{"catalogRevision":"24028ffcfc2b295fa1b08ee6caa84b765f0731b321496bf4f548c49ad2177028","contextIds":["ctrl:aiuc-1:A003","ctrl:aiuc-1:B001","ctrl:aiuc-1:B003","ctrl:aiuc-1:B006","ctrl:aiuc-1:B007","ctrl:aiuc-1:C007","ctrl:aiuc-1:C009","ctrl:aiuc-1:C010","ctrl:aiuc-1:C011","ctrl:aiuc-1:C012","ctrl:aiuc-1:D002","ctrl:aiuc-1:D003","ctrl:aiuc-1:D004","ctrl:cobit-2019:DSS06","ctrl:eu-ai-act:AIA-Art14","ctrl:gdpr:GDPR-Art32","ctrl:hipaa:HIPAA-164.308","ctrl:hipaa:HIPAA-164.310","ctrl:hipaa:HIPAA-164.312(a)","ctrl:hipaa:HIPAA-164.312(b)","ctrl:hipaa:HIPAA-164.312(d)","ctrl:iso-27001:A.5.15","ctrl:iso-27001:A.5.16","ctrl:iso-27001:A.5.17","ctrl:iso-27001:A.5.18","ctrl:iso-27001:A.5.20","ctrl:iso-27001:A.5.7","ctrl:iso-27001:A.5.9","ctrl:iso-27001:A.6.1","ctrl:iso-27001:A.6.3","ctrl:iso-27001:A.6.4","ctrl:iso-27001:A.6.5","ctrl:iso-27001:A.6.7","ctrl:iso-27001:A.7.1","ctrl:iso-27001:A.7.2","ctrl:iso-27001:A.7.3","ctrl:iso-27001:A.7.4","ctrl:iso-27001:A.7.6","ctrl:iso-27001:A.7.8","ctrl:iso-27001:A.8.15"],"directIds":[],"kind":"bundle","metadata":"/assets/agent_metadata.5c7612c9c5b0b455.json","name":"Access Control & Identity Management","next":"/assets/agent_topics-access-control-identity-management-2.2f061e0b9ae21805.json","page":1,"pageSize":40,"records":[{"attributes":{"category":"technical","framework":"aiuc-1","type":"preventive"},"canonicalUrl":"https://controlsmap.com/frameworks/aiuc-1/","description":"Limit AI agent data access","details":{"automation":"automated","control_category":"technical","control_id":"A003","control_type":"preventive","domains":["AI Governance","Data Protection & Privacy"],"framework":"aiuc-1","group":"Data & Privacy","key_control":false,"requirement_frequency":"Every 12 months","requirement_status":"mandatory","risk_count":7,"source_pages":null,"source_url":"https://www.aiuc-1.com/data-and-privacy/implement-contextual-data-safeguards"},"direct":false,"htmlUrl":"/agents/records/ctrl-aiuc-1-a003-bea61fd9.html","id":"ctrl:aiuc-1:A003","mapUrl":"https://controlsmap.com/?v=1&node=ctrl%3Aaiuc-1%3AA003","sourceIds":["aiuc-1"],"sourceUrl":"https://www.aiuc-1.com/data-and-privacy/implement-contextual-data-safeguards","title":"A003 — Limit AI agent data access","type":"control","url":"/assets/agent_record-ctrl-aiuc-1-a003-bea61fd9.af585433fb30a112.json"},{"attributes":{"category":"administrative","framework":"aiuc-1","type":"preventive"},"canonicalUrl":"https://controlsmap.com/frameworks/aiuc-1/","description":"Third-party testing of adversarial robustness","details":{"automation":"manual","control_category":"administrative","control_id":"B001","control_type":"preventive","domains":["AI Governance","Access Control & Identity Management","Secure Development (SDLC) & Application Security"],"framework":"aiuc-1","group":"Security","key_control":true,"requirement_frequency":"Every 3 months","requirement_status":"mandatory","risk_count":5,"source_pages":null,"source_url":"https://www.aiuc-1.com/security/test-adversarial-robustness"},"direct":false,"htmlUrl":"/agents/records/ctrl-aiuc-1-b001-19a54ee3.html","id":"ctrl:aiuc-1:B001","mapUrl":"https://controlsmap.com/?v=1&node=ctrl%3Aaiuc-1%3AB001","sourceIds":["aiuc-1"],"sourceUrl":"https://www.aiuc-1.com/security/test-adversarial-robustness","title":"B001 — Third-party testing of adversarial robustness","type":"control","url":"/assets/agent_record-ctrl-aiuc-1-b001-19a54ee3.f6951418c6c04285.json"},{"attributes":{"category":"administrative","framework":"aiuc-1","type":"preventive"},"canonicalUrl":"https://controlsmap.com/frameworks/aiuc-1/","description":"Manage public release of technical details","details":{"automation":"manual","control_category":"administrative","control_id":"B003","control_type":"preventive","domains":["AI Governance","Access Control & Identity Management","Secure Development (SDLC) & Application Security"],"framework":"aiuc-1","group":"Security","key_control":false,"requirement_frequency":"Every 12 months","requirement_status":"optional","risk_count":3,"source_pages":null,"source_url":"https://www.aiuc-1.com/security/limit-technical-over-disclosure"},"direct":false,"htmlUrl":"/agents/records/ctrl-aiuc-1-b003-8c740cc9.html","id":"ctrl:aiuc-1:B003","mapUrl":"https://controlsmap.com/?v=1&node=ctrl%3Aaiuc-1%3AB003","sourceIds":["aiuc-1"],"sourceUrl":"https://www.aiuc-1.com/security/limit-technical-over-disclosure","title":"B003 — Manage public release of technical details","type":"control","url":"/assets/agent_record-ctrl-aiuc-1-b003-8c740cc9.32efe3be039c433b.json"},{"attributes":{"category":"technical","framework":"aiuc-1","type":"preventive"},"canonicalUrl":"https://controlsmap.com/frameworks/aiuc-1/","description":"Prevent unauthorized AI agent actions","details":{"automation":"automated","control_category":"technical","control_id":"B006","control_type":"preventive","domains":["AI Governance","Access Control & Identity Management","Secure Development (SDLC) & Application Security"],"framework":"aiuc-1","group":"Security","key_control":false,"requirement_frequency":"Every 12 months","requirement_status":"mandatory","risk_count":4,"source_pages":null,"source_url":"https://www.aiuc-1.com/security/enforce-contextual-access-controls"},"direct":false,"htmlUrl":"/agents/records/ctrl-aiuc-1-b006-2951b397.html","id":"ctrl:aiuc-1:B006","mapUrl":"https://controlsmap.com/?v=1&node=ctrl%3Aaiuc-1%3AB006","sourceIds":["aiuc-1"],"sourceUrl":"https://www.aiuc-1.com/security/enforce-contextual-access-controls","title":"B006 — Prevent unauthorized AI agent actions","type":"control","url":"/assets/agent_record-ctrl-aiuc-1-b006-2951b397.7297d90ecea628f6.json"},{"attributes":{"category":"technical","framework":"aiuc-1","type":"preventive"},"canonicalUrl":"https://controlsmap.com/frameworks/aiuc-1/","description":"Enforce user access privileges to AI systems","details":{"automation":"hybrid","control_category":"technical","control_id":"B007","control_type":"preventive","domains":["AI Governance","Access Control & Identity Management","Secure Development (SDLC) & Application Security"],"framework":"aiuc-1","group":"Security","key_control":true,"requirement_frequency":"Every 3 months","requirement_status":"mandatory","risk_count":4,"source_pages":null,"source_url":"https://www.aiuc-1.com/security/enforce-ai-access-privileges"},"direct":false,"htmlUrl":"/agents/records/ctrl-aiuc-1-b007-151dfcd3.html","id":"ctrl:aiuc-1:B007","mapUrl":"https://controlsmap.com/?v=1&node=ctrl%3Aaiuc-1%3AB007","sourceIds":["aiuc-1"],"sourceUrl":"https://www.aiuc-1.com/security/enforce-ai-access-privileges","title":"B007 — Enforce user access privileges to AI systems","type":"control","url":"/assets/agent_record-ctrl-aiuc-1-b007-151dfcd3.a8fe995563ac9d9f.json"},{"attributes":{"category":"technical","framework":"aiuc-1","type":"preventive"},"canonicalUrl":"https://controlsmap.com/frameworks/aiuc-1/","description":"Flag high risk outputs for human review","details":{"automation":"hybrid","control_category":"technical","control_id":"C007","control_type":"preventive","domains":["AI Governance"],"framework":"aiuc-1","group":"Safety","key_control":false,"requirement_frequency":"Every 12 months","requirement_status":"optional","risk_count":6,"source_pages":null,"source_url":"https://www.aiuc-1.com/safety/flag-high-risk-recommendations"},"direct":false,"htmlUrl":"/agents/records/ctrl-aiuc-1-c007-ebb82753.html","id":"ctrl:aiuc-1:C007","mapUrl":"https://controlsmap.com/?v=1&node=ctrl%3Aaiuc-1%3AC007","sourceIds":["aiuc-1"],"sourceUrl":"https://www.aiuc-1.com/safety/flag-high-risk-recommendations","title":"C007 — Flag high risk outputs for human review","type":"control","url":"/assets/agent_record-ctrl-aiuc-1-c007-ebb82753.1f08c7eaa4a4c4d2.json"},{"attributes":{"category":"technical","framework":"aiuc-1","type":"preventive"},"canonicalUrl":"https://controlsmap.com/frameworks/aiuc-1/","description":"Enable real-time feedback and intervention","details":{"automation":"hybrid","control_category":"technical","control_id":"C009","control_type":"preventive","domains":["AI Governance"],"framework":"aiuc-1","group":"Safety","key_control":false,"requirement_frequency":"Every 3 months","requirement_status":"optional","risk_count":6,"source_pages":null,"source_url":"https://www.aiuc-1.com/safety/collect-real-time-feedback"},"direct":false,"htmlUrl":"/agents/records/ctrl-aiuc-1-c009-d98e532e.html","id":"ctrl:aiuc-1:C009","mapUrl":"https://controlsmap.com/?v=1&node=ctrl%3Aaiuc-1%3AC009","sourceIds":["aiuc-1"],"sourceUrl":"https://www.aiuc-1.com/safety/collect-real-time-feedback","title":"C009 — Enable real-time feedback and intervention","type":"control","url":"/assets/agent_record-ctrl-aiuc-1-c009-d98e532e.55b27517a45129c1.json"},{"attributes":{"category":"administrative","framework":"aiuc-1","type":"preventive"},"canonicalUrl":"https://controlsmap.com/frameworks/aiuc-1/","description":"Third-party