ISO/IEC 27701:2019 (ISO27701) - Universal Control Library

Framework Overview

ISO27701 · Full Framework Profile

Purpose & Objective

Extend privacy governance and management practices by establishing a Privacy Information Management System (PIMS) that supports the protection of personally identifiable information (PII). It helps organizations assign privacy responsibilities, manage processing risks and demonstrate structured privacy management.

Scope

Applies to organizations acting as PII controllers, PII processors or both, across relevant business processes, systems, personnel, vendors and data flows. The defined PIMS scope should identify processing activities, PII categories, jurisdictions, third parties and applicable contractual or legal privacy obligations.

Key Focus Areas

Structure & Domains

Certification & Assessment

Official Source

ISO27701 · Reference

Visit Official Source

Associated Compliance Domains

12 Mapped Domains in Framework

Click any domain to explore its controls, requirements, and implementation guidance.

Domain ID	Code	Domain Name	Business Owner	Controls	Status	Action
DOM-001	GOV	Governance	Board / CISO	8	Active	View Domain →
DOM-003	RSK	Risk Management	Chief Risk Officer	9	Active	View Domain →
DOM-006	IAM	Identity & Access Management	IAM Team	8	Active	View Domain →
DOM-008	DAT	Data Protection & Privacy	Data Protection Officer	16	Active	View Domain →
DOM-011	END	Endpoint Security	Endpoint Security	6	Active	View Domain →
DOM-012	CLD	Cloud Security	Cloud Security	10	Active	View Domain →
DOM-015	APP	Application Security	Application Security	12	Active	View Domain →
DOM-019	THR	Threat Intelligence & Threat Management	Threat Intelligence Team	4	Active	View Domain →
DOM-024	TPR	Third-Party & Supply Chain Security	Vendor Risk Management	6	Active	View Domain →
DOM-025	HRS	Human Resource Security	Human Resources	4	Active	View Domain →
DOM-026	SAT	Security Awareness & Training	Security Awareness Team	4	Active	View Domain →
DOM-027	AIG	AI Governance & Model Security	AI Governance Committee	6	Active	View Domain →

Associated Controls Catalog

35 Active Controls in Framework

Control ID	Control Name	Category & Type	Criticality	Status	Requirements	Action
GOV-001	Information Security Governance Establishes the foundational governance structures, accounta...	Administrative Detective	Critical	Active	📋 12 Reqs	View →
RSK-001	Risk Management Framework Establishes a comprehensive risk management framework with m...	Administrative Detective	Critical	Active	📋 10 Reqs	View →
RSK-002	Risk Register Establishes and maintains a centralized risk register docume...	Administrative Detective	High	Active	📋 10 Reqs	View →
IAM-001	Identity & Account Lifecycle Management Establishes comprehensive identity lifecycle management incl...	Administrative Preventive	High	Active	📋 12 Reqs	View →
DAT-001	Data Protection & Privacy Strategy Establishes enterprise data protection and privacy strategy...	Administrative Preventive	Critical	Active	📋 10 Reqs	View →
DAT-002	Data Discovery Establishes automated and manual processes to discover, iden...	Technical Detective	High	Active	📋 10 Reqs	View →
DAT-003	Data Classification & Handling Establishes a data classification framework with defined cat...	Administrative Preventive	High	Active	📋 10 Reqs	View →
DAT-004	Data Retention & Disposal Establishes data retention schedules, archival processes, di...	Technical Preventive	Critical	Active	📋 10 Reqs	View →
DAT-005	Data Ownership & Stewardship Establishes clear data ownership and stewardship assignments...	Technical Preventive	High	Active	📋 10 Reqs	View →
DAT-006	Data Flow Mapping, Inventory & Lineage Establishes comprehensive data flow mapping, data inventory,...	Administrative Preventive	High	Active	📋 10 Reqs	View →
DAT-007	Data Subject Rights Management Establishes processes for receiving, validating, fulfilling,...	Administrative Detective	High	Active	📋 10 Reqs	View →
DAT-008	Consent Management Establishes comprehensive consent management including colle...	Administrative Detective	High	Active	📋 10 Reqs	View →
DAT-009	Cross-Border Data Transfer Establishes governance for cross-border data transfers inclu...	Technical Detective	High	Active	📋 10 Reqs	View →
DAT-010	Privacy Notices Establishes processes for developing, publishing, maintainin...	Technical Preventive	High	Active	📋 10 Reqs	View →
DAT-011	Privacy by Design Establishes processes to integrate privacy requirements, con...	Technical Preventive	High	Active	📋 10 Reqs	View →
DAT-012	Data Protection Impact Assessment (DPIA) Establishes formal DPIA processes for scoping, assessing, do...	Technical Detective	Critical	Active	📋 10 Reqs	View →
DAT-013	Record of Processing Activities (ROPA) Establishes and maintains a complete, accurate Record of Pro...	Technical Preventive	High	Active	📋 10 Reqs	View →
DAT-014	Data Loss Prevention (DLP) Establishes Data Loss Prevention controls including policy d...	Technical Detective	Critical	Active	📋 10 Reqs	View →
DAT-015	Data Integrity Establishes data integrity controls including protection, va...	Technical Detective	Critical	Active	📋 10 Reqs	View →
DAT-016	Data Masking & Anonymization Establishes data masking and anonymization processes for pro...	Technical Detective	High	Active	📋 10 Reqs	View →
END-003	Mobile Device & Application Management Establishes mobile device and application management includi...	Technical Detective	High	Active	📋 10 Reqs	View →
CLD-001	Cloud Security Governance Establishes cloud security governance including framework, s...	Technical Detective	Critical	Active	📋 10 Reqs	View →
CLD-006	Cloud Data Protection Establishes cloud data protection including encryption, acce...	Technical Corrective	Critical	Active	📋 10 Reqs	View →
APP-003	Secure Software Development Lifecycle (SSDLC) Establishes SSDLC including security requirements, design re...	Administrative Detective	Critical	Active	📋 10 Reqs	View →
THR-003	Insider Threat Management Establishes insider threat management including risk identif...	Operational Corrective	High	Active	📋 10 Reqs	View →
TPR-002	Third-Party Risk Assessment & Due Diligence Establishes third-party due diligence including vendor risk...	Administrative Detective	Critical	Active	📋 10 Reqs	View →
TPR-003	Third-Party Contract & Compliance Management Establishes third-party contract management including contra...	Administrative Detective	High	Active	📋 10 Reqs	View →
HRS-001	Personnel Screening & Verification Establishes personnel screening including screening policy,...	Administrative Detective	High	Active	📋 10 Reqs	View →
HRS-002	Confidentiality & Employment Obligations Establishes confidentiality and employment obligations inclu...	Administrative Detective	High	Active	📋 10 Reqs	View →
HRS-003	Personnel Lifecycle Security Management Establishes personnel lifecycle security including recruitme...	Administrative Preventive	High	Active	📋 10 Reqs	View →
HRS-004	Employee Code of Conduct & Ethics Establishes code of conduct including ethical behavior, secu...	Administrative Detective	Medium	Active	📋 10 Reqs	View →
SAT-003	Role-Based Security & Compliance Training Establishes role-based training including role-based securit...	Administrative Detective	High	Active	📋 10 Reqs	View →
AIG-001	AI Governance & Oversight Establishes AI governance including framework, committee, po...	Administrative Detective	Critical	Active	📋 10 Reqs	View →
AIG-002	AI Risk & Impact Management Establishes AI risk management including risk assessment, im...	Administrative Detective	High	Active	📋 10 Reqs	View →
AIG-004	Responsible AI Management Establishes responsible AI including principles, transparenc...	Administrative Detective	High	Active	📋 10 Reqs	View →

