{"catalogRevision":"24028ffcfc2b295fa1b08ee6caa84b765f0731b321496bf4f548c49ad2177028","contextIds":["risk:access-excess-privilege","risk:access-privilege-abuse-repudiation","risk:access-provisioning-review-gap","risk:access-weak-authentication","risk:ai-gpai-systemic-transparency","risk:ai-supply-chain-concentration","risk:aware-insufficient-training","risk:aware-no-acceptable-use-policy","risk:aware-phishing-social-engineering","risk:aware-role-based-training-gap","risk:aware-user-error-mishandling","risk:bcdr-no-tested-continuity-plan","risk:bcdr-single-point-concentration","risk:compliance-litigation-enforcement","risk:config-internet-exposed-misconfig","risk:config-poor-baseline-drift","risk:crypto-cleartext-credential-transfer","risk:crypto-counterfeit-certificates","risk:crypto-weak-or-absent-encryption","risk:cyber-adversary-threat-sources","risk:cyber-coordinated-campaign","risk:data-exfiltration-espionage"],"directIds":["ctrl:nydfs-500:500.10","ctrl:nydfs-500:500.11","ctrl:nydfs-500:500.12","ctrl:nydfs-500:500.13","ctrl:nydfs-500:500.14","ctrl:nydfs-500:500.15","ctrl:nydfs-500:500.16","ctrl:nydfs-500:500.17","ctrl:nydfs-500:500.18","ctrl:nydfs-500:500.19","ctrl:nydfs-500:500.2","ctrl:nydfs-500:500.3","ctrl:nydfs-500:500.4","ctrl:nydfs-500:500.5","ctrl:nydfs-500:500.6","ctrl:nydfs-500:500.7","ctrl:nydfs-500:500.8","ctrl:nydfs-500:500.9"],"kind":"bundle","metadata":"/assets/agent_metadata.5c7612c9c5b0b455.json","name":"NYDFS Part 500","next":"/assets/agent_sources-nydfs-500-2.61cc7654eeed878f.json","page":1,"pageSize":40,"records":[{"attributes":{"category":"administrative","framework":"nydfs-500","type":"preventive"},"canonicalUrl":"https://controlsmap.com/frameworks/nydfs-500/","description":"Cybersecurity personnel and intelligence","details":{"automation":"manual","control_category":"administrative","control_id":"500.10","control_type":"preventive","domains":["Governance, Policy & Oversight","Risk Assessment & Management","Access Control & Identity Management","Vulnerability & Patch Management","Logging, Monitoring & Detection","Third-Party / Supply-Chain Risk","Cryptography & Key Management","Incident Management & Response","Business Continuity & Disaster Recovery","Awareness & Training"],"framework":"nydfs-500","group":"NYDFS 500 (NY Cybersecurity Regulation, 23 NYCRR 500)","key_control":false,"requirement_frequency":null,"requirement_status":null,"risk_count":2,"source_pages":null,"source_url":null},"direct":true,"htmlUrl":"/agents/records/ctrl-nydfs-500-500-10-44ad738a.html","id":"ctrl:nydfs-500:500.10","mapUrl":"https://controlsmap.com/?v=1&node=ctrl%3Anydfs-500%3A500.10","sourceIds":["nydfs-500"],"sourceUrl":null,"title":"500.10 — Cybersecurity personnel and intelligence","type":"control","url":"/assets/agent_record-ctrl-nydfs-500-500-10-44ad738a.b72cdd3cc82009f8.json"},{"attributes":{"category":"administrative","framework":"nydfs-500","type":"preventive"},"canonicalUrl":"https://controlsmap.com/frameworks/nydfs-500/","description":"Third-party service provider security policy","details":{"automation":"manual","control_category":"administrative","control_id":"500.11","control_type":"preventive","domains":["Governance, Policy & Oversight","Risk Assessment & Management","Access Control & Identity Management","Vulnerability & Patch Management","Logging, Monitoring & Detection","Third-Party / Supply-Chain Risk","Cryptography & Key Management","Incident Management & Response","Business Continuity & Disaster Recovery","Awareness & Training"],"framework":"nydfs-500","group":"NYDFS 500 (NY Cybersecurity Regulation, 23 NYCRR 500)","key_control":false,"requirement_frequency":null,"requirement_status":null,"risk_count":8,"source_pages":null,"source_url":null},"direct":true,"htmlUrl":"/agents/records/ctrl-nydfs-500-500-11-55bec62e.html","id":"ctrl:nydfs-500:500.11","mapUrl":"https://controlsmap.com/?v=1&node=ctrl%3Anydfs-500%3A500.11","sourceIds":["nydfs-500"],"sourceUrl":null,"title":"500.11 — Third-party service provider security policy","type":"control","url":"/assets/agent_record-ctrl-nydfs-500-500-11-55bec62e.836f7ad5f2806ff2.json"},{"attributes":{"category":"technical","framework":"nydfs-500","type":"preventive"},"canonicalUrl":"https://controlsmap.com/frameworks/nydfs-500/","description":"Multi-factor authentication","details":{"automation":"automated","control_category":"technical","control_id":"500.12","control_type":"preventive","domains":["Governance, Policy & Oversight","Risk Assessment & Management","Access Control & Identity Management","Vulnerability & Patch Management","Logging, Monitoring & Detection","Third-Party / Supply-Chain Risk","Cryptography & Key Management","Incident Management & Response","Business Continuity & Disaster Recovery","Awareness & Training"],"framework":"nydfs-500","group":"NYDFS 500 (NY Cybersecurity Regulation, 23 NYCRR 500)","key_control":true,"requirement_frequency":null,"requirement_status":null,"risk_count":4,"source_pages":null,"source_url":null},"direct":true,"htmlUrl":"/agents/records/ctrl-nydfs-500-500-12-c3c47b61.html","id":"ctrl:nydfs-500:500.12","mapUrl":"https://controlsmap.com/?v=1&node=ctrl%3Anydfs-500%3A500.12","sourceIds":["nydfs-500"],"sourceUrl":null,"title":"500.12 — Multi-factor authentication","type":"control","url":"/assets/agent_record-ctrl-nydfs-500-500-12-c3c47b61.12a68ca8c1a8ff09.json"},{"attributes":{"category":"administrative","framework":"nydfs-500","type":"preventive"},"canonicalUrl":"https://controlsmap.com/frameworks/nydfs-500/","description":"Asset management and data retention limitations","details":{"automation":"manual","control_category":"administrative","control_id":"500.13","control_type":"preventive","domains":["Governance, Policy & Oversight","Risk Assessment & Management","Access Control & Identity Management","Vulnerability & Patch Management","Logging, Monitoring & Detection","Third-Party / Supply-Chain Risk","Cryptography & Key Management","Incident Management & Response","Business Continuity & Disaster Recovery","Awareness & Training"],"framework":"nydfs-500","group":"NYDFS 500 (NY Cybersecurity Regulation, 23 NYCRR 500)","key_control":false,"requirement_frequency":null,"requirement_status":null,"risk_count":2,"source_pages":null,"source_url":null},"direct":true,"htmlUrl":"/agents/records/ctrl-nydfs-500-500-13-f6a493b8.html","id":"ctrl:nydfs-500:500.13","mapUrl":"https://controlsmap.com/?v=1&node=ctrl%3Anydfs-500%3A500.13","sourceIds":["nydfs-500"],"sourceUrl":null,"title":"500.13 — Asset management and data retention limitations","type":"control","url":"/assets/agent_record-ctrl-nydfs-500-500-13-f6a493b8.578418ba76aba264.json"},{"attributes":{"category":"technical","framework":"nydfs-500","type":"detective"},"canonicalUrl":"https://controlsmap.com/frameworks/nydfs-500/","description":"Monitoring and training","details":{"automation":"hybrid","control_category":"technical","control_id":"500.14","control_type":"detective","domains":["Governance, Policy & Oversight","Risk Assessment & Management","Access Control & Identity Management","Vulnerability & Patch Management","Logging, Monitoring & Detection","Third-Party / Supply-Chain Risk","Cryptography & Key Management","Incident Management & Response","Business Continuity & Disaster Recovery","Awareness & Training"],"framework":"nydfs-500","group":"NYDFS 500 (NY Cybersecurity Regulation, 23 NYCRR 500)","key_control":true,"requirement_frequency":null,"requirement_status":null,"risk_count":5,"source_pages":null,"source_url":null},"direct":true,"htmlUrl":"/agents/records/ctrl-nydfs-500-500-14-d15e0ff2.html","id":"ctrl:nydfs-500:500.14","mapUrl":"https://controlsmap.com/?v=1&node=ctrl%3Anydfs-500%3A500.14","sourceIds":["nydfs-500"],"sourceUrl":null,"title":"500.14 — Monitoring and training","type":"control","url":"/assets/agent_record-ctrl-nydfs-500-500-14-d15e0ff2.d686b8b4cb95a4b5.json"},{"attributes":{"category":"technical","framework":"nydfs-500","type":"preventive"},"canonicalUrl":"https://controlsmap.com/frameworks/nydfs-500/","description":"Encryption of nonpublic information","details":{"automation":"automated","control_category":"technical","control_id":"500.15","control_type":"preventive","domains":["Governance, Policy & Oversight","Risk Assessment & Management","Access Control & Identity Management","Vulnerability & Patch Management","Logging, Monitoring & Detection","Third-Party / Supply-Chain Risk","Cryptography & Key Management","Incident Management & Response","Business Continuity & Disaster Recovery","Awareness & Training"],"framework":"nydfs-500","group":"NYDFS 500 (NY Cybersecurity Regulation, 23 NYCRR 500)","key_control":true,"requirement_frequency":null,"requirement_status":null,"risk_count":4,"source_pages":null,"source_url":null},"direct":true,"htmlUrl":"/agents/records/ctrl-nydfs-500-500-15-5ef052ba.html","id":"ctrl:nydfs-500:500.15","mapUrl":"https://controlsmap.com/?v=1&node=ctrl%3Anydfs-500%3A500.15","sourceIds":["nydfs-500"],"sourceUrl":null,"title":"500.15 — Encryption of nonpublic information","type":"control","url":"/assets/agent_record-ctrl-nydfs-500-500-15-5ef052ba.9e4792460f3b19a6.json"},{"attributes":{"category":"administrative","framework":"nydfs-500","type":"corrective"},"canonicalUrl":"https://controlsmap.com/frameworks/nydfs-500/","description":"Incident response and business continuity management","details":{"automation":"hybrid","control_category":"administrative","control_id":"500.16","control_type":"corrective","domains":["Governance, Policy & Oversight","Risk Assessment & Management","Access Control & Identity Management","Vulnerability & Patch Management","Logging, Monitoring & Detection","Third-Party / Supply-Chain Risk","Cryptography & Key Management","Incident Management & Response","Business Continuity & Disaster Recovery","Awareness & Training"],"framework":"nydfs-500","group":"NYDFS 500 (NY Cybersecurity Regulation, 23 NYCRR 500)","key_control":true,"requirement_frequency":null,"requirement_status":null,"risk_count":5,"source_pages":null,"source_url":null},"direct":true,"htmlUrl":"/agents/records/ctrl-nydfs-500-500-16-19fe7459.html","id":"ctrl:nydfs-500:500.16","mapUrl":"https://controlsmap.com/?v=1&node=ctrl%3Anydfs-500%3A500.16","sourceIds":["nydfs-500"],"sourceUrl":null,"title":"500.16 — Incident response and business continuity management","type":"control","url":"/assets/agent_record-ctrl-nydfs-500-500-16-19fe7459.c4a6a4a3860e195b.json"},{"attributes":{"category":"administrative","framework":"nydfs-500","type":"corrective"},"canonicalUrl":"https://controlsmap.com/frameworks/nydfs-500/","description":"Notices to superintendent (incident notification and annual certification)","details":{"automation":"manual","control_category":"administrative","control_id":"500.17","control_type":"corrective","domains":["Governance, Policy & Oversight","Risk Assessment & Management","Access Control & Identity Management","Vulnerability & Patch Management","Logging, Monitoring & Detection","Third-Party / Supply-Chain Risk","Cryptography & Key Management","Incident Management & Response","Business Continuity & Disaster Recovery","Awareness & Training"],"framework":"nydfs-500","group":"NYDFS 500 (NY Cybersecurity Regulation, 23 NYCRR 500)","key_control":false,"requirement_frequency":null,"requirement_status":null,"risk_count":2,"source_pages":null,"source_url":null},"direct":true,"htmlUrl":"/agents/records/ctrl-nydfs-500-500-17-25353c71.html","id":"ctrl:nydfs-500:500.17","mapUrl":"https://controlsmap.com/?v=1&node=ctrl%3Anydfs-500%3A500.17","sourceIds":["nydfs-500"],"sourceUrl":null,"title":"500.17 — Notices to superintendent (incident notification and annual certification)","type":"control","url":"/assets/agent_record-ctrl-nydfs-500-500-17-25353c71.5ad4223c0e7baf95.json"},{"attributes":{"category":"administrative","framework":"nydfs-500","type":"preventive"},"canonicalUrl":"https://controlsmap.com/frameworks/nydfs-500/","description":"Confidentiality","details":{"automation":"manual","control_category":"administrative","control_id":"500.18","control_type":"preventive","domains":["Governance, Policy & Oversight","Risk Assessment & Management","Access Control & Identity Management","Vulnerability & Patch Management","Logging, Monitoring & Detection","Third-Party / Supply-Chain Risk","Cryptography & Key