testing for harmful outputs","details":{"automation":"manual","control_category":"administrative","control_id":"C010","control_type":"preventive","domains":["AI Governance"],"framework":"aiuc-1","group":"Safety","key_control":true,"requirement_frequency":"Every 3 months","requirement_status":"mandatory","risk_count":5,"source_pages":null,"source_url":"https://www.aiuc-1.com/safety/3rd-party-testing-for-harmful-outputs"},"direct":false,"htmlUrl":"/agents/records/ctrl-aiuc-1-c010-b0a758b4.html","id":"ctrl:aiuc-1:C010","mapUrl":"https://controlsmap.com/?v=1&node=ctrl%3Aaiuc-1%3AC010","sourceIds":["aiuc-1"],"sourceUrl":"https://www.aiuc-1.com/safety/3rd-party-testing-for-harmful-outputs","title":"C010 — Third-party testing for harmful outputs","type":"control","url":"/assets/agent_record-ctrl-aiuc-1-c010-b0a758b4.1c43b9be128d3524.json"},{"attributes":{"category":"administrative","framework":"aiuc-1","type":"preventive"},"canonicalUrl":"https://controlsmap.com/frameworks/aiuc-1/","description":"Third-party testing for out-of-scope outputs","details":{"automation":"manual","control_category":"administrative","control_id":"C011","control_type":"preventive","domains":["AI Governance"],"framework":"aiuc-1","group":"Safety","key_control":true,"requirement_frequency":"Every 3 months","requirement_status":"mandatory","risk_count":5,"source_pages":null,"source_url":"https://www.aiuc-1.com/safety/3rd-party-testing-for-out-of-scope-outputs"},"direct":false,"htmlUrl":"/agents/records/ctrl-aiuc-1-c011-7889db41.html","id":"ctrl:aiuc-1:C011","mapUrl":"https://controlsmap.com/?v=1&node=ctrl%3Aaiuc-1%3AC011","sourceIds":["aiuc-1"],"sourceUrl":"https://www.aiuc-1.com/safety/3rd-party-testing-for-out-of-scope-outputs","title":"C011 — Third-party testing for out-of-scope outputs","type":"control","url":"/assets/agent_record-ctrl-aiuc-1-c011-7889db41.be400fb756f735e6.json"},{"attributes":{"category":"administrative","framework":"aiuc-1","type":"preventive"},"canonicalUrl":"https://controlsmap.com/frameworks/aiuc-1/","description":"Third-party testing for customer-defined risk","details":{"automation":"manual","control_category":"administrative","control_id":"C012","control_type":"preventive","domains":["AI Governance"],"framework":"aiuc-1","group":"Safety","key_control":true,"requirement_frequency":"Every 3 months","requirement_status":"mandatory","risk_count":5,"source_pages":null,"source_url":"https://www.aiuc-1.com/safety/3rd-party-testing-for-other-risk"},"direct":false,"htmlUrl":"/agents/records/ctrl-aiuc-1-c012-783c55df.html","id":"ctrl:aiuc-1:C012","mapUrl":"https://controlsmap.com/?v=1&node=ctrl%3Aaiuc-1%3AC012","sourceIds":["aiuc-1"],"sourceUrl":"https://www.aiuc-1.com/safety/3rd-party-testing-for-other-risk","title":"C012 — Third-party testing for customer-defined risk","type":"control","url":"/assets/agent_record-ctrl-aiuc-1-c012-783c55df.90373a20c285e27f.json"},{"attributes":{"category":"administrative","framework":"aiuc-1","type":"preventive"},"canonicalUrl":"https://controlsmap.com/frameworks/aiuc-1/","description":"Third-party testing for hallucinations","details":{"automation":"manual","control_category":"administrative","control_id":"D002","control_type":"preventive","domains":["AI Governance"],"framework":"aiuc-1","group":"Reliability","key_control":true,"requirement_frequency":"Every 3 months","requirement_status":"mandatory","risk_count":5,"source_pages":null,"source_url":"https://www.aiuc-1.com/reliability/3rd-party-testing-for-hallucinations"},"direct":false,"htmlUrl":"/agents/records/ctrl-aiuc-1-d002-34554b38.html","id":"ctrl:aiuc-1:D002","mapUrl":"https://controlsmap.com/?v=1&node=ctrl%3Aaiuc-1%3AD002","sourceIds":["aiuc-1"],"sourceUrl":"https://www.aiuc-1.com/reliability/3rd-party-testing-for-hallucinations","title":"D002 — Third-party testing for hallucinations","type":"control","url":"/assets/agent_record-ctrl-aiuc-1-d002-34554b38.cd845fda29af2076.json"},{"attributes":{"category":"technical","framework":"aiuc-1","type":"preventive"},"canonicalUrl":"https://controlsmap.com/frameworks/aiuc-1/","description":"Restrict unsafe tool calls","details":{"automation":"automated","control_category":"technical","control_id":"D003","control_type":"preventive","domains":["AI Governance"],"framework":"aiuc-1","group":"Reliability","key_control":false,"requirement_frequency":"Every 12 months","requirement_status":"mandatory","risk_count":4,"source_pages":null,"source_url":"https://www.aiuc-1.com/reliability/restrict-unsafe-tool-calls"},"direct":false,"htmlUrl":"/agents/records/ctrl-aiuc-1-d003-9f8f52f3.html","id":"ctrl:aiuc-1:D003","mapUrl":"https://controlsmap.com/?v=1&node=ctrl%3Aaiuc-1%3AD003","sourceIds":["aiuc-1"],"sourceUrl":"https://www.aiuc-1.com/reliability/restrict-unsafe-tool-calls","title":"D003 — Restrict unsafe tool calls","type":"control","url":"/assets/agent_record-ctrl-aiuc-1-d003-9f8f52f3.26f93da8aadce30a.json"},{"attributes":{"category":"administrative","framework":"aiuc-1","type":"preventive"},"canonicalUrl":"https://controlsmap.com/frameworks/aiuc-1/","description":"Third-party testing of tool calls","details":{"automation":"manual","control_category":"administrative","control_id":"D004","control_type":"preventive","domains":["AI Governance"],"framework":"aiuc-1","group":"Reliability","key_control":true,"requirement_frequency":"Every 3 months","requirement_status":"mandatory","risk_count":5,"source_pages":null,"source_url":"https://www.aiuc-1.com/reliability/3rd-party-testing-of-tool-calls"},"direct":false,"htmlUrl":"/agents/records/ctrl-aiuc-1-d004-21d4eeb4.html","id":"ctrl:aiuc-1:D004","mapUrl":"https://controlsmap.com/?v=1&node=ctrl%3Aaiuc-1%3AD004","sourceIds":["aiuc-1"],"sourceUrl":"https://www.aiuc-1.com/reliability/3rd-party-testing-of-tool-calls","title":"D004 — Third-party testing of tool calls","type":"control","url":"/assets/agent_record-ctrl-aiuc-1-d004-21d4eeb4.7a3954e8387e3f1c.json"},{"attributes":{"category":"administrative","framework":"cobit-2019","type":"preventive"},"canonicalUrl":"https://controlsmap.com/frameworks/cobit-2019/","description":"Managed Business Process Controls","details":{"automation":"hybrid","control_category":"administrative","control_id":"DSS06","control_type":"preventive","domains":["Business Continuity & Disaster Recovery","Incident Management & Response","Logging, Monitoring & Detection","Governance, Policy & Oversight"],"framework":"cobit-2019","group":"Deliver, Service and Support","key_control":false,"requirement_frequency":null,"requirement_status":null,"risk_count":7,"source_pages":null,"source_url":null},"direct":false,"htmlUrl":"/agents/records/ctrl-cobit-2019-dss06-c2b31b0e.html","id":"ctrl:cobit-2019:DSS06","mapUrl":"https://controlsmap.com/?v=1&node=ctrl%3Acobit-2019%3ADSS06","sourceIds":["cobit-2019"],"sourceUrl":null,"title":"DSS06 — Managed Business Process Controls","type":"control","url":"/assets/agent_record-ctrl-cobit-2019-dss06-c2b31b0e.9c635c0a07e1e016.json"},{"attributes":{"category":"administrative","framework":"eu-ai-act","type":"preventive"},"canonicalUrl":"https://controlsmap.com/frameworks/eu-ai-act/","description":"Human oversight (high-risk)","details":{"automation":"manual","control_category":"administrative","control_id":"AIA-Art14","control_type":"preventive","domains":["AI Governance","Risk Assessment & Management","Governance, Policy & Oversight"],"framework":"eu-ai-act","group":"EU AI Act","key_control":false,"requirement_frequency":null,"requirement_status":null,"risk_count":6,"source_pages":null,"source_url":null},"direct":false,"htmlUrl":"/agents/records/ctrl-eu-ai-act-aia-art14-4b7ae8a7.html","id":"ctrl:eu-ai-act:AIA-Art14","mapUrl":"https://controlsmap.com/?v=1&node=ctrl%3Aeu-ai-act%3AAIA-Art14","sourceIds":["eu-ai-act"],"sourceUrl":null,"title":"AIA-Art14 — Human oversight (high-risk)","type":"control","url":"/assets/agent_record-ctrl-eu-ai-act-aia-art14-4b7ae8a7.6e174455a15db2b7.json"},{"attributes":{"category":"technical","framework":"gdpr","type":"preventive"},"canonicalUrl":"https://controlsmap.com/frameworks/gdpr/","description":"Security of processing","details":{"automation":"hybrid","control_category":"technical","control_id":"GDPR-Art32","control_type":"preventive","domains":["Data Protection & Privacy","Governance, Policy & Oversight","Incident Management & Response","Third-Party / Supply-Chain Risk","Risk Assessment & Management"],"framework":"gdpr","group":"EU