{"catalogRevision":"24028ffcfc2b295fa1b08ee6caa84b765f0731b321496bf4f548c49ad2177028","kind":"record","record":{"attributes":{"category":"administrative","domain":"Compliance, Audit & Assurance","type":"detective"},"canonicalUrl":"https://controlsmap.com/?v=1&node=uc%3AUC-AUDIT-24","description":"The organization identifies applicable external legal, regulatory, and contractual requirements - including intellectual property rights and software licensing obligations - and maintains them in a compliance register with assigned owners. Compliance with these requirements is evaluated on a defined cadence, confirmed through documented reviews, and non-compliance is remediated with status reported to management. The register and evaluation results are retained as evidence.","details":{"control_category":"administrative","control_type":"detective","domain":"Compliance, Audit & Assurance","guidance":[],"members":[{"control_id":"MEA03","coverage":"full","framework":"cobit-2019","relationship":"superset_of"},{"control_id":"A.5.32","coverage":"partial","delta":"operational IPR safeguards - license/asset registers with usage-vs-entitlement enforcement, proof-of-license retention, and acquisition from authorized sources - beyond registering and periodically evaluating the obligation","framework":"iso-27001","relationship":"intersects_with"}],"statement":"The organization identifies applicable external legal, regulatory, and contractual requirements - including intellectual property rights and software licensing obligations - and maintains them in a compliance register with assigned owners. Compliance with these requirements is evaluated on a defined cadence, confirmed through documented reviews, and non-compliance is remediated with status reported to management. The register and evaluation results are retained as evidence.","title":"Manage compliance with external legal and regulatory requirements","unified_id":"UC-AUDIT-24"},"id":"uc:UC-AUDIT-24","mapUrl":"https://controlsmap.com/?v=1&node=uc%3AUC-AUDIT-24","sourceIds":["cobit-2019","iso-27001"],"sourceUrl":null,"title":"UC-AUDIT-24 — Manage compliance with external legal and regulatory requirements","type":"unified"},"relationships":[{"expectedCatalogRevision":"24028ffcfc2b295fa1b08ee6caa84b765f0731b321496bf4f548c49ad2177028","id":"rel:01437ecc49c71603a6a1b7a9d8786334b0f3144496a38b3a520c367192a335f7","properties":{},"sourceDetailPath":"/data/v1/records/wf-r2-e4fb6250.json","sourceId":"wf:R2","targetDetailPath":"/data/v1/records/uc-uc-audit-24-fa96fe18.json","targetId":"uc:UC-AUDIT-24","type":"oversees"},{"expectedCatalogRevision":"24028ffcfc2b295fa1b08ee6caa84b765f0731b321496bf4f548c49ad2177028","id":"rel:165477b789f44ce9d930421335c11f36733e2cb74deaafce7580ec576dacad75","properties":{"control_id":"MEA03","coverage":"full","delta":null,"framework":"cobit-2019","provenance":{"defaultConfidence":"medium","defaultStatus":"active","direction":"canonical_to_source","mapper":"coworkcanvas-compliance-graph","note":"Each member is a documented relationship claim from the canonical unified control to a source control or guidance proposition. relationship: equal|superset_of (full) / intersects_with|subset_of (partial) / informs (guidance). confidence 'medium' = single-mapper, documented, not yet externally corroborated. source_version is the member framework's edition from the standard version