Management","Incident Management & Response","Business Continuity & Disaster Recovery","Awareness & Training"],"framework":"nydfs-500","group":"NYDFS 500 (NY Cybersecurity Regulation, 23 NYCRR 500)","key_control":false,"requirement_frequency":null,"requirement_status":null,"risk_count":2,"source_pages":null,"source_url":null},"direct":true,"htmlUrl":"/agents/records/ctrl-nydfs-500-500-18-1e1c055e.html","id":"ctrl:nydfs-500:500.18","mapUrl":"https://controlsmap.com/?v=1&node=ctrl%3Anydfs-500%3A500.18","sourceIds":["nydfs-500"],"sourceUrl":null,"title":"500.18 — Confidentiality","type":"control","url":"/assets/agent_record-ctrl-nydfs-500-500-18-1e1c055e.0793b745903033af.json"},{"attributes":{"category":"administrative","framework":"nydfs-500","type":"preventive"},"canonicalUrl":"https://controlsmap.com/frameworks/nydfs-500/","description":"Exemptions","details":{"automation":"manual","control_category":"administrative","control_id":"500.19","control_type":"preventive","domains":["Governance, Policy & Oversight","Risk Assessment & Management","Access Control & Identity Management","Vulnerability & Patch Management","Logging, Monitoring & Detection","Third-Party / Supply-Chain Risk","Cryptography & Key Management","Incident Management & Response","Business Continuity & Disaster Recovery","Awareness & Training"],"framework":"nydfs-500","group":"NYDFS 500 (NY Cybersecurity Regulation, 23 NYCRR 500)","key_control":false,"requirement_frequency":null,"requirement_status":null,"risk_count":2,"source_pages":null,"source_url":null},"direct":true,"htmlUrl":"/agents/records/ctrl-nydfs-500-500-19-235a6ef9.html","id":"ctrl:nydfs-500:500.19","mapUrl":"https://controlsmap.com/?v=1&node=ctrl%3Anydfs-500%3A500.19","sourceIds":["nydfs-500"],"sourceUrl":null,"title":"500.19 — Exemptions","type":"control","url":"/assets/agent_record-ctrl-nydfs-500-500-19-235a6ef9.14288ec6139c0f56.json"},{"attributes":{"category":"administrative","framework":"nydfs-500","type":"preventive"},"canonicalUrl":"https://controlsmap.com/frameworks/nydfs-500/","description":"Cybersecurity program","details":{"automation":"manual","control_category":"administrative","control_id":"500.2","control_type":"preventive","domains":["Governance, Policy & Oversight","Risk Assessment & Management","Access Control & Identity Management","Vulnerability & Patch Management","Logging, Monitoring & Detection","Third-Party / Supply-Chain Risk","Cryptography & Key Management","Incident Management & Response","Business Continuity & Disaster Recovery","Awareness & Training"],"framework":"nydfs-500","group":"NYDFS 500 (NY Cybersecurity Regulation, 23 NYCRR 500)","key_control":false,"requirement_frequency":null,"requirement_status":null,"risk_count":2,"source_pages":null,"source_url":null},"direct":true,"htmlUrl":"/agents/records/ctrl-nydfs-500-500-2-b0b2c5e0.html","id":"ctrl:nydfs-500:500.2","mapUrl":"https://controlsmap.com/?v=1&node=ctrl%3Anydfs-500%3A500.2","sourceIds":["nydfs-500"],"sourceUrl":null,"title":"500.2 — Cybersecurity program","type":"control","url":"/assets/agent_record-ctrl-nydfs-500-500-2-b0b2c5e0.0c244050e0597654.json"},{"attributes":{"category":"administrative","framework":"nydfs-500","type":"preventive"},"canonicalUrl":"https://controlsmap.com/frameworks/nydfs-500/","description":"Cybersecurity policy","details":{"automation":"manual","control_category":"administrative","control_id":"500.3","control_type":"preventive","domains":["Governance, Policy & Oversight","Risk Assessment & Management","Access Control & Identity Management","Vulnerability & Patch Management","Logging, Monitoring & Detection","Third-Party / Supply-Chain Risk","Cryptography & Key Management","Incident Management & Response","Business Continuity & Disaster Recovery","Awareness & Training"],"framework":"nydfs-500","group":"NYDFS 500 (NY Cybersecurity Regulation, 23 NYCRR 500)","key_control":false,"requirement_frequency":null,"requirement_status":null,"risk_count":2,"source_pages":null,"source_url":null},"direct":true,"htmlUrl":"/agents/records/ctrl-nydfs-500-500-3-7a3150f9.html","id":"ctrl:nydfs-500:500.3","mapUrl":"https://controlsmap.com/?v=1&node=ctrl%3Anydfs-500%3A500.3","sourceIds":["nydfs-500"],"sourceUrl":null,"title":"500.3 — Cybersecurity policy","type":"control","url":"/assets/agent_record-ctrl-nydfs-500-500-3-7a3150f9.d11b673b58a4f5d9.json"},{"attributes":{"category":"administrative","framework":"nydfs-500","type":"preventive"},"canonicalUrl":"https://controlsmap.com/frameworks/nydfs-500/","description":"Chief Information Security Officer (CISO)","details":{"automation":"manual","control_category":"administrative","control_id":"500.4","control_type":"preventive","domains":["Governance, Policy & Oversight","Risk Assessment & Management","Access Control & Identity Management","Vulnerability & Patch Management","Logging, Monitoring & Detection","Third-Party / Supply-Chain Risk","Cryptography & Key Management","Incident Management & Response","Business Continuity & Disaster Recovery","Awareness & Training"],"framework":"nydfs-500","group":"NYDFS 500 (NY Cybersecurity Regulation, 23 NYCRR 500)","key_control":false,"requirement_frequency":null,"requirement_status":null,"risk_count":2,"source_pages":null,"source_url":null},"direct":true,"htmlUrl":"/agents/records/ctrl-nydfs-500-500-4-a694a85b.html","id":"ctrl:nydfs-500:500.4","mapUrl":"https://controlsmap.com/?v=1&node=ctrl%3Anydfs-500%3A500.4","sourceIds":["nydfs-500"],"sourceUrl":null,"title":"500.4 — Chief Information Security Officer (CISO)","type":"control","url":"/assets/agent_record-ctrl-nydfs-500-500-4-a694a85b.eb7e61df375d6d7b.json"},{"attributes":{"category":"technical","framework":"nydfs-500","type":"detective"},"canonicalUrl":"https://controlsmap.com/frameworks/nydfs-500/","description":"Vulnerability management (penetration testing and scanning)","details":{"automation":"hybrid","control_category":"technical","control_id":"500.5","control_type":"detective","domains":["Governance, Policy & Oversight","Risk Assessment & Management","Access Control & Identity Management","Vulnerability & Patch Management","Logging, Monitoring & Detection","Third-Party / Supply-Chain Risk","Cryptography & Key Management","Incident Management & Response","Business Continuity & Disaster Recovery","Awareness & Training"],"framework":"nydfs-500","group":"NYDFS 500 (NY Cybersecurity Regulation, 23 NYCRR 500)","key_control":false,"requirement_frequency":null,"requirement_status":null,"risk_count":4,"source_pages":null,"source_url":null},"direct":true,"htmlUrl":"/agents/records/ctrl-nydfs-500-500-5-986f2983.html","id":"ctrl:nydfs-500:500.5","mapUrl":"https://controlsmap.com/?v=1&node=ctrl%3Anydfs-500%3A500.5","sourceIds":["nydfs-500"],"sourceUrl":null,"title":"500.5 — Vulnerability management (penetration testing and scanning)","type":"control","url":"/assets/agent_record-ctrl-nydfs-500-500-5-986f2983.8b2a6bfe14abef1b.json"},{"attributes":{"category":"technical","framework":"nydfs-500","type":"detective"},"canonicalUrl":"https://controlsmap.com/frameworks/nydfs-500/","description":"Audit trail","details":{"automation":"automated","control_category":"technical","control_id":"500.6","control_type":"detective","domains":["Governance, Policy & Oversight","Risk Assessment & Management","Access Control & Identity Management","Vulnerability & Patch Management","Logging, Monitoring & Detection","Third-Party / Supply-Chain Risk","Cryptography & Key Management","Incident Management & Response","Business Continuity & Disaster Recovery","Awareness & Training"],"framework":"nydfs-500","group":"NYDFS 500 (NY Cybersecurity Regulation, 23 NYCRR 500)","key_control":true,"requirement_frequency":null,"requirement_status":null,"risk_count":4,"source_pages":null,"source_url":null},"direct":true,"htmlUrl":"/agents/records/ctrl-nydfs-500-500-6-c10e1c50.html","id":"ctrl:nydfs-500:500.6","mapUrl":"https://controlsmap.com/?v=1&node=ctrl%3Anydfs-500%3A500.6","sourceIds":["nydfs-500"],"sourceUrl":null,"title":"500.6 — Audit trail","type":"control","url":"/assets/agent_record-ctrl-nydfs-500-500-6-c10e1c50.7694b220672bbc34.json"},{"attributes":{"category":"technical","framework":"nydfs-500","type":"preventive"},"canonicalUrl":"https://controlsmap.com/frameworks/nydfs-500/","description":"Access privileges and management","details":{"automation":"hybrid","control_category":"technical","control_id":"500.7","control_type":"preventive","domains":["Governance, Policy & Oversight","Risk Assessment & Management","Access Control & Identity Management","Vulnerability & Patch Management","Logging, Monitoring & Detection","Third-Party / Supply-Chain Risk","Cryptography & Key Management","Incident Management & Response","Business Continuity & Disaster Recovery","Awareness & Training"],"framework":"nydfs-500","group":"NYDFS 500 (NY Cybersecurity Regulation, 23 NYCRR 500)","key_control":true,"requirement_frequency":null,"requirement_status":null,"risk_count":4,"source_pages":null,"source_url":null},"direct":true,"htmlUrl":"/agents/records/ctrl-nydfs-500-500-7-09439ea1.html","id":"ctrl:nydfs-500:500.7","mapUrl":"https://controlsmap.com/?v=1&node=ctrl%3Anydfs-500%3A500.7","sourceIds":["nydfs-500"],"sourceUrl":null,"title":"500.7 — Access privileges and management","type":"control","url":"/assets/agent_record-ctrl-nydfs-500-500-7-09439ea1.e7e745f74f44e7d7.json"},{"attributes":{"category":"technical","framework":"nydfs-500","type":"preventive"},"canonicalUrl":"https://controlsmap.com/frameworks/nydfs-500/","description":"Application security","details":{"automation":"hybrid","control_category":"technical","control_id":"500.8","control_type":"preventive","domains":["Governance, Policy & Oversight","Risk Assessment & Management","Access Control & Identity Management","Vulnerability & Patch Management","Logging, Monitoring & Detection","Third-Party / Supply-Chain Risk","Cryptography & Key Management","Incident Management & Response","Business Continuity & Disaster Recovery","Awareness & Training"],"framework":"nydfs-500","group":"NYDFS 500 (NY Cybersecurity Regulation, 23 NYCRR 500)","key_control":false,"requirement_frequency":null,"requirement_status":null,"risk_count":2,"source_pages":null,"source_url":null},"direct":true,"htmlUrl":"/agents/records/ctrl-nydfs-500-500-8-68ba80b6.html","id":"ctrl:nydfs-500:500.8","mapUrl":"https://controlsmap.com/?v=1&node=ctrl%3Anydfs-500%3A500.8","sourceIds":["nydfs-500"],"sourceUrl":null,"title":"500.8 — Application security","type":"control","url":"/assets/agent_record-ctrl-nydfs-500-500-8-68ba80b6.0d6493b9cc5899a3.json"},{"attributes":{"category":"administrative","framework":"nydfs-500","type":"preventive"},"canonicalUrl":"https://controlsmap.com/frameworks/nydfs-500/","description":"Risk assessment","details":{"automation":"manual","control_category":"administrative","control_id":"500.9","control_type":"preventive","domains":["Governance, Policy & Oversight","Risk Assessment & Management","Access Control & Identity Management","Vulnerability & Patch Management","Logging, Monitoring & Detection","Third-Party / Supply-Chain Risk","Cryptography & Key Management","Incident Management & Response","Business Continuity & Disaster Recovery","Awareness & Training"],"framework":"nydfs-500","group":"NYDFS 500 (NY Cybersecurity Regulation, 23 NYCRR 500)","key_control":false,"requirement_frequency":null,"requirement_status":null,"risk_count":3,"source_pages":null,"source_url":null},"direct":true,"htmlUrl":"/agents/records/ctrl-nydfs-500-500-9-b028c41d.html","id":"ctrl:nydfs-500:500.9","mapUrl":"https://controlsmap.com/?v=1&node=ctrl%3Anydfs-500%3A500.9","sourceIds":["nydfs-500"],"sourceUrl":null,"title":"500.9 — Risk assessment","type":"control","url":"/assets/agent_record-ctrl-nydfs-500-500-9-b028c41d.8bc19a69489b8eef.json"},{"attributes":{"category":"cyber_security","domain":["Access Control & Identity Management","Data Protection & Privacy"],"inherent_rating":"high","taxonomy":["iso-27005-vulnerability","nist-800-30-threat-event","nist-privacy-risk"]},"canonicalUrl":"https://controlsmap.com/?v=1&node=risk%3Aaccess-excess-privilege","description":"Overly broad or wrongly assigned access rights, applications/services running with excessive privileges, and failure to enforce least privilege — a compromise or insider then gains