GDPR","key_control":true,"requirement_frequency":null,"requirement_status":null,"risk_count":4,"source_pages":null,"source_url":null},"direct":false,"htmlUrl":"/agents/records/ctrl-gdpr-gdpr-art32-63aa3290.html","id":"ctrl:gdpr:GDPR-Art32","mapUrl":"https://controlsmap.com/?v=1&node=ctrl%3Agdpr%3AGDPR-Art32","sourceIds":["gdpr"],"sourceUrl":null,"title":"GDPR-Art32 — Security of processing","type":"control","url":"/assets/agent_record-ctrl-gdpr-gdpr-art32-63aa3290.135b09987bf85085.json"},{"attributes":{"category":"administrative","framework":"hipaa","type":"preventive"},"canonicalUrl":"https://controlsmap.com/frameworks/hipaa/","description":"Administrative safeguards (security management, risk analysis, workforce security, training, contingency plan, evaluation, BAAs)","details":{"automation":"manual","control_category":"administrative","control_id":"HIPAA-164.308","control_type":"preventive","domains":["Governance, Policy & Oversight","Risk Assessment & Management","Access Control & Identity Management","Physical & Environmental Security","Logging, Monitoring & Detection","Business Continuity & Disaster Recovery","Third-Party / Supply-Chain Risk","Data Protection & Privacy"],"framework":"hipaa","group":"HIPAA Security Rule","key_control":false,"requirement_frequency":null,"requirement_status":null,"risk_count":2,"source_pages":null,"source_url":null},"direct":false,"htmlUrl":"/agents/records/ctrl-hipaa-hipaa-164-308-d26b6932.html","id":"ctrl:hipaa:HIPAA-164.308","mapUrl":"https://controlsmap.com/?v=1&node=ctrl%3Ahipaa%3AHIPAA-164.308","sourceIds":["hipaa"],"sourceUrl":null,"title":"HIPAA-164.308 — Administrative safeguards (security management, risk analysis, workforce security, training, contingency plan, evaluation, BAAs)","type":"control","url":"/assets/agent_record-ctrl-hipaa-hipaa-164-308-d26b6932.22ddccedcaa2755e.json"},{"attributes":{"category":"physical","framework":"hipaa","type":"preventive"},"canonicalUrl":"https://controlsmap.com/frameworks/hipaa/","description":"Physical safeguards (facility access controls, workstation use/security, device and media controls)","details":{"automation":"hybrid","control_category":"physical","control_id":"HIPAA-164.310","control_type":"preventive","domains":["Governance, Policy & Oversight","Risk Assessment & Management","Access Control & Identity Management","Physical & Environmental Security","Logging, Monitoring & Detection","Business Continuity & Disaster Recovery","Third-Party / Supply-Chain Risk","Data Protection & Privacy"],"framework":"hipaa","group":"HIPAA Security Rule","key_control":false,"requirement_frequency":null,"requirement_status":null,"risk_count":3,"source_pages":null,"source_url":null},"direct":false,"htmlUrl":"/agents/records/ctrl-hipaa-hipaa-164-310-9cf84fad.html","id":"ctrl:hipaa:HIPAA-164.310","mapUrl":"https://controlsmap.com/?v=1&node=ctrl%3Ahipaa%3AHIPAA-164.310","sourceIds":["hipaa"],"sourceUrl":null,"title":"HIPAA-164.310 — Physical safeguards (facility access controls, workstation use/security, device and media controls)","type":"control","url":"/assets/agent_record-ctrl-hipaa-hipaa-164-310-9cf84fad.0d7044dffd909ae9.json"},{"attributes":{"category":"technical","framework":"hipaa","type":"preventive"},"canonicalUrl":"https://controlsmap.com/frameworks/hipaa/","description":"Technical access control for ePHI (unique user ID, emergency access, automatic logoff, encryption/decryption)","details":{"automation":"hybrid","control_category":"technical","control_id":"HIPAA-164.312(a)","control_type":"preventive","domains":["Governance, Policy & Oversight","Risk Assessment & Management","Access Control & Identity Management","Physical & Environmental Security","Logging, Monitoring & Detection","Business Continuity & Disaster Recovery","Third-Party / Supply-Chain Risk","Data Protection & Privacy"],"framework":"hipaa","group":"HIPAA Security Rule","key_control":false,"requirement_frequency":null,"requirement_status":null,"risk_count":4,"source_pages":null,"source_url":null},"direct":false,"htmlUrl":"/agents/records/ctrl-hipaa-hipaa-164-312-a-5c8bb707.html","id":"ctrl:hipaa:HIPAA-164.312(a)","mapUrl":"https://controlsmap.com/?v=1&node=ctrl%3Ahipaa%3AHIPAA-164.312%28a%29","sourceIds":["hipaa"],"sourceUrl":null,"title":"HIPAA-164.312(a) — Technical access control for ePHI (unique user ID, emergency access, automatic logoff, encryption/decryption)","type":"control","url":"/assets/agent_record-ctrl-hipaa-hipaa-164-312-a-5c8bb707.b17a8cd3c637ac4b.json"},{"attributes":{"category":"technical","framework":"hipaa","type":"detective"},"canonicalUrl":"https://controlsmap.com/frameworks/hipaa/","description":"Audit controls recording activity in systems with ePHI","details":{"automation":"automated","control_category":"technical","control_id":"HIPAA-164.312(b)","control_type":"detective","domains":["Governance, Policy & Oversight","Risk Assessment & Management","Access Control & Identity Management","Physical & Environmental Security","Logging, Monitoring & Detection","Business Continuity & Disaster Recovery","Third-Party / Supply-Chain Risk","Data Protection & Privacy"],"framework":"hipaa","group":"HIPAA Security Rule","key_control":false,"requirement_frequency":null,"requirement_status":null,"risk_count":4,"source_pages":null,"source_url":null},"direct":false,"htmlUrl":"/agents/records/ctrl-hipaa-hipaa-164-312-b-7272303c.html","id":"ctrl:hipaa:HIPAA-164.312(b)","mapUrl":"https://controlsmap.com/?v=1&node=ctrl%3Ahipaa%3AHIPAA-164.312%28b%29","sourceIds":["hipaa"],"sourceUrl":null,"title":"HIPAA-164.312(b) — Audit controls recording activity in systems with ePHI","type":"control","url":"/assets/agent_record-ctrl-hipaa-hipaa-164-312-b-7272303c.3f97e7dbfc1288c9.json"},{"attributes":{"category":"technical","framework":"hipaa","type":"preventive"},"canonicalUrl":"https://controlsmap.com/frameworks/hipaa/","description":"Person or entity authentication before ePHI access","details":{"automation":"hybrid","control_category":"technical","control_id":"HIPAA-164.312(d)","control_type":"preventive","domains":["Governance, Policy & Oversight","Risk Assessment & Management","Access Control & Identity Management","Physical & Environmental Security","Logging, Monitoring & Detection","Business Continuity & Disaster Recovery","Third-Party / Supply-Chain Risk","Data Protection & Privacy"],"framework":"hipaa","group":"HIPAA Security Rule","key_control":true,"requirement_frequency":null,"requirement_status":null,"risk_count":4,"source_pages":null,"source_url":null},"direct":false,"htmlUrl":"/agents/records/ctrl-hipaa-hipaa-164-312-d-d1e8fe74.html","id":"ctrl:hipaa:HIPAA-164.312(d)","mapUrl":"https://controlsmap.com/?v=1&node=ctrl%3Ahipaa%3AHIPAA-164.312%28d%29","sourceIds":["hipaa"],"sourceUrl":null,"title":"HIPAA-164.312(d) — Person or entity authentication before ePHI access","type":"control","url":"/assets/agent_record-ctrl-hipaa-hipaa-164-312-d-d1e8fe74.a9123c2005f8e7fd.json"},{"attributes":{"category":"administrative","framework":"iso-27001","type":"preventive"},"canonicalUrl":"https://controlsmap.com/frameworks/iso-27001/","description":"Access control","details":{"automation":"hybrid","control_category":"administrative","control_id":"A.5.15","control_type":"preventive","domains":["Access Control & Identity Management"],"framework":"iso-27001","group":"Organizational controls","key_control":true,"requirement_frequency":null,"requirement_status":null,"risk_count":7,"source_pages":null,"source_url":null},"direct":false,"htmlUrl":"/agents/records/ctrl-iso-27001-a-5-15-b8587804.html","id":"ctrl:iso-27001:A.5.15","mapUrl":"https://controlsmap.com/?v=1&node=ctrl%3Aiso-27001%3AA.5.15","sourceIds":["iso-27001"],"sourceUrl":null,"title":"A.5.15 — Access control","type":"control","url":"/assets/agent_record-ctrl-iso-27001-a-5-15-b8587804.790e4f214625d89e.json"},{"attributes":{"category":"administrative","framework":"iso-27001","type":"preventive"},"canonicalUrl":"https://controlsmap.com/frameworks/iso-27001/","description":"Identity management","details":{"automation":"hybrid","control_category":"administrative","control_id":"A.5.16","control_type":"preventive","domains":["Access Control & Identity Management"],"framework":"iso-27001","group":"Organizational controls","key_control":true,"requirement_frequency":null,"requirement_status":null,"risk_count":3,"source_pages":null,"source_url":null},"direct":false,"htmlUrl":"/agents/records/ctrl-iso-27001-a-5-16-46fc8420.html","id":"ctrl:iso-27001:A.5.16","mapUrl":"https://controlsmap.com/?v=1&node=ctrl%3Aiso-27001%3AA.5.16","sourceIds":["iso-27001"],"sourceUrl":null,"title":"A.5.16 — Identity management","type":"control","url":"/assets/agent_record-ctrl-iso-27001-a-5-16-46fc8420.2675ac3eda4cd50e.json"},{"attributes":{"category":"administrative","framework":"iso-27001","type":"preventive"},"canonicalUrl":"https://controlsmap.com/frameworks/iso-27001/","description":"Authentication