{"catalogRevision":"24028ffcfc2b295fa1b08ee6caa84b765f0731b321496bf4f548c49ad2177028","contextIds":["risk:access-privilege-abuse-repudiation","risk:access-unauthorized-use-equipment","risk:access-weak-authentication","risk:ai-privacy-leakage","risk:aware-phishing-social-engineering","risk:compliance-litigation-enforcement","risk:crypto-cleartext-credential-transfer","risk:crypto-counterfeit-certificates","risk:crypto-weak-or-absent-encryption","risk:data-breach-unauthorized-disclosure","risk:data-corruption-integrity-loss","risk:data-excessive-collection-purpose-creep","risk:data-exfiltration-espionage","risk:data-privacy-harms-to-individuals","risk:data-privacy-program-noncompliance","risk:data-reidentification-inference","risk:data-surveillance-appropriation","risk:data-transparency-notice-dark-patterns","risk:fin-segregation-of-duties","risk:fraud-external","risk:gov-policy-absent","risk:hr-discrimination-harassment","risk:hr-insufficient-screening","risk:hr-missing-security-terms-discipline"],"directIds":["ctrl:hipaa:HIPAA-164.308","ctrl:hipaa:HIPAA-164.310","ctrl:hipaa:HIPAA-164.312(a)","ctrl:hipaa:HIPAA-164.312(b)","ctrl:hipaa:HIPAA-164.312(c)","ctrl:hipaa:HIPAA-164.312(d)","ctrl:hipaa:HIPAA-164.312(e)","ctrl:hipaa:HIPAA-164.314","ctrl:hipaa:HIPAA-164.316","ctrl:hipaa:HIPAA-164.400-414","ctrl:hipaa:HIPAA-164.502","ctrl:hipaa:HIPAA-164.508","ctrl:hipaa:HIPAA-164.514","ctrl:hipaa:HIPAA-164.520","ctrl:hipaa:HIPAA-164.524","ctrl:hipaa:HIPAA-164.526"],"kind":"bundle","metadata":"/assets/agent_metadata.5c7612c9c5b0b455.json","name":"HIPAA","next":"/assets/agent_sources-hipaa-2.c05bd4df05f76383.json","page":1,"pageSize":40,"records":[{"attributes":{"category":"administrative","framework":"hipaa","type":"preventive"},"canonicalUrl":"https://controlsmap.com/frameworks/hipaa/","description":"Administrative safeguards (security management, risk analysis, workforce security, training, contingency plan, evaluation, BAAs)","details":{"automation":"manual","control_category":"administrative","control_id":"HIPAA-164.308","control_type":"preventive","domains":["Governance, Policy & Oversight","Risk Assessment & Management","Access Control & Identity Management","Physical & Environmental Security","Logging, Monitoring & Detection","Business Continuity & Disaster Recovery","Third-Party / Supply-Chain Risk","Data Protection & Privacy"],"framework":"hipaa","group":"HIPAA Security Rule","key_control":false,"requirement_frequency":null,"requirement_status":null,"risk_count":2,"source_pages":null,"source_url":null},"direct":true,"htmlUrl":"/agents/records/ctrl-hipaa-hipaa-164-308-d26b6932.html","id":"ctrl:hipaa:HIPAA-164.308","mapUrl":"https://controlsmap.com/?v=1&node=ctrl%3Ahipaa%3AHIPAA-164.308","sourceIds":["hipaa"],"sourceUrl":null,"title":"HIPAA-164.308 — Administrative safeguards (security management, risk analysis, workforce security, training, contingency plan, evaluation, BAAs)","type":"control","url":"/assets/agent_record-ctrl-hipaa-hipaa-164-308-d26b6932.22ddccedcaa2755e.json"},{"attributes":{"category":"physical","framework":"hipaa","type":"preventive"},"canonicalUrl":"https://controlsmap.com/frameworks/hipaa/","description":"Physical safeguards (facility access controls, workstation use/security, device and media controls)","details":{"automation":"hybrid","control_category":"physical","control_id":"HIPAA-164.310","control_type":"preventive","domains":["Governance, Policy & Oversight","Risk Assessment & Management","Access Control & Identity Management","Physical & Environmental Security","Logging, Monitoring & Detection","Business Continuity & Disaster Recovery","Third-Party / Supply-Chain Risk","Data Protection & Privacy"],"framework":"hipaa","group":"HIPAA Security Rule","key_control":false,"requirement_frequency":null,"requirement_status":null,"risk_count":3,"source_pages":null,"source_url":null},"direct":true,"htmlUrl":"/agents/records/ctrl-hipaa-hipaa-164-310-9cf84fad.html","id":"ctrl:hipaa:HIPAA-164.310","mapUrl":"https://controlsmap.com/?v=1&node=ctrl%3Ahipaa%3AHIPAA-164.310","sourceIds":["hipaa"],"sourceUrl":null,"title":"HIPAA-164.310 — Physical safeguards (facility access controls, workstation use/security, device and media controls)","type":"control","url":"/assets/agent_record-ctrl-hipaa-hipaa-164-310-9cf84fad.0d7044dffd909ae9.json"},{"attributes":{"category":"technical","framework":"hipaa","type":"preventive"},"canonicalUrl":"https://controlsmap.com/frameworks/hipaa/","description":"Technical access control for ePHI (unique user ID, emergency access, automatic logoff, encryption/decryption)","details":{"automation":"hybrid","control_category":"technical","control_id":"HIPAA-164.312(a)","control_type":"preventive","domains":["Governance, Policy & Oversight","Risk Assessment & Management","Access Control & Identity Management","Physical & Environmental Security","Logging, Monitoring & Detection","Business Continuity & Disaster Recovery","Third-Party / Supply-Chain Risk","Data Protection & Privacy"],"framework":"hipaa","group":"HIPAA Security Rule","key_control":false,"requirement_frequency":null,"requirement_status":null,"risk_count":4,"source_pages":null,"source_url":null},"direct":true,"htmlUrl":"/agents/records/ctrl-hipaa-hipaa-164-312-a-5c8bb707.html","id":"ctrl:hipaa:HIPAA-164.312(a)","mapUrl":"https://controlsmap.com/?v=1&node=ctrl%3Ahipaa%3AHIPAA-164.312%28a%29","sourceIds":["hipaa"],"sourceUrl":null,"title":"HIPAA-164.312(a) — Technical access control for ePHI (unique user ID, emergency access, automatic logoff, encryption/decryption)","type":"control","url":"/assets/agent_record-ctrl-hipaa-hipaa-164-312-a-5c8bb707.b17a8cd3c637ac4b.json"},{"attributes":{"category":"technical","framework":"hipaa","type":"detective"},"canonicalUrl":"https://controlsmap.com/frameworks/hipaa/","description":"Audit controls recording activity in systems with ePHI","details":{"automation":"automated","control_category":"technical","control_id":"HIPAA-164.312(b)","control_type":"detective","domains":["Governance, Policy & Oversight","Risk Assessment & Management","Access Control & Identity Management","Physical & Environmental Security","Logging, Monitoring & Detection","Business Continuity & Disaster Recovery","Third-Party / Supply-Chain Risk","Data Protection & Privacy"],"framework":"hipaa","group":"HIPAA Security Rule","key_control":false,"requirement_frequency":null,"requirement_status":null,"risk_count":4,"source_pages":null,"source_url":null},"direct":true,"htmlUrl":"/agents/records/ctrl-hipaa-hipaa-164-312-b-7272303c.html","id":"ctrl:hipaa:HIPAA-164.312(b)","mapUrl":"https://controlsmap.com/?v=1&node=ctrl%3Ahipaa%3AHIPAA-164.312%28b%29","sourceIds":["hipaa"],"sourceUrl":null,"title":"HIPAA-164.312(b) — Audit controls recording activity in systems with ePHI","type":"control","url":"/assets/agent_record-ctrl-hipaa-hipaa-164-312-b-7272303c.3f97e7dbfc1288c9.json"},{"attributes":{"category":"technical","framework":"hipaa","type":"preventive"},"canonicalUrl":"https://controlsmap.com/frameworks/hipaa/","description":"Integrity controls protecting ePHI from improper alteration or destruction","details":{"automation":"hybrid","control_category":"technical","control_id":"HIPAA-164.312(c)","control_type":"preventive","domains":["Governance, Policy & Oversight","Risk Assessment & Management","Access Control & Identity Management","Physical & Environmental Security","Logging, Monitoring & Detection","Business Continuity & Disaster Recovery","Third-Party / Supply-Chain Risk","Data Protection & Privacy"],"framework":"hipaa","group":"HIPAA Security Rule","key_control":false,"requirement_frequency":null,"requirement_status":null,"risk_count":3,"source_pages":null,"source_url":null},"direct":true,"htmlUrl":"/agents/records/ctrl-hipaa-hipaa-164-312-c-7002cebd.html","id":"ctrl:hipaa:HIPAA-164.312(c)","mapUrl":"https://controlsmap.com/?v=1&node=ctrl%3Ahipaa%3AHIPAA-164.312%28c%29","sourceIds":["hipaa"],"sourceUrl":null,"title":"HIPAA-164.312(c) — Integrity controls protecting ePHI from improper alteration or destruction","type":"control","url":"/assets/agent_record-ctrl-hipaa-hipaa-164-312-c-7002cebd.72dc179a1aee2a40.json"},{"attributes":{"category":"technical","framework":"hipaa","type":"preventive"},"canonicalUrl":"https://controlsmap.com/frameworks/hipaa/","description":"Person or entity authentication before ePHI access","details":{"automation":"hybrid","control_category":"technical","control_id":"HIPAA-164.312(d)","control_type":"preventive","domains":["Governance, Policy & Oversight","Risk Assessment & Management","Access Control & Identity Management","Physical & Environmental Security","Logging, Monitoring & Detection","Business Continuity & Disaster Recovery","Third-Party / Supply-Chain Risk","Data Protection & Privacy"],"framework":"hipaa","group":"HIPAA Security Rule","key_control":true,"requirement_frequency":null,"requirement_status":null,"risk_count":4,"source_pages":null,"source_url":null},"direct":true,"htmlUrl":"/agents/records/ctrl-hipaa-hipaa-164-312-d-d1e8fe74.html","id":"ctrl:hipaa:HIPAA-164.312(d)","mapUrl":"https://controlsmap.com/?v=1&node=ctrl%3Ahipaa%3AHIPAA-164.312%28d%29","sourceIds":["hipaa"],"sourceUrl":null,"title":"HIPAA-164.312(d) — Person or entity authentication before ePHI access","type":"control","url":"/assets/agent_record-ctrl-hipaa-hipaa-164-312-d-d1e8fe74.a9123c2005f8e7fd.json"},{"attributes":{"category":"technical","framework":"hipaa","type":"preventive"},"canonicalUrl":"https://controlsmap.com/frameworks/hipaa/","description":"Transmission security for ePHI (integrity controls and encryption in transit)","details":{"automation":"automated","control_category":"technical","control_id":"HIPAA-164.312(e)","control_type":"preventive","domains":["Governance, Policy & Oversight","Risk Assessment & Management","Access Control & Identity Management","Physical & Environmental Security","Logging, Monitoring & Detection","Business Continuity & Disaster Recovery","Third-Party / Supply-Chain Risk","Data Protection & Privacy"],"framework":"hipaa","group":"HIPAA Security Rule","key_control":false,"requirement_frequency":null,"requirement_status":null,"risk_count":4,"source_pages":null,"source_url":null},"direct":true,"htmlUrl":"/agents/records/ctrl-hipaa-hipaa-164-312-e-edf6e525.html","id":"ctrl:hipaa:HIPAA-164.312(e)","mapUrl":"https://controlsmap.com/?v=1&node=ctrl%3Ahipaa%3AHIPAA-164.312%28e%29","sourceIds":["hipaa"],"sourceUrl":null,"title":"HIPAA-164.312(e) — Transmission security for ePHI (integrity controls and encryption in transit)","type":"control","url":"/assets/agent_record-ctrl-hipaa-hipaa-164-312-e-edf6e525.cc09c2cb5592142d.json"},{"attributes":{"category":"administrative","framework":"hipaa","type":"preventive"},"canonicalUrl":"https://controlsmap.com/frameworks/hipaa/","description":"Organizational requirements (business associate contracts, group health plan requirements)","details":{"automation":"manual","control_category":"administrative","control_id":"HIPAA-164.314","control_type":"preventive","domains":["Governance, Policy & Oversight","Risk Assessment & Management","Access Control & Identity Management","Physical & Environmental Security","Logging, Monitoring & Detection","Business Continuity & Disaster Recovery","Third-Party / Supply-Chain Risk","Data Protection & Privacy"],"framework":"hipaa","group":"HIPAA Security Rule","key_control":false,"requirement_frequency":null,"requirement_status":null,"risk_count":5,"source_pages":null,"source_url":null},"direct":true,"htmlUrl":"/agents/records/ctrl-hipaa-hipaa-164-314-0b44ffa8.html","id":"ctrl:hipaa:HIPAA-164.314","mapUrl":"https://controlsmap.com/?v=1&node=ctrl%3Ahipaa%3AHIPAA-164.314","sourceIds":["hipaa"],"sourceUrl":null,"title":"HIPAA-164.314 — Organizational requirements (business associate contracts, group health plan requirements)","type":"control","url":"/assets/agent_record-ctrl-hipaa-hipaa-164-314-0b44ffa8.99cd944bf9558eae.json"},{"attributes":{"category":"administrative","framework":"hipaa","type":"preventive"},"canonicalUrl":"https://controlsmap.com/frameworks/hipaa/","description":"Policies and procedures and documentation