	AIG-003 AI Asset & Lifecycle Managemen...	AI Asset Management, AI Owners, Engineering, IT Operations, AI Governance	View ↗
AIG-004-R001	Responsible AI Principles The organization shall define responsible AI principles that guide the developme...	AIG-004 Responsible AI Management	Responsible AI, Ethics, AI Governance, Legal, Privacy, Business Owners	View ↗
AIG-004-R002	Transparency The organization shall ensure transparency in the development, deployment, and o...	AIG-004 Responsible AI Management	Responsible AI, Ethics, AI Governance, Legal, Privacy, Business Owners	View ↗
AIG-004-R003	Explainability The organization shall ensure AI systems are explainable, enabling stakeholders...	AIG-004 Responsible AI Management	Responsible AI, Ethics, AI Governance, Legal, Privacy, Business Owners	View ↗
AIG-004-R004	Fairness The organization shall ensure fairness in AI systems, preventing discrimination...	AIG-004 Responsible AI Management	Responsible AI, Ethics, AI Governance, Legal, Privacy, Business Owners	View ↗
AIG-004-R005	Bias Management The organization shall identify, assess, and mitigate bias in AI systems, includ...	AIG-004 Responsible AI Management	Responsible AI, Ethics, AI Governance, Legal, Privacy, Business Owners	View ↗
AIG-004-R006	Human Oversight The organization shall ensure appropriate human oversight of AI systems, includi...	AIG-004 Responsible AI Management	Responsible AI, Ethics, AI Governance, Legal, Privacy, Business Owners	View ↗
AIG-004-R007	Ethical AI The organization shall ensure AI systems are developed and operated in accordanc...	AIG-004 Responsible AI Management	Responsible AI, Ethics, AI Governance, Legal, Privacy, Business Owners	View ↗
AIG-004-R008	Accountability The organization shall establish accountability for AI systems, including clear...	AIG-004 Responsible AI Management	Responsible AI, Ethics, AI Governance, Legal, Privacy, Business Owners	View ↗
AIG-004-R009	Responsible AI Review The organization shall conduct periodic reviews of responsible AI management act...	AIG-004 Responsible AI Management	Responsible AI, Ethics, AI Governance, Legal, Privacy, Business Owners	View ↗
AIG-004-R010	Continuous Improvement The organization shall establish a continuous improvement process for responsibl...	AIG-004 Responsible AI Management	Responsible AI, Ethics, AI Governance, Legal, Privacy, Business Owners	View ↗
AIG-005-R001	AI Security Framework The organization shall establish an AI security framework that defines the struc...	AIG-005 AI Security & Operational Resi...	AI Security, Security Operations, AI Engineering, Incident Response, CISO	View ↗
AIG-005-R002	Adversarial Attack Protection The organization shall implement protection measures against adversarial attacks...	AIG-005 AI Security & Operational Resi...	AI Security, Security Operations, AI Engineering, Incident Response, CISO	View ↗
AIG-005-R003	Prompt Injection Protection The organization shall implement protection measures against prompt injection at...	AIG-005 AI Security & Operational Resi...	AI Security, Security Operations, AI Engineering, Incident Response, CISO	View ↗
AIG-005-R004	Model Poisoning Protection The organization shall implement protection measures against model poisoning att...	AIG-005 AI Security & Operational Resi...	AI Security, Security Operations, AI Engineering, Incident Response, CISO	View ↗
AIG-005-R005	AI Access Security The organization shall implement access controls for AI systems, models, and dat...	AIG-005 AI Security & Operational Resi...	AI Security, Security Operations, AI Engineering, Incident Response, CISO	View ↗
AIG-005-R006	AI Monitoring The organization shall monitor AI systems to detect security threats, operationa...	AIG-005 AI Security & Operational Resi...	AI Security, Security Operations, AI Engineering, Incident Response, CISO	View ↗
AIG-005-R007	AI Incident Response The organization shall respond to AI-related security incidents, including the d...	AIG-005 AI Security & Operational Resi...	AI Security, Security Operations, AI Engineering, Incident Response, CISO	View ↗
