To provide reliable management and assurance visibility into the status, effectiveness, risks, exceptions, and outcomes of cross-border transfer management.
Define reporting requirements, audience, metrics, frequency, evidence, and escalation. Reports should distinguish status, exceptions, risks, trends, and corrective actions.
| FRAMEWORK CODE | FRAMEWORK NAME & DETAILS | FAMILY / CATEGORY | VERSION | ACTION |
|---|---|---|---|---|
| CIS-V8 | CIS Controls CIS Controls are a prioritized set of cybersecurit... Clause: Control 03 – Data Protection: 3.8 – Document Data Flows |
CIS
Best Practice
|
vv8 | View → |
| COBIT2019 | COBIT COBIT is an enterprise governance and management f... Clause: 4.5 – Monitor, Evaluate and Assess (MEA) > MEA03 – Managed Compliance with External Requirements > MEA03.04 – Obtain assurance of external compliance. |
COBIT
Governance Framework
|
v2019 | View → |
| DORA | Digital Operational Resilience Act The EU Digital Operational Resilience Act establis... Clause: Article 9(2) – ICT security policies, procedures, protocols and tools for resilience and data security Article 8(5) – Identification/documentation of ICT third-party dependencies supporting critical or important functions |
EU
Regulation
|
vCurrent | View → |
| DPDP | Digital Personal Data Protection Act The Digital Personal Data Protection Act, 2023 est... Clause: 16(1)-(2) – Processing of personal data outside India / restrictions and higher protection under other Indian law |
India
Law
|
v2023 | View → |
| HIPAA | Health Insurance Portability and Accountability Act HIPAA is a U.S. federal law supported by implement... Clause: § 164.312(g) Standard: Transmission security |
US
Law
|
vCurrent | View → |
| IRDAI | IRDAI Information & Cyber Security Guidelines IRDAI information and cyber-security requirements... Clause: §2.16-3.4 – Transfer and Movement; §2.12-3.1 – Use of Cryptography |
India
Guideline
|
vLatest | View → |
| ISO27001 | ISO/IEC 27001 ISO/IEC 27001 specifies auditable requirements for... Clause: 7.4 – Communication |
ISO
Standard
|
v2022 | View → |
| ISO27701 | ISO/IEC 27701 ISO/IEC 27701 provides requirements and guidance f... Clause: A.7.5.1; A.7.5.2; A.7.5.3; B.8.5.1; B.8.5.2; 6.5.2.4; A.7.5.1 – Identify basis for PII transfer between jurisdictions; A.7.5.2 – Countries and international organizations to which PII may be transferred; A.7.5.3 – Records of transfer of PII; B.8.5.1 – Basis for PII transfer between jurisdictions; B.8.5.2 – Countries and international organizations to which PII may be transferred; 6.5.2.4 – Information transfer (privacy) |
ISO
Privacy Standard
|
v2019 | View → |
| NIST-CSF | NIST Cybersecurity Framework (CSF) The NIST Cybersecurity Framework provides high-lev... Clause: ID.AM – Asset Management | ID.AM-07 – Inventories of data and corresponding metadata for designated data types are maintained PR.DS – Data Security | PR.DS-01 – The confidentiality, integrity, and availability of data-at-rest are protected |
NIST
Framework
|
v2 | View → |
| NPCI-ISR | NPCI Information Security Requirements NPCI information-security requirements define cont... Clause: Security Measures / Controls; Data Security |
India
Standard
|
vLatest | View → |
| PCI-DSS | PCI DSS PCI DSS is an industry security standard maintaine... Clause: 4.2.1 – Strong cryptography and security protocols; 4.2.2 – PAN is secured with strong cryptography |
PCI
Standard
|
v4 | View → |
| RBI-CSF | RBI Cyber Security Framework / Master Directions RBI cyber-security requirements and directions set... Clause: 1) Inventory Management of Business IT Assets – 1.3 Protection of data/information across storage, transmission, processing and access, inside/outside the bank; 11) Vendor Risk Management – 11.7 Legal/regulatory requirements for geographic location of infrastructure and cross-border data movement |
India
Regulation
|
vLatest | View → |
| SEBI-CSCRF | SEBI Cyber Security & Cyber Resilience Framework SEBI’s Cybersecurity and Cyber Resilience Framewor... Clause: 1.1 GV.OC: Organizational Context; 3.3 PR.DS: Data Security |
India
Regulation
|
vLatest | View → |
| SOC2 | SOC 2 Trust Services Criteria SOC 2 is an independent examination and reporting... Clause: P6.1 – Privacy: Disclosure and Notification – The entity discloses personal information to third parties with the explicit consent of data subjects and such consent is obtained prior to disclosure to meet the entity’s objectives related to privacy. CC2.2 – Information and Communication – COSO Principle 14: The entity internally communicates information, including objectives and responsibilities for internal control, necessary to support the functioning of internal control. |
AICPA
Audit Framework
|
vLatest | View → |