requirements","details":{"automation":"manual","control_category":"administrative","control_id":"HIPAA-164.316","control_type":"preventive","domains":["Governance, Policy & Oversight","Risk Assessment & Management","Access Control & Identity Management","Physical & Environmental Security","Logging, Monitoring & Detection","Business Continuity & Disaster Recovery","Third-Party / Supply-Chain Risk","Data Protection & Privacy"],"framework":"hipaa","group":"HIPAA Security Rule","key_control":false,"requirement_frequency":null,"requirement_status":null,"risk_count":2,"source_pages":null,"source_url":null},"direct":true,"htmlUrl":"/agents/records/ctrl-hipaa-hipaa-164-316-15412c2a.html","id":"ctrl:hipaa:HIPAA-164.316","mapUrl":"https://controlsmap.com/?v=1&node=ctrl%3Ahipaa%3AHIPAA-164.316","sourceIds":["hipaa"],"sourceUrl":null,"title":"HIPAA-164.316 — Policies and procedures and documentation requirements","type":"control","url":"/assets/agent_record-ctrl-hipaa-hipaa-164-316-15412c2a.f2e05fe4a5905869.json"},{"attributes":{"category":"administrative","framework":"hipaa","type":"corrective"},"canonicalUrl":"https://controlsmap.com/frameworks/hipaa/","description":"Breach notification to individuals, media, and HHS (incl. business-associate duties)","details":{"automation":"manual","control_category":"administrative","control_id":"HIPAA-164.400-414","control_type":"corrective","domains":["Data Protection & Privacy","Incident Management & Response","Compliance, Audit & Assurance"],"framework":"hipaa","group":"HIPAA Privacy & Breach Notification","key_control":true,"requirement_frequency":null,"requirement_status":null,"risk_count":1,"source_pages":null,"source_url":null},"direct":true,"htmlUrl":"/agents/records/ctrl-hipaa-hipaa-164-400-414-aeadadc4.html","id":"ctrl:hipaa:HIPAA-164.400-414","mapUrl":"https://controlsmap.com/?v=1&node=ctrl%3Ahipaa%3AHIPAA-164.400-414","sourceIds":["hipaa"],"sourceUrl":null,"title":"HIPAA-164.400-414 — Breach notification to individuals, media, and HHS (incl. business-associate duties)","type":"control","url":"/assets/agent_record-ctrl-hipaa-hipaa-164-400-414-aeadadc4.93e85a35434b624f.json"},{"attributes":{"category":"administrative","framework":"hipaa","type":"preventive"},"canonicalUrl":"https://controlsmap.com/frameworks/hipaa/","description":"Uses and disclosures of PHI (permitted/required uses, minimum necessary)","details":{"automation":"manual","control_category":"administrative","control_id":"HIPAA-164.502","control_type":"preventive","domains":["Data Protection & Privacy","Incident Management & Response","Compliance, Audit & Assurance"],"framework":"hipaa","group":"HIPAA Privacy & Breach Notification","key_control":false,"requirement_frequency":null,"requirement_status":null,"risk_count":4,"source_pages":null,"source_url":null},"direct":true,"htmlUrl":"/agents/records/ctrl-hipaa-hipaa-164-502-8e8a8216.html","id":"ctrl:hipaa:HIPAA-164.502","mapUrl":"https://controlsmap.com/?v=1&node=ctrl%3Ahipaa%3AHIPAA-164.502","sourceIds":["hipaa"],"sourceUrl":null,"title":"HIPAA-164.502 — Uses and disclosures of PHI (permitted/required uses, minimum necessary)","type":"control","url":"/assets/agent_record-ctrl-hipaa-hipaa-164-502-8e8a8216.66d213cf2d589592.json"},{"attributes":{"category":"administrative","framework":"hipaa","type":"preventive"},"canonicalUrl":"https://controlsmap.com/frameworks/hipaa/","description":"Authorizations required for other uses and disclosures of PHI","details":{"automation":"manual","control_category":"administrative","control_id":"HIPAA-164.508","control_type":"preventive","domains":["Data Protection & Privacy","Incident Management & Response","Compliance, Audit & Assurance"],"framework":"hipaa","group":"HIPAA Privacy & Breach Notification","key_control":false,"requirement_frequency":null,"requirement_status":null,"risk_count":5,"source_pages":null,"source_url":null},"direct":true,"htmlUrl":"/agents/records/ctrl-hipaa-hipaa-164-508-208be590.html","id":"ctrl:hipaa:HIPAA-164.508","mapUrl":"https://controlsmap.com/?v=1&node=ctrl%3Ahipaa%3AHIPAA-164.508","sourceIds":["hipaa"],"sourceUrl":null,"title":"HIPAA-164.508 — Authorizations required for other uses and disclosures of PHI","type":"control","url":"/assets/agent_record-ctrl-hipaa-hipaa-164-508-208be590.6ab90d475414ce0f.json"},{"attributes":{"category":"administrative","framework":"hipaa","type":"preventive"},"canonicalUrl":"https://controlsmap.com/frameworks/hipaa/","description":"De-identification of PHI and limited data sets","details":{"automation":"manual","control_category":"administrative","control_id":"HIPAA-164.514","control_type":"preventive","domains":["Data Protection & Privacy","Incident Management & Response","Compliance, Audit & Assurance"],"framework":"hipaa","group":"HIPAA Privacy & Breach Notification","key_control":false,"requirement_frequency":null,"requirement_status":null,"risk_count":4,"source_pages":null,"source_url":null},"direct":true,"htmlUrl":"/agents/records/ctrl-hipaa-hipaa-164-514-ccac89ca.html","id":"ctrl:hipaa:HIPAA-164.514","mapUrl":"https://controlsmap.com/?v=1&node=ctrl%3Ahipaa%3AHIPAA-164.514","sourceIds":["hipaa"],"sourceUrl":null,"title":"HIPAA-164.514 — De-identification of PHI and limited data sets","type":"control","url":"/assets/agent_record-ctrl-hipaa-hipaa-164-514-ccac89ca.d15a5ad0b40df9a8.json"},{"attributes":{"category":"administrative","framework":"hipaa","type":"preventive"},"canonicalUrl":"https://controlsmap.com/frameworks/hipaa/","description":"Notice of privacy practices for PHI","details":{"automation":"manual","control_category":"administrative","control_id":"HIPAA-164.520","control_type":"preventive","domains":["Data Protection & Privacy","Incident Management & Response","Compliance, Audit & Assurance"],"framework":"hipaa","group":"HIPAA Privacy & Breach Notification","key_control":false,"requirement_frequency":null,"requirement_status":null,"risk_count":4,"source_pages":null,"source_url":null},"direct":true,"htmlUrl":"/agents/records/ctrl-hipaa-hipaa-164-520-e2735a22.html","id":"ctrl:hipaa:HIPAA-164.520","mapUrl":"https://controlsmap.com/?v=1&node=ctrl%3Ahipaa%3AHIPAA-164.520","sourceIds":["hipaa"],"sourceUrl":null,"title":"HIPAA-164.520 — Notice of privacy practices for PHI","type":"control","url":"/assets/agent_record-ctrl-hipaa-hipaa-164-520-e2735a22.0d8c0c132c614f32.json"},{"attributes":{"category":"administrative","framework":"hipaa","type":"preventive"},"canonicalUrl":"https://controlsmap.com/frameworks/hipaa/","description":"Individual right of access to PHI","details":{"automation":"manual","control_category":"administrative","control_id":"HIPAA-164.524","control_type":"preventive","domains":["Data Protection & Privacy","Incident Management & Response","Compliance, Audit & Assurance"],"framework":"hipaa","group":"HIPAA Privacy & Breach Notification","key_control":false,"requirement_frequency":null,"requirement_status":null,"risk_count":3,"source_pages":null,"source_url":null},"direct":true,"htmlUrl":"/agents/records/ctrl-hipaa-hipaa-164-524-2cfa4f29.html","id":"ctrl:hipaa:HIPAA-164.524","mapUrl":"https://controlsmap.com/?v=1&node=ctrl%3Ahipaa%3AHIPAA-164.524","sourceIds":["hipaa"],"sourceUrl":null,"title":"HIPAA-164.524 — Individual right of access to PHI","type":"control","url":"/assets/agent_record-ctrl-hipaa-hipaa-164-524-2cfa4f29.10a7375f395ac133.json"},{"attributes":{"category":"administrative","framework":"hipaa","type":"corrective"},"canonicalUrl":"https://controlsmap.com/frameworks/hipaa/","description":"Individual right to amend PHI","details":{"automation":"manual","control_category":"administrative","control_id":"HIPAA-164.526","control_type":"corrective","domains":["Data Protection & Privacy","Incident Management & Response","Compliance, Audit & Assurance"],"framework":"hipaa","group":"HIPAA Privacy & Breach Notification","key_control":false,"requirement_frequency":null,"requirement_status":null,"risk_count":4,"source_pages":null,"source_url":null},"direct":true,"htmlUrl":"/agents/records/ctrl-hipaa-hipaa-164-526-a1e5b051.html","id":"ctrl:hipaa:HIPAA-164.526","mapUrl":"https://controlsmap.com/?v=1&node=ctrl%3Ahipaa%3AHIPAA-164.526","sourceIds":["hipaa"],"sourceUrl":null,"title":"HIPAA-164.526 — Individual right to amend PHI","type":"control","url":"/assets/agent_record-ctrl-hipaa-hipaa-164-526-a1e5b051.934fe0bf7d3f9646.json"},{"attributes":{"category":"cyber_security","domain":["Access Control & Identity Management","Logging, Monitoring & Detection"],"inherent_rating":"high","taxonomy":["iso-27005-threat","nist-800-30-threat-event","nist-800-30-threat-source"]},"canonicalUrl":"https://controlsmap.com/?v=1&node=risk%3Aaccess-privilege-abuse-repudiation","description":"Authorized users or administrators exploit legitimate access beyond permitted scope, fabricate or forge credentials/rights to gain privileges, and repudiate performed actions — undermining accountability and audit-trail integrity.","details":{"category":"cyber_security","impact":"high","inherent_rating":"high","likelihood":"medium","risk_id":"access-privilege-abuse-repudiation","taxonomies":["iso-27005-threat","nist-800-30-threat-event","nist-800-30-threat-source"],"treatment":"mitigate"},"direct":false,"htmlUrl":"/agents/records/risk-access-privilege-abuse-repudiation-343a8917.html","id":"risk:access-privilege-abuse-repudiation","mapUrl":"https://controlsmap.com/?v=1&node=risk%3Aaccess-privilege-abuse-repudiation","sourceIds":["aiuc-1","gdpr","hipaa","iso-27001","nist-800-53","nist-ai-agent-identity","nist-csf-2","nydfs-500","pci-dss","soc1","soc2","sox"],"sourceUrl":null,"title":"Abuse of rights, forged rights, and repudiation of actions","type":"risk","url":"/assets/agent_record-risk-access-privilege-abuse-repudiation-343a8917.5dfe55c5d06b0530.json"},{"attributes":{"category":"cyber_security","domain":["Access Control & Identity Management"],"inherent_rating":"medium","taxonomy":["iso-27005-threat","nist-800-30-threat-event"]},"canonicalUrl":"https://controlsmap.com/?v=1&node=risk%3Aaccess-unauthorized-use-equipment","description":"Use of systems, networks, or devices without authorization, and users with authorized access reaching resources that exceed their authorization, potentially to exfiltrate data or conduct attacks.","details":{"category":"cyber_security","impact":"medium","inherent_rating":"medium","likelihood":"medium","risk_id":"access-unauthorized-use-equipment","taxonomies":["iso-27005-threat","nist-800-30-threat-event"],"treatment":"mitigate"},"direct":false,"htmlUrl":"/agents/records/risk-access-unauthorized-use-equipment-d2082944.html","id":"risk:access-unauthorized-use-equipment","mapUrl":"https://controlsmap.com/?v=1&node=risk%3Aaccess-unauthorized-use-equipment","sourceIds":["aiuc-1","gdpr","hipaa","iso-27001","nist-800-53","nist-ai-agent-identity","nist-csf-2","pci-dss","soc1","soc2","sox"],"sourceUrl":null,"title":"Unauthorized use of equipment and unauthorized access escalation","type":"risk","url":"/assets/agent_record-risk-access-unauthorized-use-equipment-d2082944.659ef798ce61ee67.json"},{"attributes":{"category":"cyber_security","domain":["Access Control & Identity Management","Network & Communications Security"],"inherent_rating":"high","taxonomy":["iso-27005-vulnerability","nist-800-30-threat-event"]},"canonicalUrl":"https://controlsmap.com/?v=1&node=risk%3Aaccess-weak-authentication","description":"Absent password policy, no MFA, credentials transmitted in clear text, and no session lock/logout on unattended workstations, making account compromise, brute-force login, and session hijacking easy.","details":{"category":"cyber_security","impact":"high","inherent_rating":"high","likelihood":"high","risk_id":"access-weak-authentication","taxonomies":["iso-27005-vulnerability","nist-800-30-threat-event"],"treatment":"mitigate"},"direct":false,"htmlUrl":"/agents/records/risk-access-weak-authentication-4e35bdb2.html","id":"risk:access-weak-authentication","mapUrl":"https://controlsmap.com/?v=1&node=risk%3Aaccess-weak-authentication","sourceIds":["hipaa","iso-27001","nist-800-53","nist-ai-agent-identity","nist-csf-2","nydfs-500","pci-dss"],"sourceUrl":null,"title":"Weak authentication and password