information","details":{"automation":"hybrid","control_category":"administrative","control_id":"A.5.17","control_type":"preventive","domains":["Access Control & Identity Management"],"framework":"iso-27001","group":"Organizational controls","key_control":true,"requirement_frequency":null,"requirement_status":null,"risk_count":4,"source_pages":null,"source_url":null},"direct":false,"htmlUrl":"/agents/records/ctrl-iso-27001-a-5-17-b45de021.html","id":"ctrl:iso-27001:A.5.17","mapUrl":"https://controlsmap.com/?v=1&node=ctrl%3Aiso-27001%3AA.5.17","sourceIds":["iso-27001"],"sourceUrl":null,"title":"A.5.17 — Authentication information","type":"control","url":"/assets/agent_record-ctrl-iso-27001-a-5-17-b45de021.883dd52c9a8ad6ee.json"},{"attributes":{"category":"administrative","framework":"iso-27001","type":"preventive"},"canonicalUrl":"https://controlsmap.com/frameworks/iso-27001/","description":"Access rights","details":{"automation":"hybrid","control_category":"administrative","control_id":"A.5.18","control_type":"preventive","domains":["Access Control & Identity Management"],"framework":"iso-27001","group":"Organizational controls","key_control":true,"requirement_frequency":null,"requirement_status":null,"risk_count":4,"source_pages":null,"source_url":null},"direct":false,"htmlUrl":"/agents/records/ctrl-iso-27001-a-5-18-472ef6f1.html","id":"ctrl:iso-27001:A.5.18","mapUrl":"https://controlsmap.com/?v=1&node=ctrl%3Aiso-27001%3AA.5.18","sourceIds":["iso-27001"],"sourceUrl":null,"title":"A.5.18 — Access rights","type":"control","url":"/assets/agent_record-ctrl-iso-27001-a-5-18-472ef6f1.c3aebc6053284559.json"},{"attributes":{"category":"administrative","framework":"iso-27001","type":"preventive"},"canonicalUrl":"https://controlsmap.com/frameworks/iso-27001/","description":"Addressing information security within supplier agreements","details":{"automation":"manual","control_category":"administrative","control_id":"A.5.20","control_type":"preventive","domains":["Human Resources / Personnel Security","Third-Party / Supply-Chain Risk"],"framework":"iso-27001","group":"Organizational controls","key_control":false,"requirement_frequency":null,"requirement_status":null,"risk_count":2,"source_pages":null,"source_url":null},"direct":false,"htmlUrl":"/agents/records/ctrl-iso-27001-a-5-20-fcee3b34.html","id":"ctrl:iso-27001:A.5.20","mapUrl":"https://controlsmap.com/?v=1&node=ctrl%3Aiso-27001%3AA.5.20","sourceIds":["iso-27001"],"sourceUrl":null,"title":"A.5.20 — Addressing information security within supplier agreements","type":"control","url":"/assets/agent_record-ctrl-iso-27001-a-5-20-fcee3b34.076c27118b287da4.json"},{"attributes":{"category":"administrative","framework":"iso-27001","type":"detective"},"canonicalUrl":"https://controlsmap.com/frameworks/iso-27001/","description":"Threat intelligence","details":{"automation":"hybrid","control_category":"administrative","control_id":"A.5.7","control_type":"detective","domains":["Risk Assessment & Management"],"framework":"iso-27001","group":"Organizational controls","key_control":false,"requirement_frequency":null,"requirement_status":null,"risk_count":2,"source_pages":null,"source_url":null},"direct":false,"htmlUrl":"/agents/records/ctrl-iso-27001-a-5-7-0328fe6b.html","id":"ctrl:iso-27001:A.5.7","mapUrl":"https://controlsmap.com/?v=1&node=ctrl%3Aiso-27001%3AA.5.7","sourceIds":["iso-27001"],"sourceUrl":null,"title":"A.5.7 — Threat intelligence","type":"control","url":"/assets/agent_record-ctrl-iso-27001-a-5-7-0328fe6b.e1d8614948702701.json"},{"attributes":{"category":"administrative","framework":"iso-27001","type":"preventive"},"canonicalUrl":"https://controlsmap.com/frameworks/iso-27001/","description":"Inventory of information and other associated assets","details":{"automation":"hybrid","control_category":"administrative","control_id":"A.5.9","control_type":"preventive","domains":["Asset Management & Inventory"],"framework":"iso-27001","group":"Organizational controls","key_control":false,"requirement_frequency":null,"requirement_status":null,"risk_count":5,"source_pages":null,"source_url":null},"direct":false,"htmlUrl":"/agents/records/ctrl-iso-27001-a-5-9-64706ee7.html","id":"ctrl:iso-27001:A.5.9","mapUrl":"https://controlsmap.com/?v=1&node=ctrl%3Aiso-27001%3AA.5.9","sourceIds":["iso-27001"],"sourceUrl":null,"title":"A.5.9 — Inventory of information and other associated assets","type":"control","url":"/assets/agent_record-ctrl-iso-27001-a-5-9-64706ee7.4127a3f45cfb1299.json"},{"attributes":{"category":"administrative","framework":"iso-27001","type":"preventive"},"canonicalUrl":"https://controlsmap.com/frameworks/iso-27001/","description":"Screening","details":{"automation":"manual","control_category":"administrative","control_id":"A.6.1","control_type":"preventive","domains":["Human Resources / Personnel Security"],"framework":"iso-27001","group":"People controls","key_control":false,"requirement_frequency":null,"requirement_status":null,"risk_count":2,"source_pages":null,"source_url":null},"direct":false,"htmlUrl":"/agents/records/ctrl-iso-27001-a-6-1-048c51f3.html","id":"ctrl:iso-27001:A.6.1","mapUrl":"https://controlsmap.com/?v=1&node=ctrl%3Aiso-27001%3AA.6.1","sourceIds":["iso-27001"],"sourceUrl":null,"title":"A.6.1 — Screening","type":"control","url":"/assets/agent_record-ctrl-iso-27001-a-6-1-048c51f3.2ae67f1f08f40a3a.json"},{"attributes":{"category":"administrative","framework":"iso-27001","type":"preventive"},"canonicalUrl":"https://controlsmap.com/frameworks/iso-27001/","description":"Information security awareness, education and training","details":{"automation":"manual","control_category":"administrative","control_id":"A.6.3","control_type":"preventive","domains":["Awareness & Training"],"framework":"iso-27001","group":"People controls","key_control":false,"requirement_frequency":null,"requirement_status":null,"risk_count":5,"source_pages":null,"source_url":null},"direct":false,"htmlUrl":"/agents/records/ctrl-iso-27001-a-6-3-b9bb8fbd.html","id":"ctrl:iso-27001:A.6.3","mapUrl":"https://controlsmap.com/?v=1&node=ctrl%3Aiso-27001%3AA.6.3","sourceIds":["iso-27001"],"sourceUrl":null,"title":"A.6.3 — Information security awareness, education and training","type":"control","url":"/assets/agent_record-ctrl-iso-27001-a-6-3-b9bb8fbd.365b3922b77de0c9.json"},{"attributes":{"category":"administrative","framework":"iso-27001","type":"corrective"},"canonicalUrl":"https://controlsmap.com/frameworks/iso-27001/","description":"Disciplinary process","details":{"automation":"manual","control_category":"administrative","control_id":"A.6.4","control_type":"corrective","domains":["Human Resources / Personnel Security"],"framework":"iso-27001","group":"People controls","key_control":false,"requirement_frequency":null,"requirement_status":null,"risk_count":2,"source_pages":null,"source_url":null},"direct":false,"htmlUrl":"/agents/records/ctrl-iso-27001-a-6-4-33939a57.html","id":"ctrl:iso-27001:A.6.4","mapUrl":"https://controlsmap.com/?v=1&node=ctrl%3Aiso-27001%3AA.6.4","sourceIds":["iso-27001"],"sourceUrl":null,"title":"A.6.4 — Disciplinary process","type":"control","url":"/assets/agent_record-ctrl-iso-27001-a-6-4-33939a57.d70af9036d853554.json"},{"attributes":{"category":"administrative","framework":"iso-27001","type":"preventive"},"canonicalUrl":"https://controlsmap.com/frameworks/iso-27001/","description":"Responsibilities after termination or change of employment","details":{"automation":"manual","control_category":"administrative","control_id":"A.6.5","control_type":"preventive","domains":["Human Resources / Personnel Security"],"framework":"iso-27001","group":"People controls","key_control":false,"requirement_frequency":null,"requirement_status":null,"risk_count":1,"source_pages":null,"source_url":null},"direct":false,"htmlUrl":"/agents/records/ctrl-iso-27001-a-6-5-0eefa5a7.html","id":"ctrl:iso-27001:A.6.5","mapUrl":"https://controlsmap.com/?v=1&node=ctrl%3Aiso-27001%3AA.6.5","sourceIds":["iso-27001"],"sourceUrl":null,"title":"A.6.5 — Responsibilities after termination or change of employment","type":"control","url":"/assets/agent_record-ctrl-iso-27001-a-6-5-0eefa5a7.1253d8b6f09e516a.json"},{"attributes":{"category":"administrative","framework":"iso-27001","type":"preventive"},"canonicalUrl":"https://controlsmap.com/frameworks/iso-27001/","description":"Remote working","details":{"automation":"manual","control_category":"administrative","control_id":"A.6.7","control_type":"preventive","domains":["Human Resources / Personnel Security","Awareness & Training","Incident Management & Response"],"framework":"iso-27001","group":"People