Compliance Requirements & Audit Crosswalk

210 Specific Audit Clauses

The following requirements dictate specific audit evidence criteria and testing steps mapped directly under the controls of this framework.

REQUIREMENT ID	REQUIREMENT TITLE & DETAILS	MAPPED CONTROL	TYPICAL OWNER	ACTION
GOV-001-R001	Governance Framework The organization shall establish and maintain a formal governance framework for...	GOV-001 Information Security Governanc...	CISO, Governance Committee, Board of Directors, Risk Management	View ↗
GOV-001-R002	Governance Charter The organization shall establish and maintain a formal charter for the informati...	GOV-001 Information Security Governanc...	CISO, Board of Directors, CEO, Governance Committee, Legal	View ↗
GOV-001-R003	Governance Principles The organization shall define and document the core governance principles that g...	GOV-001 Information Security Governanc...	CISO, Governance Committee, Privacy Officer, Legal, Executive Leadership	View ↗
GOV-001-R004	Governance Scope The organization shall define and maintain a documented scope for the informatio...	GOV-001 Information Security Governanc...	CISO, Governance Committee, Enterprise Architecture, Asset Owners, Business Unit Leaders	View ↗
GOV-001-R005	Governance Authority The organization shall establish a formal governance authority for information s...	GOV-001 Information Security Governanc...	CISO, Board of Directors, CEO, Legal	View ↗
GOV-001-R006	Governance Accountability The organization shall assign accountability for the information security and pr...	GOV-001 Information Security Governanc...	CISO, CEO, Board of Directors, Compliance Committee, Risk Committee	View ↗
GOV-001-R007	Governance Decision-Making The organization shall maintain formal decision-making processes for information...	GOV-001 Information Security Governanc...	CISO, Governance Committee, Risk Committee, Compliance, Legal	View ↗
GOV-001-R008	Governance Oversight The organization shall implement formal oversight mechanisms, including governan...	GOV-001 Information Security Governanc...	Board of Directors, Audit Committee, Risk Committee, CISO, Independent Advisors	View ↗
RSK-001-R004	Risk Classification The organization shall establish a risk classification schema for consistent cat...	RSK-001 Risk Management Framework	CISO, Risk Management, Compliance	View ↗
RSK-002-R001	Register Establishment The organization shall establish and maintain a centralized risk register that p...	RSK-002 Risk Register	CISO, Risk Management, Risk Owners	View ↗
IAM-001-R005	Identity Modification The organization shall modify identity information when changes occur in an indi...	IAM-001 Identity & Account Lifecycle M...	Identity & Access Management, HR, IT Operations, Application Owners	View ↗
DAT-001-R001	Data Protection & Privacy Framework The organization shall establish a data protection and privacy strategy framewor...	DAT-001 Data Protection & Privacy Stra...	Data Protection Officer, CISO, Privacy Governance Committee	View ↗
DAT-001-R002	Strategic Objectives The organization shall define strategic objectives for the data protection and p...	DAT-001 Data Protection & Privacy Stra...	Data Protection Officer, CISO, Privacy Governance Committee	View ↗
DAT-001-R003	Privacy Governance The organization shall establish privacy governance structures that provide over...	DAT-001 Data Protection & Privacy Stra...	Data Protection Officer, CISO, Privacy Governance Committee	View ↗
DAT-001-R004	Data Protection Roles & Responsibilities The organization shall clearly define and document the roles and responsibilitie...	DAT-001 Data Protection & Privacy Stra...	Data Protection Officer, CISO, Privacy Governance Committee	View ↗
DAT-001-R005	Strategy Implementation The organization shall execute the data protection and privacy strategy in accor...	DAT-001 Data Protection & Privacy Stra...	Data Protection Officer, CISO, Privacy Governance Committee	View ↗
DAT-001-R006	Privacy Risk Alignment The organization shall align data protection and privacy activities with the org...	DAT-001 Data Protection & Privacy Stra...	Data Protection Officer, CISO, Privacy Governance Committee	View ↗
DAT-001-R007	Strategy Communication The organization shall communicate the data protection and privacy strategy to a...	DAT-001 Data Protection & Privacy Stra...	Data Protection Officer, CISO, Privacy Governance Committee	View ↗
DAT-001-R008	Strategy Performance Monitoring The organization shall monitor the performance of the data protection and privac...	DAT-001 Data Protection & Privacy Stra...	Data Protection Officer, CISO, Privacy Governance Committee	View ↗
DAT-001-R009	Strategy Review The organization shall conduct periodic reviews of the data protection and priva...	DAT-001 Data Protection & Privacy Stra...	Data Protection Officer, CISO, Privacy Governance Committee	View ↗
DAT-001-R010	Strategy Continuous Improvement The organization shall drive ongoing enhancement of the data protection and priv...	DAT-001 Data Protection & Privacy Stra...	Data Protection Officer, CISO, Privacy Governance Committee	View ↗
DAT-002-R001	Data Discovery Framework The organization shall establish a data discovery framework that defines the str...	DAT-002 Data Discovery	Data Protection Officer, Data Governance Team, Data Owners	View ↗
DAT-002-R002	Discovery Scope The organization shall define a documented scope for data discovery activities t...	DAT-002 Data Discovery	Data Protection Officer, Data Governance Team, Data Owners	View ↗
DAT-002-R003	Data Discovery Configuration The organization shall configure data discovery tools and processes to appropria...	DAT-002 Data Discovery	Data Protection Officer, Data Governance Team, Data Owners	View ↗
DAT-002-R004	Data Discovery Execution The organization shall execute data discovery activities to identify and locate...	DAT-002 Data Discovery	Data Protection Officer, Data Governance Team, Data Owners	View ↗
DAT-002-R005	Sensitive Data Identification The organization shall use data discovery to identify specific instances of pers...	DAT-002 Data Discovery	Data Protection Officer, Data Governance Team, Data Owners	View ↗
DAT-002-R006	Discovery Validation The organization shall validate data discovery results to ensure their accuracy...	DAT-002 Data Discovery	Data Protection Officer, Data Governance Team, Data Owners	View ↗
DAT-002-R007	Discovery Monitoring The organization shall monitor data discovery activities to ensure discovery is...	DAT-002 Data Discovery	Data Protection Officer, Data Governance Team, Data Owners	View ↗