management","type":"risk","url":"/assets/agent_record-risk-access-weak-authentication-4e35bdb2.331f8d7ddbb6bd4e.json"},{"attributes":{"category":"ai_governance","domain":["AI Governance","Data Protection & Privacy"],"inherent_rating":"high","taxonomy":["nist-ai-rmf-risk","nist-privacy-risk"]},"canonicalUrl":"https://controlsmap.com/?v=1&node=risk%3Aai-privacy-leakage","description":"Model inversion and membership-inference attacks reconstruct training data or reveal individuals in the training set; AI inference re-identifies anonymized data and infers sensitive attributes; training on data without consent/legal basis creates regulatory liability.","details":{"category":"ai_governance","impact":"high","inherent_rating":"high","likelihood":"medium","risk_id":"ai-privacy-leakage","taxonomies":["nist-ai-rmf-risk","nist-privacy-risk"],"treatment":"mitigate"},"direct":false,"htmlUrl":"/agents/records/risk-ai-privacy-leakage-9aa8d83c.html","id":"risk:ai-privacy-leakage","mapUrl":"https://controlsmap.com/?v=1&node=risk%3Aai-privacy-leakage","sourceIds":["aiuc-1","eu-ai-act","hipaa","iso-27001","iso-42001","nist-800-53","nist-ai-agent-identity","nist-ai-tevv-athlon"],"sourceUrl":null,"title":"AI privacy leakage and re-identification","type":"risk","url":"/assets/agent_record-risk-ai-privacy-leakage-9aa8d83c.ff6b2a9cfa591fb9.json"},{"attributes":{"category":"cyber_security","domain":["Awareness & Training","Access Control & Identity Management"],"inherent_rating":"critical","taxonomy":["nist-800-30-threat-event","basel-operational-risk"]},"canonicalUrl":"https://controlsmap.com/?v=1&node=risk%3Aaware-phishing-social-engineering","description":"Adversary counterfeits trustworthy communications (email, phone, spoofed websites) to trick individuals — including high-value executives — into revealing credentials or sensitive information, or into enabling wire-transfer/BEC fraud.","details":{"category":"cyber_security","impact":"high","inherent_rating":"critical","likelihood":"very_high","risk_id":"aware-phishing-social-engineering","taxonomies":["nist-800-30-threat-event","basel-operational-risk"],"treatment":"mitigate"},"direct":false,"htmlUrl":"/agents/records/risk-aware-phishing-social-engineering-bb9b7bd6.html","id":"risk:aware-phishing-social-engineering","mapUrl":"https://controlsmap.com/?v=1&node=risk%3Aaware-phishing-social-engineering","sourceIds":["aiuc-1","hipaa","iso-27001","nist-800-53","nist-csf-2","nydfs-500","pci-dss"],"sourceUrl":null,"title":"Phishing, spear-phishing and social engineering","type":"risk","url":"/assets/agent_record-risk-aware-phishing-social-engineering-bb9b7bd6.04cc1eb066c178e1.json"},{"attributes":{"category":"compliance_regulatory","domain":["Compliance, Audit & Assurance","Governance, Policy & Oversight"],"inherent_rating":"high","taxonomy":["enterprise-risk","coso-erm-risk"]},"canonicalUrl":"https://controlsmap.com/?v=1&node=risk%3Acompliance-litigation-enforcement","description":"Adverse judgments, class actions, contract/IP disputes, government subpoenas, DOJ/FTC/SEC investigations, consent decrees, or deferred-prosecution agreements imposing penalties, remediation, and management distraction.","details":{"category":"compliance_regulatory","impact":"high","inherent_rating":"high","likelihood":"medium","risk_id":"compliance-litigation-enforcement","taxonomies":["enterprise-risk","coso-erm-risk"],"treatment":"transfer"},"direct":false,"htmlUrl":"/agents/records/risk-compliance-litigation-enforcement-25e7935d.html","id":"risk:compliance-litigation-enforcement","mapUrl":"https://controlsmap.com/?v=1&node=risk%3Acompliance-litigation-enforcement","sourceIds":["cobit-2019","gdpr","hipaa","iso-27001","nis2","nist-800-53","nist-csf-2","nydfs-500","pci-dss","soc2"],"sourceUrl":null,"title":"Litigation, investigation and enforcement exposure","type":"risk","url":"/assets/agent_record-risk-compliance-litigation-enforcement-25e7935d.963b6cccfc52b94e.json"},{"attributes":{"category":"cyber_security","domain":["Cryptography & Key Management","Network & Communications Security"],"inherent_rating":"high","taxonomy":["iso-27005-vulnerability"]},"canonicalUrl":"https://controlsmap.com/?v=1&node=risk%3Acrypto-cleartext-credential-transfer","description":"Authentication credentials or sensitive system communications transmitted unencrypted over networks, and absence of mutual sender/receiver authentication, enable interception, credential theft, and spoofing.","details":{"category":"cyber_security","impact":"high","inherent_rating":"high","likelihood":"medium","risk_id":"crypto-cleartext-credential-transfer","taxonomies":["iso-27005-vulnerability"],"treatment":"mitigate"},"direct":false,"htmlUrl":"/agents/records/risk-crypto-cleartext-credential-transfer-b88065a1.html","id":"risk:crypto-cleartext-credential-transfer","mapUrl":"https://controlsmap.com/?v=1&node=risk%3Acrypto-cleartext-credential-transfer","sourceIds":["aiuc-1","hipaa","nist-800-53","nist-csf-2","nydfs-500","pci-dss","soc2"],"sourceUrl":null,"title":"Credentials and sensitive data transmitted in clear text","type":"risk","url":"/assets/agent_record-risk-crypto-cleartext-credential-transfer-b88065a1.a9caa8149d5dd221.json"},{"attributes":{"category":"cyber_security","domain":["Cryptography & Key Management","Network & Communications Security"],"inherent_rating":"high","taxonomy":["nist-800-30-threat-event"]},"canonicalUrl":"https://controlsmap.com/?v=1&node=risk%3Acrypto-counterfeit-certificates","description":"Adversary counterfeits or compromises a certificate authority so that malware or connections appear legitimate, defeating trust in TLS and code-signing and enabling man-in-the-middle or malicious-code delivery.","details":{"category":"cyber_security","impact":"high","inherent_rating":"high","likelihood":"low","risk_id":"crypto-counterfeit-certificates","taxonomies":["nist-800-30-threat-event"],"treatment":"mitigate"},"direct":false,"htmlUrl":"/agents/records/risk-crypto-counterfeit-certificates-d9dcc5c5.html","id":"risk:crypto-counterfeit-certificates","mapUrl":"https://controlsmap.com/?v=1&node=risk%3Acrypto-counterfeit-certificates","sourceIds":["aiuc-1","hipaa","iso-27001","nist-800-53","nist-csf-2","nydfs-500","pci-dss","soc2"],"sourceUrl":null,"title":"Compromised or counterfeit certificates / certificate authority","type":"risk","url":"/assets/agent_record-risk-crypto-counterfeit-certificates-d9dcc5c5.8f0926d32cdc4988.json"},{"attributes":{"category":"cyber_security","domain":["Cryptography & Key Management","Data Protection & Privacy","Network & Communications Security"],"inherent_rating":"high","taxonomy":["iso-27005-vulnerability","nist-800-30-threat-event","nist-privacy-risk"]},"canonicalUrl":"https://controlsmap.com/?v=1&node=risk%3Acrypto-weak-or-absent-encryption","description":"Sensitive data stored or transmitted without adequate encryption, or use of weak/flawed cryptography and poor key generation, storage, rotation, and destruction — enabling interception, disclosure, or tampering of data.","details":{"category":"cyber_security","impact":"high","inherent_rating":"high","likelihood":"medium","risk_id":"crypto-weak-or-absent-encryption","taxonomies":["iso-27005-vulnerability","nist-800-30-threat-event","nist-privacy-risk"],"treatment":"mitigate"},"direct":false,"htmlUrl":"/agents/records/risk-crypto-weak-or-absent-encryption-2fe7d24e.html","id":"risk:crypto-weak-or-absent-encryption","mapUrl":"https://controlsmap.com/?v=1&node=risk%3Acrypto-weak-or-absent-encryption","sourceIds":["aiuc-1","hipaa","iso-27001","nist-800-53","nist-csf-2","nydfs-500","pci-dss","soc2"],"sourceUrl":null,"title":"Weak or absent encryption and key management","type":"risk","url":"/assets/agent_record-risk-crypto-weak-or-absent-encryption-2fe7d24e.22e603984ef2659e.json"},{"attributes":{"category":"privacy","domain":["Data Protection & Privacy","Incident Management & Response"],"inherent_rating":"high","taxonomy":["iso-27005-threat","nist-800-30-threat-event","nist-privacy-risk"]},"canonicalUrl":"https://controlsmap.com/?v=1&node=risk%3Adata-breach-unauthorized-disclosure","description":"Unauthorized disclosure of information to parties not entitled to receive it, whether by insecure controls (insecurity), spillage, or authorized users induced to expose data — resulting in identity theft, economic loss, and loss of trust.","details":{"category":"privacy","impact":"high","inherent_rating":"high","likelihood":"medium","risk_id":"data-breach-unauthorized-disclosure","taxonomies":["iso-27005-threat","nist-800-30-threat-event","nist-privacy-risk"],"treatment":"mitigate"},"direct":false,"htmlUrl":"/agents/records/risk-data-breach-unauthorized-disclosure-3b1c296c.html","id":"risk:data-breach-unauthorized-disclosure","mapUrl":"https://controlsmap.com/?v=1&node=risk%3Adata-breach-unauthorized-disclosure","sourceIds":["aiuc-1","ccpa","gdpr","hipaa","iso-27001","nist-800-53","nist-ai-agent-identity","nist-ai-tevv-athlon","nist-csf-2","soc2"],"sourceUrl":null,"title":"Unauthorized disclosure / breach of sensitive information","type":"risk","url":"/assets/agent_record-risk-data-breach-unauthorized-disclosure-3b1c296c.8431603df36984c8.json"},{"attributes":{"category":"cyber_security","domain":["Data Protection & Privacy","Secure Development (SDLC) & Application Security"],"inherent_rating":"high","taxonomy":["iso-27005-threat","nist-800-30-threat-event"]},"canonicalUrl":"https://controlsmap.com/?v=1&node=risk%3Adata-corruption-integrity-loss","description":"Intentional or accidental alteration, deletion, defacement, or injection of false-but-believable data into systems (including web defacement and data from untrustworthy sources) renders data inaccurate and erodes confidence in it.","details":{"category":"cyber_security","impact":"high","inherent_rating":"high","likelihood":"medium","risk_id":"data-corruption-integrity-loss","taxonomies":["iso-27005-threat","nist-800-30-threat-event"],"treatment":"mitigate"},"direct":false,"htmlUrl":"/agents/records/risk-data-corruption-integrity-loss-e771738a.html","id":"risk:data-corruption-integrity-loss","mapUrl":"https://controlsmap.com/?v=1&node=risk%3Adata-corruption-integrity-loss","sourceIds":["aiuc-1","ccpa","cobit-2019","eu-ai-act","hipaa","iso-27001","nist-800-53","soc2"],"sourceUrl":null,"title":"Corruption or integrity loss of critical data","type":"risk","url":"/assets/agent_record-risk-data-corruption-integrity-loss-e771738a.745d8cb348a7d703.json"},{"attributes":{"category":"privacy","domain":["Data Protection & Privacy"],"inherent_rating":"high","taxonomy":["nist-privacy-risk"]},"canonicalUrl":"https://controlsmap.com/?v=1&node=risk%3Adata-excessive-collection-purpose-creep","description":"Collecting more personal data than necessary (data-minimization failure) and using it for purposes materially different from those disclosed without fresh notice/consent, expanding attack surface and violating purpose-limitation.","details":{"category":"privacy","impact":"medium","inherent_rating":"high","likelihood":"high","risk_id":"data-excessive-collection-purpose-creep","taxonomies":["nist-privacy-risk"],"treatment":"mitigate"},"direct":false,"htmlUrl":"/agents/records/risk-data-excessive-collection-purpose-creep-4a691595.html","id":"risk:data-excessive-collection-purpose-creep","mapUrl":"https://controlsmap.com/?v=1&node=risk%3Adata-excessive-collection-purpose-creep","sourceIds":["ccpa","gdpr","hipaa","iso-27001","nist-800-53","soc2"],"sourceUrl":null,"title":"Excessive collection, purpose creep and secondary use","type":"risk","url":"/assets/agent_record-risk-data-excessive-collection-purpose-creep-4a691595.e19f1e2bcd3171d8.json"},{"attributes":{"category":"cyber_security","domain":["Data Protection & Privacy","Network & Communications Security","Logging, Monitoring & Detection"],"inherent_rating":"critical","taxonomy":["nist-800-30-threat-event","nist-800-30-threat-source","basel-operational-risk","coso-erm-risk"]},"canonicalUrl":"https://controlsmap.com/?v=1&node=risk%3Adata-exfiltration-espionage","description":"Adversary (outsider, insider, nation-state, or competitor) installs malware or sniffers to locate and exfiltrate sensitive/proprietary information, or steals data by external actors — including systems-security losses from