broad access to systems and data.","details":{"category":"cyber_security","impact":"high","inherent_rating":"high","likelihood":"high","risk_id":"access-excess-privilege","taxonomies":["iso-27005-vulnerability","nist-800-30-threat-event","nist-privacy-risk"],"treatment":"mitigate"},"direct":false,"htmlUrl":"/agents/records/risk-access-excess-privilege-cd8adadc.html","id":"risk:access-excess-privilege","mapUrl":"https://controlsmap.com/?v=1&node=risk%3Aaccess-excess-privilege","sourceIds":["aiuc-1","iso-27001","nist-800-53","nist-ai-agent-identity","nist-csf-2","nydfs-500","pci-dss","soc1","soc2","sox"],"sourceUrl":null,"title":"Excessive privilege and wrong assignment of access rights","type":"risk","url":"/assets/agent_record-risk-access-excess-privilege-cd8adadc.c154ceb8157b770a.json"},{"attributes":{"category":"cyber_security","domain":["Access Control & Identity Management","Logging, Monitoring & Detection"],"inherent_rating":"high","taxonomy":["iso-27005-threat","nist-800-30-threat-event","nist-800-30-threat-source"]},"canonicalUrl":"https://controlsmap.com/?v=1&node=risk%3Aaccess-privilege-abuse-repudiation","description":"Authorized users or administrators exploit legitimate access beyond permitted scope, fabricate or forge credentials/rights to gain privileges, and repudiate performed actions — undermining accountability and audit-trail integrity.","details":{"category":"cyber_security","impact":"high","inherent_rating":"high","likelihood":"medium","risk_id":"access-privilege-abuse-repudiation","taxonomies":["iso-27005-threat","nist-800-30-threat-event","nist-800-30-threat-source"],"treatment":"mitigate"},"direct":false,"htmlUrl":"/agents/records/risk-access-privilege-abuse-repudiation-343a8917.html","id":"risk:access-privilege-abuse-repudiation","mapUrl":"https://controlsmap.com/?v=1&node=risk%3Aaccess-privilege-abuse-repudiation","sourceIds":["aiuc-1","gdpr","hipaa","iso-27001","nist-800-53","nist-ai-agent-identity","nist-csf-2","nydfs-500","pci-dss","soc1","soc2","sox"],"sourceUrl":null,"title":"Abuse of rights, forged rights, and repudiation of actions","type":"risk","url":"/assets/agent_record-risk-access-privilege-abuse-repudiation-343a8917.5dfe55c5d06b0530.json"},{"attributes":{"category":"cyber_security","domain":["Access Control & Identity Management"],"inherent_rating":"high","taxonomy":["iso-27005-vulnerability"]},"canonicalUrl":"https://controlsmap.com/?v=1&node=risk%3Aaccess-provisioning-review-gap","description":"No formal user registration/de-registration procedure and no periodic access-rights review, so orphaned or excessive accounts accumulate and access is not revoked when roles change or personnel leave.","details":{"category":"cyber_security","impact":"medium","inherent_rating":"high","likelihood":"high","risk_id":"access-provisioning-review-gap","taxonomies":["iso-27005-vulnerability"],"treatment":"mitigate"},"direct":false,"htmlUrl":"/agents/records/risk-access-provisioning-review-gap-dc152038.html","id":"risk:access-provisioning-review-gap","mapUrl":"https://controlsmap.com/?v=1&node=risk%3Aaccess-provisioning-review-gap","sourceIds":["iso-27001","nist-800-53","nist-ai-agent-identity","nist-csf-2","nydfs-500","soc1","soc2","sox"],"sourceUrl":null,"title":"Weak account provisioning/de-registration and access review","type":"risk","url":"/assets/agent_record-risk-access-provisioning-review-gap-dc152038.95f8a2aeb24acc6e.json"},{"attributes":{"category":"cyber_security","domain":["Access Control & Identity Management","Network & Communications Security"],"inherent_rating":"high","taxonomy":["iso-27005-vulnerability","nist-800-30-threat-event"]},"canonicalUrl":"https://controlsmap.com/?v=1&node=risk%3Aaccess-weak-authentication","description":"Absent password policy, no MFA, credentials transmitted in clear text, and no session lock/logout on unattended workstations, making account compromise, brute-force login, and session hijacking easy.","details":{"category":"cyber_security","impact":"high","inherent_rating":"high","likelihood":"high","risk_id":"access-weak-authentication","taxonomies":["iso-27005-vulnerability","nist-800-30-threat-event"],"treatment":"mitigate"},"direct":false,"htmlUrl":"/agents/records/risk-access-weak-authentication-4e35bdb2.html","id":"risk:access-weak-authentication","mapUrl":"https://controlsmap.com/?v=1&node=risk%3Aaccess-weak-authentication","sourceIds":["hipaa","iso-27001","nist-800-53","nist-ai-agent-identity","nist-csf-2","nydfs-500","pci-dss"],"sourceUrl":null,"title":"Weak authentication and password management","type":"risk","url":"/assets/agent_record-risk-access-weak-authentication-4e35bdb2.331f8d7ddbb6bd4e.json"},{"attributes":{"category":"ai_governance","domain":["AI Governance","Third-Party / Supply-Chain Risk","Compliance, Audit & Assurance"],"inherent_rating":"high","taxonomy":["eu-ai-act-risk","nist-ai-rmf-risk"]},"canonicalUrl":"https://controlsmap.com/?v=1&node=risk%3Aai-gpai-systemic-transparency","description":"GPAI providers failing transparency/copyright/training-data obligations; systemic-risk models (>10^25 FLOPs) lacking red-teaming, incident reporting, and cybersecurity; unlabeled deepfake/synthetic content; and concentration of GPAI capability creating ecosystem single points of failure.","details":{"category":"ai_governance","impact":"high","inherent_rating":"high","likelihood":"medium","risk_id":"ai-gpai-systemic-transparency","taxonomies":["eu-ai-act-risk","nist-ai-rmf-risk"],"treatment":"mitigate"},"direct":false,"htmlUrl":"/agents/records/risk-ai-gpai-systemic-transparency-7a746323.html","id":"risk:ai-gpai-systemic-transparency","mapUrl":"https://controlsmap.com/?v=1&node=risk%3Aai-gpai-systemic-transparency","sourceIds":["aiuc-1","cobit-2019","dora","eu-ai-act","iso-27001","iso-42001","nis2","nist-800-53","nist-csf-2","nydfs-500"],"sourceUrl":null,"title":"GPAI transparency, systemic-risk and synthetic-content obligations","type":"risk","url":"/assets/agent_record-risk-ai-gpai-systemic-transparency-7a746323.6e7a571abe779b08.json"},{"attributes":{"category":"ai_governance","domain":["AI Governance","Third-Party / Supply-Chain Risk","Secure Development (SDLC) & Application Security"],"inherent_rating":"high","taxonomy":["nist-ai-rmf-risk","iso-23894-ai-risk","eu-ai-act-risk"]},"canonicalUrl":"https://controlsmap.com/?v=1&node=risk%3Aai-supply-chain-concentration","description":"Because the organization relies on third-party pretrained models, datasets, and libraries that may carry backdoors, malicious code, or bias, and concentrates on a few external AI API providers, AI-dependent workflows are exposed to both supply-chain compromise and provider outage or insolvency, resulting in compromised model behaviour or sudden loss of AI capability.","details":{"category":"ai_governance","impact":"high","inherent_rating":"high","likelihood":"medium","risk_id":"ai-supply-chain-concentration","taxonomies":["nist-ai-rmf-risk","iso-23894-ai-risk","eu-ai-act-risk"],"treatment":"mitigate"},"direct":false,"htmlUrl":"/agents/records/risk-ai-supply-chain-concentration-9f791f54.html","id":"risk:ai-supply-chain-concentration","mapUrl":"https://controlsmap.com/?v=1&node=risk%3Aai-supply-chain-concentration","sourceIds":["aiuc-1","cobit-2019","dora","eu-ai-act","iso-27001","iso-42001","nis2","nist-800-53","nist-csf-2","nydfs-500","soc2"],"sourceUrl":null,"title":"AI supply-chain compromise and provider concentration","type":"risk","url":"/assets/agent_record-risk-ai-supply-chain-concentration-9f791f54.263d1eb3adc4c1e2.json"},{"attributes":{"category":"cyber_security","domain":["Awareness & Training","Human Resources / Personnel Security"],"inherent_rating":"high","taxonomy":["iso-27005-vulnerability","nist-privacy-risk"]},"canonicalUrl":"https://controlsmap.com/?v=1&node=risk%3Aaware-insufficient-training","description":"Personnel lacking security awareness and training are more likely to make harmful mistakes, misconfigure systems, or be deceived — providing weak human defence and undermining every technical control. Includes insufficient privacy training.","details":{"category":"cyber_security","impact":"medium","inherent_rating":"high","likelihood":"high","risk_id":"aware-insufficient-training","taxonomies":["iso-27005-vulnerability","nist-privacy-risk"],"treatment":"mitigate"},"direct":false,"htmlUrl":"/agents/records/risk-aware-insufficient-training-7cb09d2f.html","id":"risk:aware-insufficient-training","mapUrl":"https://controlsmap.com/?v=1&node=risk%3Aaware-insufficient-training","sourceIds":["iso-27001","nist-800-53","nist-csf-2","nydfs-500","soc2"],"sourceUrl":null,"title":"Inadequate security awareness and training","type":"risk","url":"/assets/agent_record-risk-aware-insufficient-training-7cb09d2f.0b8b5df9ddbc3039.json"},{"attributes":{"category":"cyber_security","domain":["Awareness & Training","Data Protection & Privacy"],"inherent_rating":"medium","taxonomy":["iso-27005-vulnerability"]},"canonicalUrl":"https://controlsmap.com/?v=1&node=risk%3Aaware-no-acceptable-use-policy","description":"Because acceptable-use policies for email, messaging, and telecommunication services are absent, personnel use insecure channels without guidance, so sensitive information is inadvertently or deliberately disclosed through unsanctioned communications.","details":{"category":"cyber_security","impact":"medium","inherent_rating":"medium","likelihood":"medium","risk_id":"aware-no-acceptable-use-policy","taxonomies":["iso-27005-vulnerability"],"treatment":"mitigate"},"direct":false,"htmlUrl":"/agents/records/risk-aware-no-acceptable-use-policy-e874ca5c.html","id":"risk:aware-no-acceptable-use-policy","mapUrl":"https://controlsmap.com/?v=1&node=risk%3Aaware-no-acceptable-use-policy","sourceIds":["iso-27001","nist-800-53","nist-csf-2","nydfs-500","sox"],"sourceUrl":null,"title":"No acceptable-use policy for messaging and telecoms","type":"risk","url":"/assets/agent_record-risk-aware-no-acceptable-use-policy-e874ca5c.3ed302d2568a687a.json"},{"attributes":{"category":"cyber_security","domain":["Awareness & Training","Access Control & Identity Management"],"inherent_rating":"critical","taxonomy":["nist-800-30-threat-event","basel-operational-risk"]},"canonicalUrl":"https://controlsmap.com/?v=1&node=risk%3Aaware-phishing-social-engineering","description":"Adversary counterfeits trustworthy communications (email, phone, spoofed websites) to trick individuals — including high-value executives — into revealing credentials or sensitive information, or into enabling wire-transfer/BEC fraud.","details":{"category":"cyber_security","impact":"high","inherent_rating":"critical","likelihood":"very_high","risk_id":"aware-phishing-social-engineering","taxonomies":["nist-800-30-threat-event","basel-operational-risk"],"treatment":"mitigate"},"direct":false,"htmlUrl":"/agents/records/risk-aware-phishing-social-engineering-bb9b7bd6.html","id":"risk:aware-phishing-social-engineering","mapUrl":"https://controlsmap.com/?v=1&node=risk%3Aaware-phishing-social-engineering","sourceIds":["aiuc-1","hipaa","iso-27001","nist-800-53","nist-csf-2","nydfs-500","pci-dss"],"sourceUrl":null,"title":"Phishing, spear-phishing and social engineering","type":"risk","url":"/assets/agent_record-risk-aware-phishing-social-engineering-bb9b7bd6.04cc1eb066c178e1.json"},{"attributes":{"category":"cyber_security","domain":["Awareness & Training","Human Resources / Personnel Security"],"inherent_rating":"medium","taxonomy":["iso-27005-vulnerability","nist-privacy-risk"]},"canonicalUrl":"https://controlsmap.com/?v=1&node=risk%3Aaware-role-based-training-gap","description":"Because no role-based training program or ongoing awareness refresh exists for staff handling sensitive data or privileged systems, personnel cannot execute security procedures correctly or recognize evolving attacks, so avoidable errors and successful social-engineering compromises follow.","details":{"category":"cyber_security","impact":"medium","inherent_rating":"medium","likelihood":"high","risk_id":"aware-role-based-training-gap","taxonomies":["iso-27005-vulnerability","nist-privacy-risk"],"treatment":"mitigate"},"direct":false,"htmlUrl":"/agents/records/risk-aware-role-based-training-gap-3e2ca2c3.html","id":"risk:aware-role-based-training-gap","mapUrl":"https://controlsmap.com/?v=1&node=risk%3Aaware-role-based-training-gap","sourceIds":["iso-27001","nist-800-53","nist-csf-2","nydfs-500","soc2"],"sourceUrl":null,"title":"Missing