Audit Planning

Assurance Intelligence

Dashboard Audit Universe Risk Registers Controls Hub Issues Hub Cyber Overlay Frameworks Annual Plan Engagement Planner Snapshots Analytics Score Models Framework Catalogs Universe Import Role Permissions AI Audit Log

Acting as

Loading screen…

Framework reference browser

Unified Framework Catalog

242 unified controls across 18 domains · 202 CCM v4.1 tagged · 156 NIST AI 600-1 tagged · 44 of 50 internal controls mapped

Unified CSA AICM NIST CSF 2.0 CRI Profile v2.2 MITRE ATT&CK MITRE ATLAS

All frameworks CCM v4.1 tagged AI 600-1 taggedCSF GV CSF ID CSF PR CSF DE CSF RS CSF RCAI-specific

242 of 242 references match

Application & Interface Security15

Application Vulnerability Remediation

AIS-08Input Validation

AIS-09Output Validation

AIS-10API Security

AIS-11Agents Security Boundaries

AIS-12Source Code Managemement

AIS-13AI Sandboxing

AIS-14AI Cache Protection

AIS-15Prompt Differentation

Audit & Assurance6

A&A-01Audit and Assurance Policy and Procedures
A&A-02Independent Assessments
A&A-03Risk Based Planning Assessment
A&A-04Requirements Compliance
A&A-05Audit Management Process
A&A-06Remediation

Business Continuity Management and Operational Resilience11

BCR-01Business Continuity Management Policy and Procedures
BCR-02Risk Assessment and Impact Analysis
BCR-03Business Continuity Strategy
BCR-04Business Continuity Planning
BCR-05Documentation
BCR-06Business Continuity Exercises
BCR-07Communication
BCR-08Backup
BCR-09Disaster Response Plan
BCR-10Response Plan Exercise
BCR-11Equipment Redundancy

Change Control and Configuration Management9

CCC-01Change Management Policy and Procedures
CCC-02Quality Testing
CCC-03Change Management Technology
CCC-04Change Authorization
CCC-05Change Agreements
CCC-06Change Management Baseline
CCC-07Detection of Baseline Deviation
CCC-08Exception Management
CCC-09Change Restoration

Cryptography, Encryption & Key Management21

CEK-01Encryption and Key Management Policy and Procedures
CEK-02CEK Roles and Responsibilities
CEK-03Data Encryption
CEK-04Encryption Algorithm
CEK-05Encryption Change Management
CEK-06Encryption Change Cost Benefit Analysis
CEK-07Encryption Risk Management
CEK-08Customer Key Management Capability
CEK-09Encryption and Key Management Audit
CEK-10Key Generation
CEK-11Key Purpose
CEK-12Key Rotation
CEK-13Key Revocation
CEK-14Key Destruction
CEK-15Key Activation
CEK-16Key Suspension
CEK-17Key Deactivation
CEK-18Key Archival
CEK-19Key Compromise
CEK-20Key Recovery
CEK-21Key Inventory Management

Data Security and Privacy Lifecycle Management24

DSP-01Security and Privacy Policy and Procedures
DSP-02Secure Disposal
DSP-03Data Inventory
DSP-04Data Classification
DSP-05Data Flow Documentation
DSP-06Data Ownership and Stewardship
DSP-07Data Protection by Design and Default
DSP-08Data Privacy by Design and Default
DSP-09Data Protection Impact Assessment
DSP-10Sensitive Data Transfer
DSP-11Personal Data Access, Reversal, Rectification and Deletion
DSP-12Limitation of Purpose in Personal Data Processing
DSP-13Personal Data Sub-processing
DSP-14Disclosure of Data Sub-processors
DSP-15Limitation of Production Data Use
DSP-16Data Retention and Deletion
DSP-17Sensitive Data Protection
DSP-18Disclosure Notification
DSP-19Data Location
DSP-20Data Provenance and Transparency
DSP-21Data Poisoning Prevention & Detection
DSP-22Privacy Enhancing Technologies
DSP-23Data Integrity Check
DSP-24Data Differentiation and Relevance

Datacenter Security15

DCS-01Off-Site Equipment Disposal Policy and Procedures
DCS-02Off-Site Transfer Authorization Policy and Procedures
DCS-03Secure Area Policy and Procedures
DCS-04Secure Media Transportation Policy and Procedures
DCS-05Assets Classification
DCS-06Assets Cataloguing and Tracking
DCS-07Controlled Physical Access Points
DCS-08Equipment Identification
DCS-09Secure Area Authorization
DCS-10Surveillance System
DCS-11Adverse Event Response Training
DCS-12Cabling Security
DCS-13Environmental Systems
DCS-14Secure Utilities
DCS-15Equipment Location

Governance, Risk and Compliance15

GRC-01Governance Program Policy and Procedures
GRC-02Risk Management Program
GRC-03Organizational Policy Reviews
GRC-04Policy Exception Process
GRC-05Information Security Program
GRC-06Governance Responsibility Model
GRC-07Information System Regulatory Mapping
GRC-08Special Interest Groups
GRC-09Acceptable Use of the AI Service
GRC-10AI Impact Assessment
GRC-11Bias and Fairness Assessment
GRC-12Ethics Committee
GRC-13Explainability Requirement
GRC-14Explainability Evaluation
GRC-15Human supervision

