unified
UC-GOV-04 — Set tone at the top: integrity, ethics, and risk-aware culture
Leadership defines and demonstrates commitment to integrity, core ethical values, and the desired risk-aware culture through an adopted code of conduct, consistent leadership behavior, and periodic evaluation of adherence with timely remediation of deviations. Organizational leadership is responsible and accountable for cybersecurity and internal-control risk and fosters a culture that is ethical, risk-aware, and continually improving, with expectations communicated to all personnel and business partners.
Record JSON · Open in map · Data retrieval guide
Catalog revision: 24028ffcfc2b295fa1b08ee6caa84b765f0731b321496bf4f548c49ad2177028. A connection does not establish full coverage.
Attributes
- domain
- Governance, Policy & Oversight
- type
- preventive
- category
- administrative
Details
- unified_id
- UC-GOV-04
- title
- Set tone at the top: integrity, ethics, and risk-aware culture
- statement
- Leadership defines and demonstrates commitment to integrity, core ethical values, and the desired risk-aware culture through an adopted code of conduct, consistent leadership behavior, and periodic evaluation of adherence with timely remediation of deviations. Organizational leadership is responsible and accountable for cybersecurity and internal-control risk and fosters a culture that is ethical, risk-aware, and continually improving, with expectations communicated to all personnel and business partners.
- domain
- Governance, Policy & Oversight
- control_type
- preventive
- control_category
- administrative
- members
- framework
- soc2
- control_id
- CC1.1
- coverage
- full
- relationship
- superset_of
- framework
- coso-ic
- control_id
- P1
- coverage
- full
- relationship
- superset_of
- framework
- coso-erm
- control_id
- E3
- coverage
- full
- relationship
- superset_of
- framework
- coso-erm
- control_id
- E4
- coverage
- full
- relationship
- superset_of
- framework
- nist-csf-2
- control_id
- GV.RR-01
- coverage
- full
- relationship
- superset_of
- framework
- sox
- control_id
- ELC-CE
- coverage
- partial
- delta
- also spans board oversight, organizational structure, competence, and HR policy elements
- relationship
- intersects_with
- guidance
Source
No record-specific source URL is provided.
Connections
- UC-GOV-04 — Set tone at the top: integrity, ethics, and risk-aware culture maps_to CC1.1 — The entity demonstrates a commitment to integrity and ethical values.
- framework
- soc2
- control_id
- CC1.1
- coverage
- full
- relationship
- superset_of
- delta
- Not provided
- source_version
- 2017 TSC
- provenance
- mapper
- coworkcanvas-compliance-graph
- reviewDate
- 2026-09-07
- direction
- canonical_to_source
- defaultConfidence
- medium
- defaultStatus
- active
- note
- Each member is a documented relationship claim from the canonical unified control to a source control or guidance proposition. relationship: equal|superset_of (full) / intersects_with|subset_of (partial) / informs (guidance). confidence 'medium' = single-mapper, documented, not yet externally corroborated. source_version is the member framework's edition from the standard version register.
- CSF 2.0 Profile & Maturity Assessment oversees UC-GOV-04 — Set tone at the top: integrity, ethics, and risk-aware culture
- UC-GOV-04 — Set tone at the top: integrity, ethics, and risk-aware culture mitigates Weak internal control environment enabling fraud and error
- strength
- primary
- rationale
- Tone at the top, ethics, and an adopted code of conduct are the control-environment foundation the risk names as poor.
- UC-GOV-04 — Set tone at the top: integrity, ethics, and risk-aware culture mitigates Stakeholder trust and social-license erosion
- strength
- related
- rationale
- Demonstrated integrity and core values counter the perceived values-misalignment that erodes stakeholder trust.
- UC-GOV-04 — Set tone at the top: integrity, ethics, and risk-aware culture mitigates Inadequate board and management oversight of risk and control
- strength
- primary
- rationale
- Leadership demonstrating integrity and a risk-aware culture directly addresses the unclear tone at the top driving oversight failure.
- UC-GOV-04 — Set tone at the top: integrity, ethics, and risk-aware culture maps_to P1 — The organization demonstrates a commitment to integrity and ethical values.
- framework
- coso-ic
- control_id
- P1
- coverage
- full
- relationship
- superset_of
- delta
- Not provided
- source_version
- 2013
- provenance
- mapper
- coworkcanvas-compliance-graph
- reviewDate
- 2026-09-07
- direction
- canonical_to_source
- defaultConfidence
- medium
- defaultStatus
- active
- note
- Each member is a documented relationship claim from the canonical unified control to a source control or guidance proposition. relationship: equal|superset_of (full) / intersects_with|subset_of (partial) / informs (guidance). confidence 'medium' = single-mapper, documented, not yet externally corroborated. source_version is the member framework's edition from the standard version register.
