{"catalogRevision":"24028ffcfc2b295fa1b08ee6caa84b765f0731b321496bf4f548c49ad2177028","kind":"record","record":{"attributes":{"category":"administrative","domain":"Governance, Policy & Oversight","type":"preventive"},"canonicalUrl":"https://controlsmap.com/?v=1&node=uc%3AUC-GOV-03","description":"Identify, document, and keep current all legal, statutory, regulatory, and contractual requirements relevant to information security and privacy — including privacy and civil-liberties obligations — and define and assign the organization's approach to meeting each. Assess and document applicability determinations, including any regulatory exemptions claimed, and file the notices required to support those determinations. Review the obligations register at planned intervals and upon regulatory or business change.","details":{"control_category":"administrative","control_type":"preventive","domain":"Governance, Policy & Oversight","guidance":[],"members":[{"control_id":"A.5.31","coverage":"full","framework":"iso-27001","relationship":"superset_of"},{"control_id":"GV.OC-03","coverage":"full","framework":"nist-csf-2","relationship":"superset_of"},{"control_id":"500.19","coverage":"full","framework":"nydfs-500","relationship":"superset_of"}],"statement":"Identify, document, and keep current all legal, statutory, regulatory, and contractual requirements relevant to information security and privacy — including privacy and civil-liberties obligations — and define and assign the organization's approach to meeting each. Assess and document applicability determinations, including any regulatory exemptions claimed, and file the notices required to support those determinations. Review the obligations register at planned intervals and upon regulatory or business change.","title":"Identify and manage legal, regulatory, and contractual obligations","unified_id":"UC-GOV-03"},"id":"uc:UC-GOV-03","mapUrl":"https://controlsmap.com/?v=1&node=uc%3AUC-GOV-03","sourceIds":["iso-27001","nist-csf-2","nydfs-500"],"sourceUrl":null,"title":"UC-GOV-03 — Identify and manage legal, regulatory, and contractual obligations","type":"unified"},"relationships":[{"expectedCatalogRevision":"24028ffcfc2b295fa1b08ee6caa84b765f0731b321496bf4f548c49ad2177028","id":"rel:044ef290a5fe365155d41361df8e1006589a4425d677a1001664bf696800a596","properties":{},"sourceDetailPath":"/data/v1/records/wf-r19-3b056389.json","sourceId":"wf:R19","targetDetailPath":"/data/v1/records/uc-uc-gov-03-9e248eb3.json","targetId":"uc:UC-GOV-03","type":"operates"},{"expectedCatalogRevision":"24028ffcfc2b295fa1b08ee6caa84b765f0731b321496bf4f548c49ad2177028","id":"rel:154d958f7575c4c20404f229d5d5eed816f850729edf2e15efbf4647a05a041d","properties":{},"sourceDetailPath":"/data/v1/records/wf-r20-856c93c3.json","sourceId":"wf:R20","targetDetailPath":"/data/v1/records/uc-uc-gov-03-9e248eb3.json","targetId":"uc:UC-GOV-03","type":"operates"},{"expectedCatalogRevision":"24028ffcfc2b295fa1b08ee6caa84b765f0731b321496bf4f548c49ad2177028","id":"rel:2577b41fb6b769b270deb98d35b352acd8e77e47cd7f1891ca9045efbdced96b","properties":{"rationale":"Maintaining a current register of legal/regulatory/contractual obligations and assigning how each is met reduces enforcement and litigation