Criticality Critical Active

Regulatory Obligations & Control Alignment

Maintains an authoritative obligations repository linking regulatory sources and requirements to internal policies, procedures, standards, and controls, with ownership, version history, status, and change traceability.

Control ID
REG-004
Domain Code
REG
Control Nature
Preventive
Business Owner
Compliance / Regulatory Affairs
Category
Administrative
Compensating Control
No

Control Overview

REG-004 · Full Control Profile
Business Description

Maintain a centralized regulatory obligations library and map regulatory requirements to internal policies, procedures, standards, and operational controls with version control and traceability.

Business Objective

To maintain traceability between external regulatory obligations and the organization's internal compliance framework.

Business Benefits

    Business Risks if Missing

      Stakeholders, Industries & Technologies

      REG-004 · Operating Context

      Primary Stakeholders

      Applicable Industries

      Applicable Technologies

      Mapped Regulatory & Industry Frameworks

      Harmonized Framework Mappings

      The following compliance and regulatory frameworks map directly to this control's governance scope.

      FRAMEWORK CODE FRAMEWORK NAME & DESCRIPTION FAMILY / CATEGORY VERSION ACTION
      COBIT2019 COBIT COBIT is an enterprise governance and management f...
      COBIT
      Governance Framework
      		 v2019 View →
      ISO22301 ISO/IEC 22301 ISO 22301 specifies requirements for a Business Co...
      ISO
      Standard
      		 v2019 View →
      NIST-CSF NIST Cybersecurity Framework (CSF) The NIST Cybersecurity Framework provides high-lev...
      NIST
      Framework
      		 v2 View →
      PCI-DSS PCI DSS PCI DSS is an industry security standard maintaine...
      PCI
      Standard
      		 v4 View →
      HIPAA Health Insurance Portability and Accountability Act HIPAA is a U.S. federal law supported by implement...
      US
      Law
      		 vCurrent View →

      Parent Domain Context

      Governance Domain Baseline
      Domain Name:
      Regulatory Change Management (REG)
      Purpose:
      To systematically identify, track, and assess changes in relevant laws and regulations to ensure the organization remains compliant.
      Scope:
      Enterprise
      View

      Compliance Requirements & Audit Crosswalk

      6 Specific Audit Clauses

      The following requirements dictate specific audit evidence criteria and testing steps mapped directly under this control.

      REQUIREMENT ID REQUIREMENT TITLE & DETAILS MAPPED CONTROL TYPICAL OWNER ACTION
      REG-004-R001 Regulatory Obligations Library The organization shall establish and mai... REG-004 Regulatory Obligations & Contr... Compliance / Regulatory Affairs View ↗
      REG-004-R002 Obligation Traceability The organization shall maintain traceabl... REG-004 Regulatory Obligations & Contr... Compliance / Regulatory Affairs View ↗
      REG-004-R003 Policy and Procedure Updates The organization shall update affected p... REG-004 Regulatory Obligations & Contr... Compliance / Regulatory Affairs View ↗
      REG-004-R004 Control Alignment The organization shall update affected o... REG-004 Regulatory Obligations & Contr... Compliance / Regulatory Affairs View ↗
      REG-004-R005 Version and Change History The organization shall maintain version... REG-004 Regulatory Obligations & Contr... Compliance / Regulatory Affairs View ↗
      REG-004-R006 Obligation Ownership and Review The organization shall assign owners to... REG-004 Regulatory Obligations & Contr... Compliance / Regulatory Affairs View ↗