CERT-In Directions:2022 (CERT-IN) - Universal Control Library

TypeDirection Cyber Regulation

Framework ID

FW-016

Framework Code

CERT-IN

Publisher

CERT-In

Framework Family

India

Region

India

Industry

All

Framework Overview

CERT-IN · Full Framework Profile

Purpose & Objective

Improve national cyber incident visibility and response readiness by requiring specified entities to maintain logs, report designated cyber incidents and follow prescribed operational directions. It supports timely incident coordination, investigation and preservation of relevant digital evidence.

Scope

Applies to the entities and systems covered by the relevant CERT-In directions. Scope can include ICT infrastructure, cloud or hosting services, networks, endpoints, incident records and log-retention arrangements; organizations should verify the precise category, incident types, timelines and current official guidance.

Key Focus Areas

Structure & Domains

Certification & Assessment

Official Source

CERT-IN · Reference

Visit Official Source

Associated Compliance Domains

9 Mapped Domains in Framework

Click any domain to explore its controls, requirements, and implementation guidance.

Domain ID	Code	Domain Name	Business Owner	Controls	Status	Action
DOM-004	CMP	Compliance Management	Compliance Officer	7	Active	View Domain →
DOM-008	DAT	Data Protection & Privacy	Data Protection Officer	16	Active	View Domain →
DOM-011	END	Endpoint Security	Endpoint Security	6	Active	View Domain →
DOM-012	CLD	Cloud Security	Cloud Security	10	Active	View Domain →
DOM-015	APP	Application Security	Application Security	12	Active	View Domain →
DOM-017	OPS	IT Operations & Service Management	IT Operations	7	Active	View Domain →
DOM-020	INC	Incident Management	Incident Response Team	7	Active	View Domain →
DOM-024	TPR	Third-Party & Supply Chain Security	Vendor Risk Management	6	Active	View Domain →
DOM-027	AIG	AI Governance & Model Security	AI Governance Committee	6	Active	View Domain →

Associated Controls Catalog

77 Active Controls in Framework

Control ID	Control Name	Category & Type	Criticality	Status	Requirements	Action
CMP-001	Compliance Program Management Establishes a comprehensive compliance program with governan...	Administrative Detective	High	Active	📋 10 Reqs	View →
CMP-002	Control Compliance Monitoring Establishes continuous monitoring of security control compli...	Operational Detective	High	Active	📋 10 Reqs	View →
CMP-003	Compliance Evidence Management Establishes processes for identifying, collecting, validatin...	Administrative Detective	High	Active	📋 10 Reqs	View →
CMP-004	Non-Compliance Management Establishes processes to identify, document, classify, analy...	Administrative Detective	High	Active	📋 10 Reqs	View →
CMP-005	Compliance Reporting Establishes regular reporting processes to communicate compl...	Administrative Detective	High	Active	📋 10 Reqs	View →
CMP-006	Regulatory Change Management Establishes systematic processes to identify, monitor, asses...	Administrative Detective	Critical	Active	📋 10 Reqs	View →
CMP-007	Compliance Obligation Mapping Establishes comprehensive mapping of applicable obligations...	Administrative Detective	High	Active	📋 10 Reqs	View →
DAT-001	Data Protection & Privacy Strategy Establishes enterprise data protection and privacy strategy...	Administrative Preventive	Critical	Active	📋 10 Reqs	View →
DAT-002	Data Discovery Establishes automated and manual processes to discover, iden...	Technical Detective	High	Active	📋 10 Reqs	View →
DAT-003	Data Classification & Handling Establishes a data classification framework with defined cat...	Administrative Preventive	High	Active	📋 10 Reqs	View →
DAT-004	Data Retention & Disposal Establishes data retention schedules, archival processes, di...	Technical Preventive	Critical	Active	📋 10 Reqs	View →
DAT-005	Data Ownership & Stewardship Establishes clear data ownership and stewardship assignments...	Technical Preventive	High	Active	📋 10 Reqs	View →
DAT-006	Data Flow Mapping, Inventory & Lineage Establishes comprehensive data flow mapping, data inventory,...	Administrative Preventive	High	Active	📋 10 Reqs	View →
DAT-007	Data Subject Rights Management Establishes processes for receiving, validating, fulfilling,...	Administrative Detective	High	Active	📋 10 Reqs	View →
DAT-008	Consent Management Establishes comprehensive consent management including colle...	Administrative Detective	High	Active	📋 10 Reqs	View →
DAT-009	Cross-Border Data Transfer Establishes governance for cross-border data transfers inclu...	Technical Detective	High	Active	📋 10 Reqs	View →
DAT-010	Privacy Notices Establishes processes for developing, publishing, maintainin...	Technical Preventive	High	Active	📋 10 Reqs	View →
DAT-011	Privacy by Design Establishes processes to integrate privacy requirements, con...	Technical Preventive	High	Active	📋 10 Reqs	View →
DAT-012	Data Protection Impact Assessment (DPIA) Establishes formal DPIA processes for scoping, assessing, do...	Technical Detective	Critical	Active	📋 10 Reqs	View →
DAT-013	Record of Processing Activities (ROPA) Establishes and maintains a complete, accurate Record of Pro...	Technical Preventive	High	Active	📋 10 Reqs	View →
DAT-014	Data Loss Prevention (DLP) Establishes Data Loss Prevention controls including policy d...	Technical Detective	Critical	Active	📋 10 Reqs	View →
DAT-015	Data Integrity Establishes data integrity controls including protection, va...	Technical Detective	Critical	Active	📋 10 Reqs	View →
DAT-016	Data Masking & Anonymization Establishes data masking and anonymization processes for pro...	Technical Detective	High	Active	📋 10 Reqs	View →
END-001	Endpoint Protection Establishes comprehensive endpoint protection including malw...	Technical Detective	Critical	Active	📋 10 Reqs	View →
END-002	Endpoint Detection & Response (EDR) Establishes Endpoint Detection and Response capabilities inc...	Technical Corrective	Critical	Active	📋 10 Reqs	View →
END-003	Mobile Device & Application Management Establishes mobile device and application management includi...	Technical Detective	High	Active	📋 10 Reqs	View →
END-004	Endpoint Encryption Establishes endpoint encryption including requirements defin...	Technical Corrective	Critical	Active	📋 10 Reqs	View →
END-005	Endpoint Application Control Establishes endpoint application control including approved...	Technical Detective	High	Active	📋 10 Reqs	View →
END-006	Removable Media & Peripheral Control Establishes controls for removable media and peripherals inc...	Technical Detective	High	Active	📋 10 Reqs	View →
CLD-001	Cloud Security Governance Establishes cloud security governance including framework, s...	Technical Detective	Critical	Active	📋 10 Reqs	View →
CLD-002	Cloud Shared Responsibility Management Establishes shared responsibility model documentation includ...	Technical Detective	High	Active	📋 10 Reqs	View →
CLD-003	Secure Cloud Configuration Establishes secure cloud configuration baselines, standards,...	Technical Detective	High	Active	📋 10 Reqs	View →
CLD-004	Cloud Identity & Access Management Establishes cloud identity and access management including i...	Technical Detective	Critical	Active	📋 10 Reqs	View →
CLD-005	Cloud Network Security Establishes cloud network security including segmentation, s...	Technical Detective	Critical	Active	📋 10 Reqs	View →
CLD-006	Cloud Data Protection Establishes cloud data protection including encryption, acce...	Technical Corrective	Critical	Active	📋 10 Reqs	View →
CLD-007	Cloud Workload & Container Security Establishes cloud workload security including container secu...	Technical Detective	Critical	Active	📋 10 Reqs	View →
CLD-008	Cloud Security Monitoring Establishes cloud security monitoring including logging, eve...	Technical Corrective	High	Active	📋 10 Reqs	View →
CLD-009	Cloud Incident Response Establishes cloud incident response including detection, inv...	Technical Corrective	High	Active	📋 10 Reqs	View →
CLD-010	Cloud Data Portability & Interoperability Establishes cloud data portability including export manageme...	Technical Preventive	High	Active	📋 10 Reqs	View →
APP-001	Application Security Program Establishes enterprise application security program includin...	Administrative Detective	Critical	Active	📋 10 Reqs	View →
APP-002	Application Inventory Establishes application inventory including registration, cl...	Administrative Detective	High	Active	📋 10 Reqs	View →
APP-003	Secure Software Development Lifecycle (SSDLC) Establishes SSDLC including security requirements, design re...	Administrative Detective	Critical	Active	📋 10 Reqs	View →
APP-004	Secure Coding Practices Establishes secure coding practices including standards, dev...	Technical Detective	High	Active	📋 10 Reqs	View →
APP-005	Application Security Testing Establishes application security testing including SAST, DAS...	Technical Detective	Critical	Active	📋 10 Reqs	View →
APP-006	DevSecOps Establishes DevSecOps including CI/CD security, pipeline sec...	Technical Detective	High	Active	📋 10 Reqs	View →
APP-007	Software Supply Chain Security Establishes software supply chain security including SBOM ma...	Technical Detective	Critical	Active	📋 10 Reqs	View →
APP-008	API Security Establishes API security including authentication, authoriza...	Technical Detective	Critical	Active	📋 10 Reqs	View →
APP-009	Secrets Management Establishes secrets management including inventory, secure s...	Technical Detective	Critical	Active	📋 10 Reqs	View →
APP-010	Software Release & Deployment Security Establishes secure release and deployment including release...	Technical Detective	High	Active	📋 10 Reqs	View →
APP-011	Application Security Incident Response Establishes application security incident response including...	Technical Corrective	High	Active	📋 10 Reqs	View →
APP-012	Application Risk Assessment Establishes application risk assessment including risk ident...	Administrative Detective	Critical	Active	📋 10 Reqs	View →
OPS-001	Change & Release Management Establishes change and release management including request...	Operational Detective	High	Active	📋 10 Reqs	View →
OPS-002	Operational Monitoring & Service Health Establishes operational monitoring including health monitori...	Operational Detective	High	Active	📋 10 Reqs	View →
OPS-003	Service Availability Management Establishes service availability management including availa...	Operational Detective	High	Active	📋 10 Reqs	View →
OPS-004	Capacity & Performance Management Establishes capacity and performance management including ca...	Operational Detective	High	Active	📋 10 Reqs	View →
OPS-005	System Maintenance Management Establishes system maintenance including preventive maintena...	Operational Detective	High	Active	📋 10 Reqs	View →
OPS-006	End-of-Life & Technology Lifecycle Management Establishes end-of-life management including inventory revie...	Operational Detective	High	Active	📋 10 Reqs	View →
OPS-007	Batch Processing & Job Management Establishes batch processing and job management including sc...	Operational Corrective	Medium	Active	📋 10 Reqs	View →
INC-001	Incident Response Program Establishes incident response program including governance,...	Operational Corrective	Critical	Active	📋 10 Reqs	View →
INC-002	Incident Response Preparedness Establishes incident response preparedness including team, p...	Operational Preventive	High	Active	📋 10 Reqs	View →
INC-003	Incident Detection, Analysis & Reporting Establishes incident detection and analysis including identi...	Operational Detective	Critical	Active	📋 10 Reqs	View →
INC-004	Incident Containment, Eradication & Recovery Establishes containment and recovery including containment s...	Operational Corrective	Critical	Active	📋 10 Reqs	View →
INC-005	Post-Incident Review & Continuous Improvement Establishes post-incident review including root cause analys...	Operational Corrective	High	Active	📋 10 Reqs	View →
INC-006	Crisis Communication Management Establishes crisis communication including internal communic...	Operational Corrective	High	Active	📋 10 Reqs	View →
INC-007	Regulatory & External Incident Notification Establishes regulatory and external notification including r...	Operational Corrective	Critical	Active	📋 10 Reqs	View →
TPR-001	Third-Party Risk Management Program Establishes TPRM program including governance, scope, classi...	Administrative Detective	Critical	Active	📋 10 Reqs	View →
TPR-002	Third-Party Risk Assessment & Due Diligence Establishes third-party due diligence including vendor risk...	Administrative Detective	Critical	Active	📋 10 Reqs	View →
TPR-003	Third-Party Contract & Compliance Management Establishes third-party contract management including contra...	Administrative Detective	High	Active	📋 10 Reqs	View →
TPR-004	Third-Party Continuous Monitoring & Assurance Establishes third-party monitoring including continuous risk...	Operational Detective	High	Active	📋 10 Reqs	View →
TPR-005	Third-Party Lifecycle & Offboarding Management Establishes third-party lifecycle management including onboa...	Administrative Preventive	High	Active	📋 10 Reqs	View →
TPR-006	Third-Party Concentration Risk Management Establishes concentration risk management including critical...	Administrative Detective	High	Active	📋 10 Reqs	View →
AIG-001	AI Governance & Oversight Establishes AI governance including framework, committee, po...	Administrative Detective	Critical	Active	📋 10 Reqs	View →
AIG-002	AI Risk & Impact Management Establishes AI risk management including risk assessment, im...	Administrative Detective	High	Active	📋 10 Reqs	View →
AIG-003	AI Asset & Lifecycle Management Establishes AI lifecycle management including inventory, cla...	Administrative Detective	High	Active	📋 10 Reqs	View →
AIG-004	Responsible AI Management Establishes responsible AI including principles, transparenc...	Administrative Detective	High	Active	📋 10 Reqs	View →
AIG-005	AI Security & Operational Resilience Establishes AI security including adversarial protection, pr...	Administrative Corrective	Critical	Active	📋 10 Reqs	View →
AIG-006	AI Performance Monitoring & Continuous Improvement Establishes AI performance monitoring including performance...	Operational Detective	High	Active	📋 10 Reqs	View →

Compliance Requirements & Audit Crosswalk

770 Specific Audit Clauses

The following requirements dictate specific audit evidence criteria and testing steps mapped directly under the controls of this framework.