role-based and ongoing security/privacy training","type":"risk","url":"/assets/agent_record-risk-aware-role-based-training-gap-3e2ca2c3.16d6246efc955b0b.json"},{"attributes":{"category":"operational","domain":["Awareness & Training","Data Protection & Privacy","Logging, Monitoring & Detection"],"inherent_rating":"high","taxonomy":["iso-27005-threat","nist-800-30-threat-event","nist-800-30-threat-source","iso-27005-vulnerability"]},"canonicalUrl":"https://controlsmap.com/?v=1&node=risk%3Aaware-user-error-mishandling","description":"Authorized users make mistakes — incorrect data entry, misconfiguration, improper procedures, incorrect privilege settings, or spilling/mishandling sensitive information — causing harm to information assets without malicious intent.","details":{"category":"operational","impact":"medium","inherent_rating":"high","likelihood":"high","risk_id":"aware-user-error-mishandling","taxonomies":["iso-27005-threat","nist-800-30-threat-event","nist-800-30-threat-source","iso-27005-vulnerability"],"treatment":"mitigate"},"direct":false,"htmlUrl":"/agents/records/risk-aware-user-error-mishandling-149a1d3b.html","id":"risk:aware-user-error-mishandling","mapUrl":"https://controlsmap.com/?v=1&node=risk%3Aaware-user-error-mishandling","sourceIds":["aiuc-1","gdpr","iso-27001","nist-800-53","nist-ai-agent-identity","nist-ai-tevv-athlon","nist-csf-2","nydfs-500","soc1","soc2"],"sourceUrl":null,"title":"User error and mishandling of sensitive information","type":"risk","url":"/assets/agent_record-risk-aware-user-error-mishandling-149a1d3b.111c3fa544df22a0.json"},{"attributes":{"category":"business_continuity","domain":["Business Continuity & Disaster Recovery","Risk Assessment & Management"],"inherent_rating":"high","taxonomy":["enterprise-risk","coso-erm-risk","iso-27005-vulnerability"]},"canonicalUrl":"https://controlsmap.com/?v=1&node=risk%3Abcdr-no-tested-continuity-plan","description":"No BCP/DR plan, or plans that exist but have never been exercised end-to-end, so a natural disaster, pandemic, civil unrest, or infrastructure failure disables critical processes with no tested recovery path.","details":{"category":"business_continuity","impact":"high","inherent_rating":"high","likelihood":"medium","risk_id":"bcdr-no-tested-continuity-plan","taxonomies":["enterprise-risk","coso-erm-risk","iso-27005-vulnerability"],"treatment":"mitigate"},"direct":false,"htmlUrl":"/agents/records/risk-bcdr-no-tested-continuity-plan-d4d9e7a9.html","id":"risk:bcdr-no-tested-continuity-plan","mapUrl":"https://controlsmap.com/?v=1&node=risk%3Abcdr-no-tested-continuity-plan","sourceIds":["cobit-2019","dora","iso-27001","nist-800-53","nydfs-500","soc1","soc2","sox"],"sourceUrl":null,"title":"Absent or untested business continuity / disaster recovery plan","type":"risk","url":"/assets/agent_record-risk-bcdr-no-tested-continuity-plan-d4d9e7a9.2e628816044d5241.json"},{"attributes":{"category":"business_continuity","domain":["Business Continuity & Disaster Recovery","Network & Communications Security"],"inherent_rating":"high","taxonomy":["enterprise-risk","iso-27005-vulnerability","nist-800-30-threat-event"]},"canonicalUrl":"https://controlsmap.com/?v=1&node=risk%3Abcdr-single-point-concentration","description":"Headquarters, data centers, or manufacturing concentrated in one region, single power feed or network path with no redundancy, and no failover — so one catastrophe or outage disables the whole service. Includes backup-facility loss destroying backups.","details":{"category":"business_continuity","impact":"high","inherent_rating":"high","likelihood":"medium","risk_id":"bcdr-single-point-concentration","taxonomies":["enterprise-risk","iso-27005-vulnerability","nist-800-30-threat-event"],"treatment":"mitigate"},"direct":false,"htmlUrl":"/agents/records/risk-bcdr-single-point-concentration-91008453.html","id":"risk:bcdr-single-point-concentration","mapUrl":"https://controlsmap.com/?v=1&node=risk%3Abcdr-single-point-concentration","sourceIds":["cobit-2019","iso-27001","nist-800-53","nist-csf-2","nydfs-500","soc2"],"sourceUrl":null,"title":"Single-site / single-region / single-supply concentration","type":"risk","url":"/assets/agent_record-risk-bcdr-single-point-concentration-91008453.29ef0448071a935e.json"},{"attributes":{"category":"compliance_regulatory","domain":["Compliance, Audit & Assurance","Governance, Policy & Oversight"],"inherent_rating":"high","taxonomy":["enterprise-risk","coso-erm-risk"]},"canonicalUrl":"https://controlsmap.com/?v=1&node=risk%3Acompliance-litigation-enforcement","description":"Adverse judgments, class actions, contract/IP disputes, government subpoenas, DOJ/FTC/SEC investigations, consent decrees, or deferred-prosecution agreements imposing penalties, remediation, and management distraction.","details":{"category":"compliance_regulatory","impact":"high","inherent_rating":"high","likelihood":"medium","risk_id":"compliance-litigation-enforcement","taxonomies":["enterprise-risk","coso-erm-risk"],"treatment":"transfer"},"direct":false,"htmlUrl":"/agents/records/risk-compliance-litigation-enforcement-25e7935d.html","id":"risk:compliance-litigation-enforcement","mapUrl":"https://controlsmap.com/?v=1&node=risk%3Acompliance-litigation-enforcement","sourceIds":["cobit-2019","gdpr","hipaa","iso-27001","nis2","nist-800-53","nist-csf-2","nydfs-500","pci-dss","soc2"],"sourceUrl":null,"title":"Litigation, investigation and enforcement exposure","type":"risk","url":"/assets/agent_record-risk-compliance-litigation-enforcement-25e7935d.963b6cccfc52b94e.json"},{"attributes":{"category":"cyber_security","domain":["Secure Configuration & Change Management","Network & Communications Security","Vulnerability & Patch Management"],"inherent_rating":"high","taxonomy":["nist-800-30-threat-event"]},"canonicalUrl":"https://controlsmap.com/?v=1&node=risk%3Aconfig-internet-exposed-misconfig","description":"Adversary gains access through the Internet to systems not authorized for Internet connectivity or that do not meet configuration requirements, and exploits attacks over unauthorized ports, protocols, and services.","details":{"category":"cyber_security","impact":"high","inherent_rating":"high","likelihood":"high","risk_id":"config-internet-exposed-misconfig","taxonomies":["nist-800-30-threat-event"],"treatment":"mitigate"},"direct":false,"htmlUrl":"/agents/records/risk-config-internet-exposed-misconfig-61b3613a.html","id":"risk:config-internet-exposed-misconfig","mapUrl":"https://controlsmap.com/?v=1&node=risk%3Aconfig-internet-exposed-misconfig","sourceIds":["aiuc-1","iso-27001","nist-800-53","nist-ai-tevv-athlon","nist-csf-2","nydfs-500","pci-dss","soc2"],"sourceUrl":null,"title":"Internet-exposed or misconfigured systems","type":"risk","url":"/assets/agent_record-risk-config-internet-exposed-misconfig-61b3613a.784e8a1bdf681744.json"},{"attributes":{"category":"cyber_security","domain":["Secure Configuration & Change Management","Vulnerability & Patch Management"],"inherent_rating":"high","taxonomy":["iso-27005-vulnerability","nist-800-30-threat-event"]},"canonicalUrl":"https://controlsmap.com/?v=1&node=risk%3Aconfig-poor-baseline-drift","description":"Without documented, enforced baseline configurations and change control, systems drift into insecure states, contain unauthorized changes, or expose unnecessary network services, expanding attack surface.","details":{"category":"cyber_security","impact":"medium","inherent_rating":"high","likelihood":"high","risk_id":"config-poor-baseline-drift","taxonomies":["iso-27005-vulnerability","nist-800-30-threat-event"],"treatment":"mitigate"},"direct":false,"htmlUrl":"/agents/records/risk-config-poor-baseline-drift-2dd66324.html","id":"risk:config-poor-baseline-drift","mapUrl":"https://controlsmap.com/?v=1&node=risk%3Aconfig-poor-baseline-drift","sourceIds":["coso-ic","iso-27001","nist-800-53","nist-csf-2","nydfs-500","pci-dss","soc1","soc2","sox"],"sourceUrl":null,"title":"Poor configuration management and insecure baseline drift","type":"risk","url":"/assets/agent_record-risk-config-poor-baseline-drift-2dd66324.de11f6b9169c61ac.json"},{"attributes":{"category":"cyber_security","domain":["Cryptography & Key Management","Network & Communications Security"],"inherent_rating":"high","taxonomy":["iso-27005-vulnerability"]},"canonicalUrl":"https://controlsmap.com/?v=1&node=risk%3Acrypto-cleartext-credential-transfer","description":"Authentication credentials or sensitive system communications transmitted unencrypted over networks, and absence of mutual sender/receiver authentication, enable interception, credential theft, and spoofing.","details":{"category":"cyber_security","impact":"high","inherent_rating":"high","likelihood":"medium","risk_id":"crypto-cleartext-credential-transfer","taxonomies":["iso-27005-vulnerability"],"treatment":"mitigate"},"direct":false,"htmlUrl":"/agents/records/risk-crypto-cleartext-credential-transfer-b88065a1.html","id":"risk:crypto-cleartext-credential-transfer","mapUrl":"https://controlsmap.com/?v=1&node=risk%3Acrypto-cleartext-credential-transfer","sourceIds":["aiuc-1","hipaa","nist-800-53","nist-csf-2","nydfs-500","pci-dss","soc2"],"sourceUrl":null,"title":"Credentials and sensitive data transmitted in clear text","type":"risk","url":"/assets/agent_record-risk-crypto-cleartext-credential-transfer-b88065a1.a9caa8149d5dd221.json"},{"attributes":{"category":"cyber_security","domain":["Cryptography & Key Management","Network & Communications Security"],"inherent_rating":"high","taxonomy":["nist-800-30-threat-event"]},"canonicalUrl":"https://controlsmap.com/?v=1&node=risk%3Acrypto-counterfeit-certificates","description":"Adversary counterfeits or compromises a certificate authority so that malware or connections appear legitimate, defeating trust in TLS and code-signing and enabling man-in-the-middle or malicious-code delivery.","details":{"category":"cyber_security","impact":"high","inherent_rating":"high","likelihood":"low","risk_id":"crypto-counterfeit-certificates","taxonomies":["nist-800-30-threat-event"],"treatment":"mitigate"},"direct":false,"htmlUrl":"/agents/records/risk-crypto-counterfeit-certificates-d9dcc5c5.html","id":"risk:crypto-counterfeit-certificates","mapUrl":"https://controlsmap.com/?v=1&node=risk%3Acrypto-counterfeit-certificates","sourceIds":["aiuc-1","hipaa","iso-27001","nist-800-53","nist-csf-2","nydfs-500","pci-dss","soc2"],"sourceUrl":null,"title":"Compromised or counterfeit certificates / certificate authority","type":"risk","url":"/assets/agent_record-risk-crypto-counterfeit-certificates-d9dcc5c5.8f0926d32cdc4988.json"},{"attributes":{"category":"cyber_security","domain":["Cryptography & Key Management","Data Protection & Privacy","Network & Communications Security"],"inherent_rating":"high","taxonomy":["iso-27005-vulnerability","nist-800-30-threat-event","nist-privacy-risk"]},"canonicalUrl":"https://controlsmap.com/?v=1&node=risk%3Acrypto-weak-or-absent-encryption","description":"Sensitive data stored or transmitted without adequate encryption, or use of weak/flawed cryptography and poor key generation, storage, rotation, and destruction — enabling interception, disclosure, or tampering of data.","details":{"category":"cyber_security","impact":"high","inherent_rating":"high","likelihood":"medium","risk_id":"crypto-weak-or-absent-encryption","taxonomies":["iso-27005-vulnerability","nist-800-30-threat-event","nist-privacy-risk"],"treatment":"mitigate"},"direct":false,"htmlUrl":"/agents/records/risk-crypto-weak-or-absent-encryption-2fe7d24e.html","id":"risk:crypto-weak-or-absent-encryption","mapUrl":"https://controlsmap.com/?v=1&node=risk%3Acrypto-weak-or-absent-encryption","sourceIds":["aiuc-1","hipaa","iso-27001","nist-800-53","nist-csf-2","nydfs-500","pci-dss","soc2"],"sourceUrl":null,"title":"Weak or absent encryption and key management","type":"risk","url":"/assets/agent_record-risk-crypto-weak-or-absent-encryption-2fe7d24e.22e603984ef2659e.json"},{"attributes":{"category":"cyber_security","domain":["Risk Assessment & Management","Logging, Monitoring & Detection"],"inherent_rating":"high","taxonomy":["nist-800-30-threat-source"]},"canonicalUrl":"https://controlsmap.com/?v=1&node=risk%3Acyber-adversary-threat-sources","description":"Because capable, motivated threat actors - outsiders, privileged and non-privileged insiders, organized groups, competitors, malicious partners or suppliers, and nation-states - actively target the organization's cyber resources, deliberate attacks are attempted against its systems and data, resulting in compromise, disruption, or theft when defenses are outmatched.","details":{"category":"cyber_security","impact":"high","inherent_rating":"high","likelihood":"high","risk_id":"cyber-adversary-threat-sources","taxonomies":["nist-800-30-threat-source"],"treatment":"mitigate"},"direct":false,"htmlUrl":"/agents/records/risk-cyber-adversary-threat-sources-fa9e3003.html","id":"risk:cyber-adversary-threat-sources","mapUrl":"https://controlsmap.com/?v=1&node=risk%3Acyber-adversary-threat-sources","sourceIds":["aiuc-1","cobit-2019","coso-ic","gdpr","iso-27001","iso-31000","nist-800-53","nist-csf-2","nydfs-500","soc1","soc2","sox"],"sourceUrl":null,"title":"Attacks by capable, motivated threat actors","type":"risk","url":"/assets/agent_record-risk-cyber-adversary-threat-sources-fa9e3003.8ace32770a775a42.json"},{"attributes":{"category":"cyber_security","domain":["Logging, Monitoring & Detection","Incident Management & Response","Network & Communications Security"],"inherent_rating":"high","taxonomy":["nist-800-30-threat-event"]},"canonicalUrl":"https://controlsmap.com/?v=1&node=risk%3Acyber-coordinated-campaign","description":"Adversary coordinates continuous, adaptive, multi-staged campaigns (hopping across systems, combining insider/outsider/supply-chain vectors, spreading from existing presence) to persist and progressively undermine mission/business functions.","details":{"category":"cyber_security","impact":"critical","inherent_rating":"high","likelihood":"medium","risk_id":"cyber-coordinated-campaign","taxonomies":["nist-800-30-threat-event"],"treatment":"mitigate"},"direct":false,"htmlUrl":"/agents/records/risk-cyber-coordinated-campaign-b5879769.html","id":"risk:cyber-coordinated-campaign","mapUrl":"https://controlsmap.com/?v=1&node=risk%3Acyber-coordinated-campaign","sourceIds":["aiuc-1","cobit-2019","iso-27001","nist-800-53","nist-ai-agent-identity","nist-csf-2","nydfs-500","soc2"],"sourceUrl":null,"title":"Coordinated multi-stage / APT campaigns","type":"risk","url":"/assets/agent_record-risk-cyber-coordinated-campaign-b5879769.6d44447e8f95c57c.json"},{"attributes":{"category":"cyber_security","domain":["Data Protection & Privacy","Network & Communications Security","Logging, Monitoring & Detection"],"inherent_rating":"critical","taxonomy":["nist-800-30-threat-event","nist-800-30-threat-source","basel-operational-risk","coso-erm-risk"]},"canonicalUrl":"https://controlsmap.com/?v=1&node=risk%3Adata-exfiltration-espionage","description":"Adversary (outsider, insider, nation-state, or competitor) installs malware or sniffers to locate and exfiltrate sensitive/proprietary information, or steals data by external actors — including systems-security losses from hacking.","details":{"category":"cyber_security","impact":"critical","inherent_rating":"critical","likelihood":"medium","risk_id":"data-exfiltration-espionage","taxonomies":["nist-800-30-threat-event","nist-800-30-threat-source","basel-operational-risk","coso-erm-risk"],"treatment":"mitigate"},"direct":false,"htmlUrl":"/agents/records/risk-data-exfiltration-espionage-74803ebc.html","id":"risk:data-exfiltration-espionage","mapUrl":"https://controlsmap.com/?v=1&node=risk%3Adata-exfiltration-espionage","sourceIds":["aiuc-1","cobit-2019","gdpr","hipaa","iso-27001","nist-800-53","nist-ai-agent-identity","nist-ai-tevv-athlon","nist-csf-2","nydfs-500","pci-dss","soc2"],"sourceUrl":null,"title":"Data exfiltration and theft of information by attackers","type":"risk","url":"/assets/agent_record-risk-data-exfiltration-espionage-74803ebc.a1ef3e79ab006192.json"}],"relationships":[{"expectedCatalogRevision":"24028ffcfc2b295fa1b08ee6caa84b765f0731b321496bf4f548c49ad2177028","id":"rel:00e8902e59b5f8cb4df7dfcf69939fd935ed07ec4588889ac05c71fbdbad5b61","properties":{"rationale":"Reviews confirm each entitlement stays business-limited and remove excess privilege, directly catching privilege creep and wrong assignment.","strength":"primary"},"sourceDetailPath":"/data/v1/records/uc-uc-access-02-0132e278.json","sourceId":"uc:UC-ACCESS-02","targetDetailPath":"/data/v1/records/risk-access-excess-privilege-cd8adadc.json","targetId":"risk:access-excess-privilege","type":"mitigates"},{"expectedCatalogRevision":"24028ffcfc2b295fa1b08ee6caa84b765f0731b321496bf4f548c49ad2177028","id":"rel:016e3829b4ff4569d12f77c4a5036800e14b78650e7a65d3e8c3336cf9af0306","properties":{},"sourceDetailPath":"/data/v1/records/ctrl-nydfs-500-500-3-7a3150f9.json","sourceId":"ctrl:nydfs-500:500.3","targetDetailPath":"/data/v1/records/std-nydfs-500-97d33d25.json","targetId":"std:nydfs-500","type":"belongs_to"},{"expectedCatalogRevision":"24028ffcfc2b295fa1b08ee6caa84b765f0731b321496bf4f548c49ad2177028","id":"rel:04a6d208fc62e199456b186b546a117766f45f54a64aeed4d2363ae94b8f1298","properties":{"rationale":"Control explicitly runs phishing simulations and social-engineering awareness, directly lowering susceptibility to deception/credential theft.","strength":"primary"},"sourceDetailPath":"/data/v1/records/uc-uc-train-01-5f513831.json","sourceId":"uc:UC-TRAIN-01","targetDetailPath":"/data/v1/records/risk-aware-phishing-social-engineering-bb9b7bd6.json","targetId":"risk:aware-phishing-social-engineering","type":"mitigates"},{"expectedCatalogRevision":"24028ffcfc2b295fa1b08ee6caa84b765f0731b321496bf4f548c49ad2177028","id":"rel:058988fa1e861dd7032642d84c30504d7c51bb1c8b4efc6a5cc1493d67ff285f","properties":{"rationale":"Protecting logs from modification/deletion and alerting on tampering preserves audit-trail integrity so privileged users cannot cover tracks or repudiate.","strength":"primary"},"sourceDetailPath":"/data/v1/records/uc-uc-log-03-68ab930e.json","sourceId":"uc:UC-LOG-03","targetDetailPath":"/data/v1/records/risk-access-privilege-abuse-repudiation-343a8917.json","targetId":"risk:access-privilege-abuse-repudiation","type":"mitigates"},{"expectedCatalogRevision":"24028ffcfc2b295fa1b08ee6caa84b765f0731b321496bf4f548c49ad2177028","id":"rel:05acd9a2b908becf7c7faf05f0696614f83613fed1e8ea49d4d668726afd2dee","properties":{"control_id":"500.2","coverage":"partial","delta":"Program's core functions must also include fulfilling applicable regulatory reporting obligations","framework":"nydfs-500","provenance":{"defaultConfidence":"medium","defaultStatus":"active","direction":"canonical_to_source","mapper":"coworkcanvas-compliance-graph","note":"Each member is a documented relationship claim from the canonical unified control to a source control or guidance proposition. relationship: equal|superset_of (full) / intersects_with|subset_of (partial) / informs (guidance). confidence 'medium' = single-mapper, documented, not yet externally corroborated. source_version is the member framework's edition from the standard version register.","reviewDate":"2026-09-07"},"relationship":"intersects_with","source_version":"23 NYCRR 500, Second Amendment"},"sourceDetailPath":"/data/v1/records/uc-uc-gov-15-828b3eec.json","sourceId":"uc:UC-GOV-15","targetDetailPath":"/data/v1/records/ctrl-nydfs-500-500-2-b0b2c5e0.json","targetId":"ctrl:nydfs-500:500.2","type":"maps_to"},{"expectedCatalogRevision":"24028ffcfc2b295fa1b08ee6caa84b765f0731b321496bf4f548c49ad2177028","id":"rel:06caba359dc2d65a4c9d56804c34395ff5e555522dff95ca64b630e97981f249","properties":{"rationale":"Training on safe use of email/messaging gives the guidance that reduces inadvertent disclosure via insecure channels even absent a formal AUP.","strength":"related"},"sourceDetailPath":"/data/v1/records/uc-uc-train-01-5f513831.json","sourceId":"uc:UC-TRAIN-01","targetDetailPath":"/data/v1/records/risk-aware-no-acceptable-use-policy-e874ca5c.json","targetId":"risk:aware-no-acceptable-use-policy","type":"mitigates"},{"expectedCatalogRevision":"24028ffcfc2b295fa1b08ee6caa84b765f0731b321496bf4f548c49ad2177028","id":"rel:0829af2246a85e7e5cc486581d228bba50e080557016bad92e46f06a89d07cae","properties":{"rationale":"Maintaining policies required by HIPAA/PCI/regulators reduces enforcement exposure for missing governance documentation.","strength":"related"},"sourceDetailPath":"/data/v1/records/uc-uc-gov-14-f4f2c470.json","sourceId":"uc:UC-GOV-14","targetDetailPath":"/data/v1/records/risk-compliance-litigation-enforcement-25e7935d.json","targetId":"risk:compliance-litigation-enforcement","type":"mitigates"},{"expectedCatalogRevision":"24028ffcfc2b295fa1b08ee6caa84b765f0731b321496bf4f548c49ad2177028","id":"rel:13f64e9bd86f0bc703948908c3cf78914b528e48bfb571ac0392522a46ce644f","properties":{"rationale":"Requires trusted certificates and rejects insecure fallback, helping reject rogue certs in MITM; the operative approved-CA/revocation defense sits in UC-CRYPTO-03.","strength":"related"},"sourceDetailPath":"/data/v1/records/uc-uc-crypto-01-55215c11.json","sourceId":"uc:UC-CRYPTO-01","targetDetailPath":"/data/v1/records/risk-crypto-counterfeit-certificates-d9dcc5c5.json","targetId":"risk:crypto-counterfeit-certificates","type":"mitigates"},{"expectedCatalogRevision":"24028ffcfc2b295fa1b08ee6caa84b765f0731b321496bf4f548c49ad2177028","id":"rel:1993a983f2a09427091e49375da5e2f760da75d2de3cfbb7f2308f246ceafba4","properties":{"rationale":"Protecting and retaining logs preserves the forensic evidence attackers would erase after locating and stealing data.","strength":"related"},"sourceDetailPath":"/data/v1/records/uc-uc-log-03-68ab930e.json","sourceId":"uc:UC-LOG-03","targetDetailPath":"/data/v1/records/risk-data-exfiltration-espionage-74803ebc.json","targetId":"risk:data-exfiltration-espionage","type":"mitigates"},{"expectedCatalogRevision":"24028ffcfc2b295fa1b08ee6caa84b765f0731b321496bf4f548c49ad2177028","id":"rel:20df9a588bbf7733063324af12b7062329378fd68bbde44f1a0e0f4d686c9610","properties":{},"sourceDetailPath":"/data/v1/records/ctrl-nydfs-500-500-13-f6a493b8.json","sourceId":"ctrl:nydfs-500:500.13","targetDetailPath":"/data/v1/records/std-nydfs-500-97d33d25.json","targetId":"std:nydfs-500","type":"belongs_to"},{"expectedCatalogRevision":"24028ffcfc2b295fa1b08ee6caa84b765f0731b321496bf4f548c49ad2177028","id":"rel:2577b41fb6b769b270deb98d35b352acd8e77e47cd7f1891ca9045efbdced96b","properties":{"rationale":"Maintaining a current register of legal/regulatory/contractual obligations and assigning how each is met reduces enforcement and litigation exposure.","strength":"primary"},"sourceDetailPath":"/data/v1/records/uc-uc-gov-03-9e248eb3.json","sourceId":"uc:UC-GOV-03","targetDetailPath":"/data/v1/records/risk-compliance-litigation-enforcement-25e7935d.json","targetId":"risk:compliance-litigation-enforcement","type":"mitigates"},{"expectedCatalogRevision":"24028ffcfc2b295fa1b08ee6caa84b765f0731b321496bf4f548c49ad2177028","id":"rel:2dd1693b0f792eb20e6784f0968b02a491db0771423c109c75f29f16e99c13ea","properties":{"rationale":"maintaining a documented, approved, annually-reviewed BCP/DR plan directly cures the absent-plan condition","strength":"primary"},"sourceDetailPath":"/data/v1/records/uc-uc-bcdr-01-428f23d3.json","sourceId":"uc:UC-BCDR-01","targetDetailPath":"/data/v1/records/risk-bcdr-no-tested-continuity-plan-d4d9e7a9.json","targetId":"risk:bcdr-no-tested-continuity-plan","type":"mitigates"},{"expectedCatalogRevision":"24028ffcfc2b295fa1b08ee6caa84b765f0731b321496bf4f548c49ad2177028","id":"rel:2ded127132372d45cce1477acd35b28858bb09c6f9583e315f1e478c20e0fb26","properties":{"control_id":"500.9","coverage":"full","delta":null,"framework":"nydfs-500","provenance":{"defaultConfidence":"medium","defaultStatus":"active","direction":"canonical_to_source","mapper":"coworkcanvas-compliance-graph","note":"Each member is a documented relationship claim from the canonical unified control to a source control or guidance proposition. relationship: equal|superset_of (full) / intersects_with|subset_of (partial) / informs (guidance). confidence 'medium' = single-mapper, documented, not yet externally corroborated. source_version is the member framework's edition from the