Operational Dependency Management (OPR-003) - Universal Control Library

Criticality High Active

Control ID

OPR-003

Domain Code

OPR

Control Nature

Detective

Business Owner

Business Continuity Manager / Business Owner

Control Overview

OPR-003 · Full Control Profile

Business Description

Establish and maintain processes to identify, map, assess, monitor, and govern dependencies between business services, technology, facilities, people, data, and third-party service providers.

Business Objective

Improve organizational resilience by understanding and managing operational dependencies and single points of failure.

Business Benefits

Business Risks if Missing

Stakeholders, Industries & Technologies

OPR-003 · Operating Context

Primary Stakeholders

Applicable Industries

Applicable Technologies

Mapped Regulatory & Industry Frameworks

Harmonized Framework Mappings

The following compliance and regulatory frameworks map directly to this control's governance scope.

FRAMEWORK CODE	FRAMEWORK NAME & DESCRIPTION	FAMILY / CATEGORY	VERSION	ACTION
IRDAI	IRDAI Information & Cyber Security Guidelines IRDAI information and cyber-security requirements...	India Guideline	vLatest	View →
RBI-CSF	RBI Cyber Security Framework / Master Directions RBI cyber-security requirements and directions set...	India Regulation	vLatest	View →
SEBI-CSCRF	SEBI Cyber Security & Cyber Resilience Framework SEBI’s Cybersecurity and Cyber Resilience Framewor...	India Regulation	vLatest	View →
DORA	Digital Operational Resilience Act The EU Digital Operational Resilience Act establis...	EU Regulation	vCurrent	View →
NIS2	NIS2 Directive The NIS2 Directive establishes EU-wide cybersecuri...	EU Directive	vCurrent	View →
PCI-DSS	PCI DSS PCI DSS is an industry security standard maintaine...	PCI Standard	v4	View →
COBIT2019	COBIT COBIT is an enterprise governance and management f...	COBIT Governance Framework	v2019	View →
ISO22301	ISO/IEC 22301 ISO 22301 specifies requirements for a Business Co...	ISO Standard	v2019	View →
NIST-CSF	NIST Cybersecurity Framework (CSF) The NIST Cybersecurity Framework provides high-lev...	NIST Framework	v2	View →
NIST80053	NIST SP 800-53 NIST SP 800-53 Rev. 5 presents control families, i...	NIST Control Catalog	vRev. 5	View →
GDPR	General Data Protection Regulation (GDPR) The General Data Protection Regulation is a bindin...	EU Regulation	vCurrent	View →
NPCI-ISR	NPCI Information Security Requirements NPCI information-security requirements define cont...	India Standard	vLatest	View →
SOC2	SOC 2 Trust Services Criteria SOC 2 is an independent examination and reporting...	AICPA Audit Framework	vLatest	View →
HIPAA	Health Insurance Portability and Accountability Act HIPAA is a U.S. federal law supported by implement...	US Law	vCurrent	View →
ISO27001	ISO/IEC 27001 ISO/IEC 27001 specifies auditable requirements for...	ISO Standard	v2022	View →

Parent Domain Context

Governance Domain Baseline

Domain Name:

Operational Resilience (OPR)

Purpose:

To ensure the organization can withstand and adapt to operational disruptions.

Scope:

Enterprise

View

Compliance Requirements & Audit Crosswalk

10 Specific Audit Clauses

The following requirements dictate specific audit evidence criteria and testing steps mapped directly under this control.

REQUIREMENT ID	REQUIREMENT TITLE & DETAILS	MAPPED CONTROL	TYPICAL OWNER	ACTION
OPR-003-R001	Dependency Identification The organization shall identify all depe...	OPR-003 Operational Dependency Managem...	Operational Resilience, Enterprise Architecture, IT Operations, Third-Party Risk	View ↗
OPR-003-R002	Technology Dependency Mapping The organization shall map technology de...	OPR-003 Operational Dependency Managem...	Operational Resilience, Enterprise Architecture, IT Operations, Third-Party Risk	View ↗
OPR-003-R003	Third-Party Dependency Mapping The organization shall map third-party d...	OPR-003 Operational Dependency Managem...	Operational Resilience, Enterprise Architecture, IT Operations, Third-Party Risk	View ↗
OPR-003-R004	People Dependency Mapping The organization shall map people depend...	OPR-003 Operational Dependency Managem...	Operational Resilience, Enterprise Architecture, IT Operations, Third-Party Risk	View ↗
OPR-003-R005	Facility Dependency Mapping The organization shall map facility depe...	OPR-003 Operational Dependency Managem...	Operational Resilience, Enterprise Architecture, IT Operations, Third-Party Risk	View ↗
OPR-003-R006	Dependency Risk Assessment The organization shall conduct risk asse...	OPR-003 Operational Dependency Managem...	Operational Resilience, Enterprise Architecture, IT Operations, Third-Party Risk	View ↗
OPR-003-R007	Dependency Monitoring The organization shall monitor critical...	OPR-003 Operational Dependency Managem...	Operational Resilience, Enterprise Architecture, IT Operations, Third-Party Risk	View ↗
OPR-003-R008	Dependency Reporting The organization shall report on depende...	OPR-003 Operational Dependency Managem...	Operational Resilience, Enterprise Architecture, IT Operations, Third-Party Risk	View ↗
OPR-003-R009	Dependency Review The organization shall conduct periodic...	OPR-003 Operational Dependency Managem...	Operational Resilience, Enterprise Architecture, IT Operations, Third-Party Risk	View ↗
OPR-003-R010	Continuous Improvement The organization shall establish a conti...	OPR-003 Operational Dependency Managem...	Operational Resilience, Enterprise Architecture, IT Operations, Third-Party Risk	View ↗