controls","key_control":false,"requirement_frequency":null,"requirement_status":null,"risk_count":2,"source_pages":null,"source_url":null},"direct":false,"htmlUrl":"/agents/records/ctrl-iso-27001-a-6-7-74bc3cd8.html","id":"ctrl:iso-27001:A.6.7","mapUrl":"https://controlsmap.com/?v=1&node=ctrl%3Aiso-27001%3AA.6.7","sourceIds":["iso-27001"],"sourceUrl":null,"title":"A.6.7 — Remote working","type":"control","url":"/assets/agent_record-ctrl-iso-27001-a-6-7-74bc3cd8.6d526aa59cf9e4d5.json"},{"attributes":{"category":"physical","framework":"iso-27001","type":"preventive"},"canonicalUrl":"https://controlsmap.com/frameworks/iso-27001/","description":"Physical security perimeters","details":{"automation":"manual","control_category":"physical","control_id":"A.7.1","control_type":"preventive","domains":["Physical & Environmental Security"],"framework":"iso-27001","group":"Physical controls","key_control":false,"requirement_frequency":null,"requirement_status":null,"risk_count":3,"source_pages":null,"source_url":null},"direct":false,"htmlUrl":"/agents/records/ctrl-iso-27001-a-7-1-a327b00e.html","id":"ctrl:iso-27001:A.7.1","mapUrl":"https://controlsmap.com/?v=1&node=ctrl%3Aiso-27001%3AA.7.1","sourceIds":["iso-27001"],"sourceUrl":null,"title":"A.7.1 — Physical security perimeters","type":"control","url":"/assets/agent_record-ctrl-iso-27001-a-7-1-a327b00e.7551706bb69779cc.json"},{"attributes":{"category":"physical","framework":"iso-27001","type":"preventive"},"canonicalUrl":"https://controlsmap.com/frameworks/iso-27001/","description":"Physical entry","details":{"automation":"hybrid","control_category":"physical","control_id":"A.7.2","control_type":"preventive","domains":["Physical & Environmental Security"],"framework":"iso-27001","group":"Physical controls","key_control":true,"requirement_frequency":null,"requirement_status":null,"risk_count":3,"source_pages":null,"source_url":null},"direct":false,"htmlUrl":"/agents/records/ctrl-iso-27001-a-7-2-7f774ee6.html","id":"ctrl:iso-27001:A.7.2","mapUrl":"https://controlsmap.com/?v=1&node=ctrl%3Aiso-27001%3AA.7.2","sourceIds":["iso-27001"],"sourceUrl":null,"title":"A.7.2 — Physical entry","type":"control","url":"/assets/agent_record-ctrl-iso-27001-a-7-2-7f774ee6.ea167e51a16a3695.json"},{"attributes":{"category":"physical","framework":"iso-27001","type":"preventive"},"canonicalUrl":"https://controlsmap.com/frameworks/iso-27001/","description":"Securing offices, rooms and facilities","details":{"automation":"manual","control_category":"physical","control_id":"A.7.3","control_type":"preventive","domains":["Physical & Environmental Security"],"framework":"iso-27001","group":"Physical controls","key_control":false,"requirement_frequency":null,"requirement_status":null,"risk_count":3,"source_pages":null,"source_url":null},"direct":false,"htmlUrl":"/agents/records/ctrl-iso-27001-a-7-3-1b2f4ae0.html","id":"ctrl:iso-27001:A.7.3","mapUrl":"https://controlsmap.com/?v=1&node=ctrl%3Aiso-27001%3AA.7.3","sourceIds":["iso-27001"],"sourceUrl":null,"title":"A.7.3 — Securing offices, rooms and facilities","type":"control","url":"/assets/agent_record-ctrl-iso-27001-a-7-3-1b2f4ae0.d6e9be0fa6209938.json"},{"attributes":{"category":"physical","framework":"iso-27001","type":"detective"},"canonicalUrl":"https://controlsmap.com/frameworks/iso-27001/","description":"Physical security monitoring","details":{"automation":"hybrid","control_category":"physical","control_id":"A.7.4","control_type":"detective","domains":["Physical & Environmental Security"],"framework":"iso-27001","group":"Physical controls","key_control":false,"requirement_frequency":null,"requirement_status":null,"risk_count":3,"source_pages":null,"source_url":null},"direct":false,"htmlUrl":"/agents/records/ctrl-iso-27001-a-7-4-9f51f324.html","id":"ctrl:iso-27001:A.7.4","mapUrl":"https://controlsmap.com/?v=1&node=ctrl%3Aiso-27001%3AA.7.4","sourceIds":["iso-27001"],"sourceUrl":null,"title":"A.7.4 — Physical security monitoring","type":"control","url":"/assets/agent_record-ctrl-iso-27001-a-7-4-9f51f324.e9114519c20d6a8f.json"},{"attributes":{"category":"physical","framework":"iso-27001","type":"preventive"},"canonicalUrl":"https://controlsmap.com/frameworks/iso-27001/","description":"Working in secure areas","details":{"automation":"manual","control_category":"physical","control_id":"A.7.6","control_type":"preventive","domains":["Physical & Environmental Security"],"framework":"iso-27001","group":"Physical controls","key_control":false,"requirement_frequency":null,"requirement_status":null,"risk_count":3,"source_pages":null,"source_url":null},"direct":false,"htmlUrl":"/agents/records/ctrl-iso-27001-a-7-6-3e5f12bc.html","id":"ctrl:iso-27001:A.7.6","mapUrl":"https://controlsmap.com/?v=1&node=ctrl%3Aiso-27001%3AA.7.6","sourceIds":["iso-27001"],"sourceUrl":null,"title":"A.7.6 — Working in secure areas","type":"control","url":"/assets/agent_record-ctrl-iso-27001-a-7-6-3e5f12bc.a785d5c03eb9e0a8.json"},{"attributes":{"category":"physical","framework":"iso-27001","type":"preventive"},"canonicalUrl":"https://controlsmap.com/frameworks/iso-27001/","description":"Equipment siting and protection","details":{"automation":"manual","control_category":"physical","control_id":"A.7.8","control_type":"preventive","domains":["Physical & Environmental Security"],"framework":"iso-27001","group":"Physical controls","key_control":false,"requirement_frequency":null,"requirement_status":null,"risk_count":5,"source_pages":null,"source_url":null},"direct":false,"htmlUrl":"/agents/records/ctrl-iso-27001-a-7-8-9ee41158.html","id":"ctrl:iso-27001:A.7.8","mapUrl":"https://controlsmap.com/?v=1&node=ctrl%3Aiso-27001%3AA.7.8","sourceIds":["iso-27001"],"sourceUrl":null,"title":"A.7.8 — Equipment siting and protection","type":"control","url":"/assets/agent_record-ctrl-iso-27001-a-7-8-9ee41158.828417426ad3b5d3.json"},{"attributes":{"category":"technical","framework":"iso-27001","type":"detective"},"canonicalUrl":"https://controlsmap.com/frameworks/iso-27001/","description":"Logging","details":{"automation":"automated","control_category":"technical","control_id":"A.8.15","control_type":"detective","domains":["Logging, Monitoring & Detection"],"framework":"iso-27001","group":"Technological controls","key_control":true,"requirement_frequency":null,"requirement_status":null,"risk_count":4,"source_pages":null,"source_url":null},"direct":false,"htmlUrl":"/agents/records/ctrl-iso-27001-a-8-15-ab7dd8ce.html","id":"ctrl:iso-27001:A.8.15","mapUrl":"https://controlsmap.com/?v=1&node=ctrl%3Aiso-27001%3AA.8.15","sourceIds":["iso-27001"],"sourceUrl":null,"title":"A.8.15 — Logging","type":"control","url":"/assets/agent_record-ctrl-iso-27001-a-8-15-ab7dd8ce.4b3bc4e10652c17d.json"}],"relationships":[{"expectedCatalogRevision":"24028ffcfc2b295fa1b08ee6caa84b765f0731b321496bf4f548c49ad2177028","id":"rel:0143972f536ed73420cfad9018dabcad73590f295f5a8a7d609d0277e9c474bf","properties":{"control_id":"B007","coverage":"partial","delta":"quarterly review of user access privileges to AI systems, including administrative, configuration, and training-data access","framework":"aiuc-1","provenance":{"defaultConfidence":"medium","defaultStatus":"active","direction":"canonical_to_source","mapper":"coworkcanvas-compliance-graph","note":"Each member is a documented relationship claim from the canonical unified control to a source control or guidance proposition. relationship: equal|superset_of (full) / intersects_with|subset_of (partial) / informs (guidance). confidence 'medium' = single-mapper, documented, not yet externally corroborated. source_version is the member framework's edition from the standard version register.","reviewDate":"2026-09-07"},"relationship":"intersects_with","source_version":"July 15, 2026 release (quarterly update cadence)"},"sourceDetailPath":"/data/v1/records/uc-uc-access-05-9b7f3e34.json","sourceId":"uc:UC-ACCESS-05","targetDetailPath":"/data/v1/records/ctrl-aiuc-1-b007-151dfcd3.json","targetId":"ctrl:aiuc-1:B007","type":"maps_to"},{"expectedCatalogRevision":"24028ffcfc2b295fa1b08ee6caa84b765f0731b321496bf4f548c49ad2177028","id":"rel:046ade0a8ee9f1acbd8a40a19f3a1fa742483ed0f2c87bfe975bf838d4a6e641","properties":{},"sourceDetailPath":"/data/v1/records/ctrl-hipaa-hipaa-164-312-d-d1e8fe74.json","sourceId":"ctrl:hipaa:HIPAA-164.312(d)","targetDetailPath":"/data/v1/records/std-hipaa-a825d271.json","targetId":"std:hipaa","type":"belongs_to"},{"expectedCatalogRevision":"24028ffcfc2b295fa1b08ee6caa84b765f0731b321496bf4f548c49ad2177028","id":"rel:066a3a0e5eb15d5845581b56b0e1609668817c04ae2412887b1e532a9815acfd","properties":{},"sourceDetailPath":"/data/v1/records/ctrl-iso-27001-a-7-1-a327b00e.json","sourceId":"ctrl:iso-27001:A.7.1","targetDetailPath":"/data/v1/records/std-iso-27001-656201bd.json","targetId":"std:iso-27001","type":"belongs_to"},{"expectedCatalogRevision":"24028ffcfc2b295fa1b08ee6caa84b765f0731b321496bf4f548c49ad2177028","id":"rel:0d4c62ecaae2f7303c04611942d2d3c0be48b1dbbbdc87b1c12837d9d00505c0","properties":{"control_id":"A.5.16","coverage":"full","delta":null,"framework":"iso-27001","provenance":{"defaultConfidence":"medium","defaultStatus":"active","direction":"canonical_to_source","mapper":"coworkcanvas-compliance-graph","note":"Each