This requirement exists to update policies, standards, procedures, controls, and other compliance artifacts after regulatory change and to support consistent, auditable compliance management.
Define the required compliance update management process, accountable roles, inputs, outputs, approval points, evidence requirements, review frequency, and escalation criteria. Integrate the activity with the organization's compliance records and related risk, policy, control, and assessment processes. A financial services organization tracks regulatory updates, assesses affected controls and processes, assigns implementation actions, and communicates required changes to control owners.
| FRAMEWORK CODE | FRAMEWORK NAME & DETAILS | FAMILY / CATEGORY | VERSION | ACTION |
|---|---|---|---|---|
| IRDAI | IRDAI Information & Cyber Security Guidelines IRDAI information and cyber-security requirements... Clause: §1.5-IV – Review Frequency; §2.17-3.1 – Legal and Regulatory |
India
Guideline
|
vLatest | View → |
| SEBI-CSCRF | SEBI Cyber Security & Cyber Resilience Framework SEBI’s Cybersecurity and Cyber Resilience Framewor... Clause: 1.1 GV.OC: Organizational Context |
India
Regulation
|
vLatest | View → |
| DORA | Digital Operational Resilience Act The EU Digital Operational Resilience Act establis... Clause: Article 9(4)(f) – Documented policies for patches and updates |
EU
Regulation
|
vCurrent | View → |
| ISO27002 | ISO/IEC 27002 ISO/IEC 27002 is a guidance standard containing a... Clause: 5.31 – Legal, statutory, regulatory and contractual requirements; 5.36 – Compliance with policies, rules and standards for information security |
ISO
Standard
|
v2022 | View → |
| COBIT2019 | COBIT COBIT is an enterprise governance and management f... Clause: 4.5 – Monitor, Evaluate and Assess (MEA) > MEA03 – Managed Compliance with External Requirements > MEA03.03 – Confirm external compliance. |
COBIT
Governance Framework
|
v2019 | View → |
| ISO22301 | ISO/IEC 22301 ISO 22301 specifies requirements for a Business Co... Clause: 4.2.2 – Legal and regulatory requirements |
ISO
Standard
|
v2019 | View → |
| NIST-CSF | NIST Cybersecurity Framework (CSF) The NIST Cybersecurity Framework provides high-lev... Clause: GV.OC – Organizational Context | GV.OC-03 – Legal, regulatory, and contractual requirements regarding cybersecurity — including privacy and civil liberties obligations — are understood and managed |
NIST
Framework
|
v2 | View → |
| NIST80053 | NIST SP 800-53 NIST SP 800-53 Rev. 5 presents control families, i... Clause: 3.13 – PROGRAM MANAGEMENT; PM-9 – RISK MANAGEMENT STRATEGY |
NIST
Control Catalog
|
vRev. 5 | View → |
| NPCI-ISR | NPCI Information Security Requirements NPCI information-security requirements define cont... Clause: Governance Controls; Policy, Roles and Risk Linkages – Monitor policy compliance and exceptions |
India
Standard
|
vLatest | View → |
| SOC2 | SOC 2 Trust Services Criteria SOC 2 is an independent examination and reporting... Clause: CC3.4 – Risk Assessment – COSO Principle 9: The entity identifies and assesses changes that could significantly impact the system of internal control. CC5.3 – Control Activities – COSO Principle 12: The entity deploys control activities through policies that establish what is expected and in procedures that put policies into action. |
AICPA
Audit Framework
|
vLatest | View → |