DAT-002-R008	Discovery Reporting The organization shall report on data discovery, providing visibility into disco...	DAT-002 Data Discovery	Data Protection Officer, Data Governance Team, Data Owners	View ↗
DAT-002-R009	Discovery Review The organization shall conduct periodic reviews of data discovery activities to...	DAT-002 Data Discovery	Data Protection Officer, Data Governance Team, Data Owners	View ↗
DAT-002-R010	Discovery Continuous Improvement The organization shall drive ongoing enhancement of data discovery through a con...	DAT-002 Data Discovery	Data Protection Officer, Data Governance Team, Data Owners	View ↗
DAT-003-R001	Data Classification Framework The organization shall establish a data classification framework that defines th...	DAT-003 Data Classification & Handling	Data Owners, Data Stewards, Data Protection Officer	View ↗
DAT-003-R002	Classification Criteria The organization shall define classification criteria that establish the basis f...	DAT-003 Data Classification & Handling	Data Owners, Data Stewards, Data Protection Officer	View ↗
DAT-003-R003	Data Classification Assignment The organization shall assign classification levels to data based on classificat...	DAT-003 Data Classification & Handling	Data Owners, Data Stewards, Data Protection Officer	View ↗
DAT-003-R004	Data Labeling The organization shall label data with its assigned classification, ensuring cla...	DAT-003 Data Classification & Handling	Data Owners, Data Stewards, Data Protection Officer	View ↗
DAT-003-R005	Data Handling Requirements The organization shall define data handling requirements for each data classific...	DAT-003 Data Classification & Handling	Data Owners, Data Stewards, Data Protection Officer	View ↗
DAT-003-R006	Classification Review The organization shall conduct periodic reviews of data classifications to ensur...	DAT-003 Data Classification & Handling	Data Owners, Data Stewards, Data Protection Officer	View ↗
DAT-003-R007	Classification Change Management The organization shall manage changes to data classifications, ensuring changes...	DAT-003 Data Classification & Handling	Data Owners, Data Stewards, Data Protection Officer	View ↗
DAT-003-R008	Classification Monitoring The organization shall monitor data classification to ensure data continues to b...	DAT-003 Data Classification & Handling	Data Owners, Data Stewards, Data Protection Officer	View ↗
DAT-003-R009	Classification Reporting The organization shall report on data classification, providing visibility into...	DAT-003 Data Classification & Handling	Data Owners, Data Stewards, Data Protection Officer	View ↗
DAT-003-R010	Classification Continuous Improvement The organization shall drive ongoing enhancement of data classification through...	DAT-003 Data Classification & Handling	Data Owners, Data Stewards, Data Protection Officer	View ↗
DAT-004-R001	Data Retention Framework The organization shall establish a data retention framework that defines the str...	DAT-004 Data Retention & Disposal	Data Protection Officer, Records Management, Legal, Data Owners	View ↗
DAT-004-R002	Retention Schedule Management The organization shall maintain retention schedules that define how long differe...	DAT-004 Data Retention & Disposal	Data Protection Officer, Records Management, Legal, Data Owners	View ↗
DAT-004-R003	Data Archival The organization shall archive data that is no longer actively used but must be...	DAT-004 Data Retention & Disposal	Data Protection Officer, Records Management, Legal, Data Owners	View ↗
DAT-004-R004	Data Disposal Authorization The organization shall authorize the disposal of data, ensuring disposal decisio...	DAT-004 Data Retention & Disposal	Data Protection Officer, Records Management, Legal, Data Owners	View ↗
DAT-004-R005	Secure Data Destruction The organization shall securely destroy data that has reached the end of its ret...	DAT-004 Data Retention & Disposal	Data Protection Officer, Records Management, Legal, Data Owners	View ↗
DAT-004-R006	Disposal Verification The organization shall verify that data disposal activities have been completed...	DAT-004 Data Retention & Disposal	Data Protection Officer, Records Management, Legal, Data Owners	View ↗
DAT-004-R007	Retention Compliance Monitoring The organization shall monitor retention and disposal activities to ensure compl...	DAT-004 Data Retention & Disposal	Data Protection Officer, Records Management, Legal, Data Owners	View ↗
DAT-004-R008	Retention Reporting The organization shall report on retention and disposal activities, providing vi...	DAT-004 Data Retention & Disposal	Data Protection Officer, Records Management, Legal, Data Owners	View ↗
DAT-004-R009	Retention Review The organization shall conduct periodic reviews of retention and disposal activi...	DAT-004 Data Retention & Disposal	Data Protection Officer, Records Management, Legal, Data Owners	View ↗
DAT-004-R010	Retention Continuous Improvement The organization shall drive ongoing enhancement of retention and disposal manag...	DAT-004 Data Retention & Disposal	Data Protection Officer, Records Management, Legal, Data Owners	View ↗
DAT-005-R001	Data Ownership Framework The organization shall establish a data ownership framework that defines the str...	DAT-005 Data Ownership & Stewardship	Data Owners, Data Stewards, Data Governance Committee	View ↗
DAT-005-R002	Data Owner Assignment The organization shall assign explicit data owners to all personal and sensitive...	DAT-005 Data Ownership & Stewardship	Data Owners, Data Stewards, Data Governance Committee	View ↗
DAT-005-R003	Data Steward Responsibilities The organization shall define and assign data stewards to support data owners in...	DAT-005 Data Ownership & Stewardship	Data Owners, Data Stewards, Data Governance Committee	View ↗
DAT-005-R004	Ownership Accountability The organization shall establish accountability for data ownership, ensuring dat...	DAT-005 Data Ownership & Stewardship	Data Owners, Data Stewards, Data Governance Committee	View ↗
DAT-005-R005	Ownership Transfer The organization shall transfer data ownership when organizational changes occur...	DAT-005 Data Ownership & Stewardship	Data Owners, Data Stewards, Data Governance Committee	View ↗
DAT-005-R006	Ownership Validation The organization shall validate data ownership to ensure ownership assignments r...	DAT-005 Data Ownership & Stewardship	Data Owners, Data Stewards, Data Governance Committee	View ↗
DAT-005-R007	Ownership Documentation The organization shall maintain comprehensive documentation of data ownership as...	DAT-005 Data Ownership & Stewardship	Data Owners, Data Stewards, Data Governance Committee	View ↗
DAT-005-R008	Ownership Reporting The organization shall report on data ownership, providing visibility into owner...	DAT-005 Data Ownership & Stewardship	Data Owners, Data Stewards, Data Governance Committee	View ↗