hacking.","details":{"category":"cyber_security","impact":"critical","inherent_rating":"critical","likelihood":"medium","risk_id":"data-exfiltration-espionage","taxonomies":["nist-800-30-threat-event","nist-800-30-threat-source","basel-operational-risk","coso-erm-risk"],"treatment":"mitigate"},"direct":false,"htmlUrl":"/agents/records/risk-data-exfiltration-espionage-74803ebc.html","id":"risk:data-exfiltration-espionage","mapUrl":"https://controlsmap.com/?v=1&node=risk%3Adata-exfiltration-espionage","sourceIds":["aiuc-1","cobit-2019","gdpr","hipaa","iso-27001","nist-800-53","nist-ai-agent-identity","nist-ai-tevv-athlon","nist-csf-2","nydfs-500","pci-dss","soc2"],"sourceUrl":null,"title":"Data exfiltration and theft of information by attackers","type":"risk","url":"/assets/agent_record-risk-data-exfiltration-espionage-74803ebc.a1ef3e79ab006192.json"},{"attributes":{"category":"privacy","domain":["Data Protection & Privacy","AI Governance"],"inherent_rating":"medium","taxonomy":["nist-privacy-risk"]},"canonicalUrl":"https://controlsmap.com/?v=1&node=risk%3Adata-privacy-harms-to-individuals","description":"Processing inaccurate/out-of-context data (distortion), attaching negative social labels (stigmatization), or denying services based on personal data without justification (unwarranted restriction / algorithmic gatekeeping) — causing discrimination and economic loss.","details":{"category":"privacy","impact":"medium","inherent_rating":"medium","likelihood":"medium","risk_id":"data-privacy-harms-to-individuals","taxonomies":["nist-privacy-risk"],"treatment":"mitigate"},"direct":false,"htmlUrl":"/agents/records/risk-data-privacy-harms-to-individuals-510e65af.html","id":"risk:data-privacy-harms-to-individuals","mapUrl":"https://controlsmap.com/?v=1&node=risk%3Adata-privacy-harms-to-individuals","sourceIds":["aiuc-1","ccpa","eu-ai-act","gdpr","hipaa","iso-42001","nist-800-53","nist-ai-agent-identity","soc2"],"sourceUrl":null,"title":"Privacy harms: distortion, stigmatization, unwarranted restriction","type":"risk","url":"/assets/agent_record-risk-data-privacy-harms-to-individuals-510e65af.a2f2b4ad6db96f69.json"},{"attributes":{"category":"privacy","domain":["Data Protection & Privacy","Compliance, Audit & Assurance"],"inherent_rating":"high","taxonomy":["nist-privacy-risk","enterprise-risk"]},"canonicalUrl":"https://controlsmap.com/?v=1&node=risk%3Adata-privacy-program-noncompliance","description":"Failure to honour data-subject rights (access, deletion, portability, restriction) on time, missing lawful-basis/consent documentation, defective consent mechanisms, invalid cross-border transfer mechanisms, or inadequate notices — driving fines and private rights of action.","details":{"category":"privacy","impact":"high","inherent_rating":"high","likelihood":"high","risk_id":"data-privacy-program-noncompliance","taxonomies":["nist-privacy-risk","enterprise-risk"],"treatment":"mitigate"},"direct":false,"htmlUrl":"/agents/records/risk-data-privacy-program-noncompliance-ec6178fa.html","id":"risk:data-privacy-program-noncompliance","mapUrl":"https://controlsmap.com/?v=1&node=risk%3Adata-privacy-program-noncompliance","sourceIds":["aiuc-1","ccpa","gdpr","hipaa","iso-27001","nist-800-53","nist-ai-agent-identity","nist-ai-tevv-athlon","soc2"],"sourceUrl":null,"title":"Privacy-program non-compliance (GDPR, CCPA, state laws)","type":"risk","url":"/assets/agent_record-risk-data-privacy-program-noncompliance-ec6178fa.f8a5498a8697316f.json"},{"attributes":{"category":"privacy","domain":["Data Protection & Privacy"],"inherent_rating":"medium","taxonomy":["nist-privacy-risk"]},"canonicalUrl":"https://controlsmap.com/?v=1&node=risk%3Adata-reidentification-inference","description":"Insufficient de-identification/pseudonymization, plus inference or linkage attacks and metadata leakage, re-identify individuals or reveal information they did not intend to disclose — causing embarrassment, harm, and regulatory exposure.","details":{"category":"privacy","impact":"medium","inherent_rating":"medium","likelihood":"medium","risk_id":"data-reidentification-inference","taxonomies":["nist-privacy-risk"],"treatment":"mitigate"},"direct":false,"htmlUrl":"/agents/records/risk-data-reidentification-inference-d4b31f45.html","id":"risk:data-reidentification-inference","mapUrl":"https://controlsmap.com/?v=1&node=risk%3Adata-reidentification-inference","sourceIds":["aiuc-1","ccpa","hipaa","iso-27001","nist-800-53"],"sourceUrl":null,"title":"Re-identification and unanticipated revelation from data","type":"risk","url":"/assets/agent_record-risk-data-reidentification-inference-d4b31f45.feabe05a491c6f3f.json"},{"attributes":{"category":"privacy","domain":["Data Protection & Privacy"],"inherent_rating":"medium","taxonomy":["nist-privacy-risk","nist-ai-rmf-risk"]},"canonicalUrl":"https://controlsmap.com/?v=1&node=risk%3Adata-surveillance-appropriation","description":"Pervasive monitoring beyond stated purpose (behavioral analytics, always-on telemetry, employee monitoring), using identity/data for organizational benefit without consent, and coercing individuals to over-share — causing chilling effects and loss of autonomy.","details":{"category":"privacy","impact":"medium","inherent_rating":"medium","likelihood":"medium","risk_id":"data-surveillance-appropriation","taxonomies":["nist-privacy-risk","nist-ai-rmf-risk"],"treatment":"mitigate"},"direct":false,"htmlUrl":"/agents/records/risk-data-surveillance-appropriation-18ad67e7.html","id":"risk:data-surveillance-appropriation","mapUrl":"https://controlsmap.com/?v=1&node=risk%3Adata-surveillance-appropriation","sourceIds":["ccpa","hipaa","nist-800-53","soc2"],"sourceUrl":null,"title":"Excessive surveillance, appropriation and induced disclosure","type":"risk","url":"/assets/agent_record-risk-data-surveillance-appropriation-18ad67e7.571fc2bbf276fe19.json"},{"attributes":{"category":"privacy","domain":["Data Protection & Privacy","Awareness & Training"],"inherent_rating":"medium","taxonomy":["nist-privacy-risk"]},"canonicalUrl":"https://controlsmap.com/?v=1&node=risk%3Adata-transparency-notice-dark-patterns","description":"Failure to give clear, timely notice of collection, use, retention, and sharing; misleading or dark-pattern consent flows; and failure to disclose automated decision-making — undermining meaningful consent and compounding power imbalance.","details":{"category":"privacy","impact":"medium","inherent_rating":"medium","likelihood":"medium","risk_id":"data-transparency-notice-dark-patterns","taxonomies":["nist-privacy-risk"],"treatment":"mitigate"},"direct":false,"htmlUrl":"/agents/records/risk-data-transparency-notice-dark-patterns-9326fdf0.html","id":"risk:data-transparency-notice-dark-patterns","mapUrl":"https://controlsmap.com/?v=1&node=risk%3Adata-transparency-notice-dark-patterns","sourceIds":["ccpa","gdpr","hipaa","nist-800-53","nist-csf-2","soc2"],"sourceUrl":null,"title":"Inadequate transparency, notice and deceptive privacy communications","type":"risk","url":"/assets/agent_record-risk-data-transparency-notice-dark-patterns-9326fdf0.86b6f27e81ff4310.json"},{"attributes":{"category":"financial_reporting","domain":["Financial Reporting Controls (SOX)","Access Control & Identity Management","Compliance, Audit & Assurance"],"inherent_rating":"high","taxonomy":["coso-erm-risk","sox-rmm-assertion"]},"canonicalUrl":"https://controlsmap.com/?v=1&node=risk%3Afin-segregation-of-duties","description":"Incompatible duties (initiate, approve, record, and custody) concentrated in one role or via broad system access enable unauthorized or fraudulent transactions to be recorded and concealed.","details":{"category":"financial_reporting","impact":"high","inherent_rating":"high","likelihood":"medium","risk_id":"fin-segregation-of-duties","taxonomies":["coso-erm-risk","sox-rmm-assertion"],"treatment":"mitigate"},"direct":false,"htmlUrl":"/agents/records/risk-fin-segregation-of-duties-eb7ee015.html","id":"risk:fin-segregation-of-duties","mapUrl":"https://controlsmap.com/?v=1&node=risk%3Afin-segregation-of-duties","sourceIds":["aiuc-1","cobit-2019","gdpr","hipaa","iso-27001","nist-800-53","nist-ai-agent-identity","nist-csf-2","nydfs-500","pci-dss","soc2","sox"],"sourceUrl":null,"title":"Segregation-of-duties conflicts in financial processes","type":"risk","url":"/assets/agent_record-risk-fin-segregation-of-duties-eb7ee015.da25c6668c301894.json"},{"attributes":{"category":"operational","domain":["Access Control & Identity Management","Risk Assessment & Management"],"inherent_rating":"high","taxonomy":["basel-operational-risk","coso-erm-risk"]},"canonicalUrl":"https://controlsmap.com/?v=1&node=risk%3Afraud-external","description":"Third parties defraud the entity: cheque/payment-card forgery, counterfeit currency, identity theft, account takeover with stolen credentials, fraudulent loan applications, and first-party (bust-out) fraud by customers.","details":{"category":"operational","impact":"high","inherent_rating":"high","likelihood":"high","risk_id":"fraud-external","taxonomies":["basel-operational-risk","coso-erm-risk"],"treatment":"mitigate"},"direct":false,"htmlUrl":"/agents/records/risk-fraud-external-c3ce412f.html","id":"risk:fraud-external","mapUrl":"https://controlsmap.com/?v=1&node=risk%3Afraud-external","sourceIds":["hipaa","iso-27001","nist-800-53","nist-ai-agent-identity","nist-csf-2","nydfs-500","pci-dss","soc2"],"sourceUrl":null,"title":"External fraud — third-party theft, forgery, payment and account fraud","type":"risk","url":"/assets/agent_record-risk-fraud-external-c3ce412f.ed2b6629b6a7dc3a.json"},{"attributes":{"category":"compliance_regulatory","domain":["Governance, Policy & Oversight","Data Protection & Privacy"],"inherent_rating":"medium","taxonomy":["iso-27005-vulnerability","nist-privacy-risk"]},"canonicalUrl":"https://controlsmap.com/?v=1&node=risk%3Agov-policy-absent","description":"Because documented, approved, and enforced security and privacy policies are missing and roles and duties are undefined, personnel operate without guidance on required controls and behaviours, so controls are applied inconsistently and accountability gaps leave violations undetected and unaddressed.","details":{"category":"compliance_regulatory","impact":"medium","inherent_rating":"medium","likelihood":"medium","risk_id":"gov-policy-absent","taxonomies":["iso-27005-vulnerability","nist-privacy-risk"],"treatment":"mitigate"},"direct":false,"htmlUrl":"/agents/records/risk-gov-policy-absent-cf76dbbf.html","id":"risk:gov-policy-absent","mapUrl":"https://controlsmap.com/?v=1&node=risk%3Agov-policy-absent","sourceIds":["cobit-2019","coso-erm","coso-ic","gdpr","hipaa","iso-27001","nis2","nist-800-53","nist-csf-2","nydfs-500","pci-dss","soc2"],"sourceUrl":null,"title":"Missing or insufficient security and privacy policies","type":"risk","url":"/assets/agent_record-risk-gov-policy-absent-cf76dbbf.643fca249d5d0d9c.json"},{"attributes":{"category":"people_hr","domain":["Human Resources / Personnel Security"],"inherent_rating":"high","taxonomy":["basel-operational-risk","coso-erm-risk","enterprise-risk"]},"canonicalUrl":"https://controlsmap.com/?v=1&node=risk%3Ahr-discrimination-harassment","description":"Systemic harassment or discrimination (race, gender, age, disability, etc.), pay-equity violations, retaliation, and inadequate speak-up channels resulting in regulatory action, litigation, attrition, and reputational harm.","details":{"category":"people_hr","impact":"high","inherent_rating":"high","likelihood":"medium","risk_id":"hr-discrimination-harassment","taxonomies":["basel-operational-risk","coso-erm-risk","enterprise-risk"],"treatment":"mitigate"},"direct":false,"htmlUrl":"/agents/records/risk-hr-discrimination-harassment-767d6cb7.html","id":"risk:hr-discrimination-harassment","mapUrl":"https://controlsmap.com/?v=1&node=risk%3Ahr-discrimination-harassment","sourceIds":["hipaa","iso-27001","nist-800-53"],"sourceUrl":null,"title":"Discrimination, harassment and hostile-workplace culture","type":"risk","url":"/assets/agent_record-risk-hr-discrimination-harassment-767d6cb7.6258dfdd2f03a48a.json"},{"attributes":{"category":"people_hr","domain":["Human Resources / Personnel