standard version register.","reviewDate":"2026-09-07"},"relationship":"superset_of","source_version":"23 NYCRR 500, Second Amendment"},"sourceDetailPath":"/data/v1/records/uc-uc-risk-06-e9599494.json","sourceId":"uc:UC-RISK-06","targetDetailPath":"/data/v1/records/ctrl-nydfs-500-500-9-b028c41d.json","targetId":"ctrl:nydfs-500:500.9","type":"maps_to"},{"expectedCatalogRevision":"24028ffcfc2b295fa1b08ee6caa84b765f0731b321496bf4f548c49ad2177028","id":"rel:358b69c65fd3738651f16989f96b72debda0886e39521e36e7e4bf3064c3773b","properties":{"rationale":"Delivering security & privacy awareness training to all personnel is the direct first-order defense against the inadequate-awareness gap.","strength":"primary"},"sourceDetailPath":"/data/v1/records/uc-uc-train-01-5f513831.json","sourceId":"uc:UC-TRAIN-01","targetDetailPath":"/data/v1/records/risk-aware-insufficient-training-7cb09d2f.json","targetId":"risk:aware-insufficient-training","type":"mitigates"},{"expectedCatalogRevision":"24028ffcfc2b295fa1b08ee6caa84b765f0731b321496bf4f548c49ad2177028","id":"rel:361013224ca558debafe66941fa17fb1c9b508c0b7842b8a3dd7410136e68fb9","properties":{},"sourceDetailPath":"/data/v1/records/ctrl-nydfs-500-500-16-19fe7459.json","sourceId":"ctrl:nydfs-500:500.16","targetDetailPath":"/data/v1/records/std-nydfs-500-97d33d25.json","targetId":"std:nydfs-500","type":"belongs_to"},{"expectedCatalogRevision":"24028ffcfc2b295fa1b08ee6caa84b765f0731b321496bf4f548c49ad2177028","id":"rel:365f3878096fc1b1f826e84015aab672b22281d274a9d3fbd8ff07efa0b04831","properties":{"rationale":"Authenticated scans detect exposed ports/services and misconfigured internet-facing systems, enabling correction.","strength":"related"},"sourceDetailPath":"/data/v1/records/uc-uc-vuln-01-ec9a46fe.json","sourceId":"uc:UC-VULN-01","targetDetailPath":"/data/v1/records/risk-config-internet-exposed-misconfig-61b3613a.json","targetId":"risk:config-internet-exposed-misconfig","type":"mitigates"},{"expectedCatalogRevision":"24028ffcfc2b295fa1b08ee6caa84b765f0731b321496bf4f548c49ad2177028","id":"rel:3d19250a6eb807ea71cf310372afe4b50b74ebd7100e8d95ce38afdd07db9cf9","properties":{},"sourceDetailPath":"/data/v1/records/ctrl-nydfs-500-500-4-a694a85b.json","sourceId":"ctrl:nydfs-500:500.4","targetDetailPath":"/data/v1/records/std-nydfs-500-97d33d25.json","targetId":"std:nydfs-500","type":"belongs_to"},{"expectedCatalogRevision":"24028ffcfc2b295fa1b08ee6caa84b765f0731b321496bf4f548c49ad2177028","id":"rel:4d30fee23c5621af13725ad4feae0824aeadd8a4c9fa9ace2131f8b7c7b89838","properties":{},"sourceDetailPath":"/data/v1/records/ctrl-nydfs-500-500-11-55bec62e.json","sourceId":"ctrl:nydfs-500:500.11","targetDetailPath":"/data/v1/records/std-nydfs-500-97d33d25.json","targetId":"std:nydfs-500","type":"belongs_to"},{"expectedCatalogRevision":"24028ffcfc2b295fa1b08ee6caa84b765f0731b321496bf4f548c49ad2177028","id":"rel:4eee70c373d257b88d04508560fa2d493236a925b3926a17b21d680720504410","properties":{"control_id":"500.6","coverage":"partial","delta":"also requires trails reconstructing material financial transactions","framework":"nydfs-500","provenance":{"defaultConfidence":"medium","defaultStatus":"active","direction":"canonical_to_source","mapper":"coworkcanvas-compliance-graph","note":"Each member is a documented relationship claim from the canonical unified control to a source control or guidance proposition. relationship: equal|superset_of (full) / intersects_with|subset_of (partial) / informs (guidance). confidence 'medium' = single-mapper, documented, not yet externally corroborated. source_version is the member framework's edition from the standard version register.","reviewDate":"2026-09-07"},"relationship":"intersects_with","source_version":"23 NYCRR 500, Second Amendment"},"sourceDetailPath":"/data/v1/records/uc-uc-log-03-68ab930e.json","sourceId":"uc:UC-LOG-03","targetDetailPath":"/data/v1/records/ctrl-nydfs-500-500-6-c10e1c50.json","targetId":"ctrl:nydfs-500:500.6","type":"maps_to"},{"expectedCatalogRevision":"24028ffcfc2b295fa1b08ee6caa84b765f0731b321496bf4f548c49ad2177028","id":"rel:4fd2a8dbab21276b567ca1ee445117f105f29d7df458b8a73cf90c90b40b217c","properties":{"control_id":"500.5","coverage":"partial","delta":"also requires annual penetration testing by a qualified independent party","framework":"nydfs-500","provenance":{"defaultConfidence":"medium","defaultStatus":"active","direction":"canonical_to_source","mapper":"coworkcanvas-compliance-graph","note":"Each member is a documented relationship claim from the canonical unified control to a source control or guidance proposition. relationship: equal|superset_of (full) / intersects_with|subset_of (partial) / informs (guidance). confidence 'medium' = single-mapper, documented, not yet externally corroborated. source_version is the member framework's edition from the standard version register.","reviewDate":"2026-09-07"},"relationship":"intersects_with","source_version":"23 NYCRR 500, Second Amendment"},"sourceDetailPath":"/data/v1/records/uc-uc-vuln-01-ec9a46fe.json","sourceId":"uc:UC-VULN-01","targetDetailPath":"/data/v1/records/ctrl-nydfs-500-500-5-986f2983.json","targetId":"ctrl:nydfs-500:500.5","type":"maps_to"},{"expectedCatalogRevision":"24028ffcfc2b295fa1b08ee6caa84b765f0731b321496bf4f548c49ad2177028","id":"rel:523a02ed41baf910806e759f33f602a9a7c8fa1127ebf731fae5490b892c41ee","properties":{"rationale":"the BIA-based plan identifies single points of failure and prescribes failover arrangements","strength":"related"},"sourceDetailPath":"/data/v1/records/uc-uc-bcdr-01-428f23d3.json","sourceId":"uc:UC-BCDR-01","targetDetailPath":"/data/v1/records/risk-bcdr-single-point-concentration-91008453.json","targetId":"risk:bcdr-single-point-concentration","type":"mitigates"},{"expectedCatalogRevision":"24028ffcfc2b295fa1b08ee6caa84b765f0731b321496bf4f548c49ad2177028","id":"rel:53e5d40889536378c608acbfacff804b7d936577fb09f9cad0e0ba757f90ea3b","properties":{"rationale":"Retention limits and secure disposal of nonpublic data reduce over-retention and legal exposure.","strength":"related"},"sourceDetailPath":"/data/v1/records/uc-uc-gov-30-6e914c26.json","sourceId":"uc:UC-GOV-30","targetDetailPath":"/data/v1/records/risk-compliance-litigation-enforcement-25e7935d.json","targetId":"risk:compliance-litigation-enforcement","type":"mitigates"},{"expectedCatalogRevision":"24028ffcfc2b295fa1b08ee6caa84b765f0731b321496bf4f548c49ad2177028","id":"rel:5d617594d25b8a41b14088d5998a1bdf055119fb9f57b2e22f2d2fb80e0dae91","properties":{"rationale":"MFA with credential validation only over protected channels directly remediates absent MFA and clear-text authentication.","strength":"primary"},"sourceDetailPath":"/data/v1/records/uc-uc-access-09-444baafe.json","sourceId":"uc:UC-ACCESS-09","targetDetailPath":"/data/v1/records/risk-access-weak-authentication-4e35bdb2.json","targetId":"risk:access-weak-authentication","type":"mitigates"},{"expectedCatalogRevision":"24028ffcfc2b295fa1b08ee6caa84b765f0731b321496bf4f548c49ad2177028","id":"rel:5e5a89828279770e24fbc4e75c1fe79275ee2674d9b9b13fbd01e1bcc2266145","properties":{"control_id":"500.4","coverage":"partial","delta":"500.4(c) also requires timely reporting of material cybersecurity issues, not only annual reports","framework":"nydfs-500","provenance":{"defaultConfidence":"medium","defaultStatus":"active","direction":"canonical_to_source","mapper":"coworkcanvas-compliance-graph","note":"Each member is a documented relationship claim from the canonical unified control to a source control or guidance proposition. relationship: equal|superset_of (full) / intersects_with|subset_of (partial) / informs (guidance). confidence 'medium' = single-mapper, documented, not yet externally corroborated. source_version is the member framework's edition from the standard version register.","reviewDate":"2026-09-07"},"relationship":"intersects_with","source_version":"23 NYCRR 500, Second Amendment"},"sourceDetailPath":"/data/v1/records/uc-uc-gov-09-3b622881.json","sourceId":"uc:UC-GOV-09","targetDetailPath":"/data/v1/records/ctrl-nydfs-500-500-4-a694a85b.json","targetId":"ctrl:nydfs-500:500.4","type":"maps_to"},{"expectedCatalogRevision":"24028ffcfc2b295fa1b08ee6caa84b765f0731b321496bf4f548c49ad2177028","id":"rel:5ffb88ce652506ecf84fb88b264d0eb42d61ca1f72fd14d38745d836f4be9592","properties":{"rationale":"NYDFS 500.9 member and explicit cyber scope make the assessment periodically surface evolving cyber threats for treatment, enabling context not the operative defense.","strength":"related"},"sourceDetailPath":"/data/v1/records/uc-uc-risk-06-e9599494.json","sourceId":"uc:UC-RISK-06","targetDetailPath":"/data/v1/records/risk-cyber-adversary-threat-sources-fa9e3003.json","targetId":"risk:cyber-adversary-threat-sources","type":"mitigates"},{"expectedCatalogRevision":"24028ffcfc2b295fa1b08ee6caa84b765f0731b321496bf4f548c49ad2177028","id":"rel:645d55fa8e2e3bcea96be0992abd49f6be9a6b2460bcd1eaafa9677670681fec","properties":{},"sourceDetailPath":"/data/v1/records/ctrl-nydfs-500-500-17-25353c71.json","sourceId":"ctrl:nydfs-500:500.17","targetDetailPath":"/data/v1/records/std-nydfs-500-97d33d25.json","targetId":"std:nydfs-500","type":"belongs_to"},{"expectedCatalogRevision":"24028ffcfc2b295fa1b08ee6caa84b765f0731b321496bf4f548c49ad2177028","id":"rel:6a395e5bdd2e15e676e1508c2595987a0b3e68accf57e99be3b01eb9e860e818","properties":{"rationale":"Notifying regulators within mandated timelines and filing required certifications avoids penalties for late or missing regulatory reporting.","strength":"primary"},"sourceDetailPath":"/data/v1/records/uc-uc-gov-24-b737644b.json","sourceId":"uc:UC-GOV-24","targetDetailPath":"/data/v1/records/risk-compliance-litigation-enforcement-25e7935d.json","targetId":"risk:compliance-litigation-enforcement","type":"mitigates"},{"expectedCatalogRevision":"24028ffcfc2b295fa1b08ee6caa84b765f0731b321496bf4f548c49ad2177028","id":"rel:6a7f08161288ce029a9ff09ceca2f15d66a7c1432464faeba040324abce84b91","properties":{"rationale":"General awareness cuts inadvertent sensitive-info mishandling, but the operative defense against the named operational errors (misconfiguration, privilege settings) is role-based training; general training only contributes.","strength":"related"},"sourceDetailPath":"/data/v1/records/uc-uc-train-01-5f513831.json","sourceId":"uc:UC-TRAIN-01","targetDetailPath":"/data/v1/records/risk-aware-user-error-mishandling-149a1d3b.json","targetId":"risk:aware-user-error-mishandling","type":"mitigates"},{"expectedCatalogRevision":"24028ffcfc2b295fa1b08ee6caa84b765f0731b321496bf4f548c49ad2177028","id":"rel:6bd27af7de8c37306c757455fc856aa1a73c98fc45fc7ff859d7b45306ca6dab","properties":{"rationale":"Scans surface deviations from secure baselines (missing patches, insecure settings), flagging drift for remediation.","strength":"related"},"sourceDetailPath":"/data/v1/records/uc-uc-vuln-01-ec9a46fe.json","sourceId":"uc:UC-VULN-01","targetDetailPath":"/data/v1/records/risk-config-poor-baseline-drift-2dd66324.json","targetId":"risk:config-poor-baseline-drift","type":"mitigates"},{"expectedCatalogRevision":"24028ffcfc2b295fa1b08ee6caa84b765f0731b321496bf4f548c49ad2177028","id":"rel:6d57ed165f46a76bcba83a99aa07a9d70429b63a52da1b10097d9fcd6e2de215","properties":{"control_id":"500.8","coverage":"full","delta":null,"framework":"nydfs-500","provenance":{"defaultConfidence":"medium","defaultStatus":"active","direction":"canonical_to_source","mapper":"coworkcanvas-compliance-graph","note":"Each member is a documented relationship claim from the canonical unified control to a source control or guidance proposition. relationship: equal|superset_of (full) / intersects_with|subset_of (partial) / informs (guidance). confidence 'medium' = single-mapper, documented, not yet externally corroborated. source_version is the member framework's edition from the standard version register.","reviewDate":"2026-09-07"},"relationship":"superset_of","source_version":"23 NYCRR 500, Second