member is a documented relationship claim from the canonical unified control to a source control or guidance proposition. relationship: equal|superset_of (full) / intersects_with|subset_of (partial) / informs (guidance). confidence 'medium' = single-mapper, documented, not yet externally corroborated. source_version is the member framework's edition from the standard version register.","reviewDate":"2026-09-07"},"relationship":"superset_of","source_version":"2022"},"sourceDetailPath":"/data/v1/records/uc-uc-access-06-623f356c.json","sourceId":"uc:UC-ACCESS-06","targetDetailPath":"/data/v1/records/ctrl-iso-27001-a-5-16-46fc8420.json","targetId":"ctrl:iso-27001:A.5.16","type":"maps_to"},{"expectedCatalogRevision":"24028ffcfc2b295fa1b08ee6caa84b765f0731b321496bf4f548c49ad2177028","id":"rel:125837fa57ffac78b2e9e962c9d8e11ca5fc8d0bffd212767c6b8ede1c62b007","properties":{},"sourceDetailPath":"/data/v1/records/ctrl-iso-27001-a-5-18-472ef6f1.json","sourceId":"ctrl:iso-27001:A.5.18","targetDetailPath":"/data/v1/records/std-iso-27001-656201bd.json","targetId":"std:iso-27001","type":"belongs_to"},{"expectedCatalogRevision":"24028ffcfc2b295fa1b08ee6caa84b765f0731b321496bf4f548c49ad2177028","id":"rel:154d032b8c8a51251df0659b39df888301f7cb7aae1f872ad0aa66f4279be75b","properties":{},"sourceDetailPath":"/data/v1/records/ctrl-hipaa-hipaa-164-310-9cf84fad.json","sourceId":"ctrl:hipaa:HIPAA-164.310","targetDetailPath":"/data/v1/records/std-hipaa-a825d271.json","targetId":"std:hipaa","type":"belongs_to"},{"expectedCatalogRevision":"24028ffcfc2b295fa1b08ee6caa84b765f0731b321496bf4f548c49ad2177028","id":"rel:15a88c013f269a3472c9e13dcac70293ef79deacab09c42d2a942ceb7e66cf78","properties":{},"sourceDetailPath":"/data/v1/records/ctrl-aiuc-1-d003-9f8f52f3.json","sourceId":"ctrl:aiuc-1:D003","targetDetailPath":"/data/v1/records/std-aiuc-1-d2a8b650.json","targetId":"std:aiuc-1","type":"belongs_to"},{"expectedCatalogRevision":"24028ffcfc2b295fa1b08ee6caa84b765f0731b321496bf4f548c49ad2177028","id":"rel:169d6622df6fde59aa992aa7416fb7c99cae450e0c56b5f5b5e87dc64e061da5","properties":{"control_id":"A.7.6","coverage":"full","delta":null,"framework":"iso-27001","provenance":{"defaultConfidence":"medium","defaultStatus":"active","direction":"canonical_to_source","mapper":"coworkcanvas-compliance-graph","note":"Each member is a documented relationship claim from the canonical unified control to a source control or guidance proposition. relationship: equal|superset_of (full) / intersects_with|subset_of (partial) / informs (guidance). confidence 'medium' = single-mapper, documented, not yet externally corroborated. source_version is the member framework's edition from the standard version register.","reviewDate":"2026-09-07"},"relationship":"superset_of","source_version":"2022"},"sourceDetailPath":"/data/v1/records/uc-uc-phys-01-354431a7.json","sourceId":"uc:UC-PHYS-01","targetDetailPath":"/data/v1/records/ctrl-iso-27001-a-7-6-3e5f12bc.json","targetId":"ctrl:iso-27001:A.7.6","type":"maps_to"},{"expectedCatalogRevision":"24028ffcfc2b295fa1b08ee6caa84b765f0731b321496bf4f548c49ad2177028","id":"rel:196ceefc0745c6ddc8a3f0db75c1ea4386ea6dd54352a7744060fe898f7b82cc","properties":{"control_id":"GDPR-Art32","coverage":"partial","delta":"also requires encryption, resilience, and effectiveness testing addressed in other domains","framework":"gdpr","provenance":{"defaultConfidence":"medium","defaultStatus":"active","direction":"canonical_to_source","mapper":"coworkcanvas-compliance-graph","note":"Each member is a documented relationship claim from the canonical unified control to a source control or guidance proposition. relationship: equal|superset_of (full) / intersects_with|subset_of (partial) / informs (guidance). confidence 'medium' = single-mapper, documented, not yet externally corroborated. source_version is the member framework's edition from the standard version register.","reviewDate":"2026-09-07"},"relationship":"intersects_with","source_version":"Regulation (EU) 2016/679"},"sourceDetailPath":"/data/v1/records/uc-uc-access-05-9b7f3e34.json","sourceId":"uc:UC-ACCESS-05","targetDetailPath":"/data/v1/records/ctrl-gdpr-gdpr-art32-63aa3290.json","targetId":"ctrl:gdpr:GDPR-Art32","type":"maps_to"},{"expectedCatalogRevision":"24028ffcfc2b295fa1b08ee6caa84b765f0731b321496bf4f548c49ad2177028","id":"rel:199e523235255b49f7b7f37170eadd985d243e5d71a80080efd22243a1989120","properties":{},"sourceDetailPath":"/data/v1/records/ctrl-gdpr-gdpr-art32-63aa3290.json","sourceId":"ctrl:gdpr:GDPR-Art32","targetDetailPath":"/data/v1/records/std-gdpr-17d65d0b.json","targetId":"std:gdpr","type":"belongs_to"},{"expectedCatalogRevision":"24028ffcfc2b295fa1b08ee6caa84b765f0731b321496bf4f548c49ad2177028","id":"rel:1df7d03ef432f33e2aa5d7ac1451629578a6aa10389545ab9db5a521f3bbf50a","properties":{"control_id":"C010","coverage":"full","delta":null,"framework":"aiuc-1","provenance":{"defaultConfidence":"medium","defaultStatus":"active","direction":"canonical_to_source","mapper":"coworkcanvas-compliance-graph","note":"Each member is a documented relationship claim from the canonical unified control to a source control or guidance proposition. relationship: equal|superset_of (full) / intersects_with|subset_of (partial) / informs (guidance). confidence 'medium' = single-mapper, documented, not yet externally corroborated. source_version is the member framework's edition from the standard version register.","reviewDate":"2026-09-07"},"relationship":"superset_of","source_version":"July 15, 2026 release (quarterly update cadence)"},"sourceDetailPath":"/data/v1/records/uc-uc-ai-21-8afd47db.json","sourceId":"uc:UC-AI-21","targetDetailPath":"/data/v1/records/ctrl-aiuc-1-c010-b0a758b4.json","targetId":"ctrl:aiuc-1:C010","type":"maps_to"},{"expectedCatalogRevision":"24028ffcfc2b295fa1b08ee6caa84b765f0731b321496bf4f548c49ad2177028","id":"rel:1f351b41c6da0c2df1781cfe55b9bd525fa4f987dd6f2432800908487b9d0e8e","properties":{"control_id":"A.7.1","coverage":"full","delta":null,"framework":"iso-27001","provenance":{"defaultConfidence":"medium","defaultStatus":"active","direction":"canonical_to_source","mapper":"coworkcanvas-compliance-graph","note":"Each member is a documented relationship claim from the canonical unified control to a source control or guidance proposition. relationship: equal|superset_of (full) / intersects_with|subset_of (partial) / informs (guidance). confidence 'medium' = single-mapper, documented, not yet externally corroborated. source_version is the member framework's edition from the standard version register.","reviewDate":"2026-09-07"},"relationship":"superset_of","source_version":"2022"},"sourceDetailPath":"/data/v1/records/uc-uc-phys-01-354431a7.json","sourceId":"uc:UC-PHYS-01","targetDetailPath":"/data/v1/records/ctrl-iso-27001-a-7-1-a327b00e.json","targetId":"ctrl:iso-27001:A.7.1","type":"maps_to"},{"expectedCatalogRevision":"24028ffcfc2b295fa1b08ee6caa84b765f0731b321496bf4f548c49ad2177028","id":"rel:2525c39295ea228ebb567a859879ac822a2efc6cfd453409cbb70d179fbbcfac","properties":{},"sourceDetailPath":"/data/v1/records/ctrl-iso-27001-a-7-3-1b2f4ae0.json","sourceId":"ctrl:iso-27001:A.7.3","targetDetailPath":"/data/v1/records/std-iso-27001-656201bd.json","targetId":"std:iso-27001","type":"belongs_to"},{"expectedCatalogRevision":"24028ffcfc2b295fa1b08ee6caa84b765f0731b321496bf4f548c49ad2177028","id":"rel:266423c540b8cc25e7664b89f4572ecc87cefad6a3aeb5657d0d452a9f76edb2","properties":{},"sourceDetailPath":"/data/v1/records/ctrl-aiuc-1-c009-d98e532e.json","sourceId":"ctrl:aiuc-1:C009","targetDetailPath":"/data/v1/records/std-aiuc-1-d2a8b650.json","targetId":"std:aiuc-1","type":"belongs_to"},{"expectedCatalogRevision":"24028ffcfc2b295fa1b08ee6caa84b765f0731b321496bf4f548c49ad2177028","id":"rel:27dd5e945af28141d844fab51e3199d7c1f67cead03cf2660e5481fa101c8ec7","properties":{},"sourceDetailPath":"/data/v1/records/ctrl-iso-27001-a-5-9-64706ee7.json","sourceId":"ctrl:iso-27001:A.5.9","targetDetailPath":"/data/v1/records/std-iso-27001-656201bd.json","targetId":"std:iso-27001","type":"belongs_to"},{"expectedCatalogRevision":"24028ffcfc2b295fa1b08ee6caa84b765f0731b321496bf4f548c49ad2177028","id":"rel:299a71aeeee59776f5b1a4c8f9fcfda488340adee65b5850e013858a95e1eada","properties":{"control_id":"A.6.7","coverage":"full","delta":null,"framework":"iso-27001","provenance":{"defaultConfidence":"medium","defaultStatus":"active","direction":"canonical_to_source","mapper":"coworkcanvas-compliance-graph","note":"Each