Security","Access Control & Identity Management"],"inherent_rating":"high","taxonomy":["iso-27005-vulnerability","nist-800-30-threat-event"]},"canonicalUrl":"https://controlsmap.com/?v=1&node=risk%3Ahr-insufficient-screening","description":"Failure to vet employees, contractors, or third parties before granting access enables insider threats or introduces compromised individuals; adversaries may deliberately place subverted individuals into (privileged) positions.","details":{"category":"people_hr","impact":"high","inherent_rating":"high","likelihood":"medium","risk_id":"hr-insufficient-screening","taxonomies":["iso-27005-vulnerability","nist-800-30-threat-event"],"treatment":"mitigate"},"direct":false,"htmlUrl":"/agents/records/risk-hr-insufficient-screening-bdce1f80.html","id":"risk:hr-insufficient-screening","mapUrl":"https://controlsmap.com/?v=1&node=risk%3Ahr-insufficient-screening","sourceIds":["aiuc-1","hipaa","iso-27001","nist-800-53","nist-ai-agent-identity","nist-csf-2","pci-dss","soc2"],"sourceUrl":null,"title":"Insufficient personnel screening and vetting","type":"risk","url":"/assets/agent_record-risk-hr-insufficient-screening-bdce1f80.ac42852f3377014c.json"},{"attributes":{"category":"compliance_regulatory","domain":["Human Resources / Personnel Security","Governance, Policy & Oversight","Third-Party / Supply-Chain Risk"],"inherent_rating":"medium","taxonomy":["iso-27005-vulnerability"]},"canonicalUrl":"https://controlsmap.com/?v=1&node=risk%3Ahr-missing-security-terms-discipline","description":"Employment and supplier contracts omit security/confidentiality obligations, and there is no disciplinary process for security violations — removing legal recourse and the deterrent effect against repeat offenders.","details":{"category":"compliance_regulatory","impact":"medium","inherent_rating":"medium","likelihood":"medium","risk_id":"hr-missing-security-terms-discipline","taxonomies":["iso-27005-vulnerability"],"treatment":"mitigate"},"direct":false,"htmlUrl":"/agents/records/risk-hr-missing-security-terms-discipline-0a47163d.html","id":"risk:hr-missing-security-terms-discipline","mapUrl":"https://controlsmap.com/?v=1&node=risk%3Ahr-missing-security-terms-discipline","sourceIds":["ccpa","coso-ic","gdpr","hipaa","iso-27001","nist-800-53","nist-csf-2","soc2"],"sourceUrl":null,"title":"Missing security terms in contracts and no disciplinary process","type":"risk","url":"/assets/agent_record-risk-hr-missing-security-terms-discipline-0a47163d.8fa26facc260e210.json"}],"relationships":[{"expectedCatalogRevision":"24028ffcfc2b295fa1b08ee6caa84b765f0731b321496bf4f548c49ad2177028","id":"rel:046ade0a8ee9f1acbd8a40a19f3a1fa742483ed0f2c87bfe975bf838d4a6e641","properties":{},"sourceDetailPath":"/data/v1/records/ctrl-hipaa-hipaa-164-312-d-d1e8fe74.json","sourceId":"ctrl:hipaa:HIPAA-164.312(d)","targetDetailPath":"/data/v1/records/std-hipaa-a825d271.json","targetId":"std:hipaa","type":"belongs_to"},{"expectedCatalogRevision":"24028ffcfc2b295fa1b08ee6caa84b765f0731b321496bf4f548c49ad2177028","id":"rel:071946c7f47bc974a5dad8a15a71bae0ed4c9fa115558049369b03248c1b5562","properties":{"control_id":"HIPAA-164.314","coverage":"partial","delta":"group health plan document requirements (164.314(b)) fall outside vendor/BA contracting","framework":"hipaa","provenance":{"defaultConfidence":"medium","defaultStatus":"active","direction":"canonical_to_source","mapper":"coworkcanvas-compliance-graph","note":"Each member is a documented relationship claim from the canonical unified control to a source control or guidance proposition. relationship: equal|superset_of (full) / intersects_with|subset_of (partial) / informs (guidance). confidence 'medium' = single-mapper, documented, not yet externally corroborated. source_version is the member framework's edition from the standard version register.","reviewDate":"2026-09-07"},"relationship":"intersects_with","source_version":"45 CFR Parts 160/164 (Security, Privacy, Breach Notification)"},"sourceDetailPath":"/data/v1/records/uc-uc-tprm-03-c9edcf93.json","sourceId":"uc:UC-TPRM-03","targetDetailPath":"/data/v1/records/ctrl-hipaa-hipaa-164-314-0b44ffa8.json","targetId":"ctrl:hipaa:HIPAA-164.314","type":"maps_to"},{"expectedCatalogRevision":"24028ffcfc2b295fa1b08ee6caa84b765f0731b321496bf4f548c49ad2177028","id":"rel:0829af2246a85e7e5cc486581d228bba50e080557016bad92e46f06a89d07cae","properties":{"rationale":"Maintaining policies required by HIPAA/PCI/regulators reduces enforcement exposure for missing governance documentation.","strength":"related"},"sourceDetailPath":"/data/v1/records/uc-uc-gov-14-f4f2c470.json","sourceId":"uc:UC-GOV-14","targetDetailPath":"/data/v1/records/risk-compliance-litigation-enforcement-25e7935d.json","targetId":"risk:compliance-litigation-enforcement","type":"mitigates"},{"expectedCatalogRevision":"24028ffcfc2b295fa1b08ee6caa84b765f0731b321496bf4f548c49ad2177028","id":"rel:0b37871dfe670524271af2e8e52d54d39f56878f71fd8973afdb4830c6b0f784","properties":{"rationale":"Role- and attribute-based enforcement applies the SoD separations defined for sensitive financial and administrative functions.","strength":"related"},"sourceDetailPath":"/data/v1/records/uc-uc-access-05-9b7f3e34.json","sourceId":"uc:UC-ACCESS-05","targetDetailPath":"/data/v1/records/risk-fin-segregation-of-duties-eb7ee015.json","targetId":"risk:fin-segregation-of-duties","type":"mitigates"},{"expectedCatalogRevision":"24028ffcfc2b295fa1b08ee6caa84b765f0731b321496bf4f548c49ad2177028","id":"rel:0d43e32f0d3e2b60efea95e2fed94d37ff2af0acfb522094329709a9dc6a056a","properties":{},"sourceDetailPath":"/data/v1/records/ctrl-hipaa-hipaa-164-514-ccac89ca.json","sourceId":"ctrl:hipaa:HIPAA-164.514","targetDetailPath":"/data/v1/records/std-hipaa-a825d271.json","targetId":"std:hipaa","type":"belongs_to"},{"expectedCatalogRevision":"24028ffcfc2b295fa1b08ee6caa84b765f0731b321496bf4f548c49ad2177028","id":"rel:13f64e9bd86f0bc703948908c3cf78914b528e48bfb571ac0392522a46ce644f","properties":{"rationale":"Requires trusted certificates and rejects insecure fallback, helping reject rogue certs in MITM; the operative approved-CA/revocation defense sits in UC-CRYPTO-03.","strength":"related"},"sourceDetailPath":"/data/v1/records/uc-uc-crypto-01-55215c11.json","sourceId":"uc:UC-CRYPTO-01","targetDetailPath":"/data/v1/records/risk-crypto-counterfeit-certificates-d9dcc5c5.json","targetId":"risk:crypto-counterfeit-certificates","type":"mitigates"},{"expectedCatalogRevision":"24028ffcfc2b295fa1b08ee6caa84b765f0731b321496bf4f548c49ad2177028","id":"rel:13f6aa7b3ed4b184eafd7da0757ae79318f89b1a9d20ab92bf53261aceb57e32","properties":{"rationale":"Establishing, approving, and maintaining the security policy suite directly remedies missing approved policies.","strength":"primary"},"sourceDetailPath":"/data/v1/records/uc-uc-gov-14-f4f2c470.json","sourceId":"uc:UC-GOV-14","targetDetailPath":"/data/v1/records/risk-gov-policy-absent-cf76dbbf.json","targetId":"risk:gov-policy-absent","type":"mitigates"},{"expectedCatalogRevision":"24028ffcfc2b295fa1b08ee6caa84b765f0731b321496bf4f548c49ad2177028","id":"rel:154d032b8c8a51251df0659b39df888301f7cb7aae1f872ad0aa66f4279be75b","properties":{},"sourceDetailPath":"/data/v1/records/ctrl-hipaa-hipaa-164-310-9cf84fad.json","sourceId":"ctrl:hipaa:HIPAA-164.310","targetDetailPath":"/data/v1/records/std-hipaa-a825d271.json","targetId":"std:hipaa","type":"belongs_to"},{"expectedCatalogRevision":"24028ffcfc2b295fa1b08ee6caa84b765f0731b321496bf4f548c49ad2177028","id":"rel:2bc3000083b70b18a8b11bb2a3c1c3af8db4c52ea608871c69176b9bdc03be19","properties":{"rationale":"Background verification and position-risk vetting before access is the operative defense against placing unvetted, insider-threat, or compromised individuals in roles.","strength":"primary"},"sourceDetailPath":"/data/v1/records/uc-uc-hr-01-c7e14dc5.json","sourceId":"uc:UC-HR-01","targetDetailPath":"/data/v1/records/risk-hr-insufficient-screening-bdce1f80.json","targetId":"risk:hr-insufficient-screening","type":"mitigates"},{"expectedCatalogRevision":"24028ffcfc2b295fa1b08ee6caa84b765f0731b321496bf4f548c49ad2177028","id":"rel:2ce39baacf4e08681a6e141f99447226f227084a6d955c5b9f97cc90a6558291","properties":{"rationale":"Maintaining legally-required notices and registrations addresses the inadequate-notice driver of regulatory non-compliance.","strength":"related"},"sourceDetailPath":"/data/v1/records/uc-uc-data-05-3244ac25.json","sourceId":"uc:UC-DATA-05","targetDetailPath":"/data/v1/records/risk-data-privacy-program-noncompliance-ec6178fa.json","targetId":"risk:data-privacy-program-noncompliance","type":"mitigates"},{"expectedCatalogRevision":"24028ffcfc2b295fa1b08ee6caa84b765f0731b321496bf4f548c49ad2177028","id":"rel:2d1cb49f8be93fa020dfdf4ce80b246cbfca057da0774a463d8a1f9903a873aa","properties":{"rationale":"Mediating every access attempt against approved authorizations directly blocks users reaching resources exceeding their authorization.","strength":"primary"},"sourceDetailPath":"/data/v1/records/uc-uc-access-05-9b7f3e34.json","sourceId":"uc:UC-ACCESS-05","targetDetailPath":"/data/v1/records/risk-access-unauthorized-use-equipment-d2082944.json","targetId":"risk:access-unauthorized-use-equipment","type":"mitigates"},{"expectedCatalogRevision":"24028ffcfc2b295fa1b08ee6caa84b765f0731b321496bf4f548c49ad2177028","id":"rel:2f313f616bc55cce7ba558e4371bea44fc259e5d0cdec292b9752ca5cff6f867","properties":{},"sourceDetailPath":"/data/v1/records/ctrl-hipaa-hipaa-164-308-d26b6932.json","sourceId":"ctrl:hipaa:HIPAA-164.308","targetDetailPath":"/data/v1/records/std-hipaa-a825d271.json","targetId":"std:hipaa","type":"belongs_to"},{"expectedCatalogRevision":"24028ffcfc2b295fa1b08ee6caa84b765f0731b321496bf4f548c49ad2177028","id":"rel:311f1c9e910cf8d774d86a7bd67c2a5b53ae07067c13a3b348efe6d898619609","properties":{"rationale":"Publishing clear, timely, plain-language notices at/before collection directly counters inadequate/late transparency and non-disclosure of practices.","strength":"primary"},"sourceDetailPath":"/data/v1/records/uc-uc-data-05-3244ac25.json","sourceId":"uc:UC-DATA-05","targetDetailPath":"/data/v1/records/risk-data-transparency-notice-dark-patterns-9326fdf0.json","targetId":"risk:data-transparency-notice-dark-patterns","type":"mitigates"},{"expectedCatalogRevision":"24028ffcfc2b295fa1b08ee6caa84b765f0731b321496bf4f548c49ad2177028","id":"rel:32bf6421f2b8d665a50dabd9afe913d3db465ae6fd73f6978e767f8a3e387d37","properties":{},"sourceDetailPath":"/data/v1/records/ctrl-hipaa-hipaa-164-312-a-5c8bb707.json","sourceId":"ctrl:hipaa:HIPAA-164.312(a)","targetDetailPath":"/data/v1/records/std-hipaa-a825d271.json","targetId":"std:hipaa","type":"belongs_to"},{"expectedCatalogRevision":"24028ffcfc2b295fa1b08ee6caa84b765f0731b321496bf4f548c49ad2177028","id":"rel:40fbc7e18aac68065c0acb7bfa3aad49ffa75cb36d5e751c3ae659591e4c7b8c","properties":{},"sourceDetailPath":"/data/v1/records/ctrl-hipaa-hipaa-164-316-15412c2a.json","sourceId":"ctrl:hipaa:HIPAA-164.316","targetDetailPath":"/data/v1/records/std-hipaa-a825d271.json","targetId":"std:hipaa","type":"belongs_to"},{"expectedCatalogRevision":"24028ffcfc2b295fa1b08ee6caa84b765f0731b321496bf4f548c49ad2177028","id":"rel:4139a32a44de066985ce2c2e8745e38b9e2ab523d4aa5bc7530c282a16da3030","properties":{},"sourceDetailPath":"/data/v1/records/ctrl-hipaa-hipaa-164-312-e-edf6e525.json","sourceId":"ctrl:hipaa:HIPAA-164.312(e)","targetDetailPath":"/data/v1/records/std-hipaa-a825d271.json","targetId":"std:hipaa","type":"belongs_to"},{"expectedCatalogRevision":"24028ffcfc2b295fa1b08ee6caa84b765f0731b321496bf4f548c49ad2177028","id":"rel:47472f6f81d5e60212915d60644980d00c90385e35c468c9335aebda80a424de","properties":{"control_id":"HIPAA-164.312(a)","coverage":"partial","delta":"automatic logoff and encryption/decryption of ePHI are satisfied by the session-lock (UC-ACCESS-12) and cryptographic (UC-CRYPTO-01) companion controls; emergency-access is an availability arm","framework":"hipaa","provenance":{"defaultConfidence":"medium","defaultStatus":"active","direction":"canonical_to_source","mapper":"coworkcanvas-compliance-graph","note":"Each member is a documented relationship claim from the canonical unified