- UC-GOV-04 — Set tone at the top: integrity, ethics, and risk-aware culture mitigates Internal fraud — asset misappropriation, embezzlement, forgery
- strength
- related
- rationale
- An ethical culture, code of conduct, and disciplinary follow-through deter the rationalization leg of insider fraud.
- UC-GOV-04 — Set tone at the top: integrity, ethics, and risk-aware culture mitigates Brand and reputational crisis
- strength
- related
- rationale
- Consistent ethical leadership behavior reduces executive-misconduct triggers of brand crises.
- SOC 2 Trust Services Readiness tests UC-GOV-04 — Set tone at the top: integrity, ethics, and risk-aware culture
- UC-GOV-04 — Set tone at the top: integrity, ethics, and risk-aware culture maps_to ELC-CE — Control Environment — tone at the top, integrity and ethical values, code of conduct, board/audit committee oversight, organizational structure, assignment of authority and responsibility, commitment to competence, HR policies.
- framework
- sox
- control_id
- ELC-CE
- coverage
- partial
- delta
- also spans board oversight, organizational structure, competence, and HR policy elements
- relationship
- intersects_with
- source_version
- SOX §302/§404 (2002), PCAOB AS 2201
- provenance
- mapper
- coworkcanvas-compliance-graph
- reviewDate
- 2026-09-07
- direction
- canonical_to_source
- defaultConfidence
- medium
- defaultStatus
- active
- note
- Each member is a documented relationship claim from the canonical unified control to a source control or guidance proposition. relationship: equal|superset_of (full) / intersects_with|subset_of (partial) / informs (guidance). confidence 'medium' = single-mapper, documented, not yet externally corroborated. source_version is the member framework's edition from the standard version register.
- UC-GOV-04 — Set tone at the top: integrity, ethics, and risk-aware culture maps_to GV.RR-01 — Roles, Responsibilities, and Authorities: Organizational leadership is responsible and accountable for cybersecurity risk and fosters a culture that is risk-aware, ethical, and continually improving
- framework
- nist-csf-2
- control_id
- GV.RR-01
- coverage
- full
- relationship
- superset_of
- delta
- Not provided
- source_version
- 2.0
- provenance
- mapper
- coworkcanvas-compliance-graph
- reviewDate
- 2026-09-07
- direction
- canonical_to_source
- defaultConfidence
- medium
- defaultStatus
- active
- note
- Each member is a documented relationship claim from the canonical unified control to a source control or guidance proposition. relationship: equal|superset_of (full) / intersects_with|subset_of (partial) / informs (guidance). confidence 'medium' = single-mapper, documented, not yet externally corroborated. source_version is the member framework's edition from the standard version register.
- Code of Conduct & Workforce Accountability Cycle operates UC-GOV-04 — Set tone at the top: integrity, ethics, and risk-aware culture
- UC-GOV-04 — Set tone at the top: integrity, ethics, and risk-aware culture maps_to E3 — Defines Desired Culture
- framework
- coso-erm
- control_id
- E3
- coverage
- full
- relationship
- superset_of
- delta
- Not provided
- source_version
- 2017
- provenance
- mapper
- coworkcanvas-compliance-graph
- reviewDate
- 2026-09-07
- direction
- canonical_to_source
- defaultConfidence
- medium
- defaultStatus
- active
- note
- Each member is a documented relationship claim from the canonical unified control to a source control or guidance proposition. relationship: equal|superset_of (full) / intersects_with|subset_of (partial) / informs (guidance). confidence 'medium' = single-mapper, documented, not yet externally corroborated. source_version is the member framework's edition from the standard version register.
- UC-GOV-04 — Set tone at the top: integrity, ethics, and risk-aware culture maps_to E4 — Demonstrates Commitment to Core Values
- framework
- coso-erm
- control_id
- E4
- coverage
- full
- relationship
- superset_of
- delta
- Not provided
- source_version
- 2017
- provenance
- mapper
- coworkcanvas-compliance-graph
- reviewDate
- 2026-09-07
- direction
- canonical_to_source
- defaultConfidence
- medium
- defaultStatus
- active
- note
- Each member is a documented relationship claim from the canonical unified control to a source control or guidance proposition. relationship: equal|superset_of (full) / intersects_with|subset_of (partial) / informs (guidance). confidence 'medium' = single-mapper, documented, not yet externally corroborated. source_version is the member framework's edition from the standard version register.