AIG-005-R008	AI Resilience Testing The organization shall conduct resilience testing of AI systems to verify their...	AIG-005 AI Security & Operational Resi...	AI Security, Security Operations, AI Engineering, Incident Response, CISO	View ↗
AIG-005-R009	AI Security Review The organization shall conduct periodic reviews of AI security activities to ens...	AIG-005 AI Security & Operational Resi...	AI Security, Security Operations, AI Engineering, Incident Response, CISO	View ↗
AIG-005-R010	Continuous Improvement The organization shall establish a continuous improvement process for AI securit...	AIG-005 AI Security & Operational Resi...	AI Security, Security Operations, AI Engineering, Incident Response, CISO	View ↗
AIG-006-R001	Performance Metrics The organization shall define and track performance metrics for AI systems that...	AIG-006 AI Performance Monitoring & Co...	AI Engineering, Model Owners, Data Science, Business Owners, AI Governance	View ↗
AIG-006-R002	Drift Detection The organization shall detect performance drift in AI models, including data dri...	AIG-006 AI Performance Monitoring & Co...	AI Engineering, Model Owners, Data Science, Business Owners, AI Governance	View ↗
AIG-006-R003	Model Validation The organization shall validate AI models to ensure they perform as intended and...	AIG-006 AI Performance Monitoring & Co...	AI Engineering, Model Owners, Data Science, Business Owners, AI Governance	View ↗
AIG-006-R004	Accuracy Monitoring The organization shall monitor AI model accuracy to ensure models maintain requi...	AIG-006 AI Performance Monitoring & Co...	AI Engineering, Model Owners, Data Science, Business Owners, AI Governance	View ↗
AIG-006-R005	Reliability Monitoring The organization shall monitor AI model reliability to ensure models operate con...	AIG-006 AI Performance Monitoring & Co...	AI Engineering, Model Owners, Data Science, Business Owners, AI Governance	View ↗
AIG-006-R006	Business Value Assessment The organization shall assess AI business value to evaluate the contribution of...	AIG-006 AI Performance Monitoring & Co...	AI Engineering, Model Owners, Data Science, Business Owners, AI Governance	View ↗
AIG-006-R007	Performance Reporting The organization shall report on AI performance, providing visibility into model...	AIG-006 AI Performance Monitoring & Co...	AI Engineering, Model Owners, Data Science, Business Owners, AI Governance	View ↗
AIG-006-R008	Model Optimization The organization shall optimize AI models to improve performance, efficiency, an...	AIG-006 AI Performance Monitoring & Co...	AI Engineering, Model Owners, Data Science, Business Owners, AI Governance	View ↗
AIG-006-R009	Periodic Review The organization shall conduct periodic reviews of AI performance monitoring act...	AIG-006 AI Performance Monitoring & Co...	AI Engineering, Model Owners, Data Science, Business Owners, AI Governance	View ↗
AIG-006-R010	Continuous Improvement The organization shall establish a continuous improvement process for AI perform...	AIG-006 AI Performance Monitoring & Co...	AI Engineering, Model Owners, Data Science, Business Owners, AI Governance	View ↗
AUD-001-R001	Audit Governance Framework The organization shall establish an audit governance framework that defines the...	AUD-001 Audit & Assurance Program	Chief Audit Executive / Internal Audit	View ↗
AUD-001-R002	Audit Planning The organization shall conduct formal planning for audit activities, defining th...	AUD-001 Audit & Assurance Program	Chief Audit Executive / Internal Audit	View ↗
AUD-001-R003	Audit Universe The organization shall define an audit universe that identifies all auditable en...	AUD-001 Audit & Assurance Program	Chief Audit Executive / Internal Audit	View ↗
AUD-001-R004	Audit Methodology The organization shall establish a formal audit methodology that defines the app...	AUD-001 Audit & Assurance Program	Chief Audit Executive / Internal Audit	View ↗
AUD-001-R005	Audit Evidence Management The organization shall manage audit evidence, including the collection, preserva...	AUD-001 Audit & Assurance Program	Chief Audit Executive / Internal Audit	View ↗
AUD-001-R006	Audit Scheduling The organization shall establish an audit schedule that defines the timing and s...	AUD-001 Audit & Assurance Program	Chief Audit Executive / Internal Audit	View ↗
