Active
Applicability Assessment
The organization shall perform a documented applicability assessment for each material regulatory change to determine the organizational entities, jurisdictions, products, services, and activities affected.
Requirement Details & Guidance
REG-003-R001 · REG-003Why This Requirement Exists
This requirement exists to determine how regulatory changes affect obligations, risks, business operations, controls, technology, and implementation needs before decisions are finalized.
Implementation Guidance
Use a standardized impact assessment covering applicability, affected obligations, processes, controls, systems, data, third parties, deadlines, resources, dependencies, risk, and business impact. Obtain appropriate review and approval before implementation.
Practical Application & Audit Readiness
REG-003-R001 · Field GuidanceBusiness Examples
A regulated organization assesses a new requirement against affected products, customer processes, information systems, policies, controls, and third-party services before approving remediation.
Common Audit Findings
Impact assessments omit affected processes, controls, systems, third parties, or business functions, or lack documented approval.
Common Mistakes
Assessing only legal wording; failing to identify control gaps; not considering implementation effort, dependencies, or critical business services.
Best Practices & Ownership
REG-003 · Recommended ApproachRecommended Practices
Use a standardized assessment template covering applicability, obligations, risks, controls, policies, processes, technology, data, third parties, deadlines, resources, and approvals.
Typical Owner
Chief Compliance Officer / Enterprise Risk Management
Cross-Mapped Regulatory Frameworks
Harmonized Control Mappings| FRAMEWORK CODE | FRAMEWORK NAME & DETAILS | FAMILY / CATEGORY | VERSION | ACTION |
|---|---|---|---|---|
| COBIT2019 | COBIT COBIT is an enterprise governance and management f... Clause: 4.5 – Monitor, Evaluate and Assess (MEA) > MEA03 – Managed Compliance With External Requirements > MEA03.01 – Identify external compliance requirements. |
COBIT
Governance Framework
|
v2019 | View → |
| ISO22301 | ISO/IEC 22301 ISO 22301 specifies requirements for a Business Co... Clause: 4.2.2 – Legal and regulatory requirements, 8.2.1 – General |
ISO
Standard
|
v2019 | View → |
| NIST-CSF | NIST Cybersecurity Framework (CSF) The NIST Cybersecurity Framework provides high-lev... Clause: GV.OC-03 – Organizational Context |
NIST
Framework
|
v2 | View → |
| PCI-DSS | PCI DSS PCI DSS is an industry security standard maintaine... Clause: 12.5.2 – PCI DSS scope is documented and |
PCI
Standard
|
v4 | View → |
Parent Domain Context
Governance Domain BaselineDomain Name:
Regulatory Change Management (REG)
Purpose:
To systematically identify, track, and assess changes in relevant laws and regulations to ensure the organization remains compliant.
Scope:
Enterprise
Parent Control Context
Control BaselineControl Name:
Regulatory Change Impact Assessment (REG-003)
Summary:
Requires structured impact analysis covering applicability, affected obligations, business processes, risks, policies, controls, systems, data, third parties, and critical business functions, with documented conclusions and approvals.
Business Description:
Perform documented impact assessments for identified regulatory changes to determine effects on business processes, risk profiles, policies, controls, technology, and critical business functions.