REQUIREMENT ID	REQUIREMENT TITLE & DETAILS	MAPPED CONTROL	TYPICAL OWNER	ACTION
CMP-001-R001	Compliance Program Framework The organization shall establish a compliance program framework that defines the...	CMP-001 Compliance Program Management	Chief Compliance Officer, Compliance Management	View ↗
CMP-001-R002	Compliance Governance The organization shall establish governance structures for the compliance progra...	CMP-001 Compliance Program Management	Chief Compliance Officer, Compliance Management	View ↗
CMP-001-R003	Compliance Scope The organization shall define and maintain a documented scope for the compliance...	CMP-001 Compliance Program Management	Chief Compliance Officer, Compliance Management	View ↗
CMP-001-R004	Compliance Roles and Responsibilities The organization shall clearly define and document the roles and responsibilitie...	CMP-001 Compliance Program Management	Chief Compliance Officer, Compliance Management	View ↗
CMP-001-R005	Compliance Planning The organization shall conduct formal planning for compliance management activit...	CMP-001 Compliance Program Management	Chief Compliance Officer, Compliance Management	View ↗
CMP-001-R006	Compliance Program Execution The organization shall execute the compliance program in accordance with approve...	CMP-001 Compliance Program Management	Chief Compliance Officer, Compliance Management	View ↗
CMP-001-R007	Compliance Resource Management The organization shall manage resources for the compliance program, including id...	CMP-001 Compliance Program Management	Chief Compliance Officer, Compliance Management	View ↗
CMP-001-R008	Compliance Performance Monitoring The organization shall monitor the performance of the compliance program to trac...	CMP-001 Compliance Program Management	Chief Compliance Officer, Compliance Management	View ↗
CMP-001-R009	Compliance Program Review The organization shall conduct periodic reviews of the compliance program to ass...	CMP-001 Compliance Program Management	Chief Compliance Officer, Compliance Management	View ↗
CMP-001-R010	Compliance Program Continuous Improvement The organization shall drive ongoing enhancement of the compliance program throu...	CMP-001 Compliance Program Management	Chief Compliance Officer, Compliance Management, Control Owners	View ↗
CMP-002-R001	Compliance Monitoring Framework The organization shall establish a compliance monitoring framework that defines...	CMP-002 Control Compliance Monitoring	Chief Compliance Officer, Compliance Management, Control Owners	View ↗
CMP-002-R002	Compliance Assessment Planning The organization shall conduct formal planning for compliance assessments, defin...	CMP-002 Control Compliance Monitoring	Chief Compliance Officer, Compliance Management, Control Owners	View ↗
CMP-002-R003	Control Compliance Assessment The organization shall conduct regular assessments of controls to verify complia...	CMP-002 Control Compliance Monitoring	Chief Compliance Officer, Compliance Management, Control Owners	View ↗
CMP-002-R004	Compliance Gap Identification The organization shall identify compliance gaps, including controls that are mis...	CMP-002 Control Compliance Monitoring	Chief Compliance Officer, Compliance Management, Control Owners	View ↗
CMP-002-R005	Compliance Status Tracking The organization shall track the status of compliance with applicable legal, reg...	CMP-002 Control Compliance Monitoring	Chief Compliance Officer, Compliance Management, Control Owners	View ↗
CMP-002-R006	Compliance Exception Identification The organization shall identify and document exceptions to compliance requiremen...	CMP-002 Control Compliance Monitoring	Chief Compliance Officer, Compliance Management, Control Owners	View ↗
CMP-002-R007	Compliance Monitoring Reporting The organization shall report on compliance monitoring, providing visibility int...	CMP-002 Control Compliance Monitoring	Chief Compliance Officer, Compliance Management, Control Owners	View ↗
CMP-002-R008	Compliance Escalation The organization shall establish escalation processes for significant compliance...	CMP-002 Control Compliance Monitoring	Chief Compliance Officer, Compliance Management, Control Owners	View ↗
CMP-002-R009	Compliance Monitoring Review The organization shall conduct periodic reviews of compliance monitoring activit...	CMP-002 Control Compliance Monitoring	Chief Compliance Officer, Compliance Management, Control Owners	View ↗
CMP-002-R010	Compliance Monitoring Improvement The organization shall drive ongoing enhancement of compliance monitoring activi...	CMP-002 Control Compliance Monitoring	Compliance Management, Control Owners, Records Management	View ↗
CMP-003-R001	Evidence Management Framework The organization shall establish an evidence management framework that defines t...	CMP-003 Compliance Evidence Management	Compliance Management, Control Owners, Records Management	View ↗
CMP-003-R002	Evidence Identification The organization shall identify the evidence required to demonstrate compliance...	CMP-003 Compliance Evidence Management	Compliance Management, Control Owners, Records Management	View ↗
CMP-003-R003	Evidence Collection The organization shall collect compliance evidence in a consistent, timely, and...	CMP-003 Compliance Evidence Management	Compliance Management, Control Owners, Records Management	View ↗
CMP-003-R004	Evidence Validation The organization shall validate compliance evidence to ensure its accuracy, comp...	CMP-003 Compliance Evidence Management	Compliance Management, Control Owners, Records Management	View ↗
CMP-003-R005	Evidence Classification The organization shall establish classification schemas for compliance evidence...	CMP-003 Compliance Evidence Management	Compliance Management, Control Owners, Records Management	View ↗
CMP-003-R006	Evidence Repository Management The organization shall establish and maintain a centralized repository for compl...	CMP-003 Compliance Evidence Management	Compliance Management, Control Owners, Records Management	View ↗
CMP-003-R007	Evidence Protection The organization shall protect compliance evidence from unauthorized access, mod...	CMP-003 Compliance Evidence Management	Compliance Management, Control Owners, Records Management	View ↗
CMP-003-R008	Evidence Availability The organization shall ensure compliance evidence is available to authorized par...	CMP-003 Compliance Evidence Management	Compliance Management, Control Owners, Records Management	View ↗
CMP-003-R009	Evidence Review The organization shall conduct periodic reviews of compliance evidence to ensure...	CMP-003 Compliance Evidence Management	Compliance Management, Control Owners, Records Management	View ↗
CMP-003-R010	Evidence Lifecycle Management The organization shall maintain lifecycle management processes for compliance ev...	CMP-003 Compliance Evidence Management	Chief Compliance Officer, Compliance Management, Risk Owners	View ↗
CMP-004-R001	Non-Compliance Identification The organization shall identify instances of non-compliance with applicable lega...	CMP-004 Non-Compliance Management	Chief Compliance Officer, Compliance Management, Risk Owners	View ↗
CMP-004-R002	Non-Compliance Recording The organization shall record identified non-compliance in a consistent and comp...	CMP-004 Non-Compliance Management	Chief Compliance Officer, Compliance Management, Risk Owners	View ↗
CMP-004-R003	Non-Compliance Classification The organization shall establish a classification schema for non-compliance that...	CMP-004 Non-Compliance Management	Chief Compliance Officer, Compliance Management, Risk Owners	View ↗
CMP-004-R004	Root Cause Analysis The organization shall conduct root cause analysis for significant instances of...	CMP-004 Non-Compliance Management	Chief Compliance Officer, Compliance Management, Risk Owners	View ↗
CMP-004-R005	Corrective Action Planning The organization shall develop formal corrective action plans for addressing ide...	CMP-004 Non-Compliance Management	Chief Compliance Officer, Compliance Management, Risk Owners	View ↗
CMP-004-R006	Corrective Action Implementation The organization shall implement approved corrective actions in accordance with...	CMP-004 Non-Compliance Management	Audit & Compliance	View ↗
CMP-004-R007	Corrective Action Verification The organization shall verify that implemented corrective actions have effective...	CMP-004 Non-Compliance Management	Chief Compliance Officer, Compliance Management, Risk Owners	View ↗
CMP-004-R008	Non-Compliance Escalation The organization shall establish escalation processes for significant non-compli...	CMP-004 Non-Compliance Management	Chief Compliance Officer, Compliance Management, Risk Owners	View ↗
CMP-004-R009	Non-Compliance Reporting The organization shall report on non-compliance, providing visibility into non-c...	CMP-004 Non-Compliance Management	Chief Compliance Officer, Compliance Management, Risk Owners	View ↗
CMP-004-R010	Non-Compliance Closure The organization shall establish processes for closing non-compliance instances...	CMP-004 Non-Compliance Management	Chief Compliance Officer, Compliance Management, Risk Owners	View ↗
CMP-005-R001	Compliance Reporting Framework The organization shall establish a compliance reporting framework that defines t...	CMP-005 Compliance Reporting	Chief Compliance Officer, Compliance Management, Reporting Owners	View ↗
CMP-005-R002	Reporting Scope The organization shall define a documented scope for compliance reporting that i...	CMP-005 Compliance Reporting	Chief Compliance Officer, Compliance Management, Reporting Owners	View ↗
CMP-005-R003	Reporting Content The organization shall define content requirements for compliance reports, ensur...	CMP-005 Compliance Reporting	Chief Compliance Officer, Compliance Management, Reporting Owners	View ↗
CMP-005-R004	Reporting Frequency The organization shall establish reporting frequency requirements for compliance...	CMP-005 Compliance Reporting	Chief Compliance Officer, Compliance Management, Reporting Owners	View ↗
CMP-005-R005	Executive Compliance Reporting The organization shall provide executive leadership and the board with regular r...	CMP-005 Compliance Reporting	Chief Compliance Officer, Compliance Management, Reporting Owners	View ↗
CMP-005-R006	Regulatory Compliance Reporting The organization shall prepare and submit regulatory compliance reports to appli...	CMP-005 Compliance Reporting	Chief Compliance Officer, Compliance Management, Reporting Owners	View ↗
CMP-005-R007	Compliance Dashboard Reporting The organization shall develop and maintain compliance dashboards that provide s...	CMP-005 Compliance Reporting	Chief Compliance Officer, Compliance Management, Reporting Owners	View ↗
CMP-005-R008	Report Validation The organization shall validate compliance reports to ensure their accuracy, com...	CMP-005 Compliance Reporting	Chief Compliance Officer, Compliance Management, Reporting Owners	View ↗
CMP-005-R009	Reporting Review The organization shall conduct periodic reviews of compliance reporting activiti...	CMP-005 Compliance Reporting	Chief Compliance Officer, Compliance Management, Reporting Owners	View ↗
CMP-005-R010	Reporting Continuous Improvement The organization shall drive ongoing enhancement of compliance reporting through...	CMP-005 Compliance Reporting	Chief Compliance Officer, Compliance Management, Reporting Owners	View ↗
CMP-006-R001	Regulatory Change Framework The organization shall establish a regulatory change management framework that d...	CMP-006 Regulatory Change Management	Compliance Management, Legal, Regulatory Affairs, Control Owners	View ↗
CMP-006-R002	Regulatory Change Identification The organization shall identify changes in legal, regulatory, and contractual re...	CMP-006 Regulatory Change Management	Compliance Management, Legal, Regulatory Affairs, Control Owners	View ↗
CMP-006-R003	Regulatory Change Monitoring The organization shall monitor regulatory developments and changes to legal and...	CMP-006 Regulatory Change Management	Compliance Management, Legal, Regulatory Affairs, Control Owners	View ↗
CMP-006-R004	Impact Assessment The organization shall conduct impact assessments for identified regulatory chan...	CMP-006 Regulatory Change Management	Compliance Management, Legal, Regulatory Affairs, Control Owners	View ↗
CMP-006-R005	Change Prioritization The organization shall prioritize regulatory changes based on their impact, urge...	CMP-006 Regulatory Change Management	Compliance Management, Legal, Regulatory Affairs, Control Owners	View ↗
CMP-006-R006	Change Implementation Planning The organization shall develop formal plans for implementing changes required by...	CMP-006 Regulatory Change Management	Compliance Management, Legal, Regulatory Affairs, Control Owners	View ↗
CMP-006-R007	Compliance Update Management The organization shall update compliance documentation, controls, and processes...	CMP-006 Regulatory Change Management	Compliance Management, Legal, Regulatory Affairs, Control Owners	View ↗
CMP-006-R008	Regulatory Change Communication The organization shall communicate regulatory changes and their implications to...	CMP-006 Regulatory Change Management	Compliance Management, Legal, Regulatory Affairs, Control Owners	View ↗
CMP-006-R009	Regulatory Change Review The organization shall conduct periodic reviews of the regulatory change managem...	CMP-006 Regulatory Change Management	Compliance Management, Legal, Regulatory Affairs, Control Owners	View ↗
CMP-006-R010	Regulatory Change Effectiveness The organization shall evaluate the overall effectiveness of the regulatory chan...	CMP-006 Regulatory Change Management	Compliance Management, Legal, Regulatory Affairs, Control Owners	View ↗
CMP-007-R001	Obligation Identification The organization shall identify all legal, regulatory, and contractual complianc...	CMP-007 Compliance Obligation Mapping	Compliance Management, Control Owners, Legal	View ↗
CMP-007-R002	Obligation Classification The organization shall establish a classification schema for compliance obligati...	CMP-007 Compliance Obligation Mapping	Compliance Management, Control Owners, Legal	View ↗
CMP-007-R003	Control Mapping The organization shall maintain mappings between compliance obligations and the...	CMP-007 Compliance Obligation Mapping	Compliance Management, Control Owners, Legal	View ↗
CMP-007-R004	Mapping Validation The organization shall validate control mappings to ensure they accurately refle...	CMP-007 Compliance Obligation Mapping	Compliance Management, Control Owners, Legal	View ↗
CMP-007-R005	Gap Identification The organization shall use obligation mapping to identify gaps in control covera...	CMP-007 Compliance Obligation Mapping	Compliance Management, Control Owners, Legal	View ↗
CMP-007-R006	Mapping Maintenance The organization shall maintain obligation mappings to ensure they remain curren...	CMP-007 Compliance Obligation Mapping	Compliance Management, Control Owners, Legal	View ↗
CMP-007-R007	Mapping Traceability The organization shall maintain traceability between compliance obligations, con...	CMP-007 Compliance Obligation Mapping	Compliance Management, Control Owners, Legal	View ↗
CMP-007-R008	Mapping Reporting The organization shall report on obligation mappings, providing visibility into...	CMP-007 Compliance Obligation Mapping	Compliance Management, Control Owners, Legal	View ↗
CMP-007-R009	Mapping Review The organization shall conduct periodic reviews of obligation mappings to ensure...	CMP-007 Compliance Obligation Mapping	Compliance Management, Control Owners, Legal	View ↗
CMP-007-R010	Mapping Continuous Improvement The organization shall drive ongoing enhancement of obligation mapping through a...	CMP-007 Compliance Obligation Mapping	Compliance Management, Control Owners, Legal	View ↗
DAT-001-R001	Data Protection & Privacy Framework The organization shall establish a data protection and privacy strategy framewor...	DAT-001 Data Protection & Privacy Stra...	Data Protection Officer, CISO, Privacy Governance Committee	View ↗
DAT-001-R002	Strategic Objectives The organization shall define strategic objectives for the data protection and p...	DAT-001 Data Protection & Privacy Stra...	Data Protection Officer, CISO, Privacy Governance Committee	View ↗
DAT-001-R003	Privacy Governance The organization shall establish privacy governance structures that provide over...	DAT-001 Data Protection & Privacy Stra...	Data Protection Officer, CISO, Privacy Governance Committee	View ↗
DAT-001-R004	Data Protection Roles & Responsibilities The organization shall clearly define and document the roles and responsibilitie...	DAT-001 Data Protection & Privacy Stra...	Data Protection Officer, CISO, Privacy Governance Committee	View ↗
DAT-001-R005	Strategy Implementation The organization shall execute the data protection and privacy strategy in accor...	DAT-001 Data Protection & Privacy Stra...	Data Protection Officer, CISO, Privacy Governance Committee	View ↗
DAT-001-R006	Privacy Risk Alignment The organization shall align data protection and privacy activities with the org...	DAT-001 Data Protection & Privacy Stra...	Data Protection Officer, CISO, Privacy Governance Committee	View ↗
DAT-001-R007	Strategy Communication The organization shall communicate the data protection and privacy strategy to a...	DAT-001 Data Protection & Privacy Stra...	Data Protection Officer, CISO, Privacy Governance Committee	View ↗
DAT-001-R008	Strategy Performance Monitoring The organization shall monitor the performance of the data protection and privac...	DAT-001 Data Protection & Privacy Stra...	Data Protection Officer, CISO, Privacy Governance Committee	View ↗
DAT-001-R009	Strategy Review The organization shall conduct periodic reviews of the data protection and priva...	DAT-001 Data Protection & Privacy Stra...	Data Protection Officer, CISO, Privacy Governance Committee	View ↗
DAT-001-R010	Strategy Continuous Improvement The organization shall drive ongoing enhancement of the data protection and priv...	DAT-001 Data Protection & Privacy Stra...	Data Protection Officer, CISO, Privacy Governance Committee	View ↗
DAT-002-R001	Data Discovery Framework The organization shall establish a data discovery framework that defines the str...	DAT-002 Data Discovery	Data Protection Officer, Data Governance Team, Data Owners	View ↗
DAT-002-R002	Discovery Scope The organization shall define a documented scope for data discovery activities t...	DAT-002 Data Discovery	Data Protection Officer, Data Governance Team, Data Owners	View ↗
DAT-002-R003	Data Discovery Configuration The organization shall configure data discovery tools and processes to appropria...	DAT-002 Data Discovery	Data Protection Officer, Data Governance Team, Data Owners	View ↗
DAT-002-R004	Data Discovery Execution The organization shall execute data discovery activities to identify and locate...	DAT-002 Data Discovery	Data Protection Officer, Data Governance Team, Data Owners	View ↗
DAT-002-R005	Sensitive Data Identification The organization shall use data discovery to identify specific instances of pers...	DAT-002 Data Discovery	Data Protection Officer, Data Governance Team, Data Owners	View ↗
DAT-002-R006	Discovery Validation The organization shall validate data discovery results to ensure their accuracy...	DAT-002 Data Discovery	Data Protection Officer, Data Governance Team, Data Owners	View ↗
DAT-002-R007	Discovery Monitoring The organization shall monitor data discovery activities to ensure discovery is...	DAT-002 Data Discovery	Data Protection Officer, Data Governance Team, Data Owners	View ↗
DAT-002-R008	Discovery Reporting The organization shall report on data discovery, providing visibility into disco...	DAT-002 Data Discovery	Data Protection Officer, Data Governance Team, Data Owners	View ↗
DAT-002-R009	Discovery Review The organization shall conduct periodic reviews of data discovery activities to...	DAT-002 Data Discovery	Data Protection Officer, Data Governance Team, Data Owners	View ↗
DAT-002-R010	Discovery Continuous Improvement The organization shall drive ongoing enhancement of data discovery through a con...	DAT-002 Data Discovery	Data Protection Officer, Data Governance Team, Data Owners	View ↗
DAT-003-R001	Data Classification Framework The organization shall establish a data classification framework that defines th...	DAT-003 Data Classification & Handling	Data Owners, Data Stewards, Data Protection Officer	View ↗
DAT-003-R002	Classification Criteria The organization shall define classification criteria that establish the basis f...	DAT-003 Data Classification & Handling	Data Owners, Data Stewards, Data Protection Officer	View ↗
DAT-003-R003	Data Classification Assignment The organization shall assign classification levels to data based on classificat...	DAT-003 Data Classification & Handling	Data Owners, Data Stewards, Data Protection Officer	View ↗
DAT-003-R004	Data Labeling The organization shall label data with its assigned classification, ensuring cla...	DAT-003 Data Classification & Handling	Data Owners, Data Stewards, Data Protection Officer	View ↗
DAT-003-R005	Data Handling Requirements The organization shall define data handling requirements for each data classific...	DAT-003 Data Classification & Handling	Data Owners, Data Stewards, Data Protection Officer	View ↗
DAT-003-R006	Classification Review The organization shall conduct periodic reviews of data classifications to ensur...	DAT-003 Data Classification & Handling	Data Owners, Data Stewards, Data Protection Officer	View ↗
DAT-003-R007	Classification Change Management The organization shall manage changes to data classifications, ensuring changes...	DAT-003 Data Classification & Handling	Data Owners, Data Stewards, Data Protection Officer	View ↗
DAT-003-R008	Classification Monitoring The organization shall monitor data classification to ensure data continues to b...	DAT-003 Data Classification & Handling	Data Owners, Data Stewards, Data Protection Officer	View ↗
DAT-003-R009	Classification Reporting The organization shall report on data classification, providing visibility into...	DAT-003 Data Classification & Handling	Data Owners, Data Stewards, Data Protection Officer	View ↗
DAT-003-R010	Classification Continuous Improvement The organization shall drive ongoing enhancement of data classification through...	DAT-003 Data Classification & Handling	Data Owners, Data Stewards, Data Protection Officer	View ↗
DAT-004-R001	Data Retention Framework The organization shall establish a data retention framework that defines the str...	DAT-004 Data Retention & Disposal	Data Protection Officer, Records Management, Legal, Data Owners	View ↗
DAT-004-R002	Retention Schedule Management The organization shall maintain retention schedules that define how long differe...	DAT-004 Data Retention & Disposal	Data Protection Officer, Records Management, Legal, Data Owners	View ↗
DAT-004-R003	Data Archival The organization shall archive data that is no longer actively used but must be...	DAT-004 Data Retention & Disposal	Data Protection Officer, Records Management, Legal, Data Owners	View ↗
DAT-004-R004	Data Disposal Authorization The organization shall authorize the disposal of data, ensuring disposal decisio...	DAT-004 Data Retention & Disposal	Data Protection Officer, Records Management, Legal, Data Owners	View ↗
DAT-004-R005	Secure Data Destruction The organization shall securely destroy data that has reached the end of its ret...	DAT-004 Data Retention & Disposal	Data Protection Officer, Records Management, Legal, Data Owners	View ↗
DAT-004-R006	Disposal Verification The organization shall verify that data disposal activities have been completed...	DAT-004 Data Retention & Disposal	Data Protection Officer, Records Management, Legal, Data Owners	View ↗
DAT-004-R007	Retention Compliance Monitoring The organization shall monitor retention and disposal activities to ensure compl...	DAT-004 Data Retention & Disposal	Data Protection Officer, Records Management, Legal, Data Owners	View ↗
DAT-004-R008	Retention Reporting The organization shall report on retention and disposal activities, providing vi...	DAT-004 Data Retention & Disposal	Data Protection Officer, Records Management, Legal, Data Owners	View ↗
DAT-004-R009	Retention Review The organization shall conduct periodic reviews of retention and disposal activi...	DAT-004 Data Retention & Disposal	Data Protection Officer, Records Management, Legal, Data Owners	View ↗