member is a documented relationship claim from the canonical unified control to a source control or guidance proposition. relationship: equal|superset_of (full) / intersects_with|subset_of (partial) / informs (guidance). confidence 'medium' = single-mapper, documented, not yet externally corroborated. source_version is the member framework's edition from the standard version register.","reviewDate":"2026-09-07"},"relationship":"equal","source_version":"2022"},"sourceDetailPath":"/data/v1/records/uc-uc-hr-07-7b9726ca.json","sourceId":"uc:UC-HR-07","targetDetailPath":"/data/v1/records/ctrl-iso-27001-a-6-7-74bc3cd8.json","targetId":"ctrl:iso-27001:A.6.7","type":"maps_to"},{"expectedCatalogRevision":"24028ffcfc2b295fa1b08ee6caa84b765f0731b321496bf4f548c49ad2177028","id":"rel:2f313f616bc55cce7ba558e4371bea44fc259e5d0cdec292b9752ca5cff6f867","properties":{},"sourceDetailPath":"/data/v1/records/ctrl-hipaa-hipaa-164-308-d26b6932.json","sourceId":"ctrl:hipaa:HIPAA-164.308","targetDetailPath":"/data/v1/records/std-hipaa-a825d271.json","targetId":"std:hipaa","type":"belongs_to"},{"expectedCatalogRevision":"24028ffcfc2b295fa1b08ee6caa84b765f0731b321496bf4f548c49ad2177028","id":"rel:32bf6421f2b8d665a50dabd9afe913d3db465ae6fd73f6978e767f8a3e387d37","properties":{},"sourceDetailPath":"/data/v1/records/ctrl-hipaa-hipaa-164-312-a-5c8bb707.json","sourceId":"ctrl:hipaa:HIPAA-164.312(a)","targetDetailPath":"/data/v1/records/std-hipaa-a825d271.json","targetId":"std:hipaa","type":"belongs_to"},{"expectedCatalogRevision":"24028ffcfc2b295fa1b08ee6caa84b765f0731b321496bf4f548c49ad2177028","id":"rel:3725ab082d6da8f966bc8172699871ad9290c976ed4a2cb8b98b5400c81d7929","properties":{"control_id":"C012","coverage":"full","delta":null,"framework":"aiuc-1","provenance":{"defaultConfidence":"medium","defaultStatus":"active","direction":"canonical_to_source","mapper":"coworkcanvas-compliance-graph","note":"Each member is a documented relationship claim from the canonical unified control to a source control or guidance proposition. relationship: equal|superset_of (full) / intersects_with|subset_of (partial) / informs (guidance). confidence 'medium' = single-mapper, documented, not yet externally corroborated. source_version is the member framework's edition from the standard version register.","reviewDate":"2026-09-07"},"relationship":"superset_of","source_version":"July 15, 2026 release (quarterly update cadence)"},"sourceDetailPath":"/data/v1/records/uc-uc-ai-21-8afd47db.json","sourceId":"uc:UC-AI-21","targetDetailPath":"/data/v1/records/ctrl-aiuc-1-c012-783c55df.json","targetId":"ctrl:aiuc-1:C012","type":"maps_to"},{"expectedCatalogRevision":"24028ffcfc2b295fa1b08ee6caa84b765f0731b321496bf4f548c49ad2177028","id":"rel:3dbf331723a49242ebe31772d373a6634fca02ad4e43de322e54db40626811f5","properties":{"control_id":"A.7.4","coverage":"full","delta":null,"framework":"iso-27001","provenance":{"defaultConfidence":"medium","defaultStatus":"active","direction":"canonical_to_source","mapper":"coworkcanvas-compliance-graph","note":"Each member is a documented relationship claim from the canonical unified control to a source control or guidance proposition. relationship: equal|superset_of (full) / intersects_with|subset_of (partial) / informs (guidance). confidence 'medium' = single-mapper, documented, not yet externally corroborated. source_version is the member framework's edition from the standard version register.","reviewDate":"2026-09-07"},"relationship":"superset_of","source_version":"2022"},"sourceDetailPath":"/data/v1/records/uc-uc-phys-02-05f35d07.json","sourceId":"uc:UC-PHYS-02","targetDetailPath":"/data/v1/records/ctrl-iso-27001-a-7-4-9f51f324.json","targetId":"ctrl:iso-27001:A.7.4","type":"maps_to"},{"expectedCatalogRevision":"24028ffcfc2b295fa1b08ee6caa84b765f0731b321496bf4f548c49ad2177028","id":"rel:3f1b9ea154938221b1defc204c43a177d21cac451064cf698d3df8848fb47b3f","properties":{"control_id":"A.5.20","coverage":"partial","delta":"broader supplier security terms addressed under third-party risk domain","framework":"iso-27001","provenance":{"defaultConfidence":"medium","defaultStatus":"active","direction":"canonical_to_source","mapper":"coworkcanvas-compliance-graph","note":"Each member is a documented relationship claim from the canonical unified control to a source control or guidance proposition. relationship: equal|superset_of (full) / intersects_with|subset_of (partial) / informs (guidance). confidence 'medium' = single-mapper, documented, not yet externally corroborated. source_version is the member framework's edition from the standard version register.","reviewDate":"2026-09-07"},"relationship":"intersects_with","source_version":"2022"},"sourceDetailPath":"/data/v1/records/uc-uc-hr-05-4049a32e.json","sourceId":"uc:UC-HR-05","targetDetailPath":"/data/v1/records/ctrl-iso-27001-a-5-20-fcee3b34.json","targetId":"ctrl:iso-27001:A.5.20","type":"maps_to"},{"expectedCatalogRevision":"24028ffcfc2b295fa1b08ee6caa84b765f0731b321496bf4f548c49ad2177028","id":"rel:42509eb5656a89b1a92a9c36f3a2a4cdefa1a038aa8cc37f1f6b3d0b23eeb1fe","properties":{},"sourceDetailPath":"/data/v1/records/ctrl-aiuc-1-c012-783c55df.json","sourceId":"ctrl:aiuc-1:C012","targetDetailPath":"/data/v1/records/std-aiuc-1-d2a8b650.json","targetId":"std:aiuc-1","type":"belongs_to"},{"expectedCatalogRevision":"24028ffcfc2b295fa1b08ee6caa84b765f0731b321496bf4f548c49ad2177028","id":"rel:44cc4186b5c1bb4eff60a99d8daf742e4590cc9298b27c249ab8845d231946b4","properties":{"control_id":"A.7.3","coverage":"full","delta":null,"framework":"iso-27001","provenance":{"defaultConfidence":"medium","defaultStatus":"active","direction":"canonical_to_source","mapper":"coworkcanvas-compliance-graph","note":"Each member is a documented relationship claim from the canonical unified control to a source control or guidance proposition. relationship: equal|superset_of (full) / intersects_with|subset_of (partial) / informs (guidance). confidence 'medium' = single-mapper, documented, not yet externally corroborated. source_version is the member framework's edition from the standard version register.","reviewDate":"2026-09-07"},"relationship":"superset_of","source_version":"2022"},"sourceDetailPath":"/data/v1/records/uc-uc-phys-01-354431a7.json","sourceId":"uc:UC-PHYS-01","targetDetailPath":"/data/v1/records/ctrl-iso-27001-a-7-3-1b2f4ae0.json","targetId":"ctrl:iso-27001:A.7.3","type":"maps_to"},{"expectedCatalogRevision":"24028ffcfc2b295fa1b08ee6caa84b765f0731b321496bf4f548c49ad2177028","id":"rel:45a1e5145b0928b28d18bf5921388ea0c0962d3cd43c1e225eae980c86022c05","properties":{},"sourceDetailPath":"/data/v1/records/ctrl-aiuc-1-a003-bea61fd9.json","sourceId":"ctrl:aiuc-1:A003","targetDetailPath":"/data/v1/records/std-aiuc-1-d2a8b650.json","targetId":"std:aiuc-1","type":"belongs_to"},{"expectedCatalogRevision":"24028ffcfc2b295fa1b08ee6caa84b765f0731b321496bf4f548c49ad2177028","id":"rel:47472f6f81d5e60212915d60644980d00c90385e35c468c9335aebda80a424de","properties":{"control_id":"HIPAA-164.312(a)","coverage":"partial","delta":"automatic logoff and encryption/decryption of ePHI are satisfied by the session-lock (UC-ACCESS-12) and cryptographic (UC-CRYPTO-01) companion controls; emergency-access is an availability arm","framework":"hipaa","provenance":{"defaultConfidence":"medium","defaultStatus":"active","direction":"canonical_to_source","mapper":"coworkcanvas-compliance-graph","note":"Each member is a documented relationship claim from the canonical unified control to a source control or guidance proposition. relationship: equal|superset_of (full) / intersects_with|subset_of (partial) / informs (guidance). confidence 'medium' = single-mapper, documented, not yet externally corroborated. source_version is the member framework's edition from the standard version register.","reviewDate":"2026-09-07"},"relationship":"intersects_with","source_version":"45 CFR Parts 160/164 (Security, Privacy, Breach Notification)"},"sourceDetailPath":"/data/v1/records/uc-uc-access-05-9b7f3e34.json","sourceId":"uc:UC-ACCESS-05","targetDetailPath":"/data/v1/records/ctrl-hipaa-hipaa-164-312-a-5c8bb707.json","targetId":"ctrl:hipaa:HIPAA-164.312(a)","type":"maps_to"},{"expectedCatalogRevision":"24028ffcfc2b295fa1b08ee6caa84b765f0731b321496bf4f548c49ad2177028","id":"rel:4f2a2276a11febbf649ac592a98f96d4e1ae1e06d197656be5e201c6f77cd12c","properties":{"control_id":"A.6.4","coverage":"full","delta":null,"framework":"iso-27001","provenance":{"defaultConfidence":"medium","defaultStatus":"active","direction":"canonical_to_source","mapper":"coworkcanvas-compliance-graph","note":"Each