exposure.","strength":"primary"},"sourceDetailPath":"/data/v1/records/uc-uc-gov-03-9e248eb3.json","sourceId":"uc:UC-GOV-03","targetDetailPath":"/data/v1/records/risk-compliance-litigation-enforcement-25e7935d.json","targetId":"risk:compliance-litigation-enforcement","type":"mitigates"},{"expectedCatalogRevision":"24028ffcfc2b295fa1b08ee6caa84b765f0731b321496bf4f548c49ad2177028","id":"rel:2610ff3ffaf075c384e5ec62194e94275f13d5b9a1bf4bae7a8c00297cb82266","properties":{"control_id":"A.5.31","coverage":"full","delta":null,"framework":"iso-27001","provenance":{"defaultConfidence":"medium","defaultStatus":"active","direction":"canonical_to_source","mapper":"coworkcanvas-compliance-graph","note":"Each member is a documented relationship claim from the canonical unified control to a source control or guidance proposition. relationship: equal|superset_of (full) / intersects_with|subset_of (partial) / informs (guidance). confidence 'medium' = single-mapper, documented, not yet externally corroborated. source_version is the member framework's edition from the standard version register.","reviewDate":"2026-09-07"},"relationship":"superset_of","source_version":"2022"},"sourceDetailPath":"/data/v1/records/uc-uc-gov-03-9e248eb3.json","sourceId":"uc:UC-GOV-03","targetDetailPath":"/data/v1/records/ctrl-iso-27001-a-5-31-ed7ace76.json","targetId":"ctrl:iso-27001:A.5.31","type":"maps_to"},{"expectedCatalogRevision":"24028ffcfc2b295fa1b08ee6caa84b765f0731b321496bf4f548c49ad2177028","id":"rel:26ed8e93a5dfeb9e340fec7008dd29e51f3c65168d3baf3a169af9ad4da42460","properties":{},"sourceDetailPath":"/data/v1/records/wf-r5-c423cac7.json","sourceId":"wf:R5","targetDetailPath":"/data/v1/records/uc-uc-gov-03-9e248eb3.json","targetId":"uc:UC-GOV-03","type":"operates"},{"expectedCatalogRevision":"24028ffcfc2b295fa1b08ee6caa84b765f0731b321496bf4f548c49ad2177028","id":"rel:820ca2aee235804d678aaff7458dd2c47cb8ffdecc49bb6952f5a92c664a3dcc","properties":{},"sourceDetailPath":"/data/v1/records/wf-r4-097c6fc4.json","sourceId":"wf:R4","targetDetailPath":"/data/v1/records/uc-uc-gov-03-9e248eb3.json","targetId":"uc:UC-GOV-03","type":"oversees"},{"expectedCatalogRevision":"24028ffcfc2b295fa1b08ee6caa84b765f0731b321496bf4f548c49ad2177028","id":"rel:95467c5d0032e4e5d9349fb42a2db8c397908801e8bae15156bf78eb2bfe0789","properties":{"rationale":"","strength":"related"},"sourceDetailPath":"/data/v1/records/uc-uc-gov-03-9e248eb3.json","sourceId":"uc:UC-GOV-03","targetDetailPath":"/data/v1/records/risk-esg-climate-transition-35e73915.json","targetId":"risk:esg-climate-transition","type":"mitigates"},{"expectedCatalogRevision":"24028ffcfc2b295fa1b08ee6caa84b765f0731b321496bf4f548c49ad2177028","id":"rel:96b0ad7d79fe7e5e88fb5de327ffdf50595432c80bd5e9fc1f3194712c898263","properties":{},"sourceDetailPath":"/data/v1/records/wf-r18-45ff4c37.json","sourceId":"wf:R18","targetDetailPath":"/data/v1/records/uc-uc-gov-03-9e248eb3.json","targetId":"uc:UC-GOV-03","type":"operates"},{"expectedCatalogRevision":"24028ffcfc2b295fa1b08ee6caa84b765f0731b321496bf4f548c49ad2177028","id":"rel:b03b20157570b38153b4785466f8c67ee4505aac6c1c93df3b00d4e48b221265","properties":{},"sourceDetailPath":"/data/v1/records/wf-r3-be0f2e9a.json","sourceId":"wf:R3","targetDetailPath":"/data/v1/records/uc-uc-gov-03-9e248eb3.json","targetId":"uc:UC-GOV-03","type":"oversees"},{"expectedCatalogRevision":"24028ffcfc2b295fa1b08ee6caa84b765f