DAT-005-R009	Ownership Review The organization shall conduct periodic reviews of data ownership assignments to...	DAT-005 Data Ownership & Stewardship	Data Owners, Data Stewards, Data Governance Committee	View ↗
DAT-005-R010	Ownership Continuous Improvement The organization shall drive ongoing enhancement of data ownership and stewardsh...	DAT-005 Data Ownership & Stewardship	Data Owners, Data Stewards, Data Governance Committee	View ↗
DAT-006-R001	Data Inventory Framework The organization shall establish a data inventory framework that defines the str...	DAT-006 Data Flow Mapping, Inventory &...	Data Owners, Data Stewards, Data Governance Team	View ↗
DAT-006-R002	Data Flow Identification The organization shall identify data flows that describe how personal and sensit...	DAT-006 Data Flow Mapping, Inventory &...	Data Owners, Data Stewards, Data Governance Team	View ↗
DAT-006-R003	Data Inventory Management The organization shall maintain a comprehensive inventory of data assets, includ...	DAT-006 Data Flow Mapping, Inventory &...	Data Owners, Data Stewards, Data Governance Team	View ↗
DAT-006-R004	Data Flow Mapping The organization shall create and maintain data flow maps that document the move...	DAT-006 Data Flow Mapping, Inventory &...	Data Owners, Data Stewards, Data Governance Team	View ↗
DAT-006-R005	Data Lineage Documentation The organization shall document data lineage for personal and sensitive data, tr...	DAT-006 Data Flow Mapping, Inventory &...	Data Owners, Data Stewards, Data Governance Team	View ↗
DAT-006-R006	Data Flow Validation The organization shall validate data flow maps and data inventory to ensure thei...	DAT-006 Data Flow Mapping, Inventory &...	Data Owners, Data Stewards, Data Governance Team	View ↗
DAT-006-R007	Data Flow Monitoring The organization shall monitor data flows to ensure data movements are documente...	DAT-006 Data Flow Mapping, Inventory &...	Data Owners, Data Stewards, Data Governance Team	View ↗
DAT-006-R008	Data Flow Reporting The organization shall report on data flow mapping and inventory, providing visi...	DAT-006 Data Flow Mapping, Inventory &...	Data Owners, Data Stewards, Data Governance Team	View ↗
DAT-006-R009	Data Flow Review The organization shall conduct periodic reviews of data flow mapping and invento...	DAT-006 Data Flow Mapping, Inventory &...	Data Owners, Data Stewards, Data Governance Team	View ↗
DAT-006-R010	Data Flow Continuous Improvement The organization shall drive ongoing enhancement of data flow mapping, inventory...	DAT-006 Data Flow Mapping, Inventory &...	Data Owners, Data Stewards, Data Governance Team	View ↗
DAT-007-R001	Rights Management Framework The organization shall establish a data subject rights management framework that...	DAT-007 Data Subject Rights Management	Data Protection Officer, Privacy Operations, Legal	View ↗
DAT-007-R002	Request Intake The organization shall receive data subject rights requests through accessible c...	DAT-007 Data Subject Rights Management	Data Protection Officer, Privacy Operations, Legal	View ↗
DAT-007-R003	Identity Verification The organization shall verify the identity of data subjects making rights reques...	DAT-007 Data Subject Rights Management	Data Protection Officer, Privacy Operations, Legal	View ↗
DAT-007-R004	Rights Request Processing The organization shall process data subject rights requests, including requests...	DAT-007 Data Subject Rights Management	Data Protection Officer, Privacy Operations, Legal	View ↗
DAT-007-R005	Response Management The organization shall respond to data subject rights requests, ensuring respons...	DAT-007 Data Subject Rights Management	Data Protection Officer, Privacy Operations, Legal	View ↗
DAT-007-R006	Request Tracking The organization shall track data subject rights requests from receipt through c...	DAT-007 Data Subject Rights Management	Data Protection Officer, Privacy Operations, Legal	View ↗
DAT-007-R007	Regulatory Compliance Monitoring The organization shall monitor data subject rights management to ensure complian...	DAT-007 Data Subject Rights Management	Data Protection Officer, Privacy Operations, Legal	View ↗
DAT-007-R008	Rights Reporting The organization shall report on data subject rights management, providing visib...	DAT-007 Data Subject Rights Management	Data Protection Officer, Privacy Operations, Legal	View ↗
DAT-007-R009	Rights Review The organization shall conduct periodic reviews of data subject rights managemen...	DAT-007 Data Subject Rights Management	Data Protection Officer, Privacy Operations, Legal	View ↗
DAT-007-R010	Rights Continuous Improvement The organization shall drive ongoing enhancement of data subject rights manageme...	DAT-007 Data Subject Rights Management	Data Protection Officer, Privacy Operations, Legal	View ↗
DAT-008-R001	Consent Management Framework The organization shall establish a consent management framework that defines the...	DAT-008 Consent Management	Data Protection Officer, Privacy Operations, Legal, Product Owners	View ↗
DAT-008-R002	Consent Collection The organization shall collect consent from data subjects in a manner that is in...	DAT-008 Consent Management	Data Protection Officer, Privacy Operations, Legal, Product Owners	View ↗
DAT-008-R003	Consent Recording The organization shall record consent decisions, ensuring consent records are ac...	DAT-008 Consent Management	Data Protection Officer, Privacy Operations, Legal, Product Owners	View ↗
DAT-008-R004	Consent Validation The organization shall validate the validity of consent, ensuring consent remain...	DAT-008 Consent Management	Data Protection Officer, Privacy Operations, Legal, Product Owners	View ↗
DAT-008-R005	Consent Withdrawal The organization shall process consent withdrawals, ensuring data subjects can e...	DAT-008 Consent Management	Data Protection Officer, Privacy Operations, Legal, Product Owners	View ↗
DAT-008-R006	Consent Lifecycle Management The organization shall manage the lifecycle of consent, from collection through...	DAT-008 Consent Management	Data Protection Officer, Privacy Operations, Legal, Product Owners	View ↗
DAT-008-R007	Consent Monitoring The organization shall monitor consent management to ensure consent is properly...	DAT-008 Consent Management	Data Protection Officer, Privacy Operations, Legal, Product Owners	View ↗
DAT-008-R008	Consent Reporting The organization shall report on consent management, providing visibility into c...	DAT-008 Consent Management	Data Protection Officer, Privacy Operations, Legal, Product Owners	View ↗