DAT-004-R010	Retention Continuous Improvement The organization shall drive ongoing enhancement of retention and disposal manag...	DAT-004 Data Retention & Disposal	Data Protection Officer, Records Management, Legal, Data Owners	View ↗
DAT-005-R001	Data Ownership Framework The organization shall establish a data ownership framework that defines the str...	DAT-005 Data Ownership & Stewardship	Data Owners, Data Stewards, Data Governance Committee	View ↗
DAT-005-R002	Data Owner Assignment The organization shall assign explicit data owners to all personal and sensitive...	DAT-005 Data Ownership & Stewardship	Data Owners, Data Stewards, Data Governance Committee	View ↗
DAT-005-R003	Data Steward Responsibilities The organization shall define and assign data stewards to support data owners in...	DAT-005 Data Ownership & Stewardship	Data Owners, Data Stewards, Data Governance Committee	View ↗
DAT-005-R004	Ownership Accountability The organization shall establish accountability for data ownership, ensuring dat...	DAT-005 Data Ownership & Stewardship	Data Owners, Data Stewards, Data Governance Committee	View ↗
DAT-005-R005	Ownership Transfer The organization shall transfer data ownership when organizational changes occur...	DAT-005 Data Ownership & Stewardship	Data Owners, Data Stewards, Data Governance Committee	View ↗
DAT-005-R006	Ownership Validation The organization shall validate data ownership to ensure ownership assignments r...	DAT-005 Data Ownership & Stewardship	Data Owners, Data Stewards, Data Governance Committee	View ↗
DAT-005-R007	Ownership Documentation The organization shall maintain comprehensive documentation of data ownership as...	DAT-005 Data Ownership & Stewardship	Data Owners, Data Stewards, Data Governance Committee	View ↗
DAT-005-R008	Ownership Reporting The organization shall report on data ownership, providing visibility into owner...	DAT-005 Data Ownership & Stewardship	Data Owners, Data Stewards, Data Governance Committee	View ↗
DAT-005-R009	Ownership Review The organization shall conduct periodic reviews of data ownership assignments to...	DAT-005 Data Ownership & Stewardship	Data Owners, Data Stewards, Data Governance Committee	View ↗
DAT-005-R010	Ownership Continuous Improvement The organization shall drive ongoing enhancement of data ownership and stewardsh...	DAT-005 Data Ownership & Stewardship	Data Owners, Data Stewards, Data Governance Committee	View ↗
DAT-006-R001	Data Inventory Framework The organization shall establish a data inventory framework that defines the str...	DAT-006 Data Flow Mapping, Inventory &...	Data Owners, Data Stewards, Data Governance Team	View ↗
DAT-006-R002	Data Flow Identification The organization shall identify data flows that describe how personal and sensit...	DAT-006 Data Flow Mapping, Inventory &...	Data Owners, Data Stewards, Data Governance Team	View ↗
DAT-006-R003	Data Inventory Management The organization shall maintain a comprehensive inventory of data assets, includ...	DAT-006 Data Flow Mapping, Inventory &...	Data Owners, Data Stewards, Data Governance Team	View ↗
DAT-006-R004	Data Flow Mapping The organization shall create and maintain data flow maps that document the move...	DAT-006 Data Flow Mapping, Inventory &...	Data Owners, Data Stewards, Data Governance Team	View ↗
DAT-006-R005	Data Lineage Documentation The organization shall document data lineage for personal and sensitive data, tr...	DAT-006 Data Flow Mapping, Inventory &...	Data Owners, Data Stewards, Data Governance Team	View ↗
DAT-006-R006	Data Flow Validation The organization shall validate data flow maps and data inventory to ensure thei...	DAT-006 Data Flow Mapping, Inventory &...	Data Owners, Data Stewards, Data Governance Team	View ↗
DAT-006-R007	Data Flow Monitoring The organization shall monitor data flows to ensure data movements are documente...	DAT-006 Data Flow Mapping, Inventory &...	Data Owners, Data Stewards, Data Governance Team	View ↗
DAT-006-R008	Data Flow Reporting The organization shall report on data flow mapping and inventory, providing visi...	DAT-006 Data Flow Mapping, Inventory &...	Data Owners, Data Stewards, Data Governance Team	View ↗
DAT-006-R009	Data Flow Review The organization shall conduct periodic reviews of data flow mapping and invento...	DAT-006 Data Flow Mapping, Inventory &...	Data Owners, Data Stewards, Data Governance Team	View ↗
DAT-006-R010	Data Flow Continuous Improvement The organization shall drive ongoing enhancement of data flow mapping, inventory...	DAT-006 Data Flow Mapping, Inventory &...	Data Owners, Data Stewards, Data Governance Team	View ↗
DAT-007-R001	Rights Management Framework The organization shall establish a data subject rights management framework that...	DAT-007 Data Subject Rights Management	Data Protection Officer, Privacy Operations, Legal	View ↗
DAT-007-R002	Request Intake The organization shall receive data subject rights requests through accessible c...	DAT-007 Data Subject Rights Management	Data Protection Officer, Privacy Operations, Legal	View ↗
DAT-007-R003	Identity Verification The organization shall verify the identity of data subjects making rights reques...	DAT-007 Data Subject Rights Management	Data Protection Officer, Privacy Operations, Legal	View ↗
DAT-007-R004	Rights Request Processing The organization shall process data subject rights requests, including requests...	DAT-007 Data Subject Rights Management	Data Protection Officer, Privacy Operations, Legal	View ↗
DAT-007-R005	Response Management The organization shall respond to data subject rights requests, ensuring respons...	DAT-007 Data Subject Rights Management	Data Protection Officer, Privacy Operations, Legal	View ↗
DAT-007-R006	Request Tracking The organization shall track data subject rights requests from receipt through c...	DAT-007 Data Subject Rights Management	Data Protection Officer, Privacy Operations, Legal	View ↗
DAT-007-R007	Regulatory Compliance Monitoring The organization shall monitor data subject rights management to ensure complian...	DAT-007 Data Subject Rights Management	Data Protection Officer, Privacy Operations, Legal	View ↗
DAT-007-R008	Rights Reporting The organization shall report on data subject rights management, providing visib...	DAT-007 Data Subject Rights Management	Data Protection Officer, Privacy Operations, Legal	View ↗
DAT-007-R009	Rights Review The organization shall conduct periodic reviews of data subject rights managemen...	DAT-007 Data Subject Rights Management	Data Protection Officer, Privacy Operations, Legal	View ↗
DAT-007-R010	Rights Continuous Improvement The organization shall drive ongoing enhancement of data subject rights manageme...	DAT-007 Data Subject Rights Management	Data Protection Officer, Privacy Operations, Legal	View ↗
DAT-008-R001	Consent Management Framework The organization shall establish a consent management framework that defines the...	DAT-008 Consent Management	Data Protection Officer, Privacy Operations, Legal, Product Owners	View ↗
DAT-008-R002	Consent Collection The organization shall collect consent from data subjects in a manner that is in...	DAT-008 Consent Management	Data Protection Officer, Privacy Operations, Legal, Product Owners	View ↗
DAT-008-R003	Consent Recording The organization shall record consent decisions, ensuring consent records are ac...	DAT-008 Consent Management	Data Protection Officer, Privacy Operations, Legal, Product Owners	View ↗
DAT-008-R004	Consent Validation The organization shall validate the validity of consent, ensuring consent remain...	DAT-008 Consent Management	Data Protection Officer, Privacy Operations, Legal, Product Owners	View ↗
DAT-008-R005	Consent Withdrawal The organization shall process consent withdrawals, ensuring data subjects can e...	DAT-008 Consent Management	Data Protection Officer, Privacy Operations, Legal, Product Owners	View ↗
DAT-008-R006	Consent Lifecycle Management The organization shall manage the lifecycle of consent, from collection through...	DAT-008 Consent Management	Data Protection Officer, Privacy Operations, Legal, Product Owners	View ↗
DAT-008-R007	Consent Monitoring The organization shall monitor consent management to ensure consent is properly...	DAT-008 Consent Management	Data Protection Officer, Privacy Operations, Legal, Product Owners	View ↗
DAT-008-R008	Consent Reporting The organization shall report on consent management, providing visibility into c...	DAT-008 Consent Management	Data Protection Officer, Privacy Operations, Legal, Product Owners	View ↗
DAT-008-R009	Consent Review The organization shall conduct periodic reviews of consent management activities...	DAT-008 Consent Management	Data Protection Officer, Privacy Operations, Legal, Product Owners	View ↗
DAT-008-R010	Consent Continuous Improvement The organization shall drive ongoing enhancement of consent management through a...	DAT-008 Consent Management	Data Protection Officer, Privacy Operations, Legal, Product Owners	View ↗
DAT-009-R001	Cross-Border Transfer Framework The organization shall establish a cross-border data transfer framework that def...	DAT-009 Cross-Border Data Transfer	Data Protection Officer, Legal, Privacy Operations	View ↗
DAT-009-R002	Transfer Assessment The organization shall assess cross-border data transfers to evaluate compliance...	DAT-009 Cross-Border Data Transfer	Data Protection Officer, Legal, Privacy Operations	View ↗
DAT-009-R003	Transfer Authorization The organization shall authorize cross-border data transfers, ensuring transfers...	DAT-009 Cross-Border Data Transfer	Data Protection Officer, Legal, Privacy Operations	View ↗
DAT-009-R004	Transfer Safeguards The organization shall implement appropriate safeguards for cross-border data tr...	DAT-009 Cross-Border Data Transfer	Data Protection Officer, Legal, Privacy Operations	View ↗
DAT-009-R005	Transfer Documentation The organization shall maintain comprehensive documentation of cross-border data...	DAT-009 Cross-Border Data Transfer	Data Protection Officer, Legal, Privacy Operations	View ↗
DAT-009-R006	Transfer Monitoring The organization shall monitor cross-border data transfers to ensure transfers r...	DAT-009 Cross-Border Data Transfer	Data Protection Officer, Legal, Privacy Operations	View ↗
DAT-009-R007	Regulatory Compliance Verification The organization shall verify that cross-border data transfers comply with appli...	DAT-009 Cross-Border Data Transfer	Data Protection Officer, Legal, Privacy Operations	View ↗
DAT-009-R008	Transfer Reporting The organization shall report on cross-border data transfers, providing visibili...	DAT-009 Cross-Border Data Transfer	Data Protection Officer, Legal, Privacy Operations	View ↗
DAT-009-R009	Transfer Review The organization shall conduct periodic reviews of cross-border data transfer ma...	DAT-009 Cross-Border Data Transfer	Data Protection Officer, Legal, Privacy Operations	View ↗
DAT-009-R010	Transfer Continuous Improvement The organization shall drive ongoing enhancement of cross-border data transfer m...	DAT-009 Cross-Border Data Transfer	Data Protection Officer, Legal, Privacy Operations	View ↗
DAT-010-R001	Privacy Notice Framework The organization shall establish a privacy notice framework that defines the str...	DAT-010 Privacy Notices	Data Protection Officer, Legal, Communications, Product Owners	View ↗
DAT-010-R002	Notice Content Management The organization shall develop and maintain privacy notice content that accurate...	DAT-010 Privacy Notices	Data Protection Officer, Legal, Communications, Product Owners	View ↗
DAT-010-R003	Notice Publication The organization shall publish privacy notices in locations and formats that are...	DAT-010 Privacy Notices	Data Protection Officer, Legal, Communications, Product Owners	View ↗
DAT-010-R004	Notice Accessibility The organization shall ensure privacy notices are accessible to all data subject...	DAT-010 Privacy Notices	Data Protection Officer, Legal, Communications, Product Owners	View ↗
DAT-010-R005	Notice Updates The organization shall update privacy notices when changes occur in data process...	DAT-010 Privacy Notices	Data Protection Officer, Legal, Communications, Product Owners	View ↗
DAT-010-R006	Notice Communication The organization shall communicate privacy notices to data subjects through appr...	DAT-010 Privacy Notices	Data Protection Officer, Legal, Communications, Product Owners	View ↗
DAT-010-R007	Notice Compliance Monitoring The organization shall monitor privacy notice management to ensure notices remai...	DAT-010 Privacy Notices	Data Protection Officer, Legal, Communications, Product Owners	View ↗
DAT-010-R008	Notice Reporting The organization shall report on privacy notice management, providing visibility...	DAT-010 Privacy Notices	Data Protection Officer, Legal, Communications, Product Owners	View ↗
DAT-010-R009	Notice Review The organization shall conduct periodic reviews of privacy notices to ensure the...	DAT-010 Privacy Notices	Data Protection Officer, Legal, Communications, Product Owners	View ↗
DAT-010-R010	Notice Continuous Improvement The organization shall drive ongoing enhancement of privacy notice management th...	DAT-010 Privacy Notices	Data Protection Officer, Legal, Communications, Product Owners	View ↗
DAT-011-R001	Privacy by Design Framework The organization shall establish a privacy by design framework that defines the...	DAT-011 Privacy by Design	Data Protection Officer, Privacy Engineering, Application Owners	View ↗
DAT-011-R002	Privacy Requirements Identification The organization shall identify privacy requirements that must be addressed in t...	DAT-011 Privacy by Design	Data Protection Officer, Privacy Engineering, Application Owners	View ↗
DAT-011-R003	Privacy Design Assessment The organization shall conduct privacy design assessments to evaluate whether sy...	DAT-011 Privacy by Design	Data Protection Officer, Privacy Engineering, Application Owners	View ↗
DAT-011-R004	Privacy Control Integration The organization shall integrate privacy controls into systems, products, and se...	DAT-011 Privacy by Design	Data Protection Officer, Privacy Engineering, Application Owners	View ↗
DAT-011-R005	Privacy Validation The organization shall validate that systems, products, and services meet privac...	DAT-011 Privacy by Design	Data Protection Officer, Privacy Engineering, Application Owners	View ↗
DAT-011-R006	Design Change Management The organization shall manage changes to privacy design requirements and control...	DAT-011 Privacy by Design	Data Protection Officer, Privacy Engineering, Application Owners	View ↗
DAT-011-R007	Privacy Compliance Monitoring The organization shall monitor privacy by design activities to ensure privacy re...	DAT-011 Privacy by Design	Data Protection Officer, Privacy Engineering, Application Owners	View ↗
DAT-011-R008	Design Reporting The organization shall report on privacy by design, providing visibility into pr...	DAT-011 Privacy by Design	Data Protection Officer, Privacy Engineering, Application Owners	View ↗
DAT-011-R009	Design Review The organization shall conduct periodic reviews of privacy by design activities...	DAT-011 Privacy by Design	Data Protection Officer, Privacy Engineering, Application Owners	View ↗
DAT-011-R010	Design Continuous Improvement The organization shall drive ongoing enhancement of privacy by design through a...	DAT-011 Privacy by Design	Data Protection Officer, Privacy Engineering, Application Owners	View ↗
DAT-012-R001	DPIA Framework The organization shall establish a Data Protection Impact Assessment framework t...	DAT-012 Data Protection Impact Assessm...	Data Protection Officer, Privacy Risk, Legal, Business Owners	View ↗
DAT-012-R002	DPIA Scoping The organization shall scope DPIAs, identifying the processing activities, syste...	DAT-012 Data Protection Impact Assessm...	Data Protection Officer, Privacy Risk, Legal, Business Owners	View ↗
DAT-012-R003	Privacy Risk Assessment The organization shall conduct privacy risk assessments as part of DPIAs, identi...	DAT-012 Data Protection Impact Assessm...	Data Protection Officer, Privacy Risk, Legal, Business Owners	View ↗
DAT-012-R004	Risk Treatment Planning The organization shall develop risk treatment plans as part of DPIAs, defining m...	DAT-012 Data Protection Impact Assessm...	Data Protection Officer, Privacy Risk, Legal, Business Owners	View ↗
DAT-012-R005	DPIA Approval The organization shall approve DPIAs and associated risk treatment plans, ensuri...	DAT-012 Data Protection Impact Assessm...	Data Protection Officer, Privacy Risk, Legal, Business Owners	View ↗
DAT-012-R006	DPIA Documentation The organization shall maintain comprehensive documentation of DPIAs, including...	DAT-012 Data Protection Impact Assessm...	Data Protection Officer, Privacy Risk, Legal, Business Owners	View ↗
DAT-012-R007	DPIA Monitoring The organization shall monitor DPIAs to ensure treatment plans are implemented a...	DAT-012 Data Protection Impact Assessm...	Data Protection Officer, Privacy Risk, Legal, Business Owners	View ↗
DAT-012-R008	DPIA Reporting The organization shall report on DPIAs, providing visibility into assessment act...	DAT-012 Data Protection Impact Assessm...	Data Protection Officer, Privacy Risk, Legal, Business Owners	View ↗
DAT-012-R009	DPIA Review The organization shall conduct periodic reviews of DPIA activities to ensure the...	DAT-012 Data Protection Impact Assessm...	Data Protection Officer, Privacy Risk, Legal, Business Owners	View ↗
DAT-012-R010	DPIA Continuous Improvement The organization shall drive ongoing enhancement of DPIA management through a co...	DAT-012 Data Protection Impact Assessm...	Data Protection Officer, Privacy Risk, Legal, Business Owners	View ↗
DAT-013-R001	ROPA Framework The organization shall establish a Record of Processing Activities framework tha...	DAT-013 Record of Processing Activitie...	Data Protection Officer, Data Owners, Privacy Operations	View ↗
DAT-013-R002	Processing Activity Identification The organization shall identify all processing activities that involve personal...	DAT-013 Record of Processing Activitie...	Data Protection Officer, Data Owners, Privacy Operations	View ↗
DAT-013-R003	Processing Record Maintenance The organization shall maintain comprehensive records of processing activities,...	DAT-013 Record of Processing Activitie...	Data Protection Officer, Data Owners, Privacy Operations	View ↗
DAT-013-R004	Processing Activity Classification The organization shall establish classification schemas for processing activitie...	DAT-013 Record of Processing Activitie...	Data Protection Officer, Data Owners, Privacy Operations	View ↗
DAT-013-R005	Processing Record Validation The organization shall validate ROPA records to ensure their accuracy, completen...	DAT-013 Record of Processing Activitie...	Data Protection Officer, Data Owners, Privacy Operations	View ↗
DAT-013-R006	ROPA Maintenance The organization shall maintain ROPA records to ensure they remain current and r...	DAT-013 Record of Processing Activitie...	Data Protection Officer, Data Owners, Privacy Operations	View ↗
DAT-013-R007	ROPA Monitoring The organization shall monitor ROPA management to ensure records remain accurate...	DAT-013 Record of Processing Activitie...	Data Protection Officer, Data Owners, Privacy Operations	View ↗
DAT-013-R008	ROPA Reporting The organization shall report on ROPA, providing visibility into processing acti...	DAT-013 Record of Processing Activitie...	Data Protection Officer, Data Owners, Privacy Operations	View ↗
DAT-013-R009	ROPA Review The organization shall conduct periodic reviews of ROPA management activities to...	DAT-013 Record of Processing Activitie...	Data Protection Officer, Data Owners, Privacy Operations	View ↗
DAT-013-R010	ROPA Continuous Improvement The organization shall drive ongoing enhancement of ROPA management through a co...	DAT-013 Record of Processing Activitie...	Data Protection Officer, Data Owners, Privacy Operations	View ↗
DAT-014-R001	Data Loss Prevention Framework The organization shall establish a Data Loss Prevention framework that defines t...	DAT-014 Data Loss Prevention (DLP)	CISO, DLP Team, SOC, Data Protection Officer	View ↗
DAT-014-R002	DLP Policy Definition The organization shall define DLP policies that establish the requirements for p...	DAT-014 Data Loss Prevention (DLP)	CISO, DLP Team, SOC, Data Protection Officer	View ↗
DAT-014-R003	Sensitive Data Monitoring The organization shall monitor sensitive data to detect potential data leakage,...	DAT-014 Data Loss Prevention (DLP)	CISO, DLP Team, SOC, Data Protection Officer	View ↗
DAT-014-R004	Data Loss Prevention Controls The organization shall implement controls to prevent unauthorized disclosure and...	DAT-014 Data Loss Prevention (DLP)	CISO, DLP Team, SOC, Data Protection Officer	View ↗
DAT-014-R005	DLP Incident Management The organization shall manage DLP incidents, including the response, investigati...	DAT-014 Data Loss Prevention (DLP)	CISO, DLP Team, SOC, Data Protection Officer	View ↗
DAT-014-R006	DLP Exception Management The organization shall manage exceptions to DLP policies, ensuring deviations ar...	DAT-014 Data Loss Prevention (DLP)	CISO, DLP Team, SOC, Data Protection Officer	View ↗
DAT-014-R007	DLP Monitoring The organization shall monitor DLP activities to ensure controls are operating e...	DAT-014 Data Loss Prevention (DLP)	CISO, DLP Team, SOC, Data Protection Officer	View ↗
DAT-014-R008	DLP Reporting The organization shall report on DLP, providing visibility into DLP activities,...	DAT-014 Data Loss Prevention (DLP)	CISO, DLP Team, SOC, Data Protection Officer	View ↗
DAT-014-R009	DLP Review The organization shall conduct periodic reviews of DLP activities to ensure thei...	DAT-014 Data Loss Prevention (DLP)	CISO, DLP Team, SOC, Data Protection Officer	View ↗
DAT-014-R010	DLP Continuous Improvement The organization shall drive ongoing enhancement of DLP management through a con...	DAT-014 Data Loss Prevention (DLP)	CISO, DLP Team, SOC, Data Protection Officer	View ↗
DAT-015-R001	Data Integrity Framework The organization shall establish a data integrity framework that defines the str...	DAT-015 Data Integrity	Data Owners, Data Stewards, IT Operations, CISO	View ↗
DAT-015-R002	Integrity Protection Controls The organization shall implement controls to protect data integrity, preventing...	DAT-015 Data Integrity	Data Owners, Data Stewards, IT Operations, CISO	View ↗
DAT-015-R003	Data Validation The organization shall validate data integrity, ensuring data is accurate, compl...	DAT-015 Data Integrity	Data Owners, Data Stewards, IT Operations, CISO	View ↗
DAT-015-R004	Integrity Monitoring The organization shall monitor data integrity to detect unauthorized modificatio...	DAT-015 Data Integrity	Data Owners, Data Stewards, IT Operations, CISO	View ↗
DAT-015-R005	Integrity Verification The organization shall verify data integrity through periodic assessments and te...	DAT-015 Data Integrity	Data Owners, Data Stewards, IT Operations, CISO	View ↗
DAT-015-R006	Integrity Incident Management The organization shall manage data integrity incidents, including the detection,...	DAT-015 Data Integrity	Data Owners, Data Stewards, IT Operations, CISO	View ↗
DAT-015-R007	Integrity Assessment The organization shall conduct periodic assessments of data integrity to evaluat...	DAT-015 Data Integrity	Data Owners, Data Stewards, IT Operations, CISO	View ↗
DAT-015-R008	Integrity Reporting The organization shall report on data integrity, providing visibility into integ...	DAT-015 Data Integrity	Data Owners, Data Stewards, IT Operations, CISO	View ↗
DAT-015-R009	Integrity Review The organization shall conduct periodic reviews of data integrity management act...	DAT-015 Data Integrity	Data Owners, Data Stewards, IT Operations, CISO	View ↗
DAT-015-R010	Integrity Continuous Improvement The organization shall drive ongoing enhancement of data integrity management th...	DAT-015 Data Integrity	Data Owners, Data Stewards, IT Operations, CISO	View ↗
DAT-016-R001	Data Masking & Anonymization Framework The organization shall establish a data masking and anonymization framework that...	DAT-016 Data Masking & Anonymization	Data Protection Officer, Data Engineering, Application Owners, Security Engineering	View ↗