control to a source control or guidance proposition. relationship: equal|superset_of (full) / intersects_with|subset_of (partial) / informs (guidance). confidence 'medium' = single-mapper, documented, not yet externally corroborated. source_version is the member framework's edition from the standard version register.","reviewDate":"2026-09-07"},"relationship":"intersects_with","source_version":"45 CFR Parts 160/164 (Security, Privacy, Breach Notification)"},"sourceDetailPath":"/data/v1/records/uc-uc-access-05-9b7f3e34.json","sourceId":"uc:UC-ACCESS-05","targetDetailPath":"/data/v1/records/ctrl-hipaa-hipaa-164-312-a-5c8bb707.json","targetId":"ctrl:hipaa:HIPAA-164.312(a)","type":"maps_to"},{"expectedCatalogRevision":"24028ffcfc2b295fa1b08ee6caa84b765f0731b321496bf4f548c49ad2177028","id":"rel:47cc01fbac20185035f09875fdc49f3b3e2d1f6a738b8ed24034b96703d09ae7","properties":{"rationale":"Masked/pseudonymized data lowers the impact of any disclosure by limiting identifiability of exposed data.","strength":"related"},"sourceDetailPath":"/data/v1/records/uc-uc-data-12-c5a5999a.json","sourceId":"uc:UC-DATA-12","targetDetailPath":"/data/v1/records/risk-data-breach-unauthorized-disclosure-3b1c296c.json","targetId":"risk:data-breach-unauthorized-disclosure","type":"mitigates"},{"expectedCatalogRevision":"24028ffcfc2b295fa1b08ee6caa84b765f0731b321496bf4f548c49ad2177028","id":"rel:4fb51c383bd08d7e4cb798d652a83c0b888d8fd0853a69efefe852a66ecbb53a","properties":{},"sourceDetailPath":"/data/v1/records/ctrl-hipaa-hipaa-164-312-b-7272303c.json","sourceId":"ctrl:hipaa:HIPAA-164.312(b)","targetDetailPath":"/data/v1/records/std-hipaa-a825d271.json","targetId":"std:hipaa","type":"belongs_to"},{"expectedCatalogRevision":"24028ffcfc2b295fa1b08ee6caa84b765f0731b321496bf4f548c49ad2177028","id":"rel:507c1d4b76c3c9354c1015bed108c4c0f7deaa70306e648dcb43bee10e0277b5","properties":{"rationale":"","strength":"related"},"sourceDetailPath":"/data/v1/records/uc-uc-data-06-14975c65.json","sourceId":"uc:UC-DATA-06","targetDetailPath":"/data/v1/records/risk-data-surveillance-appropriation-18ad67e7.json","targetId":"risk:data-surveillance-appropriation","type":"mitigates"},{"expectedCatalogRevision":"24028ffcfc2b295fa1b08ee6caa84b765f0731b321496bf4f548c49ad2177028","id":"rel:55b3f2441185cbad5534000b07ed6b4ad1ff328a3dff96c78e4fb08421dd19f9","properties":{},"sourceDetailPath":"/data/v1/records/ctrl-hipaa-hipaa-164-502-8e8a8216.json","sourceId":"ctrl:hipaa:HIPAA-164.502","targetDetailPath":"/data/v1/records/std-hipaa-a825d271.json","targetId":"std:hipaa","type":"belongs_to"},{"expectedCatalogRevision":"24028ffcfc2b295fa1b08ee6caa84b765f0731b321496bf4f548c49ad2177028","id":"rel:5669fd2d5b3ff1530dbbda7eb8167298deb5f15a16531065fa2675fca1094b91","properties":{"control_id":"HIPAA-164.312(c)","coverage":"partial","delta":"the electronic mechanism to authenticate that ePHI has not been altered or destroyed is the specific integrity-verification arm","framework":"hipaa","provenance":{"defaultConfidence":"medium","defaultStatus":"active","direction":"canonical_to_source","mapper":"coworkcanvas-compliance-graph","note":"Each member is a documented relationship claim from the canonical unified control to a source control or guidance proposition. relationship: equal|superset_of (full) / intersects_with|subset_of (partial) / informs (guidance). confidence 'medium' = single-mapper, documented, not yet externally corroborated. source_version is the member framework's edition from the standard version register.","reviewDate":"2026-09-07"},"relationship":"intersects_with","source_version":"45 CFR Parts 160/164 (Security, Privacy, Breach Notification)"},"sourceDetailPath":"/data/v1/records/uc-uc-data-13-c09befaf.json","sourceId":"uc:UC-DATA-13","targetDetailPath":"/data/v1/records/ctrl-hipaa-hipaa-164-312-c-7002cebd.json","targetId":"ctrl:hipaa:HIPAA-164.312(c)","type":"maps_to"},{"expectedCatalogRevision":"24028ffcfc2b295fa1b08ee6caa84b765f0731b321496bf4f548c49ad2177028","id":"rel:5d617594d25b8a41b14088d5998a1bdf055119fb9f57b2e22f2d2fb80e0dae91","properties":{"rationale":"MFA with credential validation only over protected channels directly remediates absent MFA and clear-text authentication.","strength":"primary"},"sourceDetailPath":"/data/v1/records/uc-uc-access-09-444baafe.json","sourceId":"uc:UC-ACCESS-09","targetDetailPath":"/data/v1/records/risk-access-weak-authentication-4e35bdb2.json","targetId":"risk:access-weak-authentication","type":"mitigates"},{"expectedCatalogRevision":"24028ffcfc2b295fa1b08ee6caa84b765f0731b321496bf4f548c49ad2177028","id":"rel:5f9c9f2ee7a7058784c62630d6e9a3e22633f6949103ed9b8518bb0d429377e6","properties":{"control_id":"HIPAA-164.312(d)","coverage":"full","delta":null,"framework":"hipaa","provenance":{"defaultConfidence":"medium","defaultStatus":"active","direction":"canonical_to_source","mapper":"coworkcanvas-compliance-graph","note":"Each member is a documented relationship claim from the canonical unified control to a source control or guidance proposition. relationship: equal|superset_of (full) / intersects_with|subset_of (partial) / informs (guidance). confidence 'medium' = single-mapper, documented, not yet externally corroborated. source_version is the member framework's edition from the standard version register.","reviewDate":"2026-09-07"},"relationship":"superset_of","source_version":"45 CFR Parts 160/164 (Security, Privacy, Breach Notification)"},"sourceDetailPath":"/data/v1/records/uc-uc-access-09-444baafe.json","sourceId":"uc:UC-ACCESS-09","targetDetailPath":"/data/v1/records/ctrl-hipaa-hipaa-164-312-d-d1e8fe74.json","targetId":"ctrl:hipaa:HIPAA-164.312(d)","type":"maps_to"},{"expectedCatalogRevision":"24028ffcfc2b295fa1b08ee6caa84b765f0731b321496bf4f548c49ad2177028","id":"rel:6129d2158ca40f8e83e0d0ea66270ff7a9176d2f6a5b156fb4870346d80c6570","properties":{"control_id":"HIPAA-164.502","coverage":"partial","delta":"required disclosures to HHS, personal-representative and business-associate limits not addressed","framework":"hipaa","provenance":{"defaultConfidence":"medium","defaultStatus":"active","direction":"canonical_to_source","mapper":"coworkcanvas-compliance-graph","note":"Each member is a documented relationship claim from the canonical unified control to a source control or guidance proposition. relationship: equal|superset_of (full) / intersects_with|subset_of (partial) / informs (guidance). confidence 'medium' = single-mapper, documented, not yet externally corroborated. source_version is the member framework's edition from the standard version register.","reviewDate":"2026-09-07"},"relationship":"intersects_with","source_version":"45 CFR Parts 160/164 (Security, Privacy, Breach Notification)"},"sourceDetailPath":"/data/v1/records/uc-uc-data-03-55121dc9.json","sourceId":"uc:UC-DATA-03","targetDetailPath":"/data/v1/records/ctrl-hipaa-hipaa-164-502-8e8a8216.json","targetId":"ctrl:hipaa:HIPAA-164.502","type":"maps_to"},{"expectedCatalogRevision":"24028ffcfc2b295fa1b08ee6caa84b765f0731b321496bf4f548c49ad2177028","id":"rel:6b2e1633576aec74797561acd8e2770e4a4b3bf329e76e821b581925d07ae4ea","properties":{"control_id":"HIPAA-164.312(e)","coverage":"full","delta":null,"framework":"hipaa","provenance":{"defaultConfidence":"medium","defaultStatus":"active","direction":"canonical_to_source","mapper":"coworkcanvas-compliance-graph","note":"Each member is a documented relationship claim from the canonical unified control to a source control or guidance proposition. relationship: equal|superset_of (full) / intersects_with|subset_of (partial) / informs (guidance). confidence 'medium' = single-mapper, documented, not yet externally corroborated. source_version is the member framework's edition from the standard version register.","reviewDate":"2026-09-07"},"relationship":"superset_of","source_version":"45 CFR Parts 160/164 (Security, Privacy, Breach Notification)"},"sourceDetailPath":"/data/v1/records/uc-uc-crypto-01-55215c11.json","sourceId":"uc:UC-CRYPTO-01","targetDetailPath":"/data/v1/records/ctrl-hipaa-hipaa-164-312-e-edf6e525.json","targetId":"ctrl:hipaa:HIPAA-164.312(e)","type":"maps_to"},{"expectedCatalogRevision":"24028ffcfc2b295fa1b08ee6caa84b765f0731b321496bf4f548c49ad2177028","id":"rel:6d99f965983a2fe511395722ced4825b21f49f51932d6e6c7c5a24f90f48fd7d","properties":{"rationale":"Always-invoked, tamper-resistant authorization enforcement blocks access beyond permitted scope and resists forged rights.","strength":"primary"},"sourceDetailPath":"/data/v1/records/uc-uc-access-05-9b7f3e34.json","sourceId":"uc:UC-ACCESS-05","targetDetailPath":"/data/v1/records/risk-access-privilege-abuse-repudiation-343a8917.json","targetId":"risk:access-privilege-abuse-repudiation","type":"mitigates"},{"expectedCatalogRevision":"24028ffcfc2b295fa1b08ee6caa84b765f0731b321496bf4f548c49ad2177028","id":"rel:6fd598b196e61c1753b0491a313d783c4e6647f9346bee365fd94eca69bf0ba5","properties":{"rationale":"Including required security and confidentiality obligations in supplier agreements directly fixes the missing-security-terms facet in supplier contracts.","strength":"primary"},"sourceDetailPath":"/data/v1/records/uc-uc-tprm-03-c9edcf93.json","sourceId":"uc:UC-TPRM-03","targetDetailPath":"/data/v1/records/risk-hr-missing-security-terms-discipline-0a47163d.json","targetId":"risk:hr-missing-security-terms-discipline","type":"mitigates"},{"expectedCatalogRevision":"24028ffcfc2b295fa1b08ee6caa84b765f0731b321496bf4f548c49ad2177028","id":"rel:742f12bfa22aa79dad1ad12f11142e86877ae1b270e5eb0fec253ea4a23dacd6","properties":{},"sourceDetailPath":"/data/v1/records/ctrl-hipaa-hipaa-164-312-c-7002cebd.json","sourceId":"ctrl:hipaa:HIPAA-164.312(c)","targetDetailPath":"/data/v1/records/std-hipaa-a825d271.json","targetId":"std:hipaa","type":"belongs_to"},{"expectedCatalogRevision":"24028ffcfc2b295fa1b08ee6caa84b765f0731b321496bf4f548c49ad2177028","id":"rel:7600e8066bd80f681f6cdd1adaff667045e6a5a0ff9a75dcdce290af53c5d65d","properties":{"control_id":"HIPAA-164.310","coverage":"partial","delta":"also covers workstation use/security and device and media controls","framework":"hipaa","provenance":{"defaultConfidence":"medium","defaultStatus":"active","direction":"canonical_to_source","mapper":"coworkcanvas-compliance-graph","note":"Each member is a documented relationship claim from the canonical unified control to a source control or guidance proposition. relationship: equal|superset_of (full) / intersects_with|subset_of (partial) / informs (guidance). confidence 'medium' = single-mapper, documented, not yet externally corroborated. source_version is the member framework's edition from the standard version register.","reviewDate":"2026-09-07"},"relationship":"intersects_with","source_version":"45 CFR Parts 160/164 (Security, Privacy, Breach Notification)"},"sourceDetailPath":"/data/v1/records/uc-uc-phys-01-354431a7.json","sourceId":"uc:UC-PHYS-01","targetDetailPath":"/data/v1/records/ctrl-hipaa-hipaa-164-310-9cf84fad.json","targetId":"ctrl:hipaa:HIPAA-164.310","type":"maps_to"},{"expectedCatalogRevision":"24028ffcfc2b295fa1b08ee6caa84b765f0731b321496bf4f548c49ad2177028","id":"rel:82eea83fdecd378457273ff3b26152ccbdd0dd982a892cdfbf90bfd7358b7263","properties":{},"sourceDetailPath":"/data/v1/records/ctrl-hipaa-hipaa-164-400-414-aeadadc4.json","sourceId":"ctrl:hipaa:HIPAA-164.400-414","targetDetailPath":"/data/v1/records/std-hipaa-a825d271.json","targetId":"std:hipaa","type":"belongs_to"},{"expectedCatalogRevision":"24028ffcfc2b295fa1b08ee6caa84b765f0731b321496bf4f548c49ad2177028","id":"rel:8970c33bddd154c3cef76c7c7d82e5a8d118c74e982d2ab08a338dc51797f3fa","properties":{"rationale":"Renders data at rest unreadable and encrypts data in transit with strong cryptography, directly closing the absent/inadequate-encryption exposure for stored and transmitted data.","strength":"primary"},"sourceDetailPath":"/data/v1/records/uc-uc-crypto-01-55215c11.json","sourceId":"uc:UC-CRYPTO-01","targetDetailPath":"/data/v1/records/risk-crypto-weak-or-absent-encryption-2fe7d24e.json","targetId":"risk:crypto-weak-or-absent-encryption","type":"mitigates"},{"expectedCatalogRevision":"24028ffcfc2b295fa1b08ee6caa84b765f0731b321496bf4f548c49ad2177028","id":"rel:900f2470ca4c4df7af12d284683862a42ee705902d2e28bfa5295b4ffbc5620f","properties":{"rationale":"Presenting