DAT-008-R009	Consent Review The organization shall conduct periodic reviews of consent management activities...	DAT-008 Consent Management	Data Protection Officer, Privacy Operations, Legal, Product Owners	View ↗
DAT-008-R010	Consent Continuous Improvement The organization shall drive ongoing enhancement of consent management through a...	DAT-008 Consent Management	Data Protection Officer, Privacy Operations, Legal, Product Owners	View ↗
DAT-009-R001	Cross-Border Transfer Framework The organization shall establish a cross-border data transfer framework that def...	DAT-009 Cross-Border Data Transfer	Data Protection Officer, Legal, Privacy Operations	View ↗
DAT-009-R002	Transfer Assessment The organization shall assess cross-border data transfers to evaluate compliance...	DAT-009 Cross-Border Data Transfer	Data Protection Officer, Legal, Privacy Operations	View ↗
DAT-009-R003	Transfer Authorization The organization shall authorize cross-border data transfers, ensuring transfers...	DAT-009 Cross-Border Data Transfer	Data Protection Officer, Legal, Privacy Operations	View ↗
DAT-009-R004	Transfer Safeguards The organization shall implement appropriate safeguards for cross-border data tr...	DAT-009 Cross-Border Data Transfer	Data Protection Officer, Legal, Privacy Operations	View ↗
DAT-009-R005	Transfer Documentation The organization shall maintain comprehensive documentation of cross-border data...	DAT-009 Cross-Border Data Transfer	Data Protection Officer, Legal, Privacy Operations	View ↗
DAT-009-R006	Transfer Monitoring The organization shall monitor cross-border data transfers to ensure transfers r...	DAT-009 Cross-Border Data Transfer	Data Protection Officer, Legal, Privacy Operations	View ↗
DAT-009-R007	Regulatory Compliance Verification The organization shall verify that cross-border data transfers comply with appli...	DAT-009 Cross-Border Data Transfer	Data Protection Officer, Legal, Privacy Operations	View ↗
DAT-009-R008	Transfer Reporting The organization shall report on cross-border data transfers, providing visibili...	DAT-009 Cross-Border Data Transfer	Data Protection Officer, Legal, Privacy Operations	View ↗
DAT-009-R009	Transfer Review The organization shall conduct periodic reviews of cross-border data transfer ma...	DAT-009 Cross-Border Data Transfer	Data Protection Officer, Legal, Privacy Operations	View ↗
DAT-009-R010	Transfer Continuous Improvement The organization shall drive ongoing enhancement of cross-border data transfer m...	DAT-009 Cross-Border Data Transfer	Data Protection Officer, Legal, Privacy Operations	View ↗
DAT-010-R001	Privacy Notice Framework The organization shall establish a privacy notice framework that defines the str...	DAT-010 Privacy Notices	Data Protection Officer, Legal, Communications, Product Owners	View ↗
DAT-010-R002	Notice Content Management The organization shall develop and maintain privacy notice content that accurate...	DAT-010 Privacy Notices	Data Protection Officer, Legal, Communications, Product Owners	View ↗
DAT-010-R003	Notice Publication The organization shall publish privacy notices in locations and formats that are...	DAT-010 Privacy Notices	Data Protection Officer, Legal, Communications, Product Owners	View ↗
DAT-010-R004	Notice Accessibility The organization shall ensure privacy notices are accessible to all data subject...	DAT-010 Privacy Notices	Data Protection Officer, Legal, Communications, Product Owners	View ↗
DAT-010-R005	Notice Updates The organization shall update privacy notices when changes occur in data process...	DAT-010 Privacy Notices	Data Protection Officer, Legal, Communications, Product Owners	View ↗
DAT-010-R006	Notice Communication The organization shall communicate privacy notices to data subjects through appr...	DAT-010 Privacy Notices	Data Protection Officer, Legal, Communications, Product Owners	View ↗
DAT-010-R007	Notice Compliance Monitoring The organization shall monitor privacy notice management to ensure notices remai...	DAT-010 Privacy Notices	Data Protection Officer, Legal, Communications, Product Owners	View ↗
DAT-010-R008	Notice Reporting The organization shall report on privacy notice management, providing visibility...	DAT-010 Privacy Notices	Data Protection Officer, Legal, Communications, Product Owners	View ↗
DAT-010-R009	Notice Review The organization shall conduct periodic reviews of privacy notices to ensure the...	DAT-010 Privacy Notices	Data Protection Officer, Legal, Communications, Product Owners	View ↗
DAT-010-R010	Notice Continuous Improvement The organization shall drive ongoing enhancement of privacy notice management th...	DAT-010 Privacy Notices	Data Protection Officer, Legal, Communications, Product Owners	View ↗
DAT-011-R001	Privacy by Design Framework The organization shall establish a privacy by design framework that defines the...	DAT-011 Privacy by Design	Data Protection Officer, Privacy Engineering, Application Owners	View ↗
DAT-011-R002	Privacy Requirements Identification The organization shall identify privacy requirements that must be addressed in t...	DAT-011 Privacy by Design	Data Protection Officer, Privacy Engineering, Application Owners	View ↗
DAT-011-R003	Privacy Design Assessment The organization shall conduct privacy design assessments to evaluate whether sy...	DAT-011 Privacy by Design	Data Protection Officer, Privacy Engineering, Application Owners	View ↗
DAT-011-R004	Privacy Control Integration The organization shall integrate privacy controls into systems, products, and se...	DAT-011 Privacy by Design	Data Protection Officer, Privacy Engineering, Application Owners	View ↗
DAT-011-R005	Privacy Validation The organization shall validate that systems, products, and services meet privac...	DAT-011 Privacy by Design	Data Protection Officer, Privacy Engineering, Application Owners	View ↗
DAT-011-R006	Design Change Management The organization shall manage changes to privacy design requirements and control...	DAT-011 Privacy by Design	Data Protection Officer, Privacy Engineering, Application Owners	View ↗
DAT-011-R007	Privacy Compliance Monitoring The organization shall monitor privacy by design activities to ensure privacy re...	DAT-011 Privacy by Design	Data Protection Officer, Privacy Engineering, Application Owners	View ↗
DAT-011-R008	Design Reporting The organization shall report on privacy by design, providing visibility into pr...	DAT-011 Privacy by Design	Data Protection Officer, Privacy Engineering, Application Owners	View ↗
DAT-011-R009	Design Review The organization shall conduct periodic reviews of privacy by design activities...	DAT-011 Privacy by Design	Data Protection Officer, Privacy Engineering, Application Owners	View ↗