AUD-001-R007	Audit Reporting The organization shall report on audit activities, providing visibility into aud...	AUD-001 Audit & Assurance Program	Chief Audit Executive / Internal Audit	View ↗
AUD-001-R008	Audit Metrics The organization shall define and track key metrics for the audit program that p...	AUD-001 Audit & Assurance Program	Chief Audit Executive / Internal Audit	View ↗
AUD-001-R009	Program Review The organization shall conduct periodic reviews of the audit program to assess i...	AUD-001 Audit & Assurance Program	Chief Audit Executive / Internal Audit	View ↗
AUD-001-R010	Continuous Improvement The organization shall establish a continuous improvement process for the audit...	AUD-001 Audit & Assurance Program	Chief Audit Executive / Internal Audit	View ↗
AUD-002-R001	Risk-Based Audit Planning The organization shall conduct risk-based audit planning to ensure internal audi...	AUD-002 Internal Audit Management	Chief Audit Executive / Internal Audit	View ↗
AUD-002-R002	Audit Scope Definition The organization shall define the scope of each internal audit engagement, speci...	AUD-002 Internal Audit Management	Chief Audit Executive / Internal Audit	View ↗
AUD-002-R003	Audit Execution The organization shall execute internal audits in accordance with the audit plan...	AUD-002 Internal Audit Management	Chief Audit Executive / Internal Audit	View ↗
AUD-002-R004	Audit Documentation The organization shall maintain comprehensive documentation of internal audit ac...	AUD-002 Internal Audit Management	Chief Audit Executive / Internal Audit	View ↗
AUD-002-R005	Audit Reporting The organization shall prepare and issue audit reports that communicate the resu...	AUD-002 Internal Audit Management	Chief Audit Executive / Internal Audit	View ↗
AUD-002-R006	Management Response The organization shall require management to provide formal responses to audit f...	AUD-002 Internal Audit Management	Chief Audit Executive / Internal Audit	View ↗
AUD-002-R007	Follow-Up Reviews The organization shall conduct follow-up reviews to verify management has implem...	AUD-002 Internal Audit Management	Chief Audit Executive / Internal Audit	View ↗
AUD-002-R008	Audit Quality Assurance The organization shall establish quality assurance processes for internal audit...	AUD-002 Internal Audit Management	Chief Audit Executive / Internal Audit	View ↗
AUD-002-R009	Internal Audit Review The organization shall conduct periodic reviews of internal audit management act...	AUD-002 Internal Audit Management	Chief Audit Executive / Internal Audit	View ↗
AUD-002-R010	Continuous Improvement The organization shall establish a continuous improvement process for internal a...	AUD-002 Internal Audit Management	Chief Audit Executive / Internal Audit	View ↗
AUD-003-R001	External Assessment Framework The organization shall establish an external assessment framework that defines t...	AUD-003 Independent Assessment & Exter...	Chief Audit Executive / Compliance	View ↗
AUD-003-R002	Assessor Independence The organization shall ensure external assessors are independent and objective,...	AUD-003 Independent Assessment & Exter...	Chief Audit Executive / Compliance	View ↗
AUD-003-R003	Assessment Planning The organization shall conduct formal planning for external assessments, definin...	AUD-003 Independent Assessment & Exter...	Chief Audit Executive / Compliance	View ↗
AUD-003-R004	External Assessment Execution The organization shall execute external assessments in accordance with approved...	AUD-003 Independent Assessment & Exter...	Chief Audit Executive / Compliance	View ↗
AUD-003-R005	Certification Management The organization shall manage certification processes for external certification...	AUD-003 Independent Assessment & Exter...	Chief Audit Executive / Compliance	View ↗
AUD-003-R006	Regulatory Assessment The organization shall conduct regulatory assessments to verify compliance with...	AUD-003 Independent Assessment & Exter...	Chief Audit Executive / Compliance	View ↗
AUD-003-R007	Assessment Reporting The organization shall prepare and issue reports for external assessments that c...	AUD-003 Independent Assessment & Exter...	Chief Audit Executive / Compliance	View ↗