choices/consequences clearly and capturing freely-given, specific, informed consent directly counters misleading dark-pattern consent flows.","strength":"primary"},"sourceDetailPath":"/data/v1/records/uc-uc-data-02-56e3d60a.json","sourceId":"uc:UC-DATA-02","targetDetailPath":"/data/v1/records/risk-data-transparency-notice-dark-patterns-9326fdf0.json","targetId":"risk:data-transparency-notice-dark-patterns","type":"mitigates"},{"expectedCatalogRevision":"24028ffcfc2b295fa1b08ee6caa84b765f0731b321496bf4f548c49ad2177028","id":"rel:91009775ad3f068d3dc9c55e3e41cb9b4a1800e0aff8127b232b2f778cb7108b","properties":{"rationale":"Valid consent capture, records, and honored withdrawals/opt-outs remove the defective-consent-mechanism driver of fines and private actions.","strength":"primary"},"sourceDetailPath":"/data/v1/records/uc-uc-data-02-56e3d60a.json","sourceId":"uc:UC-DATA-02","targetDetailPath":"/data/v1/records/risk-data-privacy-program-noncompliance-ec6178fa.json","targetId":"risk:data-privacy-program-noncompliance","type":"mitigates"},{"expectedCatalogRevision":"24028ffcfc2b295fa1b08ee6caa84b765f0731b321496bf4f548c49ad2177028","id":"rel:923158a614f80efc606eb3339ab911d401d3cce1fa05901ce56ea607d872d00e","properties":{},"sourceDetailPath":"/data/v1/records/ctrl-hipaa-hipaa-164-524-2cfa4f29.json","sourceId":"ctrl:hipaa:HIPAA-164.524","targetDetailPath":"/data/v1/records/std-hipaa-a825d271.json","targetId":"std:hipaa","type":"belongs_to"},{"expectedCatalogRevision":"24028ffcfc2b295fa1b08ee6caa84b765f0731b321496bf4f548c49ad2177028","id":"rel:935e9a602ba4f4838a2f1ac695db1d0e5817c01284ccf83483362e67b49b5cf3","properties":{"rationale":"Purpose limitation plus the minimum-necessary standard directly restricts over-use/over-disclosure and blocks secondary use without new authority.","strength":"primary"},"sourceDetailPath":"/data/v1/records/uc-uc-data-03-55121dc9.json","sourceId":"uc:UC-DATA-03","targetDetailPath":"/data/v1/records/risk-data-excessive-collection-purpose-creep-4a691595.json","targetId":"risk:data-excessive-collection-purpose-creep","type":"mitigates"},{"expectedCatalogRevision":"24028ffcfc2b295fa1b08ee6caa84b765f0731b321496bf4f548c49ad2177028","id":"rel:985a5440dadf75eb79883d674ef43dd30259271ae6623cd5b1ded6eb4dd4839f","properties":{"control_id":"HIPAA-164.508","coverage":"partial","delta":"when authorization is mandatory (marketing, sale of PHI, psychotherapy notes) not established","framework":"hipaa","provenance":{"defaultConfidence":"medium","defaultStatus":"active","direction":"canonical_to_source","mapper":"coworkcanvas-compliance-graph","note":"Each member is a documented relationship claim from the canonical unified control to a source control or guidance proposition. relationship: equal|superset_of (full) / intersects_with|subset_of (partial) / informs (guidance). confidence 'medium' = single-mapper, documented, not yet externally corroborated. source_version is the member framework's edition from the standard version register.","reviewDate":"2026-09-07"},"relationship":"intersects_with","source_version":"45 CFR Parts 160/164 (Security, Privacy, Breach Notification)"},"sourceDetailPath":"/data/v1/records/uc-uc-data-02-56e3d60a.json","sourceId":"uc:UC-DATA-02","targetDetailPath":"/data/v1/records/ctrl-hipaa-hipaa-164-508-208be590.json","targetId":"ctrl:hipaa:HIPAA-164.508","type":"maps_to"},{"expectedCatalogRevision":"24028ffcfc2b295fa1b08ee6caa84b765f0731b321496bf4f548c49ad2177028","id":"rel:99add7743fc03c19485dec411957bb1295d8be6e7c3bb47add70c1e2c52e4609","properties":{"rationale":"","strength":"related"},"sourceDetailPath":"/data/v1/records/uc-uc-hr-01-c7e14dc5.json","sourceId":"uc:UC-HR-01","targetDetailPath":"/data/v1/records/risk-hr-discrimination-harassment-767d6cb7.json","targetId":"risk:hr-discrimination-harassment","type":"mitigates"},{"expectedCatalogRevision":"24028ffcfc2b295fa1b08ee6caa84b765f0731b321496bf4f548c49ad2177028","id":"rel:a1bb1621ad1c51d063f6e33db96e516aadea16e66c6f3ad15bdb3abc0f0ba182","properties":{},"sourceDetailPath":"/data/v1/records/ctrl-hipaa-hipaa-164-314-0b44ffa8.json","sourceId":"ctrl:hipaa:HIPAA-164.314","targetDetailPath":"/data/v1/records/std-hipaa-a825d271.json","targetId":"std:hipaa","type":"belongs_to"},{"expectedCatalogRevision":"24028ffcfc2b295fa1b08ee6caa84b765f0731b321496bf4f548c49ad2177028","id":"rel:a61f37f0d822a0d2f0f83a8f144cc7c10b3d99b4fed6473e86dbae2100efe744","properties":{"control_id":"HIPAA-164.514","coverage":"full","delta":null,"framework":"hipaa","provenance":{"defaultConfidence":"medium","defaultStatus":"active","direction":"canonical_to_source","mapper":"coworkcanvas-compliance-graph","note":"Each member is a documented relationship claim from the canonical unified control to a source control or guidance proposition. relationship: equal|superset_of (full) / intersects_with|subset_of (partial) / informs (guidance). confidence 'medium' = single-mapper, documented, not yet externally corroborated. source_version is the member framework's edition from the standard version register.","reviewDate":"2026-09-07"},"relationship":"superset_of","source_version":"45 CFR Parts 160/164 (Security, Privacy, Breach Notification)"},"sourceDetailPath":"/data/v1/records/uc-uc-data-12-c5a5999a.json","sourceId":"uc:UC-DATA-12","targetDetailPath":"/data/v1/records/ctrl-hipaa-hipaa-164-514-ccac89ca.json","targetId":"ctrl:hipaa:HIPAA-164.514","type":"maps_to"},{"expectedCatalogRevision":"24028ffcfc2b295fa1b08ee6caa84b765f0731b321496bf4f548c49ad2177028","id":"rel:a7da59065613ede3740dad783a788bcdc502c2f193696c8d8be8b2a3c5f70637","properties":{"rationale":"Logging authentication and privileged actions creates the accountability record that detects rights abuse and defeats repudiation of actions.","strength":"primary"},"sourceDetailPath":"/data/v1/records/uc-uc-log-01-022e9745.json","sourceId":"uc:UC-LOG-01","targetDetailPath":"/data/v1/records/risk-access-privilege-abuse-repudiation-343a8917.json","targetId":"risk:access-privilege-abuse-repudiation","type":"mitigates"},{"expectedCatalogRevision":"24028ffcfc2b295fa1b08ee6caa84b765f0731b321496bf4f548c49ad2177028","id":"rel:b288b6a36eea554ba24fb212fc87faa0c94acca7b8db8977cad9f6d1305a8550","properties":{"rationale":"Keeping data accurate/current and executing corrections directly counters distortion harm from processing inaccurate/out-of-context data.","strength":"primary"},"sourceDetailPath":"/data/v1/records/uc-uc-data-07-a6976e38.json","sourceId":"uc:UC-DATA-07","targetDetailPath":"/data/v1/records/risk-data-privacy-harms-to-individuals-510e65af.json","targetId":"risk:data-privacy-harms-to-individuals","type":"mitigates"},{"expectedCatalogRevision":"24028ffcfc2b295fa1b08ee6caa84b765f0731b321496bf4f548c49ad2177028","id":"rel:b2a214b13d62b4e14783c3eae4ada122863c80907dd25fab0198d7be368231ee","properties":{"rationale":"Fulfilling access requests within statutory deadlines addresses the failure-to-honor-DSR driver of non-compliance.","strength":"related"},"sourceDetailPath":"/data/v1/records/uc-uc-data-06-14975c65.json","sourceId":"uc:UC-DATA-06","targetDetailPath":"/data/v1/records/risk-data-privacy-program-noncompliance-ec6178fa.json","targetId":"risk:data-privacy-program-noncompliance","type":"mitigates"},{"expectedCatalogRevision":"24028ffcfc2b295fa1b08ee6caa84b765f0731b321496bf4f548c49ad2177028","id":"rel:b312a3465956656f933a2d24079ffb3960496f2c22e14a96ad449d31cfe0d456","properties":{"rationale":"Mandates strong encryption of data in transit over all public/external networks and rejects fallback to insecure protocols, directly preventing credentials and sensitive comms from crossing the wire in clear text.","strength":"primary"},"sourceDetailPath":"/data/v1/records/uc-uc-crypto-01-55215c11.json","sourceId":"uc:UC-CRYPTO-01","targetDetailPath":"/data/v1/records/risk-crypto-cleartext-credential-transfer-b88065a1.json","targetId":"risk:crypto-cleartext-credential-transfer","type":"mitigates"},{"expectedCatalogRevision":"24028ffcfc2b295fa1b08ee6caa84b765f0731b321496bf4f548c49ad2177028","id":"rel:b4a52314083c62606dd5b45a89f201bf62653f36f71bc0445b6daf6f53606c3b","properties":{"control_id":"HIPAA-164.524","coverage":"full","delta":null,"framework":"hipaa","provenance":{"defaultConfidence":"medium","defaultStatus":"active","direction":"canonical_to_source","mapper":"coworkcanvas-compliance-graph","note":"Each member is a documented relationship claim from the canonical unified control to a source control or guidance proposition. relationship: equal|superset_of (full) / intersects_with|subset_of (partial) / informs (guidance). confidence 'medium' = single-mapper, documented, not yet externally corroborated. source_version is the member framework's edition from the standard version register.","reviewDate":"2026-09-07"},"relationship":"superset_of","source_version":"45 CFR Parts 160/164 (Security, Privacy, Breach Notification)"},"sourceDetailPath":"/data/v1/records/uc-uc-data-06-14975c65.json","sourceId":"uc:UC-DATA-06","targetDetailPath":"/data/v1/records/ctrl-hipaa-hipaa-164-524-2cfa4f29.json","targetId":"ctrl:hipaa:HIPAA-164.524","type":"maps_to"},{"expectedCatalogRevision":"24028ffcfc2b295fa1b08ee6caa84b765f0731b321496bf4f548c49ad2177028","id":"rel:b50bbf8c9151fb9ceac47f588664ecd9001b4cadbf208f9d2694e277952cb2bb","properties":{},"sourceDetailPath":"/data/v1/records/ctrl-hipaa-hipaa-164-520-e2735a22.json","sourceId":"ctrl:hipaa:HIPAA-164.520","targetDetailPath":"/data/v1/records/std-hipaa-a825d271.json","targetId":"std:hipaa","type":"belongs_to"},{"expectedCatalogRevision":"24028ffcfc2b295fa1b08ee6caa84b765f0731b321496bf4f548c49ad2177028","id":"rel:b56d83736730185faefb32d434fec9af7c80c5b08446a9620c03e3f2e47a05cd","properties":{"rationale":"Periodic data-quality checks detect and correct inaccurate or altered data, limiting integrity loss.","strength":"related"},"sourceDetailPath":"/data/v1/records/uc-uc-data-07-a6976e38.json","sourceId":"uc:UC-DATA-07","targetDetailPath":"/data/v1/records/risk-data-corruption-integrity-loss-e771738a.json","targetId":"risk:data-corruption-integrity-loss","type":"mitigates"},{"expectedCatalogRevision":"24028ffcfc2b295fa1b08ee6caa84b765f0731b321496bf4f548c49ad2177028","id":"rel:b8ac22db464c1e05c1286c62ad846d099b579a8246dde5212f64d48d01418e67","properties":{"control_id":"HIPAA-164.308","coverage":"partial","delta":"risk analysis, training, contingency, evaluation, and BAAs satisfied in other domains","framework":"hipaa","provenance":{"defaultConfidence":"medium","defaultStatus":"active","direction":"canonical_to_source","mapper":"coworkcanvas-compliance-graph","note":"Each member is a documented relationship claim from the canonical unified control to a source control or guidance proposition. relationship: equal|superset_of (full) / intersects_with|subset_of (partial) / informs (guidance). confidence 'medium' = single-mapper, documented, not yet externally corroborated. source_version is the member framework's edition from the standard version register.","reviewDate":"2026-09-07"},"relationship":"intersects_with","source_version":"45 CFR Parts 160/164 (Security, Privacy, Breach Notification)"},"sourceDetailPath":"/data/v1/records/uc-uc-hr-01-c7e14dc5.json","sourceId":"uc:UC-HR-01","targetDetailPath":"/data/v1/records/ctrl-hipaa-hipaa-164-308-d26b6932.json","targetId":"ctrl:hipaa:HIPAA-164.308","type":"maps_to"},{"expectedCatalogRevision":"24028ffcfc2b295fa1b08ee6caa84b765f0731b321496bf4f548c49ad2177028","id":"rel:b9f010e652a86ba096c55275dae7215b6d336e955a7220132db8747e27fd35c9","properties":{"rationale":"Implementing reasonable admin/technical/physical safeguards sized to data volume/sensitivity directly reduces unauthorized disclosure/breach.","strength":"primary"},"sourceDetailPath":"/data/v1/records/uc-uc-data-13-c09befaf.json","sourceId":"uc:UC-DATA-13","targetDetailPath":"/data/v1/records/risk-data-breach-unauthorized-disclosure-3b1c296c.json","targetId":"risk:data-breach-unauthorized-disclosure","type":"mitigates"},{"expectedCatalogRevision":"24028ffcfc2b295fa1b08ee6caa84b765f0731b321496bf4f548c49ad2177028","id":"rel:babc2f679c479b5e1c64ef64adffeec5727c9bab34ed9fee8461e2e6be6d107d","properties":{"rationale":"Executing/denying