DAT-016-R002	Sensitive Data Identification The organization shall identify sensitive data that requires masking, anonymizat...	DAT-016 Data Masking & Anonymization	Data Protection Officer, Data Engineering, Application Owners, Security Engineering	View ↗
DAT-016-R003	Masking Requirements The organization shall define masking requirements that specify how sensitive da...	DAT-016 Data Masking & Anonymization	Data Protection Officer, Data Engineering, Application Owners, Security Engineering	View ↗
DAT-016-R004	Anonymization & Pseudonymization The organization shall implement anonymization and pseudonymization techniques t...	DAT-016 Data Masking & Anonymization	Data Protection Officer, Data Engineering, Application Owners, Security Engineering	View ↗
DAT-016-R005	Data Transformation Validation The organization shall validate that data masking, anonymization, and pseudonymi...	DAT-016 Data Masking & Anonymization	Data Protection Officer, Data Engineering, Application Owners, Security Engineering	View ↗
DAT-016-R006	Non-Production Data Protection The organization shall implement data masking and anonymization for non-producti...	DAT-016 Data Masking & Anonymization	Data Protection Officer, Data Engineering, Application Owners, Security Engineering	View ↗
DAT-016-R007	Masking Effectiveness Monitoring The organization shall monitor masking and anonymization activities to ensure da...	DAT-016 Data Masking & Anonymization	Data Protection Officer, Data Engineering, Application Owners, Security Engineering	View ↗
DAT-016-R008	Masking Reporting The organization shall report on masking and anonymization, providing visibility...	DAT-016 Data Masking & Anonymization	Data Protection Officer, Data Engineering, Application Owners, Security Engineering	View ↗
DAT-016-R009	Masking Review The organization shall conduct periodic reviews of data masking and anonymizatio...	DAT-016 Data Masking & Anonymization	Data Protection Officer, Data Engineering, Application Owners, Security Engineering	View ↗
DAT-016-R010	Masking Continuous Improvement The organization shall drive ongoing enhancement of data masking and anonymizati...	DAT-016 Data Masking & Anonymization	Data Protection Officer, Data Engineering, Application Owners, Security Engineering	View ↗
END-001-R001	Endpoint Protection Policy The organization shall establish an endpoint protection framework that defines t...	END-001 Endpoint Protection	Endpoint Security, IT Operations, Security Operations, CISO	View ↗
END-001-R002	Endpoint Protection Deployment The organization shall deploy endpoint protection controls to all organizational...	END-001 Endpoint Protection	Endpoint Security, IT Operations, Security Operations, CISO	View ↗
END-001-R003	Malware Prevention The organization shall implement malware prevention controls on endpoint devices...	END-001 Endpoint Protection	Endpoint Security, IT Operations, Security Operations, CISO	View ↗
END-001-R004	Threat Prevention Configuration The organization shall configure endpoint protection controls in accordance with...	END-001 Endpoint Protection	Endpoint Security, IT Operations, Security Operations, CISO	View ↗
END-001-R005	Endpoint Protection Monitoring The organization shall monitor endpoint protection to ensure protection controls...	END-001 Endpoint Protection	Endpoint Security, IT Operations, Security Operations, CISO	View ↗
END-001-R006	Threat Detection Validation The organization shall validate endpoint threat detection capabilities to ensure...	END-001 Endpoint Protection	Endpoint Security, IT Operations, Security Operations, CISO	View ↗
END-001-R007	Protection Reporting The organization shall report on endpoint protection, providing visibility into...	END-001 Endpoint Protection	Endpoint Security, IT Operations, Security Operations, CISO	View ↗
END-001-R008	Protection Review The organization shall conduct periodic reviews of endpoint protection activitie...	END-001 Endpoint Protection	Endpoint Security, IT Operations, Security Operations, CISO	View ↗
END-001-R009	Exception Management The organization shall manage exceptions to endpoint protection requirements, en...	END-001 Endpoint Protection	Endpoint Security, IT Operations, Security Operations, CISO	View ↗
END-001-R010	Protection Continuous Improvement The organization shall drive ongoing enhancement of endpoint protection through...	END-001 Endpoint Protection	Endpoint Security, IT Operations, Security Operations, CISO	View ↗
END-002-R001	EDR Framework The organization shall establish an Endpoint Detection and Response framework th...	END-002 Endpoint Detection & Response...	Endpoint Security, IT Operations, Security Operations, CISO	View ↗
END-002-R002	Endpoint Telemetry Collection The organization shall collect comprehensive telemetry data from endpoint device...	END-002 Endpoint Detection & Response...	Endpoint Security, IT Operations, Security Operations, CISO	View ↗
END-002-R003	Threat Detection The organization shall implement threat detection capabilities for endpoint devi...	END-002 Endpoint Detection & Response...	Endpoint Security, IT Operations, Security Operations, CISO	View ↗
END-002-R004	Threat Investigation The organization shall investigate endpoint threats, including the analysis of t...	END-002 Endpoint Detection & Response...	Endpoint Security, IT Operations, Security Operations, CISO	View ↗
END-002-R005	Endpoint Response The organization shall respond to endpoint threats, including the containment of...	END-002 Endpoint Detection & Response...	Endpoint Security, IT Operations, Security Operations, CISO	View ↗
END-002-R006	Threat Hunting The organization shall establish proactive threat hunting capabilities to identi...	END-002 Endpoint Detection & Response...	Endpoint Security, IT Operations, Security Operations, CISO	View ↗
END-002-R007	EDR Monitoring The organization shall monitor EDR activities to ensure detection and response c...	END-002 Endpoint Detection & Response...	Endpoint Security, IT Operations, Security Operations, CISO	View ↗
END-002-R008	EDR Reporting The organization shall report on EDR, providing visibility into threat detection...	END-002 Endpoint Detection & Response...	Endpoint Security, IT Operations, Security Operations, CISO	View ↗
END-002-R009	EDR Review The organization shall conduct periodic reviews of EDR activities to ensure thei...	END-002 Endpoint Detection & Response...	Endpoint Security, IT Operations, Security Operations, CISO	View ↗
END-002-R010	EDR Continuous Improvement The organization shall drive ongoing enhancement of EDR through a continuous imp...	END-002 Endpoint Detection & Response...	Endpoint Security, IT Operations, Security Operations, CISO	View ↗
END-003-R001	Mobile Security Framework The organization shall establish a mobile device and application management fram...	END-003 Mobile Device & Application Ma...	Endpoint Security, IT Operations, Security Operations, CISO	View ↗
END-003-R002	Device Enrollment The organization shall enroll mobile devices into the organization's mobile mana...	END-003 Mobile Device & Application Ma...	Endpoint Security, IT Operations, Security Operations, CISO	View ↗
END-003-R003	Device Configuration Management The organization shall configure mobile devices in accordance with security requ...	END-003 Mobile Device & Application Ma...	Endpoint Security, IT Operations, Security Operations, CISO	View ↗
END-003-R004	Mobile Application Management The organization shall manage mobile applications, including the approval, distr...	END-003 Mobile Device & Application Ma...	Endpoint Security, IT Operations, Security Operations, CISO	View ↗
END-003-R005	Corporate Data Protection The organization shall protect corporate data on mobile devices, including data...	END-003 Mobile Device & Application Ma...	Endpoint Security, IT Operations, Security Operations, CISO	View ↗
END-003-R006	Mobile Compliance Monitoring The organization shall monitor mobile device compliance to ensure devices remain...	END-003 Mobile Device & Application Ma...	Endpoint Security, IT Operations, Security Operations, CISO	View ↗
END-003-R007	Mobile Incident Management The organization shall manage security incidents involving mobile devices, inclu...	END-003 Mobile Device & Application Ma...	Endpoint Security / IT Operations, Security Operations, CISO	View ↗
END-003-R008	Mobile Reporting The organization shall report on mobile device and application management, provi...	END-003 Mobile Device & Application Ma...	Endpoint Security / IT Operations, Security Operations, CISO	View ↗
END-003-R009	Mobile Review The organization shall conduct periodic reviews of mobile device and application...	END-003 Mobile Device & Application Ma...	Endpoint Security / IT Operations, Security Operations, CISO	View ↗
END-003-R010	Mobile Continuous Improvement The organization shall drive ongoing enhancement of mobile device and applicatio...	END-003 Mobile Device & Application Ma...	Endpoint Security / IT Operations, Security Operations, CISO	View ↗
END-004-R001	Endpoint Encryption Framework The organization shall establish an endpoint encryption framework that defines t...	END-004 Endpoint Encryption	Endpoint Security / IT Operations, Security Operations, CISO	View ↗
END-004-R002	Encryption Requirements The organization shall define encryption requirements for endpoint devices that...	END-004 Endpoint Encryption	Endpoint Security / IT Operations, Security Operations, CISO	View ↗
END-004-R003	Encryption Deployment The organization shall deploy encryption controls to endpoint devices in accorda...	END-004 Endpoint Encryption	Endpoint Security / IT Operations, Security Operations, CISO	View ↗
END-004-R004	Encryption Key Management Integration The organization shall integrate endpoint encryption with cryptographic key mana...	END-004 Endpoint Encryption	Endpoint Security / IT Operations, Security Operations, CISO	View ↗
END-004-R005	Encryption Status Monitoring The organization shall monitor endpoint encryption status to ensure encryption i...	END-004 Endpoint Encryption	Endpoint Security / IT Operations, Security Operations, CISO	View ↗
END-004-R006	Encryption Exception Management The organization shall manage exceptions to endpoint encryption requirements, en...	END-004 Endpoint Encryption	Endpoint Security / IT Operations, Security Operations, CISO	View ↗
END-004-R007	Encryption Reporting The organization shall report on endpoint encryption, providing visibility into...	END-004 Endpoint Encryption	Endpoint Security / IT Operations, Security Operations, CISO	View ↗
END-004-R008	Encryption Review The organization shall conduct periodic reviews of endpoint encryption activitie...	END-004 Endpoint Encryption	Endpoint Security / IT Operations, Security Operations, CISO	View ↗
END-004-R009	Recovery Management The organization shall recover encrypted data and restore access in the event of...	END-004 Endpoint Encryption	Endpoint Security / IT Operations, Security Operations, CISO	View ↗
END-004-R010	Encryption Continuous Improvement The organization shall drive ongoing enhancement of endpoint encryption through...	END-004 Endpoint Encryption	Endpoint Security / IT Operations, Security Operations, CISO	View ↗
END-005-R001	Application Control Framework The organization shall establish an endpoint application control framework that...	END-005 Endpoint Application Control	Endpoint Security / IT Operations, Security Operations, CISO	View ↗
END-005-R002	Approved Application Management The organization shall maintain an approved application list that identifies app...	END-005 Endpoint Application Control	Endpoint Security / IT Operations, Security Operations, CISO	View ↗
END-005-R003	Application Allowlisting The organization shall implement application allowlisting controls that permit o...	END-005 Endpoint Application Control	Endpoint Security / IT Operations, Security Operations, CISO	View ↗
END-005-R004	Application Execution Control The organization shall control the execution of applications, including the prev...	END-005 Endpoint Application Control	Endpoint Security / IT Operations, Security Operations, CISO	View ↗
END-005-R005	Application Exception Management The organization shall manage exceptions to application control policies, ensuri...	END-005 Endpoint Application Control	Endpoint Security / IT Operations, Security Operations, CISO	View ↗
END-005-R006	Application Monitoring The organization shall monitor application control to ensure application allowli...	END-005 Endpoint Application Control	Endpoint Security / IT Operations, Security Operations, CISO	View ↗
END-005-R007	Application Compliance Reporting The organization shall report on application control, providing visibility into...	END-005 Endpoint Application Control	Endpoint Security / IT Operations, Security Operations, CISO	View ↗
END-005-R008	Application Review The organization shall conduct periodic reviews of application control activitie...	END-005 Endpoint Application Control	Endpoint Security / IT Operations, Security Operations, CISO	View ↗
END-005-R009	Unauthorized Application Detection The organization shall detect unauthorized applications installed or executed on...	END-005 Endpoint Application Control	Endpoint Security / IT Operations, Security Operations, CISO	View ↗
END-005-R010	Application Control Continuous Improvement The organization shall drive ongoing enhancement of application control through...	END-005 Endpoint Application Control	Endpoint Security / IT Operations, Security Operations, CISO	View ↗
END-006-R001	Removable Media Framework The organization shall establish a removable media and peripheral control framew...	END-006 Removable Media & Peripheral C...	Endpoint Security / IT Operations, Security Operations, CISO	View ↗
END-006-R002	Device Authorization The organization shall authorize removable media and peripheral devices for use...	END-006 Removable Media & Peripheral C...	Endpoint Security / IT Operations, Security Operations, CISO	View ↗
END-006-R003	Peripheral Access Control The organization shall control access to peripheral devices, including USB ports...	END-006 Removable Media & Peripheral C...	Endpoint Security / IT Operations, Security Operations, CISO	View ↗
END-006-R004	Media Usage Restrictions The organization shall implement restrictions on the use of removable media, inc...	END-006 Removable Media & Peripheral C...	Endpoint Security / IT Operations, Security Operations, CISO	View ↗
END-006-R005	Media Activity Monitoring The organization shall monitor removable media activities, including device conn...	END-006 Removable Media & Peripheral C...	Endpoint Security / IT Operations, Security Operations, CISO	View ↗
END-006-R006	Exception Management The organization shall manage exceptions to removable media and peripheral contr...	END-006 Removable Media & Peripheral C...	Endpoint Security, IT Operations, Security Operations, CISO	View ↗
END-006-R007	Media Audit Logging The organization shall maintain comprehensive audit logs of removable media acti...	END-006 Removable Media & Peripheral C...	Endpoint Security / IT Operations, Security Operations, CISO	View ↗
END-006-R008	Media Reporting The organization shall report on removable media and peripheral control, providi...	END-006 Removable Media & Peripheral C...	Endpoint Security / IT Operations, Security Operations, CISO	View ↗
END-006-R009	Media Review The organization shall conduct periodic reviews of removable media and periphera...	END-006 Removable Media & Peripheral C...	Endpoint Security / IT Operations, Security Operations, CISO	View ↗
END-006-R010	Media Continuous Improvement The organization shall drive ongoing enhancement of removable media and peripher...	END-006 Removable Media & Peripheral C...	Endpoint Security / IT Operations, Security Operations, CISO	View ↗
CLD-001-R001	Cloud Governance Framework The organization shall establish a cloud security governance framework that defi...	CLD-001 Cloud Security Governance	CISO / Cloud Security Governance	View ↗
CLD-001-R002	Cloud Security Strategy The organization shall define a cloud security strategy that articulates the app...	CLD-001 Cloud Security Governance	CISO / Cloud Security Governance	View ↗
CLD-001-R003	Cloud Policies & Standards The organization shall establish cloud security policies and standards that spec...	CLD-001 Cloud Security Governance	CISO / Cloud Security Governance	View ↗
CLD-001-R004	Roles & Responsibilities The organization shall clearly define and document the roles and responsibilitie...	CLD-001 Cloud Security Governance	CISO / Cloud Security Governance	View ↗
CLD-001-R005	Cloud Risk Governance The organization shall integrate cloud security risks into the enterprise risk m...	CLD-001 Cloud Security Governance	CISO / Cloud Security Governance	View ↗
CLD-001-R006	Governance Monitoring The organization shall monitor cloud security governance to ensure governance co...	CLD-001 Cloud Security Governance	CISO / Cloud Security Governance	View ↗
CLD-001-R007	Governance Reporting The organization shall report on cloud security governance, providing visibility...	CLD-001 Cloud Security Governance	CISO / Cloud Security Governance	View ↗
CLD-001-R008	Governance Review The organization shall conduct periodic reviews of cloud security governance act...	CLD-001 Cloud Security Governance	CISO / Cloud Security Governance	View ↗
CLD-001-R009	Exception Management The organization shall manage exceptions to cloud security policies and standard...	CLD-001 Cloud Security Governance	CISO / Cloud Security Governance	View ↗
CLD-001-R010	Governance Continuous Improvement The organization shall drive ongoing enhancement of cloud security governance th...	CLD-001 Cloud Security Governance	CISO / Cloud Security Governance	View ↗
CLD-002-R001	Shared Responsibility Framework The organization shall establish a shared responsibility management framework th...	CLD-002 Cloud Shared Responsibility Ma...	Cloud Security / Third-Party Risk Management	View ↗
CLD-002-R002	Responsibility Definition The organization shall clearly define and document the division of security resp...	CLD-002 Cloud Shared Responsibility Ma...	Cloud Security / Third-Party Risk Management	View ↗
CLD-002-R003	Provider Responsibility Validation The organization shall validate that cloud service providers are fulfilling thei...	CLD-002 Cloud Shared Responsibility Ma...	Cloud Security / Third-Party Risk Management	View ↗
CLD-002-R004	Customer Responsibility Management The organization shall manage its own security responsibilities in cloud environ...	CLD-002 Cloud Shared Responsibility Ma...	Cloud Security / Third-Party Risk Management	View ↗
CLD-002-R005	Responsibility Communication The organization shall communicate shared responsibility definitions to all rele...	CLD-002 Cloud Shared Responsibility Ma...	Cloud Security / Third-Party Risk Management	View ↗
CLD-002-R006	Responsibility Monitoring The organization shall monitor shared responsibility management to ensure both p...	CLD-002 Cloud Shared Responsibility Ma...	Cloud Security / Third-Party Risk Management	View ↗
CLD-002-R007	Responsibility Documentation The organization shall maintain comprehensive documentation of shared responsibi...	CLD-002 Cloud Shared Responsibility Ma...	Cloud Security / Third-Party Risk Management	View ↗
CLD-002-R008	Responsibility Review The organization shall conduct periodic reviews of shared responsibility managem...	CLD-002 Cloud Shared Responsibility Ma...	Cloud Security / Third-Party Risk Management	View ↗
CLD-002-R009	Responsibility Reporting The organization shall report on shared responsibility management, providing vis...	CLD-002 Cloud Shared Responsibility Ma...	Cloud Security / Third-Party Risk Management	View ↗
CLD-002-R010	Continuous Improvement The organization shall drive ongoing enhancement of shared responsibility manage...	CLD-002 Cloud Shared Responsibility Ma...	Cloud Security / Third-Party Risk Management	View ↗
CLD-003-R001	Configuration Framework The organization shall establish a secure cloud configuration framework that def...	CLD-003 Secure Cloud Configuration	Cloud Security Engineering / Cloud Platform Team	View ↗
CLD-003-R002	Secure Baselines The organization shall define secure configuration baselines for all cloud servi...	CLD-003 Secure Cloud Configuration	Cloud Security Engineering / Cloud Platform Team	View ↗
CLD-003-R003	Configuration Standards The organization shall define cloud configuration standards that specify the sec...	CLD-003 Secure Cloud Configuration	Cloud Security Engineering / Cloud Platform Team	View ↗
CLD-003-R004	Configuration Validation The organization shall validate cloud configurations against secure baselines an...	CLD-003 Secure Cloud Configuration	Cloud Security Engineering / Cloud Platform Team	View ↗
CLD-003-R005	Configuration Monitoring The organization shall monitor cloud configurations to detect configuration chan...	CLD-003 Secure Cloud Configuration	Cloud Security Engineering / Cloud Platform Team	View ↗
CLD-003-R006	Configuration Drift Detection The organization shall detect configuration drift where cloud configurations dev...	CLD-003 Secure Cloud Configuration	Cloud Security Engineering / Cloud Platform Team	View ↗
CLD-003-R007	Exception Management The organization shall manage exceptions to cloud configuration standards and ba...	CLD-003 Secure Cloud Configuration	Cloud Security Engineering / Cloud Platform Team	View ↗
CLD-003-R008	Configuration Reporting The organization shall report on cloud configuration, providing visibility into...	CLD-003 Secure Cloud Configuration	Cloud Security Engineering / Cloud Platform Team	View ↗
CLD-003-R009	Configuration Review The organization shall conduct periodic reviews of cloud configuration activitie...	CLD-003 Secure Cloud Configuration	Cloud Security Engineering / Cloud Platform Team	View ↗
CLD-003-R010	Continuous Improvement The organization shall drive ongoing enhancement of cloud configuration through...	CLD-003 Secure Cloud Configuration	Cloud Security Engineering / Cloud Platform Team	View ↗
CLD-004-R001	Cloud IAM Framework The organization shall establish a cloud identity and access management framewor...	CLD-004 Cloud Identity & Access Manage...	Cloud IAM Team	View ↗
CLD-004-R002	Cloud Identity Management The organization shall manage identities in cloud environments, including user i...	CLD-004 Cloud Identity & Access Manage...	Cloud IAM Team	View ↗
CLD-004-R003	Authentication Management The organization shall authenticate users accessing cloud services, ensuring onl...	CLD-004 Cloud Identity & Access Manage...	Cloud IAM Team	View ↗
CLD-004-R004	Authorization Management The organization shall authorize access to cloud resources, ensuring users are g...	CLD-004 Cloud Identity & Access Manage...	Cloud IAM Team	View ↗
CLD-004-R005	Privileged Access Management The organization shall manage privileged access in cloud environments, including...	CLD-004 Cloud Identity & Access Manage...	Cloud IAM Team	View ↗
CLD-004-R006	Federation Management The organization shall manage identity federation with cloud service providers,...	CLD-004 Cloud Identity & Access Manage...	Cloud IAM Team	View ↗
CLD-004-R007	Access Monitoring The organization shall monitor cloud access to detect unauthorized access, suspi...	CLD-004 Cloud Identity & Access Manage...	Cloud IAM Team	View ↗
CLD-004-R008	IAM Reporting The organization shall report on cloud IAM, providing visibility into identity s...	CLD-004 Cloud Identity & Access Manage...	Cloud IAM Team	View ↗
CLD-004-R009	IAM Review The organization shall conduct periodic reviews of cloud IAM activities to ensur...	CLD-004 Cloud Identity & Access Manage...	Cloud IAM Team	View ↗
CLD-004-R010	Continuous Improvement The organization shall drive ongoing enhancement of cloud IAM through a continuo...	CLD-004 Cloud Identity & Access Manage...	Cloud IAM Team	View ↗
CLD-005-R001	Network Security Framework The organization shall establish a cloud network security framework that defines...	CLD-005 Cloud Network Security	Cloud Network Security Team	View ↗
CLD-005-R002	Network Segmentation The organization shall implement network segmentation in cloud environments, sep...	CLD-005 Cloud Network Security	Cloud Network Security Team	View ↗
CLD-005-R003	Security Groups & Firewalls The organization shall implement security groups, network firewalls, and other n...	CLD-005 Cloud Network Security	Cloud Network Security Team	View ↗