Amendment"},"sourceDetailPath":"/data/v1/records/uc-uc-gov-29-7c321dee.json","sourceId":"uc:UC-GOV-29","targetDetailPath":"/data/v1/records/ctrl-nydfs-500-500-8-68ba80b6.json","targetId":"ctrl:nydfs-500:500.8","type":"maps_to"},{"expectedCatalogRevision":"24028ffcfc2b295fa1b08ee6caa84b765f0731b321496bf4f548c49ad2177028","id":"rel:6fb41f2d6d94cc04509d520fa0c0096637073745c031c4d536c9464491acbf60","properties":{},"sourceDetailPath":"/data/v1/records/ctrl-nydfs-500-500-15-5ef052ba.json","sourceId":"ctrl:nydfs-500:500.15","targetDetailPath":"/data/v1/records/std-nydfs-500-97d33d25.json","targetId":"std:nydfs-500","type":"belongs_to"},{"expectedCatalogRevision":"24028ffcfc2b295fa1b08ee6caa84b765f0731b321496bf4f548c49ad2177028","id":"rel:709b8253a5475a1ecc520787a7b313cd93a6dfd9f5ba7d459532e88c2b9f68a4","properties":{"control_id":"500.17","coverage":"full","delta":null,"framework":"nydfs-500","provenance":{"defaultConfidence":"medium","defaultStatus":"active","direction":"canonical_to_source","mapper":"coworkcanvas-compliance-graph","note":"Each member is a documented relationship claim from the canonical unified control to a source control or guidance proposition. relationship: equal|superset_of (full) / intersects_with|subset_of (partial) / informs (guidance). confidence 'medium' = single-mapper, documented, not yet externally corroborated. source_version is the member framework's edition from the standard version register.","reviewDate":"2026-09-07"},"relationship":"superset_of","source_version":"23 NYCRR 500, Second Amendment"},"sourceDetailPath":"/data/v1/records/uc-uc-gov-24-b737644b.json","sourceId":"uc:UC-GOV-24","targetDetailPath":"/data/v1/records/ctrl-nydfs-500-500-17-25353c71.json","targetId":"ctrl:nydfs-500:500.17","type":"maps_to"},{"expectedCatalogRevision":"24028ffcfc2b295fa1b08ee6caa84b765f0731b321496bf4f548c49ad2177028","id":"rel:75a839653ee0d96335464851ed5c8ca235ac53f66c85eb34c9aac0c44c3d145f","properties":{},"sourceDetailPath":"/data/v1/records/ctrl-nydfs-500-500-8-68ba80b6.json","sourceId":"ctrl:nydfs-500:500.8","targetDetailPath":"/data/v1/records/std-nydfs-500-97d33d25.json","targetId":"std:nydfs-500","type":"belongs_to"},{"expectedCatalogRevision":"24028ffcfc2b295fa1b08ee6caa84b765f0731b321496bf4f548c49ad2177028","id":"rel:79dd679e8bdc0a739313fc5b43f2bd5c8dae9afcbe19f026e72497844c092a49","properties":{},"sourceDetailPath":"/data/v1/records/ctrl-nydfs-500-500-7-09439ea1.json","sourceId":"ctrl:nydfs-500:500.7","targetDetailPath":"/data/v1/records/std-nydfs-500-97d33d25.json","targetId":"std:nydfs-500","type":"belongs_to"},{"expectedCatalogRevision":"24028ffcfc2b295fa1b08ee6caa84b765f0731b321496bf4f548c49ad2177028","id":"rel:7f2c8c0c132ce3bcb92edbfdf4ed0485aac744eddbabd16775a0748c8edb9fd8","properties":{},"sourceDetailPath":"/data/v1/records/ctrl-nydfs-500-500-9-b028c41d.json","sourceId":"ctrl:nydfs-500:500.9","targetDetailPath":"/data/v1/records/std-nydfs-500-97d33d25.json","targetId":"std:nydfs-500","type":"belongs_to"},{"expectedCatalogRevision":"24028ffcfc2b295fa1b08ee6caa84b765f0731b321496bf4f548c49ad2177028","id":"rel:82dc71ab42ebaf00285e13cf28a7fda3cbb3663657f1c41e9d5c5b27c07e18b7","properties":{},"sourceDetailPath":"/data/v1/records/ctrl-nydfs-500-500-18-1e1c055e.json","sourceId":"ctrl:nydfs-500:500.18","targetDetailPath":"/data/v1/records/std-nydfs-500-97d33d25.json","targetId":"std:nydfs-500","type":"belongs_to"},{"expectedCatalogRevision":"24028ffcfc2b295fa1b08ee6caa84b765f0731b321496bf4f548c49ad2177028","id":"rel:8970c33bddd154c3cef76c7c7d82e5a8d118c74e982d2ab08a338dc51797f3fa","properties":{"rationale":"Renders data at rest unreadable and encrypts data in transit with strong cryptography, directly closing the absent/inadequate-encryption exposure for stored and transmitted data.","strength":"primary"},"sourceDetailPath":"/data/v1/records/uc-uc-crypto-01-55215c11.json","sourceId":"uc:UC-CRYPTO-01","targetDetailPath":"/data/v1/records/risk-crypto-weak-or-absent-encryption-2fe7d24e.json","targetId":"risk:crypto-weak-or-absent-encryption","type":"mitigates"},{"expectedCatalogRevision":"24028ffcfc2b295fa1b08ee6caa84b765f0731b321496bf4f548c49ad2177028","id":"rel:8d1d7971d424a668a87fff77c440a48dd73b76aca4faa2d4dac714336b0270b1","properties":{},"sourceDetailPath":"/data/v1/records/ctrl-nydfs-500-500-10-44ad738a.json","sourceId":"ctrl:nydfs-500:500.10","targetDetailPath":"/data/v1/records/std-nydfs-500-97d33d25.json","targetId":"std:nydfs-500","type":"belongs_to"},{"expectedCatalogRevision":"24028ffcfc2b295fa1b08ee6caa84b765f0731b321496bf4f548c49ad2177028","id":"rel:935ce2cca288bbd95863898c3e4104c7e5b9c79711228ec5563c361039874734","properties":{},"sourceDetailPath":"/data/v1/records/ctrl-nydfs-500-500-6-c10e1c50.json","sourceId":"ctrl:nydfs-500:500.6","targetDetailPath":"/data/v1/records/std-nydfs-500-97d33d25.json","targetId":"std:nydfs-500","type":"belongs_to"},{"expectedCatalogRevision":"24028ffcfc2b295fa1b08ee6caa84b765f0731b321496bf4f548c49ad2177028","id":"rel:99a914e3aa7edf4870b919f1ccda0d429d56f5cc73c8438966f9d878ac004a3f","properties":{},"sourceDetailPath":"/data/v1/records/ctrl-nydfs-500-500-19-235a6ef9.json","sourceId":"ctrl:nydfs-500:500.19","targetDetailPath":"/data/v1/records/std-nydfs-500-97d33d25.json","targetId":"std:nydfs-500","type":"belongs_to"},{"expectedCatalogRevision":"24028ffcfc2b295fa1b08ee6caa84b765f0731b321496bf4f548c49ad2177028","id":"rel:99c97e797190f26c810022f7b92ca57025f6d3039e3bda9cb9905a60caff5f98","properties":{"control_id":"500.16","coverage":"partial","delta":"plan testing, training, and backup restore verification satisfied by companion controls","framework":"nydfs-500","provenance":{"defaultConfidence":"medium","defaultStatus":"active","direction":"canonical_to_source","mapper":"coworkcanvas-compliance-graph","note":"Each member is a documented relationship claim from the canonical unified control to a source control or guidance proposition. relationship: equal|superset_of (full) / intersects_with|subset_of (partial) / informs (guidance). confidence 'medium' = single-mapper, documented, not yet externally corroborated. source_version is the member framework's edition from the standard version register.","reviewDate":"2026-09-07"},"relationship":"intersects_with","source_version":"23 NYCRR 500, Second Amendment"},"sourceDetailPath":"/data/v1/records/uc-uc-bcdr-01-428f23d3.json","sourceId":"uc:UC-BCDR-01","targetDetailPath":"/data/v1/records/ctrl-nydfs-500-500-16-19fe7459.json","targetId":"ctrl:nydfs-500:500.16","type":"maps_to"},{"expectedCatalogRevision":"24028ffcfc2b295fa1b08ee6caa84b765f0731b321496bf4f548c49ad2177028","id":"rel:9df3b2affe778942ae24edb5bf7b1f16a2743ec488ec7847a837f3bd1140f7fe","properties":{"rationale":"Periodic owner recertification of user and privileged access is the direct detective control for the missing access-review element of this risk.","strength":"primary"},"sourceDetailPath":"/data/v1/records/uc-uc-access-02-0132e278.json","sourceId":"uc:UC-ACCESS-02","targetDetailPath":"/data/v1/records/risk-access-provisioning-review-gap-dc152038.json","targetId":"risk:access-provisioning-review-gap","type":"mitigates"},{"expectedCatalogRevision":"24028ffcfc2b295fa1b08ee6caa84b765f0731b321496bf4f548c49ad2177028","id":"rel:a06d3dc3bfa286704837290a134192ad03ff22cd881b73e6ebfafaaa5df608d2","properties":{"control_id":"500.7","coverage":"partial","delta":"least-privilege limits and termination revocation satisfied by companion access controls","framework":"nydfs-500","provenance":{"defaultConfidence":"medium","defaultStatus":"active","direction":"canonical_to_source","mapper":"coworkcanvas-compliance-graph","note":"Each member is a documented relationship claim from the canonical unified control to a source control or guidance proposition. relationship: equal|superset_of (full) / intersects_with|subset_of (partial) / informs (guidance). confidence 'medium' = single-mapper, documented, not yet externally corroborated. source_version is the member framework's edition from the standard version register.","reviewDate":"2026-09-07"},"relationship":"intersects_with","source_version":"23 NYCRR 500, Second Amendment"},"sourceDetailPath":"/data/v1/records/uc-uc-access-02-0132e278.json","sourceId":"uc:UC-ACCESS-02","targetDetailPath":"/data/v1/records/ctrl-nydfs-500-500-7-09439ea1.json","targetId":"ctrl:nydfs-500:500.7","type":"maps_to"},{"expectedCatalogRevision":"24028ffcfc2b295fa1b08ee6caa84b765f0731b321496bf4f548c49ad2177028","id":"rel:af38eec7a8f928c5a9042ad4d5ea80f3bef11e25dd5ac3a101697e71f9b73a75","properties":{"rationale":"Annual all-personnel refresh supplies the ongoing-awareness component of the gap; the role-specific core is delivered by UC-TRAIN-02.","strength":"related"},"sourceDetailPath":"/data/v1/records/uc-uc-train-01-5f513831.json","sourceId":"uc:UC-TRAIN-01","targetDetailPath":"/data/v1/records/risk-aware-role-based-training-gap-3e2ca2c3.json","targetId":"risk:aware-role-based-training-gap","type":"mitigates"},{"expectedCatalogRevision":"24028ffcfc2b295fa1b08ee6caa84b765f0731b321496bf4f548c49ad2177028","id":"rel:b312a3465956656f933a2d24079ffb3960496f2c22e14a96ad449d31cfe0d456","properties":{"rationale":"Mandates strong encryption of data in transit over all public/external networks and rejects fallback to insecure protocols, directly preventing credentials and sensitive comms from crossing the wire in clear text.","strength":"primary"},"sourceDetailPath":"/data/v1/records/uc-uc-crypto-01-55215c11.json","sourceId":"uc:UC-CRYPTO-01","targetDetailPath":"/data/v1/records/risk-crypto-cleartext-credential-transfer-b88065a1.json","targetId":"risk:crypto-cleartext-credential-transfer","type":"mitigates"},{"expectedCatalogRevision":"24028ffcfc2b295fa1b08ee6caa84b765f0731b321496bf4f548c49ad2177028","id":"rel:b710763db006c50e74e56979f08771abc6a21fb508e06abd61239f155d4f359f","properties":{"control_id":"500.15","coverage":"full","delta":null,"framework":"nydfs-500","provenance":{"defaultConfidence":"medium","defaultStatus":"active","direction":"canonical_to_source","mapper":"coworkcanvas-compliance-graph","note":"Each member is a documented relationship claim from the canonical unified control to a source control or guidance proposition. relationship: equal|superset_of (full) / intersects_with|subset_of (partial) / informs (guidance). confidence 'medium' = single-mapper, documented, not yet externally corroborated. source_version is the member framework's edition from the standard version register.","reviewDate":"2026-09-07"},"relationship":"superset_of","source_version":"23 NYCRR 500, Second Amendment"},"sourceDetailPath":"/data/v1/records/uc-uc-crypto-01-55215c11.json","sourceId":"uc:UC-CRYPTO-01","targetDetailPath":"/data/v1/records/ctrl-nydfs-500-500-15-5ef052ba.json","targetId":"ctrl:nydfs-500:500.15","type":"maps_to"},{"expectedCatalogRevision":"24028ffcfc2b295fa1b08ee6caa84b765f0731b321496bf4f548c49ad2177028","id":"rel:bbf16e8d6bdc1ba0ea248f5d620c07f64df2eb13d63983b73d807ba9dc31afdd","properties":{"control_id":"500.19","coverage":"full","delta":null,"framework":"nydfs-500","provenance":{"defaultConfidence":"medium","defaultStatus":"active","direction":"canonical_to_source","mapper":"coworkcanvas-compliance-graph","note":"Each member is a documented relationship claim from the canonical unified control to a source control or guidance proposition. relationship: equal|superset_of (full) / intersects_with|subset_of (partial) / informs (guidance). confidence 'medium' = single-mapper, documented, not yet externally corroborated. source_version is the member framework's edition from the standard version register.","reviewDate":"2026-09-07"},"relationship":"superset_of","source_version":"23 NYCRR 500, Second Amendment"},"sourceDetailPath":"/data/v1/records/uc-uc-gov-03-9e248eb3.json","sourceId":"uc:UC-GOV-03","targetDetailPath":"/data/v1/records/ctrl-nydfs-500-500-19-235a6ef9.json","targetId":"ctrl:nydfs-500:500.19","type":"maps_to"},{"expectedCatalogRevision":"24028ffcfc2b295fa1b08ee6caa84b765f0731b321496bf4f548c49ad2177028","id":"rel:be79657587a31e1e4e539adc6ab5bb7a0f9ca6cbefbbf8e284f2bb97974db7ec","properties":{"control_id":"500.12","coverage":"partial","delta":"amended 500.12 requires MFA for any access to any information system","framework":"nydfs-500","provenance":{"defaultConfidence":"medium","defaultStatus":"active","direction":"canonical_to_source","mapper":"coworkcanvas-compliance-graph","note":"Each member is a documented relationship claim from the canonical unified control to a source control or guidance proposition. relationship: equal|superset_of (full) / intersects_with|subset_of (partial) / informs (guidance). confidence 