member is a documented relationship claim from the canonical unified control to a source control or guidance proposition. relationship: equal|superset_of (full) / intersects_with|subset_of (partial) / informs (guidance). confidence 'medium' = single-mapper, documented, not yet externally corroborated. source_version is the member framework's edition from the standard version register.","reviewDate":"2026-09-07"},"relationship":"superset_of","source_version":"2022"},"sourceDetailPath":"/data/v1/records/uc-uc-hr-04-a71cf995.json","sourceId":"uc:UC-HR-04","targetDetailPath":"/data/v1/records/ctrl-iso-27001-a-6-4-33939a57.json","targetId":"ctrl:iso-27001:A.6.4","type":"maps_to"},{"expectedCatalogRevision":"24028ffcfc2b295fa1b08ee6caa84b765f0731b321496bf4f548c49ad2177028","id":"rel:4fb51c383bd08d7e4cb798d652a83c0b888d8fd0853a69efefe852a66ecbb53a","properties":{},"sourceDetailPath":"/data/v1/records/ctrl-hipaa-hipaa-164-312-b-7272303c.json","sourceId":"ctrl:hipaa:HIPAA-164.312(b)","targetDetailPath":"/data/v1/records/std-hipaa-a825d271.json","targetId":"std:hipaa","type":"belongs_to"},{"expectedCatalogRevision":"24028ffcfc2b295fa1b08ee6caa84b765f0731b321496bf4f548c49ad2177028","id":"rel:51eb1aaf372e56e178e80a1502ebfcf0f2725d63b17c3f28280480fc3cce7f20","properties":{"control_id":"A.7.2","coverage":"full","delta":null,"framework":"iso-27001","provenance":{"defaultConfidence":"medium","defaultStatus":"active","direction":"canonical_to_source","mapper":"coworkcanvas-compliance-graph","note":"Each member is a documented relationship claim from the canonical unified control to a source control or guidance proposition. relationship: equal|superset_of (full) / intersects_with|subset_of (partial) / informs (guidance). confidence 'medium' = single-mapper, documented, not yet externally corroborated. source_version is the member framework's edition from the standard version register.","reviewDate":"2026-09-07"},"relationship":"superset_of","source_version":"2022"},"sourceDetailPath":"/data/v1/records/uc-uc-phys-01-354431a7.json","sourceId":"uc:UC-PHYS-01","targetDetailPath":"/data/v1/records/ctrl-iso-27001-a-7-2-7f774ee6.json","targetId":"ctrl:iso-27001:A.7.2","type":"maps_to"},{"expectedCatalogRevision":"24028ffcfc2b295fa1b08ee6caa84b765f0731b321496bf4f548c49ad2177028","id":"rel:54a5127b09fa0df51fdec8c2d52d749eb8f7b18dcdc92569ca6cf4f78c2bd536","properties":{},"sourceDetailPath":"/data/v1/records/ctrl-aiuc-1-b001-19a54ee3.json","sourceId":"ctrl:aiuc-1:B001","targetDetailPath":"/data/v1/records/std-aiuc-1-d2a8b650.json","targetId":"std:aiuc-1","type":"belongs_to"},{"expectedCatalogRevision":"24028ffcfc2b295fa1b08ee6caa84b765f0731b321496bf4f548c49ad2177028","id":"rel:5f9c9f2ee7a7058784c62630d6e9a3e22633f6949103ed9b8518bb0d429377e6","properties":{"control_id":"HIPAA-164.312(d)","coverage":"full","delta":null,"framework":"hipaa","provenance":{"defaultConfidence":"medium","defaultStatus":"active","direction":"canonical_to_source","mapper":"coworkcanvas-compliance-graph","note":"Each member is a documented relationship claim from the canonical unified control to a source control or guidance proposition. relationship: equal|superset_of (full) / intersects_with|subset_of (partial) / informs (guidance). confidence 'medium' = single-mapper, documented, not yet externally corroborated. source_version is the member framework's edition from the standard version register.","reviewDate":"2026-09-07"},"relationship":"superset_of","source_version":"45 CFR Parts 160/164 (Security, Privacy, Breach Notification)"},"sourceDetailPath":"/data/v1/records/uc-uc-access-09-444baafe.json","sourceId":"uc:UC-ACCESS-09","targetDetailPath":"/data/v1/records/ctrl-hipaa-hipaa-164-312-d-d1e8fe74.json","targetId":"ctrl:hipaa:HIPAA-164.312(d)","type":"maps_to"},{"expectedCatalogRevision":"24028ffcfc2b295fa1b08ee6caa84b765f0731b321496bf4f548c49ad2177028","id":"rel:61ab6cde6d899b2ba90748f2ccbfecd5f4955ab12b3f3601465f3272cad5e304","properties":{"control_id":"B003","coverage":"partial","delta":"controlled public release of model, system-prompt, and architecture details so technical over-disclosure does not aid adversaries","framework":"aiuc-1","provenance":{"defaultConfidence":"medium","defaultStatus":"active","direction":"canonical_to_source","mapper":"coworkcanvas-compliance-graph","note":"Each member is a documented relationship claim from the canonical unified control to a source control or guidance proposition. relationship: equal|superset_of (full) / intersects_with|subset_of (partial) / informs (guidance). confidence 'medium' = single-mapper, documented, not yet externally corroborated. source_version is the member framework's edition from the standard version register.","reviewDate":"2026-09-07"},"relationship":"intersects_with","source_version":"July 15, 2026 release (quarterly update cadence)"},"sourceDetailPath":"/data/v1/records/uc-uc-access-14-99fd72b5.json","sourceId":"uc:UC-ACCESS-14","targetDetailPath":"/data/v1/records/ctrl-aiuc-1-b003-8c740cc9.json","targetId":"ctrl:aiuc-1:B003","type":"maps_to"},{"expectedCatalogRevision":"24028ffcfc2b295fa1b08ee6caa84b765f0731b321496bf4f548c49ad2177028","id":"rel:645edf3f778bfbc0cd502e6c50e4335d30686a5adefc03d64f389a44621ec84c","properties":{},"sourceDetailPath":"/data/v1/records/ctrl-eu-ai-act-aia-art14-4b7ae8a7.json","sourceId":"ctrl:eu-ai-act:AIA-Art14","targetDetailPath":"/data/v1/records/std-eu-ai-act-54986689.json","targetId":"std:eu-ai-act","type":"belongs_to"},{"expectedCatalogRevision":"24028ffcfc2b295fa1b08ee6caa84b765f0731b321496bf4f548c49ad2177028","id":"rel:6a6ee7bb71598007c95021c955a96b2c1acda401441d403b7218ab5f3411adcb","properties":{"control_id":"A.6.1","coverage":"full","delta":null,"framework":"iso-27001","provenance":{"defaultConfidence":"medium","defaultStatus":"active","direction":"canonical_to_source","mapper":"coworkcanvas-compliance-graph","note":"Each member is a documented relationship claim from the canonical unified control to a source control or guidance proposition. relationship: equal|superset_of (full) / intersects_with|subset_of (partial) / informs (guidance). confidence 'medium' = single-mapper, documented, not yet externally corroborated. source_version is the member framework's edition from the standard version register.","reviewDate":"2026-09-07"},"relationship":"superset_of","source_version":"2022"},"sourceDetailPath":"/data/v1/records/uc-uc-hr-01-c7e14dc5.json","sourceId":"uc:UC-HR-01","targetDetailPath":"/data/v1/records/ctrl-iso-27001-a-6-1-048c51f3.json","targetId":"ctrl:iso-27001:A.6.1","type":"maps_to"},{"expectedCatalogRevision":"24028ffcfc2b295fa1b08ee6caa84b765f0731b321496bf4f548c49ad2177028","id":"rel:6e78e0481feaa67b20a386a2793b8dd288b60bbe92bf3303d2f27e141417dca7","properties":{},"sourceDetailPath":"/data/v1/records/ctrl-iso-27001-a-6-1-048c51f3.json","sourceId":"ctrl:iso-27001:A.6.1","targetDetailPath":"/data/v1/records/std-iso-27001-656201bd.json","targetId":"std:iso-27001","type":"belongs_to"},{"expectedCatalogRevision":"24028ffcfc2b295fa1b08ee6caa84b765f0731b321496bf4f548c49ad2177028","id":"rel:7135470f5a63fc7121113c02de833d6fde647eb75c6bb98fd804caa7badca929","properties":{},"sourceDetailPath":"/data/v1/records/ctrl-iso-27001-a-5-7-0328fe6b.json","sourceId":"ctrl:iso-27001:A.5.7","targetDetailPath":"/data/v1/records/std-iso-27001-656201bd.json","targetId":"std:iso-27001","type":"belongs_to"},{"expectedCatalogRevision":"24028ffcfc2b295fa1b08ee6caa84b765f0731b321496bf4f548c49ad2177028","id":"rel:72b94ed91e964541cc87bf386c4b6994337ba2ac851d16d3f3454cfd9b8d8eb3","properties":{"control_id":"D002","coverage":"full","delta":null,"framework":"aiuc-1","provenance":{"defaultConfidence":"medium","defaultStatus":"active","direction":"canonical_to_source","mapper":"coworkcanvas-compliance-graph","note":"Each member is a documented relationship claim from the canonical unified control to a source control or guidance proposition. relationship: equal|superset_of (full) / intersects_with|subset_of (partial) / informs (guidance). confidence 'medium' = single-mapper, documented, not yet externally corroborated. source_version is the member framework's edition from the standard version register.","reviewDate":"2026-09-07"},"relationship":"superset_of","source_version":"July 15, 2026 release (quarterly update cadence)"},"sourceDetailPath":"/data/v1/records/uc-uc-ai-21-8afd47db.json","sourceId":"uc:UC-AI-21","targetDetailPath":"/data/v1/records/ctrl-aiuc-1-d002-34554b38.json","targetId":"ctrl:aiuc-1:D002","type":"maps_to"},{"expectedCatalogRevision":"24028ffcfc2b295fa1b08ee6caa84b765f0731b321496bf4f548c49ad2177028","id":"rel:7378e9eab62be8ba3d1a1ed5bd35f653d390c7165684821983a39c6e739cf851","properties":{"control