0731b321496bf4f548c49ad2177028","id":"rel:b951279b3c1990ff98e42714207f34e338e83228a9e417d0814c5da0a1264235","properties":{},"sourceDetailPath":"/data/v1/records/wf-r2-e4fb6250.json","sourceId":"wf:R2","targetDetailPath":"/data/v1/records/uc-uc-gov-03-9e248eb3.json","targetId":"uc:UC-GOV-03","type":"oversees"},{"expectedCatalogRevision":"24028ffcfc2b295fa1b08ee6caa84b765f0731b321496bf4f548c49ad2177028","id":"rel:bbf16e8d6bdc1ba0ea248f5d620c07f64df2eb13d63983b73d807ba9dc31afdd","properties":{"control_id":"500.19","coverage":"full","delta":null,"framework":"nydfs-500","provenance":{"defaultConfidence":"medium","defaultStatus":"active","direction":"canonical_to_source","mapper":"coworkcanvas-compliance-graph","note":"Each member is a documented relationship claim from the canonical unified control to a source control or guidance proposition. relationship: equal|superset_of (full) / intersects_with|subset_of (partial) / informs (guidance). confidence 'medium' = single-mapper, documented, not yet externally corroborated. source_version is the member framework's edition from the standard version register.","reviewDate":"2026-09-07"},"relationship":"superset_of","source_version":"23 NYCRR 500, Second Amendment"},"sourceDetailPath":"/data/v1/records/uc-uc-gov-03-9e248eb3.json","sourceId":"uc:UC-GOV-03","targetDetailPath":"/data/v1/records/ctrl-nydfs-500-500-19-235a6ef9.json","targetId":"ctrl:nydfs-500:500.19","type":"maps_to"},{"expectedCatalogRevision":"24028ffcfc2b295fa1b08ee6caa84b765f0731b321496bf4f548c49ad2177028","id":"rel:bc5cf81f4191c5f14478cac23004a2e17a04cbc38cb9fb08f37e15a2e480eb92","properties":{},"sourceDetailPath":"/data/v1/records/wf-r17-a480a2e9.json","sourceId":"wf:R17","targetDetailPath":"/data/v1/records/uc-uc-gov-03-9e248eb3.json","targetId":"uc:UC-GOV-03","type":"operates"},{"expectedCatalogRevision":"24028ffcfc2b295fa1b08ee6caa84b765f0731b321496bf4f548c49ad2177028","id":"rel:d890f9cfff5498bfc8ac15d24f5cd7ef29966c87f57401588f542b075f1f744b","properties":{},"sourceDetailPath":"/data/v1/records/wf-d06-c9616fb8.json","sourceId":"wf:D06","targetDetailPath":"/data/v1/records/uc-uc-gov-03-9e248eb3.json","targetId":"uc:UC-GOV-03","type":"tests"},{"expectedCatalogRevision":"24028ffcfc2b295fa1b08ee6caa84b765f0731b321496bf4f548c49ad2177028","id":"rel:e4ffca6a9b9edeae0044e8efd3d760357fe322e2abf330c6355ba463db4f5e4c","properties":{"control_id":"GV.OC-03","coverage":"full","delta":null,"framework":"nist-csf-2","provenance":{"defaultConfidence":"medium","defaultStatus":"active","direction":"canonical_to_source","mapper":"coworkcanvas-compliance-graph","note":"Each member is a documented relationship claim from the canonical unified control to a source control or guidance proposition. relationship: equal|superset_of (full) / intersects_with|subset_of (partial) / informs (guidance). confidence 'medium' = single-mapper, documented, not yet externally corroborated. source_version is the member framework's edition from the standard version register.","reviewDate":"2026-09-07"},"relationship":"superset_of","source_version":"2.0"},"sourceDetailPath":"/data/v1/records/uc-uc-gov-03-9e248eb3.json","sourceId":"uc:UC-GOV-03","targetDetailPath":"/data/v1/records/ctrl-nist-csf-2-gv-oc-03-325aeeeb.json","targetId":"ctrl:nist-csf-2:GV.OC-03","type":"maps_to"}],"schemaVersion":1}