'medium' = single-mapper, documented, not yet externally corroborated. source_version is the member framework's edition from the standard version register.","reviewDate":"2026-09-07"},"relationship":"intersects_with","source_version":"23 NYCRR 500, Second Amendment"},"sourceDetailPath":"/data/v1/records/uc-uc-access-09-444baafe.json","sourceId":"uc:UC-ACCESS-09","targetDetailPath":"/data/v1/records/ctrl-nydfs-500-500-12-c3c47b61.json","targetId":"ctrl:nydfs-500:500.12","type":"maps_to"},{"expectedCatalogRevision":"24028ffcfc2b295fa1b08ee6caa84b765f0731b321496bf4f548c49ad2177028","id":"rel:c4d9a8ef5397b2733ba341189f1046dc4fd3c7ebc85625e7b2ba47829b0eab5e","properties":{"control_id":"500.11","coverage":"partial","delta":"policies must address TPSP MFA/access, encryption, event-notice, and representations guidelines","framework":"nydfs-500","provenance":{"defaultConfidence":"medium","defaultStatus":"active","direction":"canonical_to_source","mapper":"coworkcanvas-compliance-graph","note":"Each member is a documented relationship claim from the canonical unified control to a source control or guidance proposition. relationship: equal|superset_of (full) / intersects_with|subset_of (partial) / informs (guidance). confidence 'medium' = single-mapper, documented, not yet externally corroborated. source_version is the member framework's edition from the standard version register.","reviewDate":"2026-09-07"},"relationship":"intersects_with","source_version":"23 NYCRR 500, Second Amendment"},"sourceDetailPath":"/data/v1/records/uc-uc-tprm-01-16b62053.json","sourceId":"uc:UC-TPRM-01","targetDetailPath":"/data/v1/records/ctrl-nydfs-500-500-11-55bec62e.json","targetId":"ctrl:nydfs-500:500.11","type":"maps_to"},{"expectedCatalogRevision":"24028ffcfc2b295fa1b08ee6caa84b765f0731b321496bf4f548c49ad2177028","id":"rel:c716c1473998a90841cbd8c457c8f372f2f84be9b1336d1e31752b79f3eb52a5","properties":{},"sourceDetailPath":"/data/v1/records/ctrl-nydfs-500-500-12-c3c47b61.json","sourceId":"ctrl:nydfs-500:500.12","targetDetailPath":"/data/v1/records/std-nydfs-500-97d33d25.json","targetId":"std:nydfs-500","type":"belongs_to"},{"expectedCatalogRevision":"24028ffcfc2b295fa1b08ee6caa84b765f0731b321496bf4f548c49ad2177028","id":"rel:c8436cf942803f6684548623379ec24ed1adf724f2ef38897a2c22b83c5b428f","properties":{"rationale":"MFA blocks account takeover even when a password is phished, the canonical defense against credential-harvesting social engineering.","strength":"primary"},"sourceDetailPath":"/data/v1/records/uc-uc-access-09-444baafe.json","sourceId":"uc:UC-ACCESS-09","targetDetailPath":"/data/v1/records/risk-aware-phishing-social-engineering-bb9b7bd6.json","targetId":"risk:aware-phishing-social-engineering","type":"mitigates"},{"expectedCatalogRevision":"24028ffcfc2b295fa1b08ee6caa84b765f0731b321496bf4f548c49ad2177028","id":"rel:cc42ae43a07e6751affbd567aa46907a8bcb7af8d8d84616257c0cbb2fcbc6a1","properties":{"control_id":"500.14","coverage":"partial","delta":"authorized-user activity monitoring and email/web filtering prongs not covered","framework":"nydfs-500","provenance":{"defaultConfidence":"medium","defaultStatus":"active","direction":"canonical_to_source","mapper":"coworkcanvas-compliance-graph","note":"Each member is a documented relationship claim from the canonical unified control to a source control or guidance proposition. relationship: equal|superset_of (full) / intersects_with|subset_of (partial) / informs (guidance). confidence 'medium' = single-mapper, documented, not yet externally corroborated. source_version is the member framework's edition from the standard version register.","reviewDate":"2026-09-07"},"relationship":"intersects_with","source_version":"23 NYCRR 500, Second Amendment"},"sourceDetailPath":"/data/v1/records/uc-uc-train-01-5f513831.json","sourceId":"uc:UC-TRAIN-01","targetDetailPath":"/data/v1/records/ctrl-nydfs-500-500-14-d15e0ff2.json","targetId":"ctrl:nydfs-500:500.14","type":"maps_to"},{"expectedCatalogRevision":"24028ffcfc2b295fa1b08ee6caa84b765f0731b321496bf4f548c49ad2177028","id":"rel:d1bc3d44abfcb1b212921d6c5e3323d0b33cf5166e5957cd9e0d160834fac695","properties":{"rationale":"A criticality-ranked third-party register plus concentration and exit-strategy assessment applies to AI API providers, reducing concentration and outage impact.","strength":"related"},"sourceDetailPath":"/data/v1/records/uc-uc-tprm-01-16b62053.json","sourceId":"uc:UC-TPRM-01","targetDetailPath":"/data/v1/records/risk-ai-supply-chain-concentration-9f791f54.json","targetId":"risk:ai-supply-chain-concentration","type":"mitigates"},{"expectedCatalogRevision":"24028ffcfc2b295fa1b08ee6caa84b765f0731b321496bf4f548c49ad2177028","id":"rel:d3f75371a6103a0019f7fdc78e5c10160a8d4e35c2fc9457d72c40dbc045c619","properties":{"control_id":"500.10","coverage":"full","delta":null,"framework":"nydfs-500","provenance":{"defaultConfidence":"medium","defaultStatus":"active","direction":"canonical_to_source","mapper":"coworkcanvas-compliance-graph","note":"Each member is a documented relationship claim from the canonical unified control to a source control or guidance proposition. relationship: equal|superset_of (full) / intersects_with|subset_of (partial) / informs (guidance). confidence 'medium' = single-mapper, documented, not yet externally corroborated. source_version is the member framework's edition from the standard version register.","reviewDate":"2026-09-07"},"relationship":"superset_of","source_version":"23 NYCRR 500, Second Amendment"},"sourceDetailPath":"/data/v1/records/uc-uc-gov-10-016614d1.json","sourceId":"uc:UC-GOV-10","targetDetailPath":"/data/v1/records/ctrl-nydfs-500-500-10-44ad738a.json","targetId":"ctrl:nydfs-500:500.10","type":"maps_to"},{"expectedCatalogRevision":"24028ffcfc2b295fa1b08ee6caa84b765f0731b321496bf4f548c49ad2177028","id":"rel:d4b9c1bc5d5b46c50e5265631570fcfbbffcb4f968267b494fe4ef079c0a023f","properties":{"rationale":"Removing standing/excess privilege found in reviews shrinks the rights available to be abused.","strength":"related"},"sourceDetailPath":"/data/v1/records/uc-uc-access-02-0132e278.json","sourceId":"uc:UC-ACCESS-02","targetDetailPath":"/data/v1/records/risk-access-privilege-abuse-repudiation-343a8917.json","targetId":"risk:access-privilege-abuse-repudiation","type":"mitigates"},{"expectedCatalogRevision":"24028ffcfc2b295fa1b08ee6caa84b765f0731b321496bf4f548c49ad2177028","id":"rel:d7cc1f08f27b6315ce2ec5eed4c8b0a4dc59776e29cddc1c7873e1fdeecb6d99","properties":{"rationale":"Assessing concentration risk and maintaining exit strategies for critical providers reduces the ecosystem single-point-of-failure impact from GPAI-capability concentration.","strength":"related"},"sourceDetailPath":"/data/v1/records/uc-uc-tprm-01-16b62053.json","sourceId":"uc:UC-TPRM-01","targetDetailPath":"/data/v1/records/risk-ai-gpai-systemic-transparency-7a746323.json","targetId":"risk:ai-gpai-systemic-transparency","type":"mitigates"},{"expectedCatalogRevision":"24028ffcfc2b295fa1b08ee6caa84b765f0731b321496bf4f548c49ad2177028","id":"rel:dd2057920f7f9cceb8904ae17068fd358745d80a95246634a8eb7a8d2c0ce079","properties":{"control_id":"500.13","coverage":"partial","delta":"Inventory must track owner, location, classification, support expiration, RTO, plus update frequency","framework":"nydfs-500","provenance":{"defaultConfidence":"medium","defaultStatus":"active","direction":"canonical_to_source","mapper":"coworkcanvas-compliance-graph","note":"Each member is a documented relationship claim from the canonical unified control to a source control or guidance proposition. relationship: equal|superset_of (full) / intersects_with|subset_of (partial) / informs (guidance). confidence 'medium' = single-mapper, documented, not yet externally corroborated. source_version is the member framework's edition from the standard version register.","reviewDate":"2026-09-07"},"relationship":"intersects_with","source_version":"23 NYCRR 500, Second Amendment"},"sourceDetailPath":"/data/v1/records/uc-uc-gov-30-6e914c26.json","sourceId":"uc:UC-GOV-30","targetDetailPath":"/data/v1/records/ctrl-nydfs-500-500-13-f6a493b8.json","targetId":"ctrl:nydfs-500:500.13","type":"maps_to"},{"expectedCatalogRevision":"24028ffcfc2b295fa1b08ee6caa84b765f0731b321496bf4f548c49ad2177028","id":"rel:e223584687b5204e754de74a0c4f12c90c4b09f7d942666800c1256ced40aaf2","properties":{"control_id":"500.18","coverage":"full","delta":null,"framework":"nydfs-500","provenance":{"defaultConfidence":"medium","defaultStatus":"active","direction":"canonical_to_source","mapper":"coworkcanvas-compliance-graph","note":"Each member is a documented relationship claim from the canonical unified control to a source control or guidance proposition. relationship: equal|superset_of (full) / intersects_with|subset_of (partial) / informs (guidance). confidence 'medium' = single-mapper, documented, not yet externally corroborated. source_version is the member framework's edition from the standard version register.","reviewDate":"2026-09-07"},"relationship":"superset_of","source_version":"23 NYCRR 500, Second Amendment"},"sourceDetailPath":"/data/v1/records/uc-uc-gov-24-b737644b.json","sourceId":"uc:UC-GOV-24","targetDetailPath":"/data/v1/records/ctrl-nydfs-500-500-18-1e1c055e.json","targetId":"ctrl:nydfs-500:500.18","type":"maps_to"},{"expectedCatalogRevision":"24028ffcfc2b295fa1b08ee6caa84b765f0731b321496bf4f548c49ad2177028","id":"rel:e831b8a5d7d217ed1bfa299b37207847c718595e688084ec797d5acf0f2bca14","properties":{"rationale":"Immutable log storage and tamper alerts counter the anti-forensic log-deletion tactic APT campaigns use to hide persistence.","strength":"related"},"sourceDetailPath":"/data/v1/records/uc-uc-log-03-68ab930e.json","sourceId":"uc:UC-LOG-03","targetDetailPath":"/data/v1/records/risk-cyber-coordinated-campaign-b5879769.json","targetId":"risk:cyber-coordinated-campaign","type":"mitigates"},{"expectedCatalogRevision":"24028ffcfc2b295fa1b08ee6caa84b765f0731b321496bf4f548c49ad2177028","id":"rel:ede6aa8750315d3461dc9d4adfb070a10c5ae10cd85f36d7737f381ce566a8fb","properties":{"control_id":"500.3","coverage":"full","delta":null,"framework":"nydfs-500","provenance":{"defaultConfidence":"medium","defaultStatus":"active","direction":"canonical_to_source","mapper":"coworkcanvas-compliance-graph","note":"Each member is a documented relationship claim from the canonical unified control to a source control or guidance proposition. relationship: equal|superset_of (full) / intersects_with|subset_of (partial) / informs (guidance). confidence 'medium' = single-mapper, documented, not yet externally corroborated. source_version is the member framework's edition from the standard version register.","reviewDate":"2026-09-07"},"relationship":"superset_of","source_version":"23 NYCRR 500, Second Amendment"},"sourceDetailPath":"/data/v1/records/uc-uc-gov-14-f4f2c470.json","sourceId":"uc:UC-GOV-14","targetDetailPath":"/data/v1/records/ctrl-nydfs-500-500-3-7a3150f9.json","targetId":"ctrl:nydfs-500:500.3","type":"maps_to"},{"expectedCatalogRevision":"24028ffcfc2b295fa1b08ee6caa84b765f0731b321496bf4f548c49ad2177028","id":"rel:f1d3d16320669ffe597275e167d8f746890a070825f7a548addd8a9f96a41f92","properties":{},"sourceDetailPath":"/data/v1/records/ctrl-nydfs-500-500-5-986f2983.json","sourceId":"ctrl:nydfs-500:500.5","targetDetailPath":"/data/v1/records/std-nydfs-500-97d33d25.json","targetId":"std:nydfs-500","type":"belongs_to"},{"expectedCatalogRevision":"24028ffcfc2b295fa1b08ee6caa84b765f0731b321496bf4f548c49ad2177028","id":"rel:f27b71af0883af22fad6a7a1c58eaca3191da00ff3e083d84cbc6f53e3660a78","properties":{},"sourceDetailPath":"/data/v1/records/ctrl-nydfs-500-500-2-b0b2c5e0.json","sourceId":"ctrl:nydfs-500:500.2","targetDetailPath":"/data/v1/records/std-nydfs-500-97d33d25.json","targetId":"std:nydfs-500","type":"belongs_to"},{"expectedCatalogRevision":"24028ffcfc2b295fa1b08ee6caa84b765f0731b321496bf4f548c49ad2177028","id":"rel:f9b6a2406f111f7caee4749b4b22a882a851734fa990b1f88152bdb25a6d89f7","properties":{},"sourceDetailPath":"/data/v1/records/ctrl-nydfs-500-500-14-d15e0ff2.json","sourceId":"ctrl:nydfs-500:500.14","targetDetailPath":"/data/v1/records/std-nydfs-500-97d33d25.json","targetId":"std:nydfs-500","type":"belongs_to"}],"schemaVersion":1,"scope":"sources","total":128}