register.","reviewDate":"2026-09-07"},"relationship":"superset_of","source_version":"2019"},"sourceDetailPath":"/data/v1/records/uc-uc-audit-24-fa96fe18.json","sourceId":"uc:UC-AUDIT-24","targetDetailPath":"/data/v1/records/ctrl-cobit-2019-mea03-99c7dcca.json","targetId":"ctrl:cobit-2019:MEA03","type":"maps_to"},{"expectedCatalogRevision":"24028ffcfc2b295fa1b08ee6caa84b765f0731b321496bf4f548c49ad2177028","id":"rel:1d604f85f6c9ff7f5e38c98e78baacf9f2ca0011e622d3b735ffc61a4dd2364c","properties":{},"sourceDetailPath":"/data/v1/records/wf-g33-6008159c.json","sourceId":"wf:G33","targetDetailPath":"/data/v1/records/uc-uc-audit-24-fa96fe18.json","targetId":"uc:UC-AUDIT-24","type":"oversees"},{"expectedCatalogRevision":"24028ffcfc2b295fa1b08ee6caa84b765f0731b321496bf4f548c49ad2177028","id":"rel:41b33684e4b96c5e7adadba8734dae6b1849c1f9c0a41ed507a73de84aba54a1","properties":{"rationale":"Maintaining a register of software-licensing/IP obligations and evaluating compliance (ISO A.5.32) directly reduces use of unlicensed or pirated software.","strength":"primary"},"sourceDetailPath":"/data/v1/records/uc-uc-audit-24-fa96fe18.json","sourceId":"uc:UC-AUDIT-24","targetDetailPath":"/data/v1/records/risk-tech-unlicensed-counterfeit-software-91025350.json","targetId":"risk:tech-unlicensed-counterfeit-software","type":"mitigates"},{"expectedCatalogRevision":"24028ffcfc2b295fa1b08ee6caa84b765f0731b321496bf4f548c49ad2177028","id":"rel:57f3861fd75ea1e615d896cd9b7a87c6d164a98bb3e10a58ddcc0630cea68b2a","properties":{"rationale":"Maintaining and periodically re-evaluating the requirements register helps detect and adapt to changes in law and regulation.","strength":"related"},"sourceDetailPath":"/data/v1/records/uc-uc-audit-24-fa96fe18.json","sourceId":"uc:UC-AUDIT-24","targetDetailPath":"/data/v1/records/risk-compliance-regulatory-policy-change-9429f25b.json","targetId":"risk:compliance-regulatory-policy-change","type":"mitigates"},{"expectedCatalogRevision":"24028ffcfc2b295fa1b08ee6caa84b765f0731b321496bf4f548c49ad2177028","id":"rel:6245560e88a0b25a51c060ec56866eed4994290ee0d92752753fc75bd841b7e1","properties":{"control_id":"A.5.32","coverage":"partial","delta":"operational IPR safeguards - license/asset registers with usage-vs-entitlement enforcement, proof-of-license retention, and acquisition from authorized sources - beyond registering and periodically evaluating the obligation","framework":"iso-27001","provenance":{"defaultConfidence":"medium","defaultStatus":"active","direction":"canonical_to_source","mapper":"coworkcanvas-compliance-graph","note":"Each member is a documented relationship claim from the canonical unified control to a source control or guidance proposition. relationship: equal|superset_of (full) / intersects_with|subset_of (partial) / informs (guidance). confidence 'medium' = single-mapper, documented, not yet externally corroborated. source_version is the member framework's edition from the standard version register.","reviewDate":"2026-09-07"},"relationship":"intersects_with","source_version":"2022"},"sourceDetailPath":"/data/v1/records/uc-uc-audit-24-fa96fe18.json","sourceId":"uc:UC-AUDIT-24","targetDetailPath":"/data/v1/records/ctrl-iso-27001-a-5-32-7342e3f4.json","targetId":"ctrl:iso-27001:A.5.32","type":"maps_to"},{"expectedCatalogRevision":"24028ffcfc2b295fa1b08ee6caa84b765f0731b321496bf4f548c49ad2177028","id":"rel:7764fcbef31bc2b3ad7f35c5aa7463baaab50282693c1eeb83d99595d8116654","properties":{},"sourceDetailPath":"/data/v1/records/wf-d06-c9616fb8.json","sourceId":"wf:D06","targetDetailPath":"/data/v1/records/uc-uc-audit-24-fa96fe18.json","targetId":"uc:UC-AUDIT-24","type":"tests"},{"expectedCatalogRevision":"24028ffcfc2b295fa1b08ee6caa84b765f0731b321496bf4f548c49ad2177028","id":"rel:7c4f25785eb3c87346d26956d2c4162168f137acbb9c02526bcc6b48fc865995","properties":{"rationale":"Identifying