This requirement exists to rank regulatory changes according to impact, urgency, significance, and implementation constraints and to support consistent, auditable compliance management.
Define the required change prioritization process, accountable roles, inputs, outputs, approval points, evidence requirements, review frequency, and escalation criteria. Integrate the activity with the organization's compliance records and related risk, policy, control, and assessment processes. A financial services organization tracks regulatory updates, assesses affected controls and processes, assigns implementation actions, and communicates required changes to control owners.
| FRAMEWORK CODE | FRAMEWORK NAME & DETAILS | FAMILY / CATEGORY | VERSION | ACTION |
|---|---|---|---|---|
| IRDAI | IRDAI Information & Cyber Security Guidelines IRDAI information and cyber-security requirements... Clause: §2.17-3.1 – Legal and Regulatory; §1.5-IV – Review Frequency |
India
Guideline
|
vLatest | View → |
| SEBI-CSCRF | SEBI Cyber Security & Cyber Resilience Framework SEBI’s Cybersecurity and Cyber Resilience Framewor... Clause: 1.1 GV.OC: Organizational Context |
India
Regulation
|
vLatest | View → |
| ISO27002 | ISO/IEC 27002 ISO/IEC 27002 is a guidance standard containing a... Clause: 5.31 – Legal, statutory, regulatory and contractual requirements; 5.36 – Compliance with policies, rules and standards for information security |
ISO
Standard
|
v2022 | View → |
| COBIT2019 | COBIT COBIT is an enterprise governance and management f... Clause: 4.5 – Monitor, Evaluate and Assess (MEA) > MEA03 – Managed Compliance with External Requirements > MEA03.01 – Identify external compliance requirements. |
COBIT
Governance Framework
|
v2019 | View → |
| ISO22301 | ISO/IEC 22301 ISO 22301 specifies requirements for a Business Co... Clause: 4.2.2 – Legal and regulatory requirements |
ISO
Standard
|
v2019 | View → |
| NIST-CSF | NIST Cybersecurity Framework (CSF) The NIST Cybersecurity Framework provides high-lev... Clause: ID.RA – Risk Assessment | ID.RA-07 – Changes and exceptions are managed, assessed for risk impact, recorded, and tracked |
NIST
Framework
|
v2 | View → |
| NIST80053 | NIST SP 800-53 NIST SP 800-53 Rev. 5 presents control families, i... Clause: 3.13 – PROGRAM MANAGEMENT; PM-9 – RISK MANAGEMENT STRATEGY |
NIST
Control Catalog
|
vRev. 5 | View → |
| SOC2 | SOC 2 Trust Services Criteria SOC 2 is an independent examination and reporting... Clause: CC3.4 – Risk Assessment – COSO Principle 9: The entity identifies and assesses changes that could significantly impact the system of internal control. CC5.3 – Control Activities – COSO Principle 12: The entity deploys control activities through policies that establish what is expected and in procedures that put policies into action. CC8.1 – Change Management – The entity authorizes, designs, develops or acquires, configures, documents, tests, approves, and implements changes to infrastructure, data, software, and procedures to meet its objectives. |
AICPA
Audit Framework
|
vLatest | View → |