CLD-005-R004	Secure Connectivity The organization shall establish secure connectivity between on-premises and clo...	CLD-005 Cloud Network Security	Cloud Network Security Team	View ↗
CLD-005-R005	Traffic Protection The organization shall implement traffic protection controls in cloud environmen...	CLD-005 Cloud Network Security	Cloud Network Security Team	View ↗
CLD-005-R006	Network Monitoring The organization shall monitor cloud networks to detect network anomalies, secur...	CLD-005 Cloud Network Security	Cloud Network Security Team	View ↗
CLD-005-R007	Network Logging The organization shall maintain comprehensive network logs for cloud environment...	CLD-005 Cloud Network Security	Cloud Network Security Team	View ↗
CLD-005-R008	Network Reporting The organization shall report on cloud network security, providing visibility in...	CLD-005 Cloud Network Security	Cloud Network Security Team	View ↗
CLD-005-R009	Network Review The organization shall conduct periodic reviews of cloud network security activi...	CLD-005 Cloud Network Security	Cloud Network Security Team	View ↗
CLD-005-R010	Continuous Improvement The organization shall drive ongoing enhancement of cloud network security throu...	CLD-005 Cloud Network Security	Cloud Network Security Team	View ↗
CLD-006-R001	Data Protection Framework The organization shall establish a cloud data protection framework that defines...	CLD-006 Cloud Data Protection	Data Protection / Cloud Security Team	View ↗
CLD-006-R002	Cloud Encryption The organization shall implement encryption for data stored in cloud environment...	CLD-006 Cloud Data Protection	Data Protection / Cloud Security Team	View ↗
CLD-006-R003	Data Access Protection The organization shall implement access controls for cloud data, ensuring only a...	CLD-006 Cloud Data Protection	Data Protection / Cloud Security Team	View ↗
CLD-006-R004	Cloud Backup Protection The organization shall protect cloud backups and ensure backup data is encrypted...	CLD-006 Cloud Data Protection	Data Protection / Cloud Security Team	View ↗
CLD-006-R005	Data Recovery The organization shall recover data from cloud backups in the event of data loss...	CLD-006 Cloud Data Protection	Data Protection / Cloud Security Team	View ↗
CLD-006-R006	Data Monitoring The organization shall monitor cloud data to detect unauthorized access, data le...	CLD-006 Cloud Data Protection	Data Protection / Cloud Security Team	View ↗
CLD-006-R007	Data Compliance The organization shall ensure cloud data processing complies with applicable leg...	CLD-006 Cloud Data Protection	Data Protection / Cloud Security Team	View ↗
CLD-006-R008	Data Reporting The organization shall report on cloud data protection, providing visibility int...	CLD-006 Cloud Data Protection	Data Protection / Cloud Security Team	View ↗
CLD-006-R009	Data Review The organization shall conduct periodic reviews of cloud data protection activit...	CLD-006 Cloud Data Protection	Data Protection / Cloud Security Team	View ↗
CLD-006-R010	Continuous Improvement The organization shall drive ongoing enhancement of cloud data protection throug...	CLD-006 Cloud Data Protection	Data Protection / Cloud Security Team	View ↗
CLD-007-R001	Workload Security Framework The organization shall establish a cloud workload security framework that define...	CLD-007 Cloud Workload & Container Sec...	Cloud Security Engineering / DevSecOps	View ↗
CLD-007-R002	Container Security The organization shall implement security controls for containerized workloads,...	CLD-007 Cloud Workload & Container Sec...	Cloud Security Engineering / DevSecOps	View ↗
CLD-007-R003	Kubernetes Security The organization shall implement security controls for Kubernetes environments,...	CLD-007 Cloud Workload & Container Sec...	Cloud Security Engineering / DevSecOps	View ↗
CLD-007-R004	Serverless Security The organization shall implement security controls for serverless functions and...	CLD-007 Cloud Workload & Container Sec...	Cloud Security Engineering / DevSecOps	View ↗
CLD-007-R005	Image Security The organization shall implement security controls for container images, ensurin...	CLD-007 Cloud Workload & Container Sec...	Cloud Security Engineering / DevSecOps	View ↗
CLD-007-R006	Runtime Protection The organization shall implement runtime protection for cloud workloads, includi...	CLD-007 Cloud Workload & Container Sec...	Cloud Security Engineering / DevSecOps	View ↗
CLD-007-R007	Workload Monitoring The organization shall monitor cloud workloads to detect security issues, perfor...	CLD-007 Cloud Workload & Container Sec...	Cloud Security Engineering / DevSecOps	View ↗
CLD-007-R008	Security Reporting The organization shall report on cloud workload security, providing visibility i...	CLD-007 Cloud Workload & Container Sec...	Cloud Security Engineering / DevSecOps	View ↗
CLD-007-R009	Workload Review The organization shall conduct periodic reviews of cloud workload security activ...	CLD-007 Cloud Workload & Container Sec...	Cloud Security Engineering / DevSecOps	View ↗
CLD-007-R010	Continuous Improvement The organization shall drive ongoing enhancement of cloud workload and container...	CLD-007 Cloud Workload & Container Sec...	Cloud Security Engineering / DevSecOps	View ↗
CLD-008-R001	Monitoring Framework The organization shall establish a cloud security monitoring framework that defi...	CLD-008 Cloud Security Monitoring	SOC / Cloud Security Monitoring Team	View ↗
CLD-008-R002	Cloud Logging The organization shall log cloud activities comprehensively, including user acti...	CLD-008 Cloud Security Monitoring	SOC / Cloud Security Monitoring Team	View ↗
CLD-008-R003	Security Event Collection The organization shall collect security events from cloud services, including se...	CLD-008 Cloud Security Monitoring	SOC / Cloud Security Monitoring Team	View ↗
CLD-008-R004	Threat Detection The organization shall implement threat detection capabilities for cloud environ...	CLD-008 Cloud Security Monitoring	SOC / Cloud Security Monitoring Team	View ↗
CLD-008-R005	Alert Management The organization shall manage security alerts generated by cloud monitoring syst...	CLD-008 Cloud Security Monitoring	SOC / Cloud Security Monitoring Team	View ↗
CLD-008-R006	Continuous Monitoring The organization shall continuously monitor cloud environments to detect securit...	CLD-008 Cloud Security Monitoring	SOC / Cloud Security Monitoring Team	View ↗
CLD-008-R007	Monitoring Reporting The organization shall report on cloud security monitoring, providing visibility...	CLD-008 Cloud Security Monitoring	SOC / Cloud Security Monitoring Team	View ↗
CLD-008-R008	Monitoring Review The organization shall conduct periodic reviews of cloud security monitoring act...	CLD-008 Cloud Security Monitoring	SOC / Cloud Security Monitoring Team	View ↗
CLD-008-R009	Monitoring Validation The organization shall validate cloud security monitoring capabilities to ensure...	CLD-008 Cloud Security Monitoring	SOC / Cloud Security Monitoring Team	View ↗
CLD-008-R010	Continuous Improvement The organization shall drive ongoing enhancement of cloud security monitoring th...	CLD-008 Cloud Security Monitoring	SOC / Cloud Security Monitoring Team	View ↗
CLD-009-R001	Cloud IR Framework The organization shall establish a cloud incident response framework that define...	CLD-009 Cloud Incident Response	Incident Response / Cloud Security Team	View ↗
CLD-009-R002	Incident Detection The organization shall detect security incidents in cloud environments using mon...	CLD-009 Cloud Incident Response	Incident Response / Cloud Security Team	View ↗
CLD-009-R003	Incident Investigation The organization shall investigate cloud security incidents, including the colle...	CLD-009 Cloud Incident Response	Incident Response / Cloud Security Team	View ↗
CLD-009-R004	Incident Containment The organization shall contain cloud security incidents, including the isolation...	CLD-009 Cloud Incident Response	Incident Response / Cloud Security Team	View ↗
CLD-009-R005	Incident Recovery The organization shall recover from cloud security incidents, including the rest...	CLD-009 Cloud Incident Response	Incident Response / Cloud Security Team	View ↗
CLD-009-R006	Cloud Forensics The organization shall establish forensic capabilities for investigating cloud s...	CLD-009 Cloud Incident Response	Incident Response / Cloud Security Team	View ↗
CLD-009-R007	Incident Communication The organization shall communicate cloud security incidents to relevant stakehol...	CLD-009 Cloud Incident Response	Incident Response / Cloud Security Team	View ↗
CLD-009-R008	Incident Reporting The organization shall report on cloud security incidents, providing visibility...	CLD-009 Cloud Incident Response	Incident Response / Cloud Security Team	View ↗
CLD-009-R009	Incident Review The organization shall conduct periodic reviews of cloud incident response activ...	CLD-009 Cloud Incident Response	Incident Response / Cloud Security Team	View ↗
CLD-009-R010	Continuous Improvement The organization shall drive ongoing enhancement of cloud incident response thro...	CLD-009 Cloud Incident Response	Incident Response / Cloud Security Team	View ↗
CLD-010-R001	Portability Framework The organization shall establish a cloud data portability and interoperability f...	CLD-010 Cloud Data Portability & Inter...	Cloud Architecture / Data Governance Team	View ↗
CLD-010-R002	Data Export Management The organization shall export data from cloud environments in a secure and stand...	CLD-010 Cloud Data Portability & Inter...	Cloud Architecture / Data Governance Team	View ↗
CLD-010-R003	Secure Data Migration The organization shall securely migrate data between cloud environments, ensurin...	CLD-010 Cloud Data Portability & Inter...	Cloud Architecture / Data Governance Team	View ↗
CLD-010-R004	Interoperability Standards The organization shall define and adhere to interoperability standards that enab...	CLD-010 Cloud Data Portability & Inter...	Cloud Architecture / Data Governance Team	View ↗
CLD-010-R005	Exit Strategy Management The organization shall develop and maintain exit strategies for cloud service re...	CLD-010 Cloud Data Portability & Inter...	Cloud Architecture / Data Governance Team	View ↗
CLD-010-R006	Migration Validation The organization shall validate that data migrations have been completed success...	CLD-010 Cloud Data Portability & Inter...	Cloud Architecture / Data Governance Team	View ↗
CLD-010-R007	Portability Monitoring The organization shall monitor data portability and interoperability to ensure c...	CLD-010 Cloud Data Portability & Inter...	Cloud Architecture / Data Governance Team	View ↗
CLD-010-R008	Portability Reporting The organization shall report on data portability and interoperability, providin...	CLD-010 Cloud Data Portability & Inter...	Cloud Architecture / Data Governance Team	View ↗
CLD-010-R009	Portability Review The organization shall conduct periodic reviews of data portability and interope...	CLD-010 Cloud Data Portability & Inter...	Cloud Architecture / Data Governance Team	View ↗
CLD-010-R010	Continuous Improvement The organization shall drive ongoing enhancement of cloud data portability and i...	CLD-010 Cloud Data Portability & Inter...	Cloud Architecture / Data Governance Team	View ↗
APP-001-R001	Application Security Governance The organization shall establish an application security governance program that...	APP-001 Application Security Program	CISO / Application Security Team	View ↗
APP-001-R002	Security Program Scope The organization shall define a documented scope for the application security pr...	APP-001 Application Security Program	CISO / Application Security Team	View ↗
APP-001-R003	Roles & Responsibilities The organization shall clearly define and document the roles and responsibilitie...	APP-001 Application Security Program	CISO / Application Security Team	View ↗
APP-001-R004	Security Policies The organization shall establish application security policies that define the s...	APP-001 Application Security Program	CISO / Application Security Team	View ↗
APP-001-R005	Security Metrics The organization shall define and track application security metrics that provid...	APP-001 Application Security Program	CISO / Application Security Team	View ↗
APP-001-R006	Program Monitoring The organization shall monitor application security program activities to ensure...	APP-001 Application Security Program	CISO / Application Security Team	View ↗
APP-001-R007	Executive Reporting The organization shall provide executive leadership and the board with regular r...	APP-001 Application Security Program	CISO / Application Security Team	View ↗
APP-001-R008	Program Review The organization shall conduct periodic reviews of application security program...	APP-001 Application Security Program	CISO / Application Security Team	View ↗
APP-001-R009	Exception Management The organization shall manage exceptions to application security policies and re...	APP-001 Application Security Program	CISO / Application Security Team	View ↗
APP-001-R010	Continuous Improvement The organization shall establish a continuous improvement process for the applic...	APP-001 Application Security Program	CISO / Application Security Team	View ↗
APP-002-R001	Inventory Framework The organization shall establish an application inventory framework that defines...	APP-002 Application Inventory	Application Portfolio Management / Application Security	View ↗
APP-002-R002	Application Registration The organization shall register all applications in the application inventory, i...	APP-002 Application Inventory	Application Portfolio Management / Application Security	View ↗
APP-002-R003	Application Classification The organization shall apply classification schemas to applications to enable co...	APP-002 Application Inventory	Application Portfolio Management / Application Security	View ↗
APP-002-R004	Ownership Assignment The organization shall assign explicit ownership for each application in the inv...	APP-002 Application Inventory	Application Portfolio Management / Application Security	View ↗
APP-002-R005	Lifecycle Status The organization shall maintain lifecycle status information for each applicatio...	APP-002 Application Inventory	Application Portfolio Management / Application Security	View ↗
APP-002-R006	Inventory Validation The organization shall validate the application inventory to ensure its accuracy...	APP-002 Application Inventory	Application Portfolio Management / Application Security	View ↗
APP-002-R007	Inventory Monitoring The organization shall monitor the application inventory to ensure inventory dat...	APP-002 Application Inventory	Application Portfolio Management / Application Security	View ↗
APP-002-R008	Inventory Reporting The organization shall report on the application inventory, providing visibility...	APP-002 Application Inventory	Application Portfolio Management / Application Security	View ↗
APP-002-R009	Inventory Review The organization shall conduct periodic reviews of application inventory activit...	APP-002 Application Inventory	Application Portfolio Management / Application Security	View ↗
APP-002-R010	Continuous Improvement The organization shall establish a continuous improvement process for applicatio...	APP-002 Application Inventory	Application Portfolio Management / Application Security	View ↗
APP-003-R001	SSDLC Framework The organization shall establish a Secure Software Development Lifecycle framewo...	APP-003 Secure Software Development Li...	Application Security / Engineering	View ↗
APP-003-R002	Security Requirements The organization shall define security requirements for all software development...	APP-003 Secure Software Development Li...	Application Security / Engineering	View ↗
APP-003-R003	Secure Design Review The organization shall conduct secure design reviews for software development pr...	APP-003 Secure Software Development Li...	Application Security / Engineering	View ↗
APP-003-R004	Threat Modeling The organization shall conduct threat modeling for software development projects...	APP-003 Secure Software Development Li...	Application Security / Engineering	View ↗
APP-003-R005	Secure Development The organization shall implement secure development practices throughout the sof...	APP-003 Secure Software Development Li...	Application Security / Engineering	View ↗
APP-003-R006	Security Verification The organization shall conduct security verification activities during the devel...	APP-003 Secure Software Development Li...	Application Security / Engineering	View ↗
APP-003-R007	Security Validation The organization shall conduct security validation activities before application...	APP-003 Secure Software Development Li...	Application Security / Engineering	View ↗
APP-003-R008	Security Acceptance The organization shall establish security acceptance criteria for application re...	APP-003 Secure Software Development Li...	Application Security / Engineering	View ↗
APP-003-R009	SDLC Review The organization shall conduct periodic reviews of SSDLC activities to ensure th...	APP-003 Secure Software Development Li...	Application Security / Engineering	View ↗
APP-003-R010	Continuous Improvement The organization shall establish a continuous improvement process for the SSDLC,...	APP-003 Secure Software Development Li...	Application Security / Engineering	View ↗
APP-004-R001	Secure Coding Standards The organization shall define secure coding standards that specify the security...	APP-004 Secure Coding Practices	Engineering / Application Security	View ↗
APP-004-R002	Developer Training The organization shall provide secure coding training to all developers to ensur...	APP-004 Secure Coding Practices	Engineering / Application Security	View ↗
APP-004-R003	Code Review The organization shall conduct security-focused code reviews for all software de...	APP-004 Secure Coding Practices	Engineering / Application Security	View ↗
APP-004-R004	Static Analysis The organization shall implement static analysis tools and processes to automati...	APP-004 Secure Coding Practices	Engineering / Application Security	View ↗
APP-004-R005	Coding Exceptions The organization shall manage exceptions to secure coding standards, ensuring de...	APP-004 Secure Coding Practices	Engineering / Application Security	View ↗
APP-004-R006	Coding Validation The organization shall validate that secure coding practices have been followed...	APP-004 Secure Coding Practices	Engineering / Application Security	View ↗
APP-004-R007	Coding Metrics The organization shall define and track secure coding metrics that provide insig...	APP-004 Secure Coding Practices	Engineering / Application Security	View ↗
APP-004-R008	Coding Reporting The organization shall report on secure coding activities, providing visibility...	APP-004 Secure Coding Practices	Engineering / Application Security	View ↗
APP-004-R009	Coding Review The organization shall conduct periodic reviews of secure coding activities to e...	APP-004 Secure Coding Practices	Engineering / Application Security	View ↗
APP-004-R010	Continuous Improvement The organization shall establish a continuous improvement process for secure cod...	APP-004 Secure Coding Practices	Engineering / Application Security	View ↗
APP-005-R001	Security Testing Framework The organization shall establish an application security testing framework that...	APP-005 Application Security Testing	Application Security / QA	View ↗
APP-005-R002	SAST The organization shall implement Static Application Security Testing capabilitie...	APP-005 Application Security Testing	Application Security / QA	View ↗
APP-005-R003	DAST The organization shall implement Dynamic Application Security Testing capabiliti...	APP-005 Application Security Testing	Application Security / QA	View ↗
APP-005-R004	Interactive Testing (IAST) The organization shall implement Interactive Application Security Testing capabi...	APP-005 Application Security Testing	Application Security / QA	View ↗
APP-005-R005	Penetration Testing The organization shall conduct penetration testing of applications to identify v...	APP-005 Application Security Testing	Application Security / QA	View ↗
APP-005-R006	Vulnerability Validation The organization shall validate application security testing results to ensure t...	APP-005 Application Security Testing	Application Security / QA	View ↗
APP-005-R007	Test Reporting The organization shall report on application security testing, providing visibil...	APP-005 Application Security Testing	Application Security / QA	View ↗
APP-005-R008	Test Review The organization shall conduct periodic reviews of application security testing...	APP-005 Application Security Testing	Application Security / QA	View ↗
APP-005-R009	Remediation Verification The organization shall verify that identified vulnerabilities have been properly...	APP-005 Application Security Testing	Application Security / QA	View ↗
APP-005-R010	Continuous Improvement The organization shall establish a continuous improvement process for applicatio...	APP-005 Application Security Testing	Application Security / QA	View ↗
APP-006-R001	DevSecOps Framework The organization shall establish a DevSecOps framework that defines the structur...	APP-006 DevSecOps	DevSecOps / Platform Engineering	View ↗
APP-006-R002	CI/CD Security The organization shall implement security controls within CI/CD pipelines to ens...	APP-006 DevSecOps	DevSecOps / Platform Engineering	View ↗
APP-006-R003	Pipeline Security The organization shall secure CI/CD pipelines against unauthorized access, tampe...	APP-006 DevSecOps	DevSecOps / Platform Engineering	View ↗
APP-006-R004	Build Security The organization shall implement security controls for the build process, ensuri...	APP-006 DevSecOps	DevSecOps / Platform Engineering	View ↗
APP-006-R005	Artifact Security The organization shall implement security controls for build artifacts, includin...	APP-006 DevSecOps	DevSecOps / Platform Engineering	View ↗
APP-006-R006	Infrastructure as Code Security The organization shall implement security controls for Infrastructure as Code, e...	APP-006 DevSecOps	DevSecOps / Platform Engineering	View ↗
APP-006-R007	Pipeline Monitoring The organization shall monitor DevSecOps pipelines to ensure security controls a...	APP-006 DevSecOps	DevSecOps / Platform Engineering	View ↗
APP-006-R008	DevSecOps Reporting The organization shall report on DevSecOps, providing visibility into pipeline s...	APP-006 DevSecOps	DevSecOps / Platform Engineering	View ↗
APP-006-R009	Pipeline Review The organization shall conduct periodic reviews of DevSecOps activities to ensur...	APP-006 DevSecOps	DevSecOps / Platform Engineering	View ↗
APP-006-R010	Continuous Improvement The organization shall establish a continuous improvement process for DevSecOps,...	APP-006 DevSecOps	DevSecOps / Platform Engineering	View ↗
APP-007-R001	Supply Chain Framework The organization shall establish a software supply chain security framework that...	APP-007 Software Supply Chain Security	Application Security / DevSecOps	View ↗
APP-007-R002	SBOM Management The organization shall manage Software Bills of Materials for all applications a...	APP-007 Software Supply Chain Security	Application Security / DevSecOps	View ↗
APP-007-R003	Third-Party Component Management The organization shall manage third-party software components, ensuring componen...	APP-007 Software Supply Chain Security	Application Security / DevSecOps	View ↗
APP-007-R004	Open Source Security The organization shall manage open source software security, including vulnerabi...	APP-007 Software Supply Chain Security	Application Security / DevSecOps	View ↗
APP-007-R005	Dependency Management The organization shall manage software dependencies, including identification, t...	APP-007 Software Supply Chain Security	Application Security / DevSecOps	View ↗
APP-007-R006	Component Verification The organization shall verify the integrity and authenticity of software compone...	APP-007 Software Supply Chain Security	Application Security / DevSecOps	View ↗
APP-007-R007	Supply Chain Monitoring The organization shall monitor software supply chain security to identify vulner...	APP-007 Software Supply Chain Security	Application Security / DevSecOps	View ↗
APP-007-R008	Supply Chain Reporting The organization shall report on software supply chain security, providing visib...	APP-007 Software Supply Chain Security	Application Security / DevSecOps	View ↗