AUD-003-R008	Management Response The organization shall require management to provide formal responses to externa...	AUD-003 Independent Assessment & Exter...	Chief Audit Executive / Compliance	View ↗
AUD-003-R009	Assessment Review The organization shall conduct periodic reviews of external assessment activitie...	AUD-003 Independent Assessment & Exter...	Chief Audit Executive / Compliance	View ↗
AUD-003-R010	Continuous Improvement The organization shall establish a continuous improvement process for independen...	AUD-003 Independent Assessment & Exter...	Chief Audit Executive / Compliance	View ↗
AUD-004-R001	Control Testing Framework The organization shall establish a control testing framework that defines the st...	AUD-004 Control Assurance & Validation	CISO / Internal Audit / Control Owners	View ↗
AUD-004-R002	Design Effectiveness Review The organization shall review the design effectiveness of controls to ensure con...	AUD-004 Control Assurance & Validation	CISO / Internal Audit / Control Owners	View ↗
AUD-004-R003	Operating Effectiveness Testing The organization shall test the operating effectiveness of controls to verify co...	AUD-004 Control Assurance & Validation	CISO / Internal Audit / Control Owners	View ↗
AUD-004-R004	Continuous Assurance The organization shall establish continuous assurance capabilities that provide...	AUD-004 Control Assurance & Validation	CISO / Internal Audit / Control Owners	View ↗
AUD-004-R005	Control Performance Monitoring The organization shall monitor control performance to ensure controls are operat...	AUD-004 Control Assurance & Validation	CISO / Internal Audit / Control Owners	View ↗
AUD-004-R006	Validation Reporting The organization shall report on control validation, providing visibility into c...	AUD-004 Control Assurance & Validation	CISO / Internal Audit / Control Owners	View ↗
AUD-004-R007	Exception Management The organization shall manage exceptions identified during control testing and v...	AUD-004 Control Assurance & Validation	CISO / Internal Audit / Control Owners	View ↗
AUD-004-R008	Assurance Review The organization shall conduct periodic reviews of control assurance and validat...	AUD-004 Control Assurance & Validation	CISO / Internal Audit / Control Owners	View ↗
AUD-004-R009	Metrics Reporting The organization shall report on control assurance metrics that provide insight...	AUD-004 Control Assurance & Validation	CISO / Internal Audit / Control Owners	View ↗
AUD-004-R010	Continuous Improvement The organization shall establish a continuous improvement process for control as...	AUD-004 Control Assurance & Validation	CISO / Internal Audit / Control Owners	View ↗
AUD-005-R001	CSA Framework The organization shall establish a Control Self-Assessment framework that define...	AUD-005 Control Self-Assessment (CSA)	Control Owners / Internal Audit	View ↗
AUD-005-R002	Control Owner Responsibilities The organization shall define and communicate the responsibilities of control ow...	AUD-005 Control Self-Assessment (CSA)	Control Owners / Internal Audit	View ↗
AUD-005-R003	Self-Assessment Planning The organization shall conduct formal planning for self-assessments, defining th...	AUD-005 Control Self-Assessment (CSA)	Control Owners / Internal Audit	View ↗
AUD-005-R004	Assessment Execution The organization shall execute self-assessments in accordance with approved plan...	AUD-005 Control Self-Assessment (CSA)	Control Owners / Internal Audit	View ↗
AUD-005-R005	Assessment Validation The organization shall validate self-assessment results to ensure their accuracy...	AUD-005 Control Self-Assessment (CSA)	Control Owners / Internal Audit	View ↗
AUD-005-R006	Deficiency Reporting The organization shall report control deficiencies identified through self-asses...	AUD-005 Control Self-Assessment (CSA)	Control Owners / Internal Audit	View ↗
AUD-005-R007	Management Review The organization shall review self-assessment results to ensure assessment concl...	AUD-005 Control Self-Assessment (CSA)	Control Owners / Internal Audit	View ↗
