Governance Reporting (GOV-001-R011) - GOV-001

Requirement Details & Guidance

GOV-001-R011 · GOV-001

Why This Requirement Exists

To ensure all stakeholders have the information they need to fulfill their governance responsibilities, enabling informed oversight and decision-making.

Implementation Guidance

Define reporting requirements for each stakeholder; establish reporting schedules; ensure reports are accurate and timely; tailor content to audience; use clear, understandable language; maintain reporting quality.

Practical Application & Audit Readiness

GOV-001-R011 · Field Guidance

Business Examples

Common Audit Findings

Common Mistakes

Best Practices & Ownership

GOV-001 · Recommended Approach

Recommended Practices

Typical Owner

Cross-Mapped Regulatory Frameworks

Harmonized Control Mappings

FRAMEWORK CODE	FRAMEWORK NAME & DETAILS	FAMILY / CATEGORY	VERSION	ACTION
COBIT2019	COBIT COBIT is an enterprise governance and management f... Clause: 4.1 – Evaluate, Direct and Monitor (EDM) > EDM05 – Ensured Stakeholder Engagement > EDM05.02 – Direct stakeholder engagement, communication and reporting.	COBIT Governance Framework	v2019	View →
DORA	Digital Operational Resilience Act The EU Digital Operational Resilience Act establis... Clause: Article 5 – Governance and organisation Article 6(8)(a) – Alignment of ICT risk management framework with business strategy and objectives	EU Regulation	vCurrent	View →
GDPR	General Data Protection Regulation (GDPR) The General Data Protection Regulation is a bindin... Clause: Article 24(1) – Responsibility of the controller; Article 5(2) – Accountability	EU Regulation	vCurrent	View →
IRDAI	IRDAI Information & Cyber Security Guidelines IRDAI information and cyber-security requirements... Clause: §1.6-3 – Chief Information Security Officer (CISO); §1.6-14 – ISRMC; §1.6-15 – Control Management Committee	India Guideline	vLatest	View →
ISO22301	ISO/IEC 22301 ISO 22301 specifies requirements for a Business Co... Clause: 7.4 – Communication; 9.1 – Monitoring, measurement, analysis and evaluation; 9.3.2 – Management review input	ISO Standard	v2019	View →
ISO27001	ISO/IEC 27001 ISO/IEC 27001 specifies auditable requirements for... Clause: 7.4 – Communication	ISO Standard	v2022	View →
ISO27002	ISO/IEC 27002 ISO/IEC 27002 is a guidance standard containing a... Clause: 5.4 – Management responsibilities	ISO Standard	v2022	View →
NIS2	NIS2 Directive The NIS2 Directive establishes EU-wide cybersecuri... Clause: Article 20(1) – Governance	EU Directive	vCurrent	View →
NIST-CSF	NIST Cybersecurity Framework (CSF) The NIST Cybersecurity Framework provides high-lev... Clause: GV.OV – Oversight \| GV.OV-03 – Organizational cybersecurity risk management performance is evaluated and reviewed for adjustments needed	NIST Framework	v2	View →
NIST80053	NIST SP 800-53 NIST SP 800-53 Rev. 5 presents control families, i... Clause: 3.13 – PROGRAM MANAGEMENT; PM-6 – MEASURES OF PERFORMANCE	NIST Control Catalog	vRev. 5	View →
NPCI-ISR	NPCI Information Security Requirements NPCI information-security requirements define cont... Clause: Governance Controls; Governance and Oversight Structure – Governance Channels (Board of Directors / ISSC)	India Standard	vLatest	View →
PCI-DSS	PCI DSS PCI DSS is an industry security standard maintaine... Clause: 12.1.1 – An overall information security policy is:	PCI Standard	v4	View →
RBI-CSF	RBI Cyber Security Framework / Master Directions RBI cyber-security requirements and directions set... Clause: Circular §17 – Organisational arrangements; Circular §3 – Need for a Board approved Cyber-security Policy	India Regulation	vLatest	View →
SEBI-CSCRF	SEBI Cyber Security & Cyber Resilience Framework SEBI’s Cybersecurity and Cyber Resilience Framewor... Clause: 1.4 GV.OV: Oversight; 1.5 GV.RM: Risk Management	India Regulation	vLatest	View →
SOC2	SOC 2 Trust Services Criteria SOC 2 is an independent examination and reporting... Clause: CC2.2 – Information and Communication – COSO Principle 14: The entity internally communicates information, including objectives and responsibilities for internal control, necessary to support the functioning of internal control. CC4.2 – Monitoring of Controls – COSO Principle 17: The entity evaluates and communicates internal control deficiencies in a timely manner to those parties responsible for taking corrective action, including senior management and the board of directors, as appropriate.	AICPA Audit Framework	vLatest	View →

Parent Domain Context

Governance Domain Baseline

Domain Name:

Governance (GOV)

Purpose:

To establish, oversee, and continually improve the organization's security, privacy, and resilience program.

Scope:

Enterprise

View

Parent Control Context

Control Baseline

Control Name:

Information Security Governance (GOV-001)

Summary:

Establishes the foundational governance structures, accountabilities, and decision-making processes for the enterprise information security program, ensuring alignment with business strategy and regulatory requirements.

Business Description:

Establish, govern, operate, monitor, and continually improve an enterprise information security program that manages information security, cybersecurity, privacy, resilience, and regulatory compliance risks.

View