DAT-011-R010	Design Continuous Improvement The organization shall drive ongoing enhancement of privacy by design through a...	DAT-011 Privacy by Design	Data Protection Officer, Privacy Engineering, Application Owners	View ↗
DAT-012-R001	DPIA Framework The organization shall establish a Data Protection Impact Assessment framework t...	DAT-012 Data Protection Impact Assessm...	Data Protection Officer, Privacy Risk, Legal, Business Owners	View ↗
DAT-012-R002	DPIA Scoping The organization shall scope DPIAs, identifying the processing activities, syste...	DAT-012 Data Protection Impact Assessm...	Data Protection Officer, Privacy Risk, Legal, Business Owners	View ↗
DAT-012-R003	Privacy Risk Assessment The organization shall conduct privacy risk assessments as part of DPIAs, identi...	DAT-012 Data Protection Impact Assessm...	Data Protection Officer, Privacy Risk, Legal, Business Owners	View ↗
DAT-012-R004	Risk Treatment Planning The organization shall develop risk treatment plans as part of DPIAs, defining m...	DAT-012 Data Protection Impact Assessm...	Data Protection Officer, Privacy Risk, Legal, Business Owners	View ↗
DAT-012-R005	DPIA Approval The organization shall approve DPIAs and associated risk treatment plans, ensuri...	DAT-012 Data Protection Impact Assessm...	Data Protection Officer, Privacy Risk, Legal, Business Owners	View ↗
DAT-012-R006	DPIA Documentation The organization shall maintain comprehensive documentation of DPIAs, including...	DAT-012 Data Protection Impact Assessm...	Data Protection Officer, Privacy Risk, Legal, Business Owners	View ↗
DAT-012-R007	DPIA Monitoring The organization shall monitor DPIAs to ensure treatment plans are implemented a...	DAT-012 Data Protection Impact Assessm...	Data Protection Officer, Privacy Risk, Legal, Business Owners	View ↗
DAT-012-R008	DPIA Reporting The organization shall report on DPIAs, providing visibility into assessment act...	DAT-012 Data Protection Impact Assessm...	Data Protection Officer, Privacy Risk, Legal, Business Owners	View ↗
DAT-012-R009	DPIA Review The organization shall conduct periodic reviews of DPIA activities to ensure the...	DAT-012 Data Protection Impact Assessm...	Data Protection Officer, Privacy Risk, Legal, Business Owners	View ↗
DAT-012-R010	DPIA Continuous Improvement The organization shall drive ongoing enhancement of DPIA management through a co...	DAT-012 Data Protection Impact Assessm...	Data Protection Officer, Privacy Risk, Legal, Business Owners	View ↗
DAT-013-R001	ROPA Framework The organization shall establish a Record of Processing Activities framework tha...	DAT-013 Record of Processing Activitie...	Data Protection Officer, Data Owners, Privacy Operations	View ↗
DAT-013-R002	Processing Activity Identification The organization shall identify all processing activities that involve personal...	DAT-013 Record of Processing Activitie...	Data Protection Officer, Data Owners, Privacy Operations	View ↗
DAT-013-R003	Processing Record Maintenance The organization shall maintain comprehensive records of processing activities,...	DAT-013 Record of Processing Activitie...	Data Protection Officer, Data Owners, Privacy Operations	View ↗
DAT-013-R004	Processing Activity Classification The organization shall establish classification schemas for processing activitie...	DAT-013 Record of Processing Activitie...	Data Protection Officer, Data Owners, Privacy Operations	View ↗
DAT-013-R005	Processing Record Validation The organization shall validate ROPA records to ensure their accuracy, completen...	DAT-013 Record of Processing Activitie...	Data Protection Officer, Data Owners, Privacy Operations	View ↗
DAT-013-R006	ROPA Maintenance The organization shall maintain ROPA records to ensure they remain current and r...	DAT-013 Record of Processing Activitie...	Data Protection Officer, Data Owners, Privacy Operations	View ↗
DAT-013-R007	ROPA Monitoring The organization shall monitor ROPA management to ensure records remain accurate...	DAT-013 Record of Processing Activitie...	Data Protection Officer, Data Owners, Privacy Operations	View ↗
DAT-013-R008	ROPA Reporting The organization shall report on ROPA, providing visibility into processing acti...	DAT-013 Record of Processing Activitie...	Data Protection Officer, Data Owners, Privacy Operations	View ↗
DAT-013-R009	ROPA Review The organization shall conduct periodic reviews of ROPA management activities to...	DAT-013 Record of Processing Activitie...	Data Protection Officer, Data Owners, Privacy Operations	View ↗
DAT-013-R010	ROPA Continuous Improvement The organization shall drive ongoing enhancement of ROPA management through a co...	DAT-013 Record of Processing Activitie...	Data Protection Officer, Data Owners, Privacy Operations	View ↗
DAT-014-R001	Data Loss Prevention Framework The organization shall establish a Data Loss Prevention framework that defines t...	DAT-014 Data Loss Prevention (DLP)	CISO, DLP Team, SOC, Data Protection Officer	View ↗
DAT-014-R002	DLP Policy Definition The organization shall define DLP policies that establish the requirements for p...	DAT-014 Data Loss Prevention (DLP)	CISO, DLP Team, SOC, Data Protection Officer	View ↗
DAT-014-R003	Sensitive Data Monitoring The organization shall monitor sensitive data to detect potential data leakage,...	DAT-014 Data Loss Prevention (DLP)	CISO, DLP Team, SOC, Data Protection Officer	View ↗
DAT-014-R004	Data Loss Prevention Controls The organization shall implement controls to prevent unauthorized disclosure and...	DAT-014 Data Loss Prevention (DLP)	CISO, DLP Team, SOC, Data Protection Officer	View ↗
DAT-014-R005	DLP Incident Management The organization shall manage DLP incidents, including the response, investigati...	DAT-014 Data Loss Prevention (DLP)	CISO, DLP Team, SOC, Data Protection Officer	View ↗
DAT-014-R006	DLP Exception Management The organization shall manage exceptions to DLP policies, ensuring deviations ar...	DAT-014 Data Loss Prevention (DLP)	CISO, DLP Team, SOC, Data Protection Officer	View ↗
DAT-014-R007	DLP Monitoring The organization shall monitor DLP activities to ensure controls are operating e...	DAT-014 Data Loss Prevention (DLP)	CISO, DLP Team, SOC, Data Protection Officer	View ↗
DAT-014-R008	DLP Reporting The organization shall report on DLP, providing visibility into DLP activities,...	DAT-014 Data Loss Prevention (DLP)	CISO, DLP Team, SOC, Data Protection Officer	View ↗
DAT-014-R009	DLP Review The organization shall conduct periodic reviews of DLP activities to ensure thei...	DAT-014 Data Loss Prevention (DLP)	CISO, DLP Team, SOC, Data Protection Officer	View ↗