AUD-005-R008	CSA Reporting The organization shall report on CSA, providing visibility into self-assessment...	AUD-005 Control Self-Assessment (CSA)	Control Owners / Internal Audit	View ↗
AUD-005-R009	Periodic Review The organization shall conduct periodic reviews of CSA activities to ensure thei...	AUD-005 Control Self-Assessment (CSA)	Control Owners / Internal Audit	View ↗
AUD-005-R010	Continuous Improvement The organization shall establish a continuous improvement process for CSA, drivi...	AUD-005 Control Self-Assessment (CSA)	Control Owners / Internal Audit	View ↗
AUD-006-R001	Certification Governance The organization shall establish governance structures for attestation and certi...	AUD-006 Attestation & Certification Ma...	Compliance Officer / Certification Manager	View ↗
AUD-006-R002	Certification Planning The organization shall conduct formal planning for certification activities, def...	AUD-006 Attestation & Certification Ma...	Compliance Officer / Certification Manager	View ↗
AUD-006-R003	Attestation Management The organization shall manage attestation processes, including preparation of at...	AUD-006 Attestation & Certification Ma...	Compliance Officer / Certification Manager	View ↗
AUD-006-R004	Certification Maintenance The organization shall maintain certifications once achieved, including ongoing...	AUD-006 Attestation & Certification Ma...	Compliance Officer / Certification Manager	View ↗
AUD-006-R005	Renewal Management The organization shall manage certification renewals, ensuring certifications ar...	AUD-006 Attestation & Certification Ma...	Compliance Officer / Certification Manager	View ↗
AUD-006-R006	Regulatory Examinations The organization shall manage regulatory examinations and supervisory reviews, e...	AUD-006 Attestation & Certification Ma...	Compliance Officer / Certification Manager	View ↗
AUD-006-R007	Certification Reporting The organization shall report on certification and attestation, providing visibi...	AUD-006 Attestation & Certification Ma...	Compliance Officer / Certification Manager	View ↗
AUD-006-R008	Management Review The organization shall review certification and attestation status to ensure cer...	AUD-006 Attestation & Certification Ma...	Compliance Officer / Certification Manager	View ↗
AUD-006-R009	Evidence Collection The organization shall collect, organize, and maintain evidence to support attes...	AUD-006 Attestation & Certification Ma...	Compliance Officer / Certification Manager	View ↗
AUD-006-R010	Continuous Improvement The organization shall establish a continuous improvement process for attestatio...	AUD-006 Attestation & Certification Ma...	Compliance Officer / Certification Manager	View ↗
AUD-007-R001	Findings Registration The organization shall register audit findings in a centralized repository, ensu...	AUD-007 Audit Findings & Remediation M...	Internal Audit / Finding Owners	View ↗
AUD-007-R002	Risk Prioritization The organization shall prioritize audit findings based on risk, impact, and urge...	AUD-007 Audit Findings & Remediation M...	Internal Audit / Finding Owners	View ↗
AUD-007-R003	Corrective Action Assignment The organization shall assign ownership for corrective actions to address audit...	AUD-007 Audit Findings & Remediation M...	Internal Audit / Finding Owners	View ↗
AUD-007-R004	Remediation Tracking The organization shall track the remediation of audit findings, including monito...	AUD-007 Audit Findings & Remediation M...	Internal Audit / Finding Owners	View ↗
AUD-007-R005	Verification Testing The organization shall conduct verification testing to confirm that corrective a...	AUD-007 Audit Findings & Remediation M...	Internal Audit / Finding Owners	View ↗
AUD-007-R006	Closure Approval The organization shall approve the closure of audit findings, ensuring findings...	AUD-007 Audit Findings & Remediation M...	Internal Audit / Finding Owners	View ↗
AUD-007-R007	Escalation Management The organization shall escalate audit findings that are not remediated within de...	AUD-007 Audit Findings & Remediation M...	Internal Audit / Finding Owners	View ↗
AUD-007-R008	Findings Reporting The organization shall report on audit findings, providing visibility into findi...	AUD-007 Audit Findings & Remediation M...	Internal Audit / Finding Owners	View ↗