and tracking intellectual-property-rights obligations and confirming compliance reduces infringement of third-party IP.","strength":"related"},"sourceDetailPath":"/data/v1/records/uc-uc-audit-24-fa96fe18.json","sourceId":"uc:UC-AUDIT-24","targetDetailPath":"/data/v1/records/risk-compliance-ip-infringement-337b44a1.json","targetId":"risk:compliance-ip-infringement","type":"mitigates"},{"expectedCatalogRevision":"24028ffcfc2b295fa1b08ee6caa84b765f0731b321496bf4f548c49ad2177028","id":"rel:91f8bd36cbb35927dbf563a1c310227e54f5c541cb5fc3c95ecf227d62101a94","properties":{},"sourceDetailPath":"/data/v1/records/wf-r1-a5f4fc75.json","sourceId":"wf:R1","targetDetailPath":"/data/v1/records/uc-uc-audit-24-fa96fe18.json","targetId":"uc:UC-AUDIT-24","type":"oversees"},{"expectedCatalogRevision":"24028ffcfc2b295fa1b08ee6caa84b765f0731b321496bf4f548c49ad2177028","id":"rel:9355fd7a51ade2a286f4a1133269c3027bb627d8db6eca853c29e2c5b2ecbfe7","properties":{"rationale":"A register of applicable legal/regulatory requirements with owners, evaluated on a cadence and remediated, is the operative defense against sector non-compliance.","strength":"primary"},"sourceDetailPath":"/data/v1/records/uc-uc-audit-24-fa96fe18.json","sourceId":"uc:UC-AUDIT-24","targetDetailPath":"/data/v1/records/risk-compliance-sector-regulatory-breach-5eb29698.json","targetId":"risk:compliance-sector-regulatory-breach","type":"mitigates"},{"expectedCatalogRevision":"24028ffcfc2b295fa1b08ee6caa84b765f0731b321496bf4f548c49ad2177028","id":"rel:9c3c4d0328acea5052f5489ea1db864610c950c0c00e30ae927573c946dfb645","properties":{"rationale":"Environmental permit and reporting obligations tracked in the register and evaluated for compliance reduce environmental non-compliance.","strength":"related"},"sourceDetailPath":"/data/v1/records/uc-uc-audit-24-fa96fe18.json","sourceId":"uc:UC-AUDIT-24","targetDetailPath":"/data/v1/records/risk-compliance-environmental-regulatory-5adf55ce.json","targetId":"risk:compliance-environmental-regulatory","type":"mitigates"},{"expectedCatalogRevision":"24028ffcfc2b295fa1b08ee6caa84b765f0731b321496bf4f548c49ad2177028","id":"rel:9e28b66a7684366e1c248bd4903cd2b5019e949e0e054ccb938deb48999e50c1","properties":{},"sourceDetailPath":"/data/v1/records/wf-r12-f55631e7.json","sourceId":"wf:R12","targetDetailPath":"/data/v1/records/uc-uc-audit-24-fa96fe18.json","targetId":"uc:UC-AUDIT-24","type":"operates"},{"expectedCatalogRevision":"24028ffcfc2b295fa1b08ee6caa84b765f0731b321496bf4f548c49ad2177028","id":"rel:bf002489ae975bdd6ba44ee23c5210a373c9e1fd74ca8ae486aefdd943e4a7cc","properties":{},"sourceDetailPath":"/data/v1/records/wf-r4-097c6fc4.json","sourceId":"wf:R4","targetDetailPath":"/data/v1/records/uc-uc-audit-24-fa96fe18.json","targetId":"uc:UC-AUDIT-24","type":"oversees"},{"expectedCatalogRevision":"24028ffcfc2b295fa1b08ee6caa84b765f0731b321496bf4f548c49ad2177028","id":"rel:f8a6f81e052712b32e1ddf11342cc7f624268cdfffbbb3ced7891611fb002135","properties":{"rationale":"Documented compliance evaluation and remediation of non-compliance reduces exposure to enforcement actions and litigation.","strength":"related"},"sourceDetailPath":"/data/v1/records/uc-uc-audit-24-fa96fe18.json","sourceId":"uc:UC-AUDIT-24","targetDetailPath":"/data/v1/records/risk-compliance-litigation-enforcement-25e7935d.json","targetId":"risk:compliance-litigation-enforcement","type":"mitigates"}],"schemaVersion":1}