APP-007-R009	Supply Chain Review The organization shall conduct periodic reviews of software supply chain securit...	APP-007 Software Supply Chain Security	Application Security / DevSecOps	View ↗
APP-007-R010	Continuous Improvement The organization shall establish a continuous improvement process for software s...	APP-007 Software Supply Chain Security	Application Security / DevSecOps	View ↗
APP-008-R001	API Security Framework The organization shall establish an API security framework that defines the stru...	APP-008 API Security	API Security / Application Engineering	View ↗
APP-008-R002	API Authentication The organization shall implement authentication controls for all APIs, ensuring...	APP-008 API Security	API Security / Application Engineering	View ↗
APP-008-R003	API Authorization The organization shall implement authorization controls for all APIs, ensuring A...	APP-008 API Security	API Security / Application Engineering	View ↗
APP-008-R004	API Input Validation The organization shall implement input validation controls for all APIs to preve...	APP-008 API Security	API Security / Application Engineering	View ↗
APP-008-R005	API Rate Limiting The organization shall implement rate limiting controls for APIs to prevent deni...	APP-008 API Security	API Security / Application Engineering	View ↗
APP-008-R006	API Monitoring The organization shall monitor API activities to detect security incidents, perf...	APP-008 API Security	API Security / Application Engineering	View ↗
APP-008-R007	API Security Testing The organization shall conduct security testing of APIs to identify vulnerabilit...	APP-008 API Security	API Security / Application Engineering	View ↗
APP-008-R008	API Reporting The organization shall report on API security, providing visibility into API sta...	APP-008 API Security	API Security / Application Engineering	View ↗
APP-008-R009	API Review The organization shall conduct periodic reviews of API security activities to en...	APP-008 API Security	API Security / Application Engineering	View ↗
APP-008-R010	Continuous Improvement The organization shall establish a continuous improvement process for API securi...	APP-008 API Security	API Security / Application Engineering	View ↗
APP-009-R001	Secrets Governance The organization shall establish a secrets governance program that defines the s...	APP-009 Secrets Management	Application Security / Platform Engineering	View ↗
APP-009-R002	Secret Inventory The organization shall maintain a comprehensive inventory of all secrets used in...	APP-009 Secrets Management	Application Security / Platform Engineering	View ↗
APP-009-R003	Secure Storage The organization shall implement secure storage for secrets, ensuring secrets ar...	APP-009 Secrets Management	Application Security / Platform Engineering	View ↗
APP-009-R004	Secret Rotation The organization shall rotate secrets at defined intervals and in response to sp...	APP-009 Secrets Management	Application Security / Platform Engineering	View ↗
APP-009-R005	Secret Distribution The organization shall distribute secrets securely to authorized consumers, ensu...	APP-009 Secrets Management	Application Security / Platform Engineering	View ↗
APP-009-R006	Secret Monitoring The organization shall monitor secrets to detect unauthorized access, compromise...	APP-009 Secrets Management	Application Security / Platform Engineering	View ↗
APP-009-R007	Secret Audit The organization shall maintain comprehensive audit logs of secret activities, i...	APP-009 Secrets Management	Application Security / Platform Engineering	View ↗
APP-009-R008	Secret Reporting The organization shall report on secrets management, providing visibility into s...	APP-009 Secrets Management	Application Security / Platform Engineering	View ↗
APP-009-R009	Secret Review The organization shall conduct periodic reviews of secrets management activities...	APP-009 Secrets Management	Application Security / Platform Engineering	View ↗
APP-009-R010	Continuous Improvement The organization shall establish a continuous improvement process for secrets ma...	APP-009 Secrets Management	Application Security / Platform Engineering	View ↗
APP-010-R001	Release Security Framework The organization shall establish a software release and deployment security fram...	APP-010 Software Release & Deployment...	Product Management / Application Security / Risk Owner	View ↗
APP-010-R002	Release Approval The organization shall approve software releases, ensuring releases are authoriz...	APP-010 Software Release & Deployment...	Product Management / Application Security / Risk Owner	View ↗
APP-010-R003	Deployment Validation The organization shall validate that software deployments have been completed su...	APP-010 Software Release & Deployment...	Product Management / Application Security / Risk Owner	View ↗
APP-010-R004	Deployment Integrity The organization shall implement controls to ensure the integrity of software de...	APP-010 Software Release & Deployment...	Product Management / Application Security / Risk Owner	View ↗
APP-010-R005	Rollback Management The organization shall roll back software deployments in the event of security i...	APP-010 Software Release & Deployment...	Product Management / Application Security / Risk Owner	View ↗
APP-010-R006	Production Verification The organization shall conduct security verification of software in production e...	APP-010 Software Release & Deployment...	Product Management / Application Security / Risk Owner	View ↗
APP-010-R007	Deployment Monitoring The organization shall monitor software deployments to detect security issues, d...	APP-010 Software Release & Deployment...	Product Management / Application Security / Risk Owner	View ↗
APP-010-R008	Deployment Reporting The organization shall report on software release and deployment security, provi...	APP-010 Software Release & Deployment...	Product Management / Application Security / Risk Owner	View ↗
APP-010-R009	Deployment Review The organization shall conduct periodic reviews of software release and deployme...	APP-010 Software Release & Deployment...	Product Management / Application Security / Risk Owner	View ↗
APP-010-R010	Continuous Improvement The organization shall establish a continuous improvement process for software r...	APP-010 Software Release & Deployment...	Product Management / Application Security / Risk Owner	View ↗
APP-011-R001	Incident Response Framework The organization shall establish an application security incident response frame...	APP-011 Application Security Incident...	Product Management / Application Security / Risk Owner	View ↗
APP-011-R002	Application Incident Detection The organization shall detect security incidents in applications using monitorin...	APP-011 Application Security Incident...	Product Management / Application Security / Risk Owner	View ↗
APP-011-R003	Incident Investigation The organization shall investigate application security incidents, including col...	APP-011 Application Security Incident...	Product Management / Application Security / Risk Owner	View ↗
APP-011-R004	Containment The organization shall contain application security incidents, including isolati...	APP-011 Application Security Incident...	Product Management / Application Security / Risk Owner	View ↗
APP-011-R005	Recovery The organization shall recover from application security incidents, including re...	APP-011 Application Security Incident...	Product Management / Application Security / Risk Owner	View ↗
APP-011-R006	Root Cause Analysis The organization shall conduct root cause analysis for application security inci...	APP-011 Application Security Incident...	Product Management / Application Security / Risk Owner	View ↗
APP-011-R007	Incident Reporting The organization shall report on application security incidents, providing visib...	APP-011 Application Security Incident...	Product Management / Application Security / Risk Owner	View ↗
APP-011-R008	Lessons Learned The organization shall capture and integrate lessons learned from application se...	APP-011 Application Security Incident...	Product Management / Application Security / Risk Owner	View ↗
APP-011-R009	Incident Review The organization shall conduct periodic reviews of application security incident...	APP-011 Application Security Incident...	Product Management / Application Security / Risk Owner	View ↗
APP-011-R010	Continuous Improvement The organization shall establish a continuous improvement process for applicatio...	APP-011 Application Security Incident...	Product Management / Application Security / Risk Owner	View ↗
APP-012-R001	Risk Assessment Framework The organization shall establish an application risk assessment framework that d...	APP-012 Application Risk Assessment	Product Management / Application Security / Risk Owner	View ↗
APP-012-R002	Risk Identification The organization shall identify security risks associated with applications, inc...	APP-012 Application Risk Assessment	Product Management / Application Security / Risk Owner	View ↗
APP-012-R003	Threat Assessment The organization shall conduct threat assessments for applications to identify p...	APP-012 Application Risk Assessment	Product Management / Application Security / Risk Owner	View ↗
APP-012-R004	Business Impact Assessment The organization shall conduct business impact assessments for application risks...	APP-012 Application Risk Assessment	Product Management / Application Security / Risk Owner	View ↗
APP-012-R005	Risk Scoring The organization shall apply consistent risk scoring methodologies to quantify a...	APP-012 Application Risk Assessment	Product Management / Application Security / Risk Owner	View ↗
APP-012-R006	Risk Treatment The organization shall define and implement risk treatment strategies for applic...	APP-012 Application Risk Assessment	Product Management / Application Security / Risk Owner	View ↗
APP-012-R007	Risk Monitoring The organization shall monitor application security risks to ensure risks are tr...	APP-012 Application Risk Assessment	Product Management / Application Security / Risk Owner	View ↗
APP-012-R008	Risk Reporting The organization shall report on application risk assessment, providing visibili...	APP-012 Application Risk Assessment	Product Management / Application Security / Risk Owner	View ↗
APP-012-R009	Risk Review The organization shall conduct periodic reviews of application risk assessment a...	APP-012 Application Risk Assessment	Product Management / Application Security / Risk Owner	View ↗
APP-012-R010	Continuous Improvement The organization shall establish a continuous improvement process for applicatio...	APP-012 Application Risk Assessment	Product Management / Application Security / Risk Owner	View ↗
OPS-001-R001	Change Management Framework The organization shall establish a change and release management framework that...	OPS-001 Change & Release Management	IT Operations, Change Manager, Release Manager, CISO	View ↗
OPS-001-R002	Change Request Management The organization shall manage change requests, ensuring all changes are formally...	OPS-001 Change & Release Management	IT Operations, Change Manager, Release Manager, CISO	View ↗
OPS-001-R003	Change Risk Assessment The organization shall conduct risk assessments for proposed changes to evaluate...	OPS-001 Change & Release Management	IT Operations, Change Manager, Release Manager, CISO	View ↗
OPS-001-R004	Change Approval The organization shall approve changes, ensuring changes are authorized by appro...	OPS-001 Change & Release Management	IT Operations, Change Manager, Release Manager, CISO	View ↗
OPS-001-R005	Release Planning The organization shall plan releases, ensuring releases are planned with adequat...	OPS-001 Change & Release Management	IT Operations, Change Manager, Release Manager, CISO	View ↗
OPS-001-R006	Release Deployment The organization shall deploy releases into production environments, ensuring de...	OPS-001 Change & Release Management	IT Operations, Change Manager, Release Manager, CISO	View ↗
OPS-001-R007	Post-Implementation Review The organization shall conduct post-implementation reviews for significant chang...	OPS-001 Change & Release Management	IT Operations, Change Manager, Release Manager, CISO	View ↗
OPS-001-R008	Emergency Changes The organization shall manage emergency changes required to address urgent secur...	OPS-001 Change & Release Management	IT Operations, Change Manager, Release Manager, CISO	View ↗
OPS-001-R009	Change Reporting The organization shall report on change and release management, providing visibi...	OPS-001 Change & Release Management	IT Operations, Change Manager, Release Manager, CISO	View ↗
OPS-001-R010	Continuous Improvement The organization shall establish a continuous improvement process for change and...	OPS-001 Change & Release Management	IT Operations, Change Manager, Release Manager, CISO	View ↗
OPS-002-R001	Operational Monitoring Framework The organization shall establish an operational monitoring framework that define...	OPS-002 Operational Monitoring & Servi...	IT Operations, Security Operations, NOC, Service Owners	View ↗
OPS-002-R002	Health Monitoring The organization shall monitor the health of operational systems and services, i...	OPS-002 Operational Monitoring & Servi...	IT Operations, Security Operations, NOC, Service Owners	View ↗
OPS-002-R003	Performance Monitoring The organization shall monitor system performance, including response times, thr...	OPS-002 Operational Monitoring & Servi...	IT Operations, Security Operations, NOC, Service Owners	View ↗
OPS-002-R004	Alert Management The organization shall manage alerts generated by monitoring systems, ensuring a...	OPS-002 Operational Monitoring & Servi...	IT Operations, Security Operations, NOC, Service Owners	View ↗
OPS-002-R005	Event Monitoring The organization shall monitor operational events, including system events, secu...	OPS-002 Operational Monitoring & Servi...	IT Operations, Security Operations, NOC, Service Owners	View ↗
OPS-002-R006	Operational Dashboards The organization shall develop and maintain operational dashboards that provide...	OPS-002 Operational Monitoring & Servi...	IT Operations, Security Operations, NOC, Service Owners	View ↗
OPS-002-R007	Monitoring Review The organization shall conduct periodic reviews of operational monitoring activi...	OPS-002 Operational Monitoring & Servi...	IT Operations, Security Operations, NOC, Service Owners	View ↗
OPS-002-R008	Monitoring Reporting The organization shall report on operational monitoring, providing visibility in...	OPS-002 Operational Monitoring & Servi...	IT Operations, Security Operations, NOC, Service Owners	View ↗
OPS-002-R009	Escalation Management The organization shall escalate operational issues that require management atten...	OPS-002 Operational Monitoring & Servi...	IT Operations, Security Operations, NOC, Service Owners	View ↗
OPS-002-R010	Continuous Improvement The organization shall establish a continuous improvement process for operationa...	OPS-002 Operational Monitoring & Servi...	IT Operations, Security Operations, NOC, Service Owners	View ↗
OPS-003-R001	Availability Framework The organization shall establish a service availability management framework tha...	OPS-003 Service Availability Managemen...	IT Operations, Service Owners, Business Continuity, Service Management	View ↗
OPS-003-R002	Availability Objectives The organization shall define availability objectives for critical services and...	OPS-003 Service Availability Managemen...	IT Operations, Service Owners, Business Continuity, Service Management	View ↗
OPS-003-R003	Service Availability Monitoring The organization shall monitor the availability of critical services and systems...	OPS-003 Service Availability Managemen...	IT Operations, Service Owners, Business Continuity, Service Management	View ↗
OPS-003-R004	Availability Risk Assessment The organization shall conduct risk assessments for service availability to iden...	OPS-003 Service Availability Managemen...	IT Operations, Service Owners, Business Continuity, Service Management	View ↗
OPS-003-R005	Availability Reporting The organization shall report on service availability, providing visibility into...	OPS-003 Service Availability Managemen...	IT Operations, Service Owners, Business Continuity, Service Management	View ↗
OPS-003-R006	Service Restoration The organization shall restore services in the event of availability incidents,...	OPS-003 Service Availability Managemen...	IT Operations, Service Owners, Business Continuity, Service Management	View ↗
OPS-003-R007	Availability Review The organization shall conduct periodic reviews of service availability manageme...	OPS-003 Service Availability Managemen...	IT Operations, Service Owners, Business Continuity, Service Management	View ↗
OPS-003-R008	Availability Testing The organization shall regularly test availability capabilities, including failo...	OPS-003 Service Availability Managemen...	IT Operations, Service Owners, Business Continuity, Service Management	View ↗
OPS-003-R009	SLA Monitoring The organization shall monitor compliance with service level agreements related...	OPS-003 Service Availability Managemen...	IT Operations, Service Owners, Business Continuity, Service Management	View ↗
OPS-003-R010	Continuous Improvement The organization shall establish a continuous improvement process for service av...	OPS-003 Service Availability Managemen...	IT Operations, Service Owners, Business Continuity, Service Management	View ↗
OPS-004-R001	Capacity Management Framework The organization shall establish a capacity and performance management framework...	OPS-004 Capacity & Performance Managem...	IT Operations, Infrastructure Engineering, Cloud Operations, Service Owners	View ↗
OPS-004-R002	Capacity Planning The organization shall conduct capacity planning to ensure systems have adequate...	OPS-004 Capacity & Performance Managem...	IT Operations, Infrastructure Engineering, Cloud Operations, Service Owners	View ↗
OPS-004-R003	Performance Monitoring The organization shall monitor system performance, including response times, thr...	OPS-004 Capacity & Performance Managem...	IT Operations, Infrastructure Engineering, Cloud Operations, Service Owners	View ↗
OPS-004-R004	Workload Forecasting The organization shall forecast workload demands to anticipate capacity needs an...	OPS-004 Capacity & Performance Managem...	IT Operations, Infrastructure Engineering, Cloud Operations, Service Owners	View ↗
OPS-004-R005	Resource Optimization The organization shall optimize resource utilization to ensure efficient use of...	OPS-004 Capacity & Performance Managem...	IT Operations, Infrastructure Engineering, Cloud Operations, Service Owners	View ↗
OPS-004-R006	Auto-Scaling Management The organization shall manage auto-scaling capabilities to automatically adjust...	OPS-004 Capacity & Performance Managem...	IT Operations, Infrastructure Engineering, Cloud Operations, Service Owners	View ↗
OPS-004-R007	Capacity Reporting The organization shall report on capacity and performance management, providing...	OPS-004 Capacity & Performance Managem...	IT Operations, Infrastructure Engineering, Cloud Operations, Service Owners	View ↗
OPS-004-R008	Performance Review The organization shall conduct periodic reviews of capacity and performance mana...	OPS-004 Capacity & Performance Managem...	IT Operations, Infrastructure Engineering, Cloud Operations, Service Owners	View ↗
OPS-004-R009	Capacity Risk Assessment The organization shall conduct risk assessments for capacity to identify potenti...	OPS-004 Capacity & Performance Managem...	IT Operations, Infrastructure Engineering, Cloud Operations, Service Owners	View ↗
OPS-004-R010	Continuous Improvement The organization shall establish a continuous improvement process for capacity a...	OPS-004 Capacity & Performance Managem...	IT Operations, Infrastructure Engineering, Cloud Operations, Service Owners	View ↗
OPS-005-R001	Maintenance Framework The organization shall establish a system maintenance management framework that...	OPS-005 System Maintenance Management	IT Operations, Infrastructure Engineering, Application Operations, Change Management	View ↗
OPS-005-R002	Preventive Maintenance The organization shall conduct preventive maintenance to proactively identify an...	OPS-005 System Maintenance Management	IT Operations, Infrastructure Engineering, Application Operations, Change Management	View ↗
OPS-005-R003	Planned Maintenance The organization shall conduct planned maintenance activities, including the sch...	OPS-005 System Maintenance Management	IT Operations, Infrastructure Engineering, Application Operations, Change Management	View ↗
OPS-005-R004	Maintenance Scheduling The organization shall schedule maintenance activities to minimize business impa...	OPS-005 System Maintenance Management	IT Operations, Infrastructure Engineering, Application Operations, Change Management	View ↗
OPS-005-R005	Maintenance Validation The organization shall validate that maintenance activities have been completed...	OPS-005 System Maintenance Management	IT Operations, Infrastructure Engineering, Application Operations, Change Management	View ↗
OPS-005-R006	Maintenance Documentation The organization shall maintain comprehensive documentation of maintenance activ...	OPS-005 System Maintenance Management	IT Operations, Infrastructure Engineering, Application Operations, Change Management	View ↗
OPS-005-R007	Maintenance Reporting The organization shall report on maintenance activities, providing visibility in...	OPS-005 System Maintenance Management	IT Operations, Infrastructure Engineering, Application Operations, Change Management	View ↗
OPS-005-R008	Maintenance Review The organization shall conduct periodic reviews of maintenance activities to ens...	OPS-005 System Maintenance Management	IT Operations, Infrastructure Engineering, Application Operations, Change Management	View ↗
OPS-005-R009	Maintenance Exception Management The organization shall manage exceptions to maintenance requirements and schedul...	OPS-005 System Maintenance Management	IT Operations, Infrastructure Engineering, Application Operations, Change Management	View ↗
OPS-005-R010	Continuous Improvement The organization shall establish a continuous improvement process for maintenanc...	OPS-005 System Maintenance Management	IT Operations, Infrastructure Engineering, Application Operations, Change Management	View ↗
OPS-006-R001	Technology Lifecycle Framework The organization shall establish a technology lifecycle management framework tha...	OPS-006 End-of-Life & Technology Lifec...	IT Asset Management, IT Operations, Enterprise Architecture, Security Architecture	View ↗
OPS-006-R002	Technology Inventory Review The organization shall regularly review the technology inventory to identify ass...	OPS-006 End-of-Life & Technology Lifec...	IT Asset Management, IT Operations, Enterprise Architecture, Security Architecture	View ↗
OPS-006-R003	End-of-Life Identification The organization shall identify technology assets that have reached or are appro...	OPS-006 End-of-Life & Technology Lifec...	IT Asset Management, IT Operations, Enterprise Architecture, Security Architecture	View ↗
OPS-006-R004	Risk Assessment The organization shall conduct risk assessments for technology assets approachin...	OPS-006 End-of-Life & Technology Lifec...	IT Asset Management, IT Operations, Enterprise Architecture, Security Architecture	View ↗
OPS-006-R005	Technology Replacement Planning The organization shall develop plans for replacing technology assets that have r...	OPS-006 End-of-Life & Technology Lifec...	IT Asset Management, IT Operations, Enterprise Architecture, Security Architecture	View ↗
OPS-006-R006	Compensating Controls The organization shall implement compensating controls for technology assets tha...	OPS-006 End-of-Life & Technology Lifec...	IT Asset Management, IT Operations, Enterprise Architecture, Security Architecture	View ↗
OPS-006-R007	Lifecycle Monitoring The organization shall monitor technology lifecycle management to ensure assets...	OPS-006 End-of-Life & Technology Lifec...	IT Asset Management, IT Operations, Enterprise Architecture, Security Architecture	View ↗