DAT-014-R010	DLP Continuous Improvement The organization shall drive ongoing enhancement of DLP management through a con...	DAT-014 Data Loss Prevention (DLP)	CISO, DLP Team, SOC, Data Protection Officer	View ↗
DAT-015-R001	Data Integrity Framework The organization shall establish a data integrity framework that defines the str...	DAT-015 Data Integrity	Data Owners, Data Stewards, IT Operations, CISO	View ↗
DAT-015-R002	Integrity Protection Controls The organization shall implement controls to protect data integrity, preventing...	DAT-015 Data Integrity	Data Owners, Data Stewards, IT Operations, CISO	View ↗
DAT-015-R003	Data Validation The organization shall validate data integrity, ensuring data is accurate, compl...	DAT-015 Data Integrity	Data Owners, Data Stewards, IT Operations, CISO	View ↗
DAT-015-R004	Integrity Monitoring The organization shall monitor data integrity to detect unauthorized modificatio...	DAT-015 Data Integrity	Data Owners, Data Stewards, IT Operations, CISO	View ↗
DAT-015-R005	Integrity Verification The organization shall verify data integrity through periodic assessments and te...	DAT-015 Data Integrity	Data Owners, Data Stewards, IT Operations, CISO	View ↗
DAT-015-R006	Integrity Incident Management The organization shall manage data integrity incidents, including the detection,...	DAT-015 Data Integrity	Data Owners, Data Stewards, IT Operations, CISO	View ↗
DAT-015-R007	Integrity Assessment The organization shall conduct periodic assessments of data integrity to evaluat...	DAT-015 Data Integrity	Data Owners, Data Stewards, IT Operations, CISO	View ↗
DAT-015-R008	Integrity Reporting The organization shall report on data integrity, providing visibility into integ...	DAT-015 Data Integrity	Data Owners, Data Stewards, IT Operations, CISO	View ↗
DAT-015-R009	Integrity Review The organization shall conduct periodic reviews of data integrity management act...	DAT-015 Data Integrity	Data Owners, Data Stewards, IT Operations, CISO	View ↗
DAT-015-R010	Integrity Continuous Improvement The organization shall drive ongoing enhancement of data integrity management th...	DAT-015 Data Integrity	Data Owners, Data Stewards, IT Operations, CISO	View ↗
DAT-016-R001	Data Masking & Anonymization Framework The organization shall establish a data masking and anonymization framework that...	DAT-016 Data Masking & Anonymization	Data Protection Officer, Data Engineering, Application Owners, Security Engineering	View ↗
DAT-016-R002	Sensitive Data Identification The organization shall identify sensitive data that requires masking, anonymizat...	DAT-016 Data Masking & Anonymization	Data Protection Officer, Data Engineering, Application Owners, Security Engineering	View ↗
DAT-016-R003	Masking Requirements The organization shall define masking requirements that specify how sensitive da...	DAT-016 Data Masking & Anonymization	Data Protection Officer, Data Engineering, Application Owners, Security Engineering	View ↗
DAT-016-R004	Anonymization & Pseudonymization The organization shall implement anonymization and pseudonymization techniques t...	DAT-016 Data Masking & Anonymization	Data Protection Officer, Data Engineering, Application Owners, Security Engineering	View ↗
DAT-016-R005	Data Transformation Validation The organization shall validate that data masking, anonymization, and pseudonymi...	DAT-016 Data Masking & Anonymization	Data Protection Officer, Data Engineering, Application Owners, Security Engineering	View ↗
DAT-016-R006	Non-Production Data Protection The organization shall implement data masking and anonymization for non-producti...	DAT-016 Data Masking & Anonymization	Data Protection Officer, Data Engineering, Application Owners, Security Engineering	View ↗
DAT-016-R007	Masking Effectiveness Monitoring The organization shall monitor masking and anonymization activities to ensure da...	DAT-016 Data Masking & Anonymization	Data Protection Officer, Data Engineering, Application Owners, Security Engineering	View ↗
DAT-016-R008	Masking Reporting The organization shall report on masking and anonymization, providing visibility...	DAT-016 Data Masking & Anonymization	Data Protection Officer, Data Engineering, Application Owners, Security Engineering	View ↗
DAT-016-R009	Masking Review The organization shall conduct periodic reviews of data masking and anonymizatio...	DAT-016 Data Masking & Anonymization	Data Protection Officer, Data Engineering, Application Owners, Security Engineering	View ↗
DAT-016-R010	Masking Continuous Improvement The organization shall drive ongoing enhancement of data masking and anonymizati...	DAT-016 Data Masking & Anonymization	Data Protection Officer, Data Engineering, Application Owners, Security Engineering	View ↗
END-003-R005	Corporate Data Protection The organization shall protect corporate data on mobile devices, including data...	END-003 Mobile Device & Application Ma...	Endpoint Security, IT Operations, Security Operations, CISO	View ↗
CLD-001-R003	Cloud Policies & Standards The organization shall establish cloud security policies and standards that spec...	CLD-001 Cloud Security Governance	CISO / Cloud Security Governance	View ↗
CLD-006-R001	Data Protection Framework The organization shall establish a cloud data protection framework that defines...	CLD-006 Cloud Data Protection	Data Protection / Cloud Security Team	View ↗
CLD-006-R008	Data Reporting The organization shall report on cloud data protection, providing visibility int...	CLD-006 Cloud Data Protection	Data Protection / Cloud Security Team	View ↗
CLD-006-R009	Data Review The organization shall conduct periodic reviews of cloud data protection activit...	CLD-006 Cloud Data Protection	Data Protection / Cloud Security Team	View ↗
CLD-006-R010	Continuous Improvement The organization shall drive ongoing enhancement of cloud data protection throug...	CLD-006 Cloud Data Protection	Data Protection / Cloud Security Team	View ↗
APP-003-R002	Security Requirements The organization shall define security requirements for all software development...	APP-003 Secure Software Development Li...	Application Security / Engineering	View ↗
THR-003-R003	User Activity Monitoring The organization shall monitor user activity to detect potential insider threats...	THR-003 Insider Threat Management	Threat Intelligence Analysts	View ↗
THR-003-R004	Insider Investigation The organization shall investigate potential insider threats, including collecti...	THR-003 Insider Threat Management	Threat Intelligence Analysts	View ↗
TPR-002-R004	Privacy Assessment The organization shall conduct privacy assessments of third-party vendors to eva...	TPR-002 Third-Party Risk Assessment &...	Third-Party Risk Management, Information Security, Privacy, Finance, Compliance	View ↗
