Criticality Medium Active

Attestation & Certification Management

Establishes attestation and certification including certification governance, planning, attestation management, certification maintenance, renewal management, regulatory examinations, reporting, review, evidence collection, and continuous improvement.

Control ID
AUD-006
Domain Code
AUD
Control Nature
Detective
Business Owner
CISO / Compliance Officer
Category
Operational
Compensating Control
No

Control Overview

AUD-006 · Full Control Profile
Business Description

Establish and maintain processes to manage organizational certifications, attestations, regulatory examinations, external audits, and assurance obligations throughout their lifecycle.

Business Objective

Demonstrate ongoing compliance and provide confidence to customers, regulators, partners, and other stakeholders.

Business Benefits

    Business Risks if Missing

      Stakeholders, Industries & Technologies

      AUD-006 · Operating Context

      Primary Stakeholders

      Applicable Industries

      Applicable Technologies

      Mapped Regulatory & Industry Frameworks

      Harmonized Framework Mappings

      The following compliance and regulatory frameworks map directly to this control's governance scope.

      FRAMEWORK CODE FRAMEWORK NAME & DESCRIPTION FAMILY / CATEGORY VERSION ACTION
      RBI-CSF RBI Cyber Security Framework / Master Directions RBI cyber-security requirements and directions set...
      India
      Regulation
      		 vLatest View →
      DORA Digital Operational Resilience Act The EU Digital Operational Resilience Act establis...
      EU
      Regulation
      		 vCurrent View →
      HIPAA Health Insurance Portability and Accountability Act HIPAA is a U.S. federal law supported by implement...
      US
      Law
      		 vCurrent View →
      COBIT2019 COBIT COBIT is an enterprise governance and management f...
      COBIT
      Governance Framework
      		 v2019 View →
      NIST-CSF NIST Cybersecurity Framework (CSF) The NIST Cybersecurity Framework provides high-lev...
      NIST
      Framework
      		 v2 View →
      NIST80053 NIST SP 800-53 NIST SP 800-53 Rev. 5 presents control families, i...
      NIST
      Control Catalog
      		 vRev. 5 View →
      GDPR General Data Protection Regulation (GDPR) The General Data Protection Regulation is a bindin...
      EU
      Regulation
      		 vCurrent View →
      NPCI-ISR NPCI Information Security Requirements NPCI information-security requirements define cont...
      India
      Standard
      		 vLatest View →
      SOC2 SOC 2 Trust Services Criteria SOC 2 is an independent examination and reporting...
      AICPA
      Audit Framework
      		 vLatest View →
      ISO27001 ISO/IEC 27001 ISO/IEC 27001 specifies auditable requirements for...
      ISO
      Standard
      		 v2022 View →

      Parent Domain Context

      Governance Domain Baseline
      Domain Name:
      Audit & Assurance (AUD)
      Purpose:
      To provide confidence that security controls are effective and operating as intended.
      Scope:
      Enterprise
      View

      Compliance Requirements & Audit Crosswalk

      10 Specific Audit Clauses

      The following requirements dictate specific audit evidence criteria and testing steps mapped directly under this control.

      REQUIREMENT ID REQUIREMENT TITLE & DETAILS MAPPED CONTROL TYPICAL OWNER ACTION
      AUD-006-R001 Certification Governance The organization shall establish governa... AUD-006 Attestation & Certification Ma... Compliance Officer / Certification Manager View ↗
      AUD-006-R002 Certification Planning The organization shall conduct formal pl... AUD-006 Attestation & Certification Ma... Compliance Officer / Certification Manager View ↗
      AUD-006-R003 Attestation Management The organization shall manage attestatio... AUD-006 Attestation & Certification Ma... Compliance Officer / Certification Manager View ↗
      AUD-006-R004 Certification Maintenance The organization shall maintain certific... AUD-006 Attestation & Certification Ma... Compliance Officer / Certification Manager View ↗
      AUD-006-R005 Renewal Management The organization shall manage certificat... AUD-006 Attestation & Certification Ma... Compliance Officer / Certification Manager View ↗
      AUD-006-R006 Regulatory Examinations The organization shall manage regulatory... AUD-006 Attestation & Certification Ma... Compliance Officer / Certification Manager View ↗
      AUD-006-R007 Certification Reporting The organization shall report on certifi... AUD-006 Attestation & Certification Ma... Compliance Officer / Certification Manager View ↗
      AUD-006-R008 Management Review The organization shall review certificat... AUD-006 Attestation & Certification Ma... Compliance Officer / Certification Manager View ↗
      AUD-006-R009 Evidence Collection The organization shall collect, organize... AUD-006 Attestation & Certification Ma... Compliance Officer / Certification Manager View ↗
      AUD-006-R010 Continuous Improvement The organization shall establish a conti... AUD-006 Attestation & Certification Ma... Compliance Officer / Certification Manager View ↗