AUD-007-R009	Trend Analysis The organization shall conduct trend analysis of audit findings to identify patt...	AUD-007 Audit Findings & Remediation M...	Internal Audit / Finding Owners	View ↗
AUD-007-R010	Continuous Improvement The organization shall establish a continuous improvement process for audit find...	AUD-007 Audit Findings & Remediation M...	Internal Audit / Finding Owners	View ↗
EXC-001-R001	Exception Governance Framework The organization shall establish an exception management governance framework th...	EXC-001 Exception Management Program	Risk & Compliance, CISO, Exception Management Committee	View ↗
EXC-001-R002	Program Scope The organization shall define a documented scope for the exception management pr...	EXC-001 Exception Management Program	Exception Manager, CISO, Compliance, Control Owners	View ↗
EXC-001-R003	Roles & Responsibilities The organization shall clearly define and document the roles and responsibilitie...	EXC-001 Exception Management Program	Exception Manager, Control Owners, Risk Management, CISO	View ↗
EXC-001-R004	Exception Policy The organization shall establish an exception policy that defines the requiremen...	EXC-001 Exception Management Program	CISO, Compliance, Risk Management, Policy Owner	View ↗
EXC-001-R005	Risk Governance The organization shall establish governance processes for exception risk managem...	EXC-001 Exception Management Program	Chief Risk Officer, CISO, Risk Management, Exception Approvers	View ↗
EXC-001-R006	Exception Metrics The organization shall define and track key metrics for the exception management...	EXC-001 Exception Management Program	Exception Manager, Risk Management, CISO	View ↗
EXC-001-R007	Executive Reporting The organization shall provide executive leadership and the board with regular r...	EXC-001 Exception Management Program	CISO, Chief Risk Officer, Board Risk Committee, Exception Manager	View ↗
EXC-001-R008	Program Review The organization shall conduct periodic reviews of the exception management prog...	EXC-001 Exception Management Program	Exception Manager, CISO, Risk Management, Internal Audit	View ↗
EXC-001-R009	Program Compliance The organization shall ensure the exception management program complies with app...	EXC-001 Exception Management Program	Compliance Officer, CISO, Legal, Exception Manager	View ↗
EXC-001-R010	Continuous Improvement The organization shall establish a continuous improvement process for the except...	EXC-001 Exception Management Program	Exception Manager, CISO, Control Owners, Process Improvement Team	View ↗
EXC-002-R001	Exception Request The organization shall submit exception requests for deviations from organizatio...	EXC-002 Exception Lifecycle Management	Control Owner, Exception Requestor, Exception Manager	View ↗
EXC-002-R002	Exception Risk Assessment The organization shall conduct risk assessments for exception requests to evalua...	EXC-002 Exception Lifecycle Management	Risk Management, Security Risk Officer, Control Owner	View ↗
EXC-002-R003	Exception Approval The organization shall approve exception requests, ensuring exceptions are autho...	EXC-002 Exception Lifecycle Management	Authorized Exception Approver, CISO, Risk Management, Control Owner	View ↗
EXC-002-R004	Exception Documentation The organization shall maintain comprehensive documentation of exception request...	EXC-002 Exception Lifecycle Management	Exception Manager, GRC Administrator, Records Management	View ↗
EXC-002-R005	Exception Monitoring The organization shall monitor approved exceptions, including monitoring of comp...	EXC-002 Exception Lifecycle Management	Control Owner, Exception Manager, Security Operations	View ↗
EXC-002-R006	Exception Periodic Review The organization shall conduct periodic reviews of approved exceptions to assess...	EXC-002 Exception Lifecycle Management	Exception Owner, Control Owner, Risk Management	View ↗
EXC-002-R007	Exception Renewal The organization shall renew exceptions before expiration, ensuring exceptions r...	EXC-002 Exception Lifecycle Management	Exception Manager, Exception Owner, Risk Approver	View ↗