TPR-003-R001	Contract Requirements The organization shall establish contract requirements for third-party relations...	TPR-003 Third-Party Contract & Complia...	Procurement, Legal, Third-Party Risk Management, Compliance, Information Security	View ↗
TPR-003-R003	Privacy Clauses The organization shall include privacy clauses in third-party contracts that def...	TPR-003 Third-Party Contract & Complia...	Procurement, Legal, Third-Party Risk Management, Compliance, Information Security	View ↗
TPR-003-R004	Audit Rights The organization shall include audit rights clauses in third-party contracts tha...	TPR-003 Third-Party Contract & Complia...	Procurement, Legal, Third-Party Risk Management, Compliance, Information Security	View ↗
TPR-003-R007	Compliance Verification The organization shall verify third-party compliance with contractual obligation...	TPR-003 Third-Party Contract & Complia...	Procurement, Legal, Third-Party Risk Management, Compliance, Information Security	View ↗
TPR-003-R008	Contract Review The organization shall conduct periodic reviews of third-party contracts to ensu...	TPR-003 Third-Party Contract & Complia...	Procurement, Legal, Third-Party Risk Management, Compliance, Information Security	View ↗
HRS-001-R001	Screening Policy The organization shall establish a personnel screening policy that defines the r...	HRS-001 Personnel Screening & Verifica...	Human Resources, Security, Legal, Compliance	View ↗
HRS-001-R002	Background Verification The organization shall conduct background verifications for all personnel prior...	HRS-001 Personnel Screening & Verifica...	Human Resources, Security, Legal, Compliance	View ↗
HRS-001-R003	Identity Verification The organization shall verify the identity of all personnel prior to employment...	HRS-001 Personnel Screening & Verifica...	Human Resources, Security, Legal, Compliance	View ↗
HRS-001-R004	Employment Eligibility The organization shall verify the employment eligibility of all personnel prior...	HRS-001 Personnel Screening & Verifica...	Human Resources, Security, Legal, Compliance	View ↗
HRS-001-R005	Screening Approval The organization shall approve personnel based on screening results, ensuring hi...	HRS-001 Personnel Screening & Verifica...	Human Resources, Security, Legal, Compliance	View ↗
HRS-001-R006	Re-screening Requirements The organization shall establish re-screening requirements for personnel, includ...	HRS-001 Personnel Screening & Verifica...	Human Resources, Security, Legal, Compliance	View ↗
HRS-001-R007	Screening Exceptions The organization shall manage exceptions to screening requirements, ensuring dev...	HRS-001 Personnel Screening & Verifica...	Human Resources, Security, Legal, Compliance	View ↗
HRS-001-R008	Screening Documentation The organization shall maintain comprehensive documentation of personnel screeni...	HRS-001 Personnel Screening & Verifica...	Human Resources, Security, Legal, Compliance	View ↗
HRS-001-R009	Screening Review The organization shall conduct periodic reviews of personnel screening activitie...	HRS-001 Personnel Screening & Verifica...	Human Resources, Security, Legal, Compliance	View ↗
HRS-001-R010	Continuous Improvement The organization shall establish a continuous improvement process for personnel...	HRS-001 Personnel Screening & Verifica...	Human Resources, Security, Legal, Compliance	View ↗
HRS-002-R002	Employment Obligations The organization shall define and document employment obligations for all person...	HRS-002 Confidentiality & Employment O...	Human Resources, Legal, Information Security, Compliance	View ↗
HRS-002-R007	Obligation Monitoring The organization shall monitor compliance with confidentiality and employment ob...	HRS-002 Confidentiality & Employment O...	Human Resources, Legal, Information Security, Compliance	View ↗
HRS-002-R008	Documentation The organization shall maintain comprehensive documentation of confidentiality a...	HRS-002 Confidentiality & Employment O...	Human Resources, Legal, Information Security, Compliance	View ↗
HRS-002-R009	Obligation Review The organization shall conduct periodic reviews of confidentiality and employmen...	HRS-002 Confidentiality & Employment O...	Human Resources, Legal, Information Security, Compliance	View ↗
HRS-002-R010	Continuous Improvement The organization shall establish a continuous improvement process for confidenti...	HRS-002 Confidentiality & Employment O...	Human Resources, Legal, Information Security, Compliance	View ↗
HRS-003-R001	Recruitment Security The organization shall establish recruitment security processes that ensure secu...	HRS-003 Personnel Lifecycle Security M...	Human Resources, Information Security, Hiring Managers, IT Operations	View ↗
HRS-003-R008	Exit Activities The organization shall establish exit activities for departing personnel, includ...	HRS-003 Personnel Lifecycle Security M...	Human Resources, Information Security, Hiring Managers, IT Operations	View ↗
HRS-003-R009	Post-Employment Obligations The organization shall define and communicate post-employment obligations for de...	HRS-003 Personnel Lifecycle Security M...	Human Resources, Information Security, Hiring Managers, IT Operations	View ↗
HRS-004-R004	Privacy Responsibilities The organization shall include privacy responsibilities in the code of conduct,...	HRS-004 Employee Code of Conduct & Eth...	Human Resources, Legal, Compliance, Information Security, Ethics/Compliance	View ↗
HRS-004-R006	Policy Compliance The organization shall require all personnel to comply with organizational polic...	HRS-004 Employee Code of Conduct & Eth...	Human Resources, Legal, Compliance, Information Security, Ethics/Compliance	View ↗
SAT-003-R003	Privacy Training The organization shall provide training on privacy responsibilities and obligati...	SAT-003 Role-Based Security & Complian...	Security Training, Information Security, Compliance, Human Resources	View ↗
AIG-001-R003	AI Policies The organization shall establish AI policies that define the requirements, princ...	AIG-001 AI Governance & Oversight	AI Governance Committee, Executive Leadership, CISO, Legal, Compliance, Risk, Ethics	View ↗
AIG-002-R003	AI Impact Assessment The organization shall conduct impact assessments for AI systems to evaluate the...	AIG-002 AI Risk & Impact Management	AI Risk Management, Enterprise Risk, Compliance, Privacy, AI Governance	View ↗
AIG-004-R001	Responsible AI Principles The organization shall define responsible AI principles that guide the developme...	AIG-004 Responsible AI Management	Responsible AI, Ethics, AI Governance, Legal, Privacy, Business Owners	View ↗

ISO/IEC 27701:2019