correction requests within statutory deadlines addresses the DSR-timeliness driver of non-compliance.","strength":"related"},"sourceDetailPath":"/data/v1/records/uc-uc-data-07-a6976e38.json","sourceId":"uc:UC-DATA-07","targetDetailPath":"/data/v1/records/risk-data-privacy-program-noncompliance-ec6178fa.json","targetId":"risk:data-privacy-program-noncompliance","type":"mitigates"},{"expectedCatalogRevision":"24028ffcfc2b295fa1b08ee6caa84b765f0731b321496bf4f548c49ad2177028","id":"rel:bb610d04c71da3f279147ee116490166020dfc381a936ab40d1bddb6767a0c60","properties":{"rationale":"PII-protection requirements include data-minimization and purpose-limitation, directly addressing over-collection and purpose creep.","strength":"primary"},"sourceDetailPath":"/data/v1/records/uc-uc-data-13-c09befaf.json","sourceId":"uc:UC-DATA-13","targetDetailPath":"/data/v1/records/risk-data-excessive-collection-purpose-creep-4a691595.json","targetId":"risk:data-excessive-collection-purpose-creep","type":"mitigates"},{"expectedCatalogRevision":"24028ffcfc2b295fa1b08ee6caa84b765f0731b321496bf4f548c49ad2177028","id":"rel:bf5f7706b3e73a46db661616cf5be6eac2a75128746032843f715220ed4b0d51","properties":{"control_id":"HIPAA-164.312(b)","coverage":"full","delta":null,"framework":"hipaa","provenance":{"defaultConfidence":"medium","defaultStatus":"active","direction":"canonical_to_source","mapper":"coworkcanvas-compliance-graph","note":"Each member is a documented relationship claim from the canonical unified control to a source control or guidance proposition. relationship: equal|superset_of (full) / intersects_with|subset_of (partial) / informs (guidance). confidence 'medium' = single-mapper, documented, not yet externally corroborated. source_version is the member framework's edition from the standard version register.","reviewDate":"2026-09-07"},"relationship":"superset_of","source_version":"45 CFR Parts 160/164 (Security, Privacy, Breach Notification)"},"sourceDetailPath":"/data/v1/records/uc-uc-log-01-022e9745.json","sourceId":"uc:UC-LOG-01","targetDetailPath":"/data/v1/records/ctrl-hipaa-hipaa-164-312-b-7272303c.json","targetId":"ctrl:hipaa:HIPAA-164.312(b)","type":"maps_to"},{"expectedCatalogRevision":"24028ffcfc2b295fa1b08ee6caa84b765f0731b321496bf4f548c49ad2177028","id":"rel:bf8fbdcb6b595ec8b42bfc9e5fa5f080efc5ae864aa1493692275cb3b0f86ba0","properties":{},"sourceDetailPath":"/data/v1/records/ctrl-hipaa-hipaa-164-508-208be590.json","sourceId":"ctrl:hipaa:HIPAA-164.508","targetDetailPath":"/data/v1/records/std-hipaa-a825d271.json","targetId":"std:hipaa","type":"belongs_to"},{"expectedCatalogRevision":"24028ffcfc2b295fa1b08ee6caa84b765f0731b321496bf4f548c49ad2177028","id":"rel:c8436cf942803f6684548623379ec24ed1adf724f2ef38897a2c22b83c5b428f","properties":{"rationale":"MFA blocks account takeover even when a password is phished, the canonical defense against credential-harvesting social engineering.","strength":"primary"},"sourceDetailPath":"/data/v1/records/uc-uc-access-09-444baafe.json","sourceId":"uc:UC-ACCESS-09","targetDetailPath":"/data/v1/records/risk-aware-phishing-social-engineering-bb9b7bd6.json","targetId":"risk:aware-phishing-social-engineering","type":"mitigates"},{"expectedCatalogRevision":"24028ffcfc2b295fa1b08ee6caa84b765f0731b321496bf4f548c49ad2177028","id":"rel:c8ca93910cdaab4b8e5eb6137031ced2d72703c1b8870a0749d54ba253b04841","properties":{"rationale":"","strength":"related"},"sourceDetailPath":"/data/v1/records/uc-uc-data-13-c09befaf.json","sourceId":"uc:UC-DATA-13","targetDetailPath":"/data/v1/records/risk-data-reidentification-inference-d4b31f45.json","targetId":"risk:data-reidentification-inference","type":"mitigates"},{"expectedCatalogRevision":"24028ffcfc2b295fa1b08ee6caa84b765f0731b321496bf4f548c49ad2177028","id":"rel:cf20f209cd1c7d4ef9387c1eeb0c255613c65e9023166ff5fc7b6a53a6a5f8ef","properties":{"control_id":"HIPAA-164.400-414","coverage":"partial","delta":"individual notice within 60 days; media notice at 500+ residents of a state/jurisdiction; HHS notice at 500+ individuals (contemporaneous); HHS notification required for all breaches (sub-500 via annual log)","framework":"hipaa","provenance":{"defaultConfidence":"medium","defaultStatus":"active","direction":"canonical_to_source","mapper":"coworkcanvas-compliance-graph","note":"Each member is a documented relationship claim from the canonical unified control to a source control or guidance proposition. relationship: equal|superset_of (full) / intersects_with|subset_of (partial) / informs (guidance). confidence 'medium' = single-mapper, documented, not yet externally corroborated. source_version is the member framework's edition from the standard version register.","reviewDate":"2026-09-07"},"relationship":"intersects_with","source_version":"45 CFR Parts 160/164 (Security, Privacy, Breach Notification)"},"sourceDetailPath":"/data/v1/records/uc-uc-ir-08-01afe3d1.json","sourceId":"uc:UC-IR-08","targetDetailPath":"/data/v1/records/ctrl-hipaa-hipaa-164-400-414-aeadadc4.json","targetId":"ctrl:hipaa:HIPAA-164.400-414","type":"maps_to"},{"expectedCatalogRevision":"24028ffcfc2b295fa1b08ee6caa84b765f0731b321496bf4f548c49ad2177028","id":"rel:d03de70994cf6ae42ed65883aeba4e7b4c30f2e8f3aba91d450e253570833ce3","properties":{"rationale":"Masking/pseudonymization/de-identification plus protecting re-identification keys and prohibiting re-identification directly counters linkage/inference attacks.","strength":"primary"},"sourceDetailPath":"/data/v1/records/uc-uc-data-12-c5a5999a.json","sourceId":"uc:UC-DATA-12","targetDetailPath":"/data/v1/records/risk-data-reidentification-inference-d4b31f45.json","targetId":"risk:data-reidentification-inference","type":"mitigates"},{"expectedCatalogRevision":"24028ffcfc2b295fa1b08ee6caa84b765f0731b321496bf4f548c49ad2177028","id":"rel:d41f0bc69ad3c8a5089dc58f95d944447d4b94539bbfdf3975aa97dedee63698","properties":{"control_id":"HIPAA-164.526","coverage":"partial","delta":"statement-of-disagreement appending and inclusion in future disclosures omitted","framework":"hipaa","provenance":{"defaultConfidence":"medium","defaultStatus":"active","direction":"canonical_to_source","mapper":"coworkcanvas-compliance-graph","note":"Each member is a documented relationship claim from the canonical unified control to a source control or guidance proposition. relationship: equal|superset_of (full) / intersects_with|subset_of (partial) / informs (guidance). confidence 'medium' = single-mapper, documented, not yet externally corroborated. source_version is the member framework's edition from the standard version register.","reviewDate":"2026-09-07"},"relationship":"intersects_with","source_version":"45 CFR Parts 160/164 (Security, Privacy, Breach Notification)"},"sourceDetailPath":"/data/v1/records/uc-uc-data-07-a6976e38.json","sourceId":"uc:UC-DATA-07","targetDetailPath":"/data/v1/records/ctrl-hipaa-hipaa-164-526-a1e5b051.json","targetId":"ctrl:hipaa:HIPAA-164.526","type":"maps_to"},{"expectedCatalogRevision":"24028ffcfc2b295fa1b08ee6caa84b765f0731b321496bf4f548c49ad2177028","id":"rel:d8d42bf85ad8b78bd895f84c62c95e0675bfd71b283e9534f0fc444210b33e94","properties":{"rationale":"Logging access to sensitive/regulated (e.g., cardholder) data provides a targeted detection input for locating and investigating exfiltration.","strength":"related"},"sourceDetailPath":"/data/v1/records/uc-uc-log-01-022e9745.json","sourceId":"uc:UC-LOG-01","targetDetailPath":"/data/v1/records/risk-data-exfiltration-espionage-74803ebc.json","targetId":"risk:data-exfiltration-espionage","type":"mitigates"},{"expectedCatalogRevision":"24028ffcfc2b295fa1b08ee6caa84b765f0731b321496bf4f548c49ad2177028","id":"rel:e7d0fd4079f9f307876e9cce5ca8ba86e2eb2bcfdf07139d75ac5c078694489f","properties":{"control_id":"HIPAA-164.316","coverage":"full","delta":null,"framework":"hipaa","provenance":{"defaultConfidence":"medium","defaultStatus":"active","direction":"canonical_to_source","mapper":"coworkcanvas-compliance-graph","note":"Each member is a documented relationship claim from the canonical unified control to a source control or guidance proposition. relationship: equal|superset_of (full) / intersects_with|subset_of (partial) / informs (guidance). confidence 'medium' = single-mapper, documented, not yet externally corroborated. source_version is the member framework's edition from the standard version register.","reviewDate":"2026-09-07"},"relationship":"superset_of","source_version":"45 CFR Parts 160/164 (Security, Privacy, Breach Notification)"},"sourceDetailPath":"/data/v1/records/uc-uc-gov-14-f4f2c470.json","sourceId":"uc:UC-GOV-14","targetDetailPath":"/data/v1/records/ctrl-hipaa-hipaa-164-316-15412c2a.json","targetId":"ctrl:hipaa:HIPAA-164.316","type":"maps_to"},{"expectedCatalogRevision":"24028ffcfc2b295fa1b08ee6caa84b765f0731b321496bf4f548c49ad2177028","id":"rel:e91251e51b94359281b7802f4e678303af65735c05c6373bedd59f6c5af215ec","properties":{"rationale":"Restricting use/disclosure to documented purposes limits monitoring and appropriation of data beyond its stated purpose.","strength":"related"},"sourceDetailPath":"/data/v1/records/uc-uc-data-03-55121dc9.json","sourceId":"uc:UC-DATA-03","targetDetailPath":"/data/v1/records/risk-data-surveillance-appropriation-18ad67e7.json","targetId":"risk:data-surveillance-appropriation","type":"mitigates"},{"expectedCatalogRevision":"24028ffcfc2b295fa1b08ee6caa84b765f0731b321496bf4f548c49ad2177028","id":"rel:ea0857f1471c448528c386dedf7737383f16319ad8aa316a3aa3f3e4ae295328","properties":{"rationale":"Robust de-identification reduces AI inference re-identifying anonymized data and inferring sensitive attributes.","strength":"related"},"sourceDetailPath":"/data/v1/records/uc-uc-data-12-c5a5999a.json","sourceId":"uc:UC-DATA-12","targetDetailPath":"/data/v1/records/risk-ai-privacy-leakage-9aa8d83c.json","targetId":"risk:ai-privacy-leakage","type":"mitigates"},{"expectedCatalogRevision":"24028ffcfc2b295fa1b08ee6caa84b765f0731b321496bf4f548c49ad2177028","id":"rel:eb574e1ee5af198d30e979b5a3e95c9f89a9b517eb2b5e67b71ad349dfcda820","properties":{},"sourceDetailPath":"/data/v1/records/ctrl-hipaa-hipaa-164-526-a1e5b051.json","sourceId":"ctrl:hipaa:HIPAA-164.526","targetDetailPath":"/data/v1/records/std-hipaa-a825d271.json","targetId":"std:hipaa","type":"belongs_to"},{"expectedCatalogRevision":"24028ffcfc2b295fa1b08ee6caa84b765f0731b321496bf4f548c49ad2177028","id":"rel:f62bc12363b88d2a2532db52ba69792e4010cf7b96f0aa647a145a846a23c2a7","properties":{"rationale":"MFA directly defeats account takeover using stolen credentials.","strength":"primary"},"sourceDetailPath":"/data/v1/records/uc-uc-access-09-444baafe.json","sourceId":"uc:UC-ACCESS-09","targetDetailPath":"/data/v1/records/risk-fraud-external-c3ce412f.json","targetId":"risk:fraud-external","type":"mitigates"},{"expectedCatalogRevision":"24028ffcfc2b295fa1b08ee6caa84b765f0731b321496bf4f548c49ad2177028","id":"rel:fbbd0dcfdd8c9aa3e68221ba809794838d36c34b66b5794d6d87cb634894f6ad","properties":{"control_id":"HIPAA-164.520","coverage":"partial","delta":"NPP-specific content (header, complaint process, duties, effective date) and acknowledgment mechanics omitted","framework":"hipaa","provenance":{"defaultConfidence":"medium","defaultStatus":"active","direction":"canonical_to_source","mapper":"coworkcanvas-compliance-graph","note":"Each member is a documented relationship claim from the canonical unified control to a source control or guidance proposition. relationship: equal|superset_of (full) / intersects_with|subset_of (partial) / informs (guidance). confidence 'medium' = single-mapper, documented, not yet externally corroborated. source_version is the member framework's edition from the standard version register.","reviewDate":"2026-09-07"},"relationship":"intersects_with","source_version":"45 CFR Parts 160/164 (Security, Privacy, Breach Notification)"},"sourceDetailPath":"/data/v1/records/uc-uc-data-05-3244ac25.json","sourceId":"uc:UC-DATA-05","targetDetailPath":"/data/v1/records/ctrl-hipaa-hipaa-164-520-e2735a22.json","targetId":"ctrl:hipaa:HIPAA-164.520","type":"maps_to"}],"schemaVersion":1,"scope":"sources","total":105}