EXC-002-R008	Exception Expiration The organization shall manage exception expiration, ensuring exceptions are eith...	EXC-002 Exception Lifecycle Management	Exception Manager, Control Owner, IT Operations	View ↗
EXC-002-R009	Exception Closure The organization shall close exceptions when they are no longer required, when c...	EXC-002 Exception Lifecycle Management	Control Owner, Exception Manager, Security Assurance	View ↗
EXC-002-R010	Continuous Improvement The organization shall establish a continuous improvement process for exception...	EXC-002 Exception Lifecycle Management	Exception Manager, CISO, Control Owners, Process Improvement Team	View ↗
REG-001-R001	Governance Charter The organization shall establish and maintain a formal regulatory change governa...	REG-001 Regulatory Change Governance &...	Chief Compliance Officer / General Counsel	View ↗
REG-001-R002	Change Control Board The organization shall establish a Change Control Board (CCB) or equivalent desi...	REG-001 Regulatory Change Governance &...	Chief Compliance Officer / General Counsel	View ↗
REG-001-R003	Accountability and Ownership The organization shall assign accountable owners for each stage of the regulator...	REG-001 Regulatory Change Governance &...	Chief Compliance Officer / General Counsel	View ↗
REG-001-R004	Approval and Escalation The organization shall define approval thresholds and escalation criteria based...	REG-001 Regulatory Change Governance &...	Chief Compliance Officer / General Counsel	View ↗
REG-001-R005	Governance Records The organization shall maintain records of regulatory change governance decision...	REG-001 Regulatory Change Governance &...	Chief Compliance Officer / General Counsel	View ↗
REG-001-R006	Periodic Governance Review The organization shall periodically review the regulatory change governance stru...	REG-001 Regulatory Change Governance &...	Chief Compliance Officer / General Counsel	View ↗
REG-002-R001	Authoritative Source Inventory The organization shall maintain an inventory of authoritative regulatory sources...	REG-002 Automated Regulatory Monitorin...	Compliance / Regulatory Affairs	View ↗
REG-002-R002	Automated Regulatory Monitoring The organization shall implement defined processes or technology to monitor rele...	REG-002 Automated Regulatory Monitorin...	Compliance / Regulatory Affairs	View ↗
REG-002-R003	Regulatory Relevance Assessment The organization shall apply documented criteria to determine whether identified...	REG-002 Automated Regulatory Monitorin...	Compliance / Regulatory Affairs	View ↗
REG-002-R004	Regulatory Intelligence Triage The organization shall triage identified regulatory changes according to relevan...	REG-002 Automated Regulatory Monitorin...	Compliance / Regulatory Affairs	View ↗
REG-002-R005	Monitoring Evidence The organization shall retain evidence of regulatory monitoring activities, incl...	REG-002 Automated Regulatory Monitorin...	Compliance / Regulatory Affairs	View ↗
REG-002-R006	Human Review of Automated Results Where automated or AI-assisted relevance scoring is used, the organization shall...	REG-002 Automated Regulatory Monitorin...	Compliance / Regulatory Affairs	View ↗
REG-003-R001	Applicability Assessment The organization shall perform a documented applicability assessment for each ma...	REG-003 Regulatory Change Impact Asses...	Chief Compliance Officer / Enterprise Risk Management	View ↗
REG-003-R002	Obligation Impact Analysis The organization shall identify the specific regulatory obligations created, mod...	REG-003 Regulatory Change Impact Asses...	Chief Compliance Officer / Enterprise Risk Management	View ↗
REG-003-R003	Business Process Impact Assessment The organization shall assess the effect of regulatory changes on relevant busin...	REG-003 Regulatory Change Impact Asses...	Chief Compliance Officer / Enterprise Risk Management	View ↗
REG-003-R004	Control Gap Assessment The organization shall evaluate affected internal controls to identify gaps, def...	REG-003 Regulatory Change Impact Asses...	Chief Compliance Officer / Enterprise Risk Management	View ↗