Human Resources15

HRS-01Background Screening Policy and Procedures
HRS-02Acceptable Use of Technology Policy and Procedures
HRS-03Clean Desk Policy and Procedures
HRS-04Remote and Home Working Policy and Procedures
HRS-05Asset returns
HRS-06Employment Termination
HRS-07Employment Agreement Process
HRS-08Employment Agreement Content
HRS-09Personnel Roles and Responsibilities
HRS-10Non-Disclosure Agreements
HRS-11Security Awareness Training
HRS-12Personal and Sensitive Data Awareness and Training
HRS-13Compliance User Responsibility
HRS-14AI Competency Training
HRS-15AI Acceptable Use

Identity & Access Management19

IAM-01Identity and Access Management Policy and Procedures
IAM-02Strong Password Policy and Procedures
IAM-03Identity Inventory
IAM-04Separation of Duties
IAM-05Least Privilege
IAM-06User Access Provisioning
IAM-07User Access Changes and Revocation
IAM-08User Access Review
IAM-09Segregation of Privileged Access Roles
IAM-10Management of Privileged Access Roles
IAM-11Customers' Approval for Agreed Privileged Access Roles
IAM-12Safeguard Logs Integrity
IAM-13Uniquely Identifiable Users
IAM-14Strong Authentication
IAM-15Passwords and Secrets Management
IAM-16Authorization Mechanisms
IAM-17Knowledge Access Control - Need to Know
IAM-18Output Modification and Special Authorization
IAM-19Agent Access Restriction

Infrastructure Security9

I&S-01Infrastructure and Virtualization Security Policy and Procedures
I&S-02Capacity and Resource Planning
I&S-03Network Security
I&S-04OS Hardening and Base Controls
I&S-05Production and Non-Production Environments
I&S-06Segmentation and Segregation
I&S-07Migration to Hosted Environments
I&S-08Network Architecture Documentation
I&S-09Network Defense

Interoperability & Portability4

IPY-01Interoperability and Portability Policy and Procedures
IPY-02Application Interface Availability
IPY-03Secure Interoperability and Portability Management
IPY-04Data Portability Contractual Obligations

Logging and Monitoring15

LOG-01Logging and Monitoring Policy and Procedures
LOG-02Audit Logs Protection
LOG-03Security Monitoring and Alerting
LOG-04Audit Logs Access and Accountability
LOG-05Audit Logs Monitoring and Response
LOG-06Clock Synchronization
LOG-07Logging Scope
LOG-08Log Records
LOG-09Log Protection
LOG-10Encryption Monitoring and Reporting
LOG-11Transaction/Activity Logging
LOG-12Access Control Logs
LOG-13Failures and Anomalies Reporting
LOG-14Input Monitoring
LOG-15Output Monitoring

Model Security13

MDS-01Training Pipeline Security
MDS-02Model Artifact Scanning
MDS-03Model Documentation
MDS-04Model Documentation Requirements
MDS-05Model Documentation Validation
MDS-06Adversarial Attack Analysis
MDS-07Robustness against Adversarial Attack / Model Hardening
MDS-08Model Integrity Checks
MDS-09Model Signing/Ownership Verification
MDS-10Model Continuous Monitoring
MDS-11Model Failure
MDS-12Open Model Risk Assessment
MDS-13Secure Model Format

Security Incident Management, E-Discovery, & Cloud Forensics9

SEF-01Security Incident Management Policy and Procedures
SEF-02Service Management Policy and Procedures
SEF-03Incident Response Plans
SEF-04Incident Response Testing
SEF-05Incident Response Metrics
SEF-06Event Triage Processes
SEF-07Security Breach Notification
SEF-08Points of Contact Maintenance
SEF-09Incident Response

Supply Chain Management, Transparency, and Accountability16

STA-01Supply Chain Risk Management Policies and Procedures
STA-02SSRM Policy and Procedures
STA-03SSRM Supply Chain
STA-04SSRM Guidance
STA-05SSRM Control Ownership
STA-06SSRM Documentation Review
STA-07SSRM Control Implementation
STA-08Supply Chain Inventory
STA-09Supply Chain Risk Management
STA-10Primary Service and Contractual Agreement
STA-11Supply Chain Agreement Review
STA-12Supply Chain Compliance Assessment
STA-13Supply Chain Service Agreement Compliance
STA-14Supply Chain Governance Review
STA-15Supply Chain Data Security Assessment
STA-16Service Bill of Material (BOM)

Threat & Vulnerability Management12

TVM-01Threat and Vulnerability Management Policy and Procedures
TVM-02Malware and Malicious Instructions Protection Policy and Procedures
TVM-03Vulnerability Remediation Schedule
TVM-04Detection Updates
TVM-05External Library Vulnerabilities
TVM-06Penetration Testing
TVM-07Vulnerability Remediation Schedule
TVM-08Vulnerability Prioritization
TVM-09Vulnerability Management Reporting
TVM-10Vulnerability Management Metrics
TVM-11Guardrails
TVM-13Threat Analysis and Modelling

Universal Endpoint Management14

UEM-01Endpoint Devices Policy and Procedures
UEM-02Application and Service Approval
UEM-03Compatibility
UEM-04Endpoint Inventory
UEM-05Endpoint Management
UEM-06Automatic Lock Screen
UEM-07Operating Systems
UEM-08Storage Encryption
UEM-09Anti-Malware Detection and Prevention
UEM-10Software Firewall
UEM-11Data Loss Prevention
UEM-12Remote Locate
UEM-13Remote Wipe
UEM-14Third-Party Endpoint Security Posture

Select a framework reference from the catalog tree to see its citations and mapped internal controls.