All records
Page 12 of 17. 1677 records.
Browse the catalog · First JSON page
risk
Remote-work, mobile and split-tunneling exposure
risk
Session hijacking and unauthorized-protocol egress
risk
Acceptance of data from untrustworthy sources
risk
Negligent advisory activities and breach of duty of care
risk
Core process breakdown and inability to scale
risk
Trade-counterparty performance and settlement disputes
risk
Client intake, documentation and account-management failures
risk
Transaction-processing and execution errors
risk
Product design and model errors
risk
Product and service quality failure
risk
Failed or inaccurate mandatory regulatory reporting
risk
Physical and cyber-physical attacks on facilities and infrastructure
risk
Physical damage to assets from disaster, terrorism or vandalism
risk
Environmental degradation of equipment (dust, humidity, temperature, EMI)
risk
Inadequate protection against fire, flood and physical hazards
risk
Inadequate physical protection and access controls
risk
Remote spying and shoulder-surfing of screens/documents
risk
Theft of equipment, media or unattended devices
risk
Cross-border personal-data transfer without safeguards
risk
Erosion of individual trust and confidence in data practices
risk
Absence of privacy-by-design and default
risk
Power imbalance and loss of self-determination over personal data
risk
Brand and reputational crisis
risk
Stakeholder trust and social-license erosion
risk
Inadequate or absent risk assessment process
risk
Securities-law and SEC-reporting non-compliance
risk
Applications running with excessive privilege / insecure design
risk
Malware delivery, insertion and compromise of systems
risk
Ransomware disrupting operations and data availability
risk
Vulnerabilities introduced during software development
risk
Product, customer or market concentration
risk
Competitive disruption and business-model obsolescence
risk
Geopolitical, macroeconomic and sovereign risk
risk
Innovation shortfall and emerging-technology adoption risk
risk
Failed M&A, integration or divestiture
risk
Strategic misalignment and execution failure
risk
Hardware and equipment failure
risk
Illegal processing of personal or sensitive data
risk
Loss of essential services (power, HVAC, telecoms)
risk
Loss of system maintainability
risk
Software and information-system failure
risk
Use of unlicensed, counterfeit or pirated software
risk
Critical vendor failure, insolvency or concentration
risk
Supply-chain disruption of critical inputs
risk
Malicious supply-chain injection of tampered hardware/software
risk
Third-party compliance failure creating vicarious liability
risk
Vendor/outsourcing service non-performance and disputes
risk
Weak supplier security requirements and monitoring
risk
Inadequate vulnerability scanning and pre-release testing
risk
Exploitation of known, unpatched vulnerabilities
risk
Zero-day exploitation
standard
AIUC-1 (Jul 2026)
standard
CCPA/CPRA
standard
COBIT 2019
standard
COSO ERM 2017
standard
COSO IC 2013
standard
EU DORA
standard
EU AI Act
standard
EU GDPR
standard
HIPAA
standard
IIA 2024 Standards
standard
The Role of the Internal Audit Function in Enterprise Risk Management
standard
Three Lines Model: Assurance and Advice in Support of Effective Governance
standard
ISO/IEC 27001:2022
standard
ISO 31000:2018
standard
ISO/IEC 42001:2023 (AI)
standard
EU NIS2
standard
NIST SP 800-53 Rev5
standard
NIST Agent Identity (draft, Feb 2026)
standard
NIST TEVV-Athlon (draft, Aug 2026)
standard
NIST CSF 2.0
standard
NYDFS Part 500
standard
PCI DSS v4.0.1
standard
SOC 1
standard
SOC 2 (TSC)
standard
SOX / PCAOB (ICFR)
unified
UC-ACCESS-01 — Provision and deprovision accounts through a managed lifecycle
unified
UC-ACCESS-02 — Review user access rights periodically
unified
UC-ACCESS-03 — Enforce least privilege, need-to-know, and segregation of duties
unified
UC-ACCESS-04 — Restrict privileged rights, utilities, and unauthorized software
unified
UC-ACCESS-05 — Enforce approved authorizations for information and functions
unified
UC-ACCESS-06 — Manage unique identities and identifiers end to end
unified
UC-ACCESS-07 — Proof identities before binding credentials
unified
UC-ACCESS-08 — Manage and protect authenticators across their lifecycle
unified
UC-ACCESS-09 — Authenticate all users with multi-factor authentication
unified
UC-ACCESS-10 — Authenticate devices and services before granting connections
unified
UC-ACCESS-11 — Defend logons against brute-force and anomalous attempts
unified
UC-ACCESS-12 — Lock, limit, and terminate user sessions
unified
UC-ACCESS-13 — Notify users of system terms and previous logon activity
unified
UC-ACCESS-14 — Authorize public content and external information sharing
unified
UC-ACCESS-15 — Design control activities over technology access
unified
UC-ACCESS-16 — Authorize, test, and approve changes and development
unified
UC-ACCESS-17 — Execute, monitor, and recover production processing
unified
UC-ACCESS-18 — Log and monitor system activity, capacity, and incidents
unified
UC-ACCESS-19 — Restrict physical access and maintain environmental safeguards
unified
UC-ACCESS-20 — Ensure complete, accurate, and authorized data processing
unified
UC-ACCESS-21 — Manage subservice organizations supporting the system
unified
UC-AI-01 — Maintain and periodically review the AI policy
unified
UC-AI-02 — Define AI roles, responsibilities, and competencies
unified
UC-AI-03 — Document AI system resources and dependencies