This requirement exists to ensure planning for certification assessments, evidence readiness, assessor coordination, and remediation is consistently governed, documented, and capable of producing reliable assurance. Without it, audit activities may be inconsistent, difficult to evidence, or insufficient to support management, regulatory, and stakeholder decisions.
Document the required planning for certification assessments, evidence readiness, assessor coordination, and remediation; assign accountable roles and approval points; define minimum records and evidence; apply the approved audit methodology and risk criteria; and retain evidence of execution and review. Periodically review the process for changes in organizational risk, regulatory expectations, and audit scope.
| FRAMEWORK CODE | FRAMEWORK NAME & DETAILS | FAMILY / CATEGORY | VERSION | ACTION |
|---|---|---|---|---|
| RBI-CSF | RBI Cyber Security Framework / Master Directions RBI cyber-security requirements and directions set... Clause: Circular §13 – Cyber security preparedness indicators |
India
Regulation
|
vLatest | View → |
| DORA | Digital Operational Resilience Act The EU Digital Operational Resilience Act establis... Clause: Article 5(2)(f) – Approval and periodic review of ICT internal audit plans and audits Article 6(6) – Regular internal audit of ICT risk management framework |
EU
Regulation
|
vCurrent | View → |
| HIPAA | Health Insurance Portability and Accountability Act HIPAA is a U.S. federal law supported by implement... Clause: § 164.308(a)(14) Standard: Compliance audit; § 164.316(a)(2) Actions, activities and assessments documentation |
US
Law
|
vCurrent | View → |
| COBIT2019 | COBIT COBIT is an enterprise governance and management f... Clause: 4.5 – Monitor, Evaluate and Assess (MEA) > MEA02 – Managed System of Internal Control > MEA02.02 – Review effectiveness of business process controls. |
COBIT
Governance Framework
|
v2019 | View → |
| NIST-CSF | NIST Cybersecurity Framework (CSF) The NIST Cybersecurity Framework provides high-lev... Clause: GV.OV – Oversight | GV.OV-03 – Organizational cybersecurity risk management performance is evaluated and reviewed for adjustments needed |
NIST
Framework
|
v2 | View → |
| NIST80053 | NIST SP 800-53 NIST SP 800-53 Rev. 5 presents control families, i... Clause: 3.4 – ASSESSMENT, AUTHORIZATION, AND MONITORING; CA-2 – CONTROL ASSESSMENTS, CA-4 – SECURITY CERTIFICATION |
NIST
Control Catalog
|
vRev. 5 | View → |
| GDPR | General Data Protection Regulation (GDPR) The General Data Protection Regulation is a bindin... Clause: Article 42 – Certification |
EU
Regulation
|
vCurrent | View → |
| NPCI-ISR | NPCI Information Security Requirements NPCI information-security requirements define cont... Clause: Operational Review; Review – ISO 27001 and PCI DSS |
India
Standard
|
vLatest | View → |
| SOC2 | SOC 2 Trust Services Criteria SOC 2 is an independent examination and reporting... Clause: CC4.1 – Monitoring of Controls – COSO Principle 16: The entity selects, develops, and performs ongoing and/or separate evaluations to ascertain whether the components of internal control are present and functioning. |
AICPA
Audit Framework
|
vLatest | View → |