OPS-006-R008	Lifecycle Reporting The organization shall report on technology lifecycle management, providing visi...	OPS-006 End-of-Life & Technology Lifec...	IT Asset Management, IT Operations, Enterprise Architecture, Security Architecture	View ↗
OPS-006-R009	Lifecycle Review The organization shall conduct periodic reviews of technology lifecycle manageme...	OPS-006 End-of-Life & Technology Lifec...	IT Asset Management, IT Operations, Enterprise Architecture, Security Architecture	View ↗
OPS-006-R010	Continuous Improvement The organization shall establish a continuous improvement process for technology...	OPS-006 End-of-Life & Technology Lifec...	IT Asset Management, IT Operations, Enterprise Architecture, Security Architecture	View ↗
OPS-007-R001	Batch Processing Framework The organization shall establish a batch processing and job management framework...	OPS-007 Batch Processing & Job Managem...	IT Operations, Application Operations, Job Scheduling Team, Data Operations	View ↗
OPS-007-R002	Job Scheduling The organization shall schedule batch jobs, ensuring jobs are scheduled appropri...	OPS-007 Batch Processing & Job Managem...	IT Operations, Application Operations, Job Scheduling Team, Data Operations	View ↗
OPS-007-R003	Job Authorization The organization shall authorize batch jobs, ensuring jobs are approved before e...	OPS-007 Batch Processing & Job Managem...	IT Operations, Application Operations, Job Scheduling Team, Data Operations	View ↗
OPS-007-R004	Job Execution Monitoring The organization shall monitor batch job execution, ensuring jobs complete succe...	OPS-007 Batch Processing & Job Managem...	IT Operations, Application Operations, Job Scheduling Team, Data Operations	View ↗
OPS-007-R005	Batch Failure Management The organization shall manage batch job failures, including the detection, inves...	OPS-007 Batch Processing & Job Managem...	IT Operations, Application Operations, Job Scheduling Team, Data Operations	View ↗
OPS-007-R006	Batch Logging The organization shall maintain comprehensive logs of batch processing activitie...	OPS-007 Batch Processing & Job Managem...	IT Operations, Application Operations, Job Scheduling Team, Data Operations	View ↗
OPS-007-R007	Batch Reporting The organization shall report on batch processing, providing visibility into job...	OPS-007 Batch Processing & Job Managem...	IT Operations, Application Operations, Job Scheduling Team, Data Operations	View ↗
OPS-007-R008	Batch Review The organization shall conduct periodic reviews of batch processing activities t...	OPS-007 Batch Processing & Job Managem...	IT Operations, Application Operations, Job Scheduling Team, Data Operations	View ↗
OPS-007-R009	Batch Recovery The organization shall recover from batch job failures, ensuring failed jobs can...	OPS-007 Batch Processing & Job Managem...	IT Operations, Application Operations, Job Scheduling Team, Data Operations	View ↗
OPS-007-R010	Continuous Improvement The organization shall establish a continuous improvement process for batch proc...	OPS-007 Batch Processing & Job Managem...	IT Operations, Application Operations, Job Scheduling Team, Data Operations	View ↗
INC-001-R001	Incident Response Governance The organization shall establish governance structures for the incident response...	INC-001 Incident Response Program	CISO, Incident Response Manager, Security Governance, Executive Management	View ↗
INC-001-R002	Incident Response Policy The organization shall establish an incident response policy that defines the re...	INC-001 Incident Response Program	CISO, Incident Response Manager, Security Governance, Executive Management	View ↗
INC-001-R003	Incident Response Plan The organization shall develop a comprehensive incident response plan that defin...	INC-001 Incident Response Program	CISO, Incident Response Manager, Security Governance, Executive Management	View ↗
INC-001-R004	Roles & Responsibilities The organization shall clearly define and document the roles and responsibilitie...	INC-001 Incident Response Program	CISO, Incident Response Manager, Security Governance, Executive Management	View ↗
INC-001-R005	Incident Classification The organization shall establish an incident classification schema that enables...	INC-001 Incident Response Program	CISO, Incident Response Manager, Security Governance, Executive Management	View ↗
INC-001-R006	Program Governance The organization shall establish governance processes for the incident response...	INC-001 Incident Response Program	CISO, Incident Response Manager, Security Governance, Executive Management	View ↗
INC-001-R007	Executive Reporting The organization shall provide executive leadership and the board with regular r...	INC-001 Incident Response Program	CISO, Incident Response Manager, Security Governance, Executive Management	View ↗
INC-001-R008	Program Review The organization shall conduct periodic reviews of the incident response program...	INC-001 Incident Response Program	CISO, Incident Response Manager, Security Governance, Executive Management	View ↗
INC-001-R009	Program Metrics The organization shall define and track key metrics for the incident response pr...	INC-001 Incident Response Program	CISO, Incident Response Manager, Security Governance, Executive Management	View ↗
INC-001-R010	Continuous Improvement The organization shall establish a continuous improvement process for the incide...	INC-001 Incident Response Program	CISO, Incident Response Manager, Security Governance, Executive Management	View ↗
INC-002-R001	Preparedness Framework The organization shall establish an incident response preparedness framework tha...	INC-002 Incident Response Preparedness	Incident Response Manager, Security Operations, IT Operations, Business Continuity	View ↗
INC-002-R002	Incident Response Team The organization shall establish a qualified incident response team with the ski...	INC-002 Incident Response Preparedness	Incident Response Manager, Security Operations, IT Operations, Business Continuity	View ↗
INC-002-R003	Incident Playbooks The organization shall develop and maintain incident playbooks that provide deta...	INC-002 Incident Response Preparedness	Incident Response Manager, Security Operations, IT Operations, Business Continuity	View ↗
INC-002-R004	Response Technologies The organization shall implement and maintain response technologies that enable...	INC-002 Incident Response Preparedness	Incident Response Manager, Security Operations, IT Operations, Business Continuity	View ↗
INC-002-R005	Communication Readiness The organization shall establish communication readiness capabilities to ensure...	INC-002 Incident Response Preparedness	Incident Response Manager, Security Operations, IT Operations, Business Continuity	View ↗
INC-002-R006	Tabletop Exercises The organization shall conduct regular tabletop exercises to test incident respo...	INC-002 Incident Response Preparedness	Incident Response Manager, Security Operations, IT Operations, Business Continuity	View ↗
INC-002-R007	Technical Simulations The organization shall conduct regular technical simulations to test incident re...	INC-002 Incident Response Preparedness	Incident Response Manager, Security Operations, IT Operations, Business Continuity	View ↗
INC-002-R008	Readiness Assessment The organization shall conduct readiness assessments to evaluate the organizatio...	INC-002 Incident Response Preparedness	Incident Response Manager, Security Operations, IT Operations, Business Continuity	View ↗
INC-002-R009	Preparedness Reporting The organization shall report on incident response preparedness, providing visib...	INC-002 Incident Response Preparedness	Incident Response Manager, Security Operations, IT Operations, Business Continuity	View ↗
INC-002-R010	Continuous Improvement The organization shall establish a continuous improvement process for incident r...	INC-002 Incident Response Preparedness	Incident Response Manager, Security Operations, IT Operations, Business Continuity	View ↗
INC-003-R001	Detection Framework The organization shall establish an incident detection framework that defines th...	INC-003 Incident Detection, Analysis &...	Security Operations, SOC, Incident Response Team, Threat Detection	View ↗
INC-003-R002	Incident Identification The organization shall identify potential security incidents through monitoring,...	INC-003 Incident Detection, Analysis &...	Security Operations, SOC, Incident Response Team, Threat Detection	View ↗
INC-003-R003	Incident Triage The organization shall triage potential security incidents to determine their va...	INC-003 Incident Detection, Analysis &...	Security Operations, SOC, Incident Response Team, Threat Detection	View ↗
INC-003-R004	Incident Classification The organization shall classify incidents according to the established incident...	INC-003 Incident Detection, Analysis &...	Security Operations, SOC, Incident Response Team, Threat Detection	View ↗
INC-003-R005	Incident Analysis The organization shall conduct analysis of security incidents to determine their...	INC-003 Incident Detection, Analysis &...	Security Operations, SOC, Incident Response Team, Threat Detection	View ↗
INC-003-R006	Incident Escalation The organization shall establish escalation processes for security incidents tha...	INC-003 Incident Detection, Analysis &...	Security Operations, SOC, Incident Response Team, Threat Detection	View ↗
INC-003-R007	Incident Documentation The organization shall maintain comprehensive documentation of incident detectio...	INC-003 Incident Detection, Analysis &...	Security Operations, SOC, Incident Response Team, Threat Detection	View ↗
INC-003-R008	Incident Reporting The organization shall report on security incidents, providing visibility into i...	INC-003 Incident Detection, Analysis &...	Security Operations, SOC, Incident Response Team, Threat Detection	View ↗
INC-003-R009	Detection Review The organization shall conduct periodic reviews of incident detection, analysis,...	INC-003 Incident Detection, Analysis &...	Security Operations, SOC, Incident Response Team, Threat Detection	View ↗
INC-003-R010	Continuous Improvement The organization shall establish a continuous improvement process for incident d...	INC-003 Incident Detection, Analysis &...	Security Operations, SOC, Incident Response Team, Threat Detection	View ↗
INC-004-R001	Containment Strategy The organization shall establish containment strategies that define the approach...	INC-004 Incident Containment, Eradicat...	Incident Response Team, IT Operations, Security Operations, System Owners	View ↗
INC-004-R002	Short-Term Containment The organization shall establish processes for short-term containment of securit...	INC-004 Incident Containment, Eradicat...	Incident Response Team, IT Operations, Security Operations, System Owners	View ↗
INC-004-R003	Long-Term Containment The organization shall establish processes for long-term containment of security...	INC-004 Incident Containment, Eradicat...	Incident Response Team, IT Operations, Security Operations, System Owners	View ↗
INC-004-R004	Threat Eradication The organization shall establish processes for eradicating threats from affected...	INC-004 Incident Containment, Eradicat...	Incident Response Team, IT Operations, Security Operations, System Owners	View ↗
INC-004-R005	System Recovery The organization shall establish processes for recovering systems and data affec...	INC-004 Incident Containment, Eradicat...	Incident Response Team, IT Operations, Security Operations, System Owners	View ↗
INC-004-R006	Recovery Validation The organization shall validate that recovery has been completed successfully an...	INC-004 Incident Containment, Eradicat...	Incident Response Team, IT Operations, Security Operations, System Owners	View ↗
INC-004-R007	Recovery Monitoring The organization shall monitor recovered systems to ensure they remain secure an...	INC-004 Incident Containment, Eradicat...	Incident Response Team, IT Operations, Security Operations, System Owners	View ↗
INC-004-R008	Recovery Reporting The organization shall report on containment, eradication, and recovery activiti...	INC-004 Incident Containment, Eradicat...	Incident Response Team, IT Operations, Security Operations, System Owners	View ↗
INC-004-R009	Recovery Review The organization shall conduct periodic reviews of containment, eradication, and...	INC-004 Incident Containment, Eradicat...	Incident Response Team, IT Operations, Security Operations, System Owners	View ↗
INC-004-R010	Continuous Improvement The organization shall establish a continuous improvement process for containmen...	INC-004 Incident Containment, Eradicat...	Incident Response Team, IT Operations, Security Operations, System Owners	View ↗
INC-005-R001	Post-Incident Review Framework The organization shall establish a post-incident review framework that defines t...	INC-005 Post-Incident Review & Continu...	Incident Response Manager, CISO, Risk Management, Process Owners	View ↗
INC-005-R002	Root Cause Analysis The organization shall conduct root cause analysis for significant security inci...	INC-005 Post-Incident Review & Continu...	Incident Response Manager, CISO, Risk Management, Process Owners	View ↗
INC-005-R003	Lessons Learned The organization shall capture and document lessons learned from security incide...	INC-005 Post-Incident Review & Continu...	Incident Response Manager, CISO, Risk Management, Process Owners	View ↗
INC-005-R004	Corrective Actions The organization shall identify and implement corrective actions to address issu...	INC-005 Post-Incident Review & Continu...	Incident Response Manager, CISO, Risk Management, Process Owners	View ↗
INC-005-R005	Preventive Actions The organization shall identify and implement preventive actions to reduce the l...	INC-005 Post-Incident Review & Continu...	Incident Response Manager, CISO, Risk Management, Process Owners	View ↗
INC-005-R006	Improvement Tracking The organization shall track post-incident improvement actions to ensure correct...	INC-005 Post-Incident Review & Continu...	Incident Response Manager, CISO, Risk Management, Process Owners	View ↗
INC-005-R007	Metrics Analysis The organization shall analyze incident metrics to identify trends, patterns, an...	INC-005 Post-Incident Review & Continu...	Incident Response Manager, CISO, Risk Management, Process Owners	View ↗
INC-005-R008	Executive Reporting The organization shall provide executive leadership and the board with regular r...	INC-005 Post-Incident Review & Continu...	Incident Response Manager, CISO, Risk Management, Process Owners	View ↗
INC-005-R009	Review Governance The organization shall establish governance processes for post-incident reviews...	INC-005 Post-Incident Review & Continu...	Incident Response Manager, CISO, Risk Management, Process Owners	View ↗
INC-005-R010	Continuous Improvement The organization shall establish a continuous improvement process for incident r...	INC-005 Post-Incident Review & Continu...	Incident Response Manager, CISO, Risk Management, Process Owners	View ↗
INC-006-R001	Crisis Communication Framework The organization shall establish a crisis communication framework that defines t...	INC-006 Crisis Communication Managemen...	Crisis Management, Communications, CISO, Legal, Executive Management	View ↗
INC-006-R002	Internal Communication The organization shall establish processes for internal communication during sec...	INC-006 Crisis Communication Managemen...	Crisis Management, Communications, CISO, Legal, Executive Management	View ↗
INC-006-R003	External Communication The organization shall establish processes for external communication during sec...	INC-006 Crisis Communication Managemen...	Crisis Management, Communications, CISO, Legal, Executive Management	View ↗
INC-006-R004	Media Management The organization shall establish processes for managing media inquiries and comm...	INC-006 Crisis Communication Managemen...	Crisis Management, Communications, CISO, Legal, Executive Management	View ↗
INC-006-R005	Executive Communication The organization shall establish processes for communicating with executive lead...	INC-006 Crisis Communication Managemen...	Crisis Management, Communications, CISO, Legal, Executive Management	View ↗
INC-006-R006	Stakeholder Communication The organization shall establish processes for communicating with key stakeholde...	INC-006 Crisis Communication Managemen...	Crisis Management, Communications, CISO, Legal, Executive Management	View ↗
INC-006-R007	Communication Approval The organization shall establish processes for approving communications during s...	INC-006 Crisis Communication Managemen...	Crisis Management, Communications, CISO, Legal, Executive Management	View ↗
INC-006-R008	Communication Monitoring The organization shall monitor communications during security incidents to ensur...	INC-006 Crisis Communication Managemen...	Crisis Management, Communications, CISO, Legal, Executive Management	View ↗
INC-006-R009	Communication Review The organization shall conduct periodic reviews of crisis communication activiti...	INC-006 Crisis Communication Managemen...	Crisis Management, Communications, CISO, Legal, Executive Management	View ↗
INC-006-R010	Continuous Improvement The organization shall establish a continuous improvement process for crisis com...	INC-006 Crisis Communication Managemen...	Crisis Management, Communications, CISO, Legal, Executive Management	View ↗
INC-007-R001	Notification Framework The organization shall establish a regulatory and external incident notification...	INC-007 Regulatory & External Incident...	Compliance, Legal, CISO, Incident Response, Privacy, Regulatory Affairs	View ↗
INC-007-R002	Regulatory Assessment The organization shall conduct regulatory assessments for security incidents to...	INC-007 Regulatory & External Incident...	Compliance, Legal, CISO, Incident Response, Privacy, Regulatory Affairs	View ↗
INC-007-R003	Notification Approval The organization shall approve regulatory and external notifications, ensuring n...	INC-007 Regulatory & External Incident...	Compliance, Legal, CISO, Incident Response, Privacy, Regulatory Affairs	View ↗
INC-007-R004	Regulatory Reporting The organization shall submit regulatory notifications and reports in accordance...	INC-007 Regulatory & External Incident...	Compliance, Legal, CISO, Incident Response, Privacy, Regulatory Affairs	View ↗
INC-007-R005	Customer Notification The organization shall notify customers affected by security incidents in accord...	INC-007 Regulatory & External Incident...	Compliance, Legal, CISO, Incident Response, Privacy, Regulatory Affairs	View ↗
INC-007-R006	Third-Party Notification The organization shall notify third parties affected by security incidents, incl...	INC-007 Regulatory & External Incident...	Compliance, Legal, CISO, Incident Response, Privacy, Regulatory Affairs	View ↗
INC-007-R007	Law Enforcement Coordination The organization shall coordinate with law enforcement and other authorities dur...	INC-007 Regulatory & External Incident...	Compliance, Legal, CISO, Incident Response, Privacy, Regulatory Affairs	View ↗
INC-007-R008	Notification Documentation The organization shall maintain comprehensive documentation of regulatory and ex...	INC-007 Regulatory & External Incident...	Compliance, Legal, CISO, Incident Response, Privacy, Regulatory Affairs	View ↗
INC-007-R009	Notification Review The organization shall conduct periodic reviews of regulatory and external notif...	INC-007 Regulatory & External Incident...	Compliance, Legal, CISO, Incident Response, Privacy, Regulatory Affairs	View ↗
INC-007-R010	Continuous Improvement The organization shall establish a continuous improvement process for regulatory...	INC-007 Regulatory & External Incident...	Compliance, Legal, CISO, Incident Response, Privacy, Regulatory Affairs	View ↗
TPR-001-R001	TPRM Governance Framework The organization shall establish a Third-Party Risk Management governance framew...	TPR-001 Third-Party Risk Management Pr...	Third-Party Risk Management, Procurement, Risk Management, CISO	View ↗
TPR-001-R002	Program Scope The organization shall define a documented scope for the TPRM program that ident...	TPR-001 Third-Party Risk Management Pr...	Third-Party Risk Management, Procurement, Risk Management, CISO	View ↗
TPR-001-R003	Third-Party Classification The organization shall establish a classification schema for third-party relatio...	TPR-001 Third-Party Risk Management Pr...	Third-Party Risk Management, Procurement, Risk Management, CISO	View ↗
TPR-001-R004	Roles & Responsibilities The organization shall clearly define and document the roles and responsibilitie...	TPR-001 Third-Party Risk Management Pr...	Third-Party Risk Management, Procurement, Risk Management, CISO	View ↗
TPR-001-R005	Risk Governance The organization shall establish governance processes for third-party risk manag...	TPR-001 Third-Party Risk Management Pr...	Third-Party Risk Management, Procurement, Risk Management, CISO	View ↗
TPR-001-R006	Program Metrics The organization shall define and track key metrics for the TPRM program that pr...	TPR-001 Third-Party Risk Management Pr...	Third-Party Risk Management, Procurement, Risk Management, CISO	View ↗
TPR-001-R007	Executive Reporting The organization shall provide executive leadership and the board with regular r...	TPR-001 Third-Party Risk Management Pr...	Third-Party Risk Management, Procurement, Risk Management, CISO	View ↗
TPR-001-R008	Program Review The organization shall conduct periodic reviews of the TPRM program to assess it...	TPR-001 Third-Party Risk Management Pr...	Third-Party Risk Management, Procurement, Risk Management, CISO	View ↗
TPR-001-R009	Program Compliance The organization shall ensure the TPRM program complies with applicable legal, r...	TPR-001 Third-Party Risk Management Pr...	Third-Party Risk Management, Procurement, Risk Management, CISO	View ↗
TPR-001-R010	Continuous Improvement The organization shall establish a continuous improvement process for the TPRM p...	TPR-001 Third-Party Risk Management Pr...	Third-Party Risk Management, Procurement, Risk Management, CISO	View ↗
TPR-002-R001	Due Diligence Framework The organization shall establish a due diligence framework that defines the stru...	TPR-002 Third-Party Risk Assessment &...	Third-Party Risk Management, Information Security, Privacy, Finance, Compliance	View ↗
TPR-002-R002	Vendor Risk Assessment The organization shall conduct comprehensive risk assessments of third-party ven...	TPR-002 Third-Party Risk Assessment &...	Third-Party Risk Management, Information Security, Privacy, Finance, Compliance	View ↗
TPR-002-R003	Security Assessment The organization shall conduct security assessments of third-party vendors to ev...	TPR-002 Third-Party Risk Assessment &...	Third-Party Risk Management, Information Security, Privacy, Finance, Compliance	View ↗
TPR-002-R004	Privacy Assessment The organization shall conduct privacy assessments of third-party vendors to eva...	TPR-002 Third-Party Risk Assessment &...	Third-Party Risk Management, Information Security, Privacy, Finance, Compliance	View ↗
TPR-002-R005	Financial Assessment The organization shall conduct financial assessments of third-party vendors to e...	TPR-002 Third-Party Risk Assessment &...	Third-Party Risk Management, Information Security, Privacy, Finance, Compliance	View ↗
TPR-002-R006	Risk Scoring The organization shall apply risk scoring methodologies to quantify and prioriti...	TPR-002 Third-Party Risk Assessment &...	Third-Party Risk Management, Information Security, Privacy, Finance, Compliance	View ↗
TPR-002-R007	Risk Acceptance The organization shall accept third-party risks that exceed defined thresholds,...	TPR-002 Third-Party Risk Assessment &...	Third-Party Risk Management, Information Security, Privacy, Finance, Compliance	View ↗
TPR-002-R008	Assessment Reporting The organization shall report on third-party risk assessments, providing visibil...	TPR-002 Third-Party Risk Assessment &...	Third-Party Risk Management, Information Security, Privacy, Finance, Compliance	View ↗
TPR-002-R009	Assessment Review The organization shall conduct periodic reviews of third-party risk assessment a...	TPR-002 Third-Party Risk Assessment &...	Third-Party Risk Management, Information Security, Privacy, Finance, Compliance	View ↗