REG-003-R005	Technology and Third-Party Impact The organization shall assess the effect of material regulatory changes on relev...	REG-003 Regulatory Change Impact Asses...	Chief Compliance Officer / Enterprise Risk Management	View ↗
REG-003-R006	Implementation Effort and Risk Assessment The organization shall evaluate implementation effort, resources, dependencies,...	REG-003 Regulatory Change Impact Asses...	Chief Compliance Officer / Enterprise Risk Management	View ↗
REG-004-R001	Regulatory Obligations Library The organization shall establish and maintain a centralized library of applicabl...	REG-004 Regulatory Obligations & Contr...	Compliance / Regulatory Affairs	View ↗
REG-004-R002	Obligation Traceability The organization shall maintain traceable linkages between regulatory obligation...	REG-004 Regulatory Obligations & Contr...	Compliance / Regulatory Affairs	View ↗
REG-004-R003	Policy and Procedure Updates The organization shall update affected policies, standards, procedures, and othe...	REG-004 Regulatory Obligations & Contr...	Compliance / Regulatory Affairs	View ↗
REG-004-R004	Control Alignment The organization shall update affected operational and technical controls when r...	REG-004 Regulatory Obligations & Contr...	Compliance / Regulatory Affairs	View ↗
REG-004-R005	Version and Change History The organization shall maintain version history and change records for regulator...	REG-004 Regulatory Obligations & Contr...	Compliance / Regulatory Affairs	View ↗
REG-004-R006	Obligation Ownership and Review The organization shall assign owners to regulatory obligations and periodically...	REG-004 Regulatory Obligations & Contr...	Compliance / Regulatory Affairs	View ↗
REG-005-R001	Regulatory Change Workflow The organization shall maintain a documented workflow for routing regulatory cha...	REG-005 Regulatory Change Workflow & A...	Compliance / Regulatory Change Manager	View ↗
REG-005-R002	Stakeholder Assignment The organization shall assign regulatory change actions to accountable stakehold...	REG-005 Regulatory Change Workflow & A...	Compliance / Regulatory Change Manager	View ↗
REG-005-R003	Implementation Milestones The organization shall define implementation activities, owners, target dates, d...	REG-005 Regulatory Change Workflow & A...	Compliance / Regulatory Change Manager	View ↗
REG-005-R004	Escalation and Overdue Actions The organization shall establish escalation procedures for overdue, blocked, hig...	REG-005 Regulatory Change Workflow & A...	Compliance / Regulatory Change Manager	View ↗
REG-005-R005	Audit Trail and Evidence The organization shall maintain an auditable record of regulatory change identif...	REG-005 Regulatory Change Workflow & A...	Compliance / Regulatory Change Manager	View ↗
REG-005-R006	Closure Approval The organization shall require documented validation and authorized approval bef...	REG-005 Regulatory Change Workflow & A...	Compliance / Regulatory Change Manager	View ↗
REG-006-R001	Post-Implementation Validation The organization shall perform documented validation after implementing material...	REG-006 Regulatory Change Validation &...	Compliance / Internal Audit / Control Owners	View ↗
REG-006-R002	Control Effectiveness Testing The organization shall test affected controls to determine whether they operate...	REG-006 Regulatory Change Validation &...	Compliance / Internal Audit / Control Owners	View ↗
REG-006-R003	Evidence Review The organization shall review and retain evidence demonstrating that regulatory...	REG-006 Regulatory Change Validation &...	Compliance / Internal Audit / Control Owners	View ↗
REG-006-R004	Deficiency and Remediation Tracking The organization shall record deficiencies identified through validation or test...	REG-006 Regulatory Change Validation &...	Compliance / Internal Audit / Control Owners	View ↗
REG-006-R005	Continuous Regulatory Monitoring The organization shall continue monitoring relevant regulatory sources after imp...	REG-006 Regulatory Change Validation &...	Compliance / Internal Audit / Control Owners	View ↗
REG-006-R006	Effectiveness Review The organization shall periodically evaluate the effectiveness and sustainabilit...	REG-006 Regulatory Change Validation &...	Compliance / Internal Audit / Control Owners	View ↗

COBIT:2019