TPR-002-R010	Continuous Improvement The organization shall establish a continuous improvement process for third-part...	TPR-002 Third-Party Risk Assessment &...	Third-Party Risk Management, Information Security, Privacy, Finance, Compliance	View ↗
TPR-003-R001	Contract Requirements The organization shall establish contract requirements for third-party relations...	TPR-003 Third-Party Contract & Complia...	Procurement, Legal, Third-Party Risk Management, Compliance, Information Security	View ↗
TPR-003-R002	Security Clauses The organization shall include security clauses in third-party contracts that de...	TPR-003 Third-Party Contract & Complia...	Procurement, Legal, Third-Party Risk Management, Compliance, Information Security	View ↗
TPR-003-R003	Privacy Clauses The organization shall include privacy clauses in third-party contracts that def...	TPR-003 Third-Party Contract & Complia...	Procurement, Legal, Third-Party Risk Management, Compliance, Information Security	View ↗
TPR-003-R004	Audit Rights The organization shall include audit rights clauses in third-party contracts tha...	TPR-003 Third-Party Contract & Complia...	Procurement, Legal, Third-Party Risk Management, Compliance, Information Security	View ↗
TPR-003-R005	Regulatory Obligations The organization shall include regulatory compliance clauses in third-party cont...	TPR-003 Third-Party Contract & Complia...	Procurement, Legal, Third-Party Risk Management, Compliance, Information Security	View ↗
TPR-003-R006	SLA Management The organization shall establish and manage Service Level Agreements with third-...	TPR-003 Third-Party Contract & Complia...	Procurement, Legal, Third-Party Risk Management, Compliance, Information Security	View ↗
TPR-003-R007	Compliance Verification The organization shall verify third-party compliance with contractual obligation...	TPR-003 Third-Party Contract & Complia...	Procurement, Legal, Third-Party Risk Management, Compliance, Information Security	View ↗
TPR-003-R008	Contract Review The organization shall conduct periodic reviews of third-party contracts to ensu...	TPR-003 Third-Party Contract & Complia...	Procurement, Legal, Third-Party Risk Management, Compliance, Information Security	View ↗
TPR-003-R009	Contract Maintenance The organization shall maintain third-party contracts, including amendments, ren...	TPR-003 Third-Party Contract & Complia...	Procurement, Legal, Third-Party Risk Management, Compliance, Information Security	View ↗
TPR-003-R010	Continuous Improvement The organization shall establish a continuous improvement process for contract a...	TPR-003 Third-Party Contract & Complia...	Procurement, Legal, Third-Party Risk Management, Compliance, Information Security	View ↗
TPR-004-R001	Monitoring Framework The organization shall establish a third-party continuous monitoring framework t...	TPR-004 Third-Party Continuous Monitor...	Third-Party Risk Management, Security Operations, Procurement, Service Management	View ↗
TPR-004-R002	Continuous Risk Monitoring The organization shall continuously monitor third-party risks, including securit...	TPR-004 Third-Party Continuous Monitor...	Third-Party Risk Management, Security Operations, Procurement, Service Management	View ↗
TPR-004-R003	Security Performance Monitoring The organization shall monitor third-party security performance, including secur...	TPR-004 Third-Party Continuous Monitor...	Third-Party Risk Management, Security Operations, Procurement, Service Management	View ↗
TPR-004-R004	Incident Coordination The organization shall coordinate security incidents involving third-party vendo...	TPR-004 Third-Party Continuous Monitor...	Third-Party Risk Management, Security Operations, Procurement, Service Management	View ↗
TPR-004-R005	Fourth-Party Oversight The organization shall oversee fourth-party relationships, including subcontract...	TPR-004 Third-Party Continuous Monitor...	Third-Party Risk Management, Security Operations, Procurement, Service Management	View ↗
TPR-004-R006	Compliance Monitoring The organization shall monitor third-party compliance with legal, regulatory, an...	TPR-004 Third-Party Continuous Monitor...	Third-Party Risk Management, Security Operations, Procurement, Service Management	View ↗
TPR-004-R007	Performance Reporting The organization shall report on third-party performance monitoring, providing v...	TPR-004 Third-Party Continuous Monitor...	Third-Party Risk Management, Security Operations, Procurement, Service Management	View ↗
TPR-004-R008	Assurance Reviews The organization shall conduct periodic assurance reviews of third-party risk ma...	TPR-004 Third-Party Continuous Monitor...	Third-Party Risk Management, Security Operations, Procurement, Service Management	View ↗
TPR-004-R009	Monitoring Review The organization shall conduct periodic reviews of third-party monitoring activi...	TPR-004 Third-Party Continuous Monitor...	Third-Party Risk Management, Security Operations, Procurement, Service Management	View ↗
TPR-004-R010	Continuous Improvement The organization shall establish a continuous improvement process for third-part...	TPR-004 Third-Party Continuous Monitor...	Third-Party Risk Management, Security Operations, Procurement, Service Management	View ↗
TPR-005-R001	Vendor Onboarding The organization shall onboard third-party vendors and service providers, ensuri...	TPR-005 Third-Party Lifecycle & Offboa...	Third-Party Risk Management, Procurement, Legal, IT Operations, Information Security	View ↗
TPR-005-R002	Relationship Management The organization shall manage third-party relationships throughout the lifecycle...	TPR-005 Third-Party Lifecycle & Offboa...	Third-Party Risk Management, Procurement, Legal, IT Operations, Information Security	View ↗
TPR-005-R003	Change Management The organization shall manage changes in third-party relationships, including ch...	TPR-005 Third-Party Lifecycle & Offboa...	Third-Party Risk Management, Procurement, Legal, IT Operations, Information Security	View ↗
TPR-005-R004	Contract Renewal The organization shall manage third-party contract renewals, ensuring contracts...	TPR-005 Third-Party Lifecycle & Offboa...	Third-Party Risk Management, Procurement, Legal, IT Operations, Information Security	View ↗
TPR-005-R005	Vendor Termination The organization shall terminate third-party relationships, ensuring termination...	TPR-005 Third-Party Lifecycle & Offboa...	Third-Party Risk Management, Procurement, Legal, IT Operations, Information Security	View ↗
TPR-005-R006	Data Return The organization shall return organizational data by third parties at the end of...	TPR-005 Third-Party Lifecycle & Offboa...	Third-Party Risk Management, Procurement, Legal, IT Operations, Information Security	View ↗
TPR-005-R007	Data Destruction The organization shall ensure the destruction of organizational data by third pa...	TPR-005 Third-Party Lifecycle & Offboa...	Third-Party Risk Management, Procurement, Legal, IT Operations, Information Security	View ↗
TPR-005-R008	Access Revocation The organization shall revoke third-party access to organizational systems, faci...	TPR-005 Third-Party Lifecycle & Offboa...	Third-Party Risk Management, Procurement, Legal, IT Operations, Information Security	View ↗
TPR-005-R009	Offboarding Verification The organization shall verify that all offboarding activities have been complete...	TPR-005 Third-Party Lifecycle & Offboa...	Third-Party Risk Management, Procurement, Legal, IT Operations, Information Security	View ↗
TPR-005-R010	Continuous Improvement The organization shall establish a continuous improvement process for third-part...	TPR-005 Third-Party Lifecycle & Offboa...	Third-Party Risk Management, Procurement, Legal, IT Operations, Information Security	View ↗
TPR-006-R001	Concentration Risk Framework The organization shall establish a third-party concentration risk framework that...	TPR-006 Third-Party Concentration Risk...	Third-Party Risk Management, Enterprise Risk, Procurement, Operational Resilience	View ↗
TPR-006-R002	Critical Dependency Identification The organization shall identify critical dependencies on third-party vendors, in...	TPR-006 Third-Party Concentration Risk...	Third-Party Risk Management, Enterprise Risk, Procurement, Operational Resilience	View ↗
TPR-006-R003	Concentration Assessment The organization shall conduct concentration assessments to evaluate the level o...	TPR-006 Third-Party Concentration Risk...	Third-Party Risk Management, Enterprise Risk, Procurement, Operational Resilience	View ↗
TPR-006-R004	Geographic Concentration The organization shall assess geographic concentration risks, including the conc...	TPR-006 Third-Party Concentration Risk...	Third-Party Risk Management, Enterprise Risk, Procurement, Operational Resilience	View ↗
TPR-006-R005	Technology Concentration The organization shall assess technology concentration risks, including the conc...	TPR-006 Third-Party Concentration Risk...	Third-Party Risk Management, Enterprise Risk, Procurement, Operational Resilience	View ↗
TPR-006-R006	Mitigation Planning The organization shall develop mitigation plans for identified concentration ris...	TPR-006 Third-Party Concentration Risk...	Third-Party Risk Management, Enterprise Risk, Procurement, Operational Resilience	View ↗
TPR-006-R007	Concentration Monitoring The organization shall monitor concentration risks to ensure risks are tracked a...	TPR-006 Third-Party Concentration Risk...	Third-Party Risk Management, Enterprise Risk, Procurement, Operational Resilience	View ↗
TPR-006-R008	Concentration Reporting The organization shall report on concentration risk, providing visibility into c...	TPR-006 Third-Party Concentration Risk...	Third-Party Risk Management, Enterprise Risk, Procurement, Operational Resilience	View ↗
TPR-006-R009	Periodic Review The organization shall conduct periodic reviews of concentration risk management...	TPR-006 Third-Party Concentration Risk...	Third-Party Risk Management, Enterprise Risk, Procurement, Operational Resilience	View ↗
TPR-006-R010	Continuous Improvement The organization shall establish a continuous improvement process for third-part...	TPR-006 Third-Party Concentration Risk...	Third-Party Risk Management, Enterprise Risk, Procurement, Operational Resilience	View ↗
AIG-001-R001	AI Governance Framework The organization shall establish an AI governance framework that defines the str...	AIG-001 AI Governance & Oversight	AI Governance Committee, Executive Leadership, CISO, Legal, Compliance, Risk, Ethics	View ↗
AIG-001-R002	AI Governance Committee The organization shall establish an AI governance committee with responsibility...	AIG-001 AI Governance & Oversight	AI Governance Committee, Executive Leadership, CISO, Legal, Compliance, Risk, Ethics	View ↗
AIG-001-R003	AI Policies The organization shall establish AI policies that define the requirements, princ...	AIG-001 AI Governance & Oversight	AI Governance Committee, Executive Leadership, CISO, Legal, Compliance, Risk, Ethics	View ↗
AIG-001-R004	AI Roles & Responsibilities The organization shall clearly define and document the roles and responsibilitie...	AIG-001 AI Governance & Oversight	AI Governance Committee, Executive Leadership, CISO, Legal, Compliance, Risk, Ethics	View ↗
AIG-001-R005	AI Decision Governance The organization shall establish governance processes for AI-related decisions,...	AIG-001 AI Governance & Oversight	AI Governance Committee, Executive Leadership, CISO, Legal, Compliance, Risk, Ethics	View ↗
AIG-001-R006	Executive Oversight The organization shall ensure executive leadership and the board provide active...	AIG-001 AI Governance & Oversight	AI Governance Committee, Executive Leadership, CISO, Legal, Compliance, Risk, Ethics	View ↗
AIG-001-R007	AI Compliance The organization shall ensure AI systems comply with applicable legal, regulator...	AIG-001 AI Governance & Oversight	AI Governance Committee, Executive Leadership, CISO, Legal, Compliance, Risk, Ethics	View ↗
AIG-001-R008	AI Reporting The organization shall report on AI governance, providing visibility into AI str...	AIG-001 AI Governance & Oversight	AI Governance Committee, Executive Leadership, CISO, Legal, Compliance, Risk, Ethics	View ↗
AIG-001-R009	AI Review The organization shall conduct periodic reviews of AI governance activities to e...	AIG-001 AI Governance & Oversight	AI Governance Committee, Executive Leadership, CISO, Legal, Compliance, Risk, Ethics	View ↗
AIG-001-R010	Continuous Improvement The organization shall establish a continuous improvement process for AI governa...	AIG-001 AI Governance & Oversight	AI Governance Committee, Executive Leadership, CISO, Legal, Compliance, Risk, Ethics	View ↗
AIG-002-R001	AI Risk Framework The organization shall establish an AI risk framework that defines the structure...	AIG-002 AI Risk & Impact Management	AI Risk Management, Enterprise Risk, Compliance, Privacy, AI Governance	View ↗
AIG-002-R002	AI Risk Assessment The organization shall conduct regular risk assessments of AI systems to identif...	AIG-002 AI Risk & Impact Management	AI Risk Management, Enterprise Risk, Compliance, Privacy, AI Governance	View ↗
AIG-002-R003	AI Impact Assessment The organization shall conduct impact assessments for AI systems to evaluate the...	AIG-002 AI Risk & Impact Management	AI Risk Management, Enterprise Risk, Compliance, Privacy, AI Governance	View ↗
AIG-002-R004	AI Risk Treatment The organization shall treat AI risks, including the implementation of controls,...	AIG-002 AI Risk & Impact Management	AI Risk Management, Enterprise Risk, Compliance, Privacy, AI Governance	View ↗
AIG-002-R005	AI Risk Acceptance The organization shall accept AI risks that exceed defined thresholds, ensuring...	AIG-002 AI Risk & Impact Management	AI Risk Management, Enterprise Risk, Compliance, Privacy, AI Governance	View ↗
AIG-002-R006	AI Risk Monitoring The organization shall monitor AI risks to ensure risks are tracked and changes...	AIG-002 AI Risk & Impact Management	AI Risk Management, Enterprise Risk, Compliance, Privacy, AI Governance	View ↗
AIG-002-R007	AI Risk Reporting The organization shall report on AI risk management, providing visibility into r...	AIG-002 AI Risk & Impact Management	AI Risk Management, Enterprise Risk, Compliance, Privacy, AI Governance	View ↗
AIG-002-R008	AI Risk Review The organization shall conduct periodic reviews of AI risk management activities...	AIG-002 AI Risk & Impact Management	AI Risk Management, Enterprise Risk, Compliance, Privacy, AI Governance	View ↗
AIG-002-R009	Regulatory Assessment The organization shall conduct regular assessments of AI regulatory requirements...	AIG-002 AI Risk & Impact Management	AI Risk Management, Enterprise Risk, Compliance, Privacy, AI Governance	View ↗
AIG-002-R010	Continuous Improvement The organization shall establish a continuous improvement process for AI risk an...	AIG-002 AI Risk & Impact Management	AI Risk Management, Enterprise Risk, Compliance, Privacy, AI Governance	View ↗
AIG-003-R001	AI Inventory The organization shall maintain a comprehensive inventory of all artificial inte...	AIG-003 AI Asset & Lifecycle Managemen...	AI Asset Management, AI Owners, Engineering, IT Operations, AI Governance	View ↗
AIG-003-R002	AI Asset Classification The organization shall establish a classification schema for AI assets that enab...	AIG-003 AI Asset & Lifecycle Managemen...	AI Asset Management, AI Owners, Engineering, IT Operations, AI Governance	View ↗
AIG-003-R003	AI Ownership The organization shall assign explicit ownership for each AI asset, defining the...	AIG-003 AI Asset & Lifecycle Managemen...	AI Asset Management, AI Owners, Engineering, IT Operations, AI Governance	View ↗
AIG-003-R004	AI Registration The organization shall register AI assets in the AI inventory, ensuring all requ...	AIG-003 AI Asset & Lifecycle Managemen...	AI Asset Management, AI Owners, Engineering, IT Operations, AI Governance	View ↗
AIG-003-R005	AI Version Management The organization shall manage versions of AI models and systems, ensuring change...	AIG-003 AI Asset & Lifecycle Managemen...	AI Asset Management, AI Owners, Engineering, IT Operations, AI Governance	View ↗
AIG-003-R006	AI Deployment The organization shall deploy AI models and systems in a controlled manner, ensu...	AIG-003 AI Asset & Lifecycle Managemen...	AI Asset Management, AI Owners, Engineering, IT Operations, AI Governance	View ↗
AIG-003-R007	AI Change Management The organization shall manage changes to AI models and systems, including change...	AIG-003 AI Asset & Lifecycle Managemen...	AI Asset Management, AI Owners, Engineering, IT Operations, AI Governance	View ↗
AIG-003-R008	AI Retirement The organization shall retire AI models and systems at the end of their useful l...	AIG-003 AI Asset & Lifecycle Managemen...	AI Asset Management, AI Owners, Engineering, IT Operations, AI Governance	View ↗
AIG-003-R009	Lifecycle Review The organization shall conduct periodic reviews of AI asset lifecycle management...	AIG-003 AI Asset & Lifecycle Managemen...	AI Asset Management, AI Owners, Engineering, IT Operations, AI Governance	View ↗
AIG-003-R010	Continuous Improvement The organization shall establish a continuous improvement process for AI asset a...	AIG-003 AI Asset & Lifecycle Managemen...	AI Asset Management, AI Owners, Engineering, IT Operations, AI Governance	View ↗
AIG-004-R001	Responsible AI Principles The organization shall define responsible AI principles that guide the developme...	AIG-004 Responsible AI Management	Responsible AI, Ethics, AI Governance, Legal, Privacy, Business Owners	View ↗
AIG-004-R002	Transparency The organization shall ensure transparency in the development, deployment, and o...	AIG-004 Responsible AI Management	Responsible AI, Ethics, AI Governance, Legal, Privacy, Business Owners	View ↗
AIG-004-R003	Explainability The organization shall ensure AI systems are explainable, enabling stakeholders...	AIG-004 Responsible AI Management	Responsible AI, Ethics, AI Governance, Legal, Privacy, Business Owners	View ↗
AIG-004-R004	Fairness The organization shall ensure fairness in AI systems, preventing discrimination...	AIG-004 Responsible AI Management	Responsible AI, Ethics, AI Governance, Legal, Privacy, Business Owners	View ↗
AIG-004-R005	Bias Management The organization shall identify, assess, and mitigate bias in AI systems, includ...	AIG-004 Responsible AI Management	Responsible AI, Ethics, AI Governance, Legal, Privacy, Business Owners	View ↗
AIG-004-R006	Human Oversight The organization shall ensure appropriate human oversight of AI systems, includi...	AIG-004 Responsible AI Management	Responsible AI, Ethics, AI Governance, Legal, Privacy, Business Owners	View ↗
AIG-004-R007	Ethical AI The organization shall ensure AI systems are developed and operated in accordanc...	AIG-004 Responsible AI Management	Responsible AI, Ethics, AI Governance, Legal, Privacy, Business Owners	View ↗
AIG-004-R008	Accountability The organization shall establish accountability for AI systems, including clear...	AIG-004 Responsible AI Management	Responsible AI, Ethics, AI Governance, Legal, Privacy, Business Owners	View ↗
AIG-004-R009	Responsible AI Review The organization shall conduct periodic reviews of responsible AI management act...	AIG-004 Responsible AI Management	Responsible AI, Ethics, AI Governance, Legal, Privacy, Business Owners	View ↗
AIG-004-R010	Continuous Improvement The organization shall establish a continuous improvement process for responsibl...	AIG-004 Responsible AI Management	Responsible AI, Ethics, AI Governance, Legal, Privacy, Business Owners	View ↗
AIG-005-R001	AI Security Framework The organization shall establish an AI security framework that defines the struc...	AIG-005 AI Security & Operational Resi...	AI Security, Security Operations, AI Engineering, Incident Response, CISO	View ↗
AIG-005-R002	Adversarial Attack Protection The organization shall implement protection measures against adversarial attacks...	AIG-005 AI Security & Operational Resi...	AI Security, Security Operations, AI Engineering, Incident Response, CISO	View ↗
AIG-005-R003	Prompt Injection Protection The organization shall implement protection measures against prompt injection at...	AIG-005 AI Security & Operational Resi...	AI Security, Security Operations, AI Engineering, Incident Response, CISO	View ↗
AIG-005-R004	Model Poisoning Protection The organization shall implement protection measures against model poisoning att...	AIG-005 AI Security & Operational Resi...	AI Security, Security Operations, AI Engineering, Incident Response, CISO	View ↗
AIG-005-R005	AI Access Security The organization shall implement access controls for AI systems, models, and dat...	AIG-005 AI Security & Operational Resi...	AI Security, Security Operations, AI Engineering, Incident Response, CISO	View ↗
AIG-005-R006	AI Monitoring The organization shall monitor AI systems to detect security threats, operationa...	AIG-005 AI Security & Operational Resi...	AI Security, Security Operations, AI Engineering, Incident Response, CISO	View ↗
AIG-005-R007	AI Incident Response The organization shall respond to AI-related security incidents, including the d...	AIG-005 AI Security & Operational Resi...	AI Security, Security Operations, AI Engineering, Incident Response, CISO	View ↗
AIG-005-R008	AI Resilience Testing The organization shall conduct resilience testing of AI systems to verify their...	AIG-005 AI Security & Operational Resi...	AI Security, Security Operations, AI Engineering, Incident Response, CISO	View ↗
AIG-005-R009	AI Security Review The organization shall conduct periodic reviews of AI security activities to ens...	AIG-005 AI Security & Operational Resi...	AI Security, Security Operations, AI Engineering, Incident Response, CISO	View ↗
AIG-005-R010	Continuous Improvement The organization shall establish a continuous improvement process for AI securit...	AIG-005 AI Security & Operational Resi...	AI Security, Security Operations, AI Engineering, Incident Response, CISO	View ↗
AIG-006-R001	Performance Metrics The organization shall define and track performance metrics for AI systems that...	AIG-006 AI Performance Monitoring & Co...	AI Engineering, Model Owners, Data Science, Business Owners, AI Governance	View ↗
AIG-006-R002	Drift Detection The organization shall detect performance drift in AI models, including data dri...	AIG-006 AI Performance Monitoring & Co...	AI Engineering, Model Owners, Data Science, Business Owners, AI Governance	View ↗
AIG-006-R003	Model Validation The organization shall validate AI models to ensure they perform as intended and...	AIG-006 AI Performance Monitoring & Co...	AI Engineering, Model Owners, Data Science, Business Owners, AI Governance	View ↗
AIG-006-R004	Accuracy Monitoring The organization shall monitor AI model accuracy to ensure models maintain requi...	AIG-006 AI Performance Monitoring & Co...	AI Engineering, Model Owners, Data Science, Business Owners, AI Governance	View ↗
AIG-006-R005	Reliability Monitoring The organization shall monitor AI model reliability to ensure models operate con...	AIG-006 AI Performance Monitoring & Co...	AI Engineering, Model Owners, Data Science, Business Owners, AI Governance	View ↗
AIG-006-R006	Business Value Assessment The organization shall assess AI business value to evaluate the contribution of...	AIG-006 AI Performance Monitoring & Co...	AI Engineering, Model Owners, Data Science, Business Owners, AI Governance	View ↗
AIG-006-R007	Performance Reporting The organization shall report on AI performance, providing visibility into model...	AIG-006 AI Performance Monitoring & Co...	AI Engineering, Model Owners, Data Science, Business Owners, AI Governance	View ↗
AIG-006-R008	Model Optimization The organization shall optimize AI models to improve performance, efficiency, an...	AIG-006 AI Performance Monitoring & Co...	AI Engineering, Model Owners, Data Science, Business Owners, AI Governance	View ↗
AIG-006-R009	Periodic Review The organization shall conduct periodic reviews of AI performance monitoring act...	AIG-006 AI Performance Monitoring & Co...	AI Engineering, Model Owners, Data Science, Business Owners, AI Governance	View ↗
AIG-006-R010	Continuous Improvement The organization shall establish a continuous improvement process for AI perform...	AIG-006 AI Performance Monitoring & Co...	AI Engineering, Model Owners, Data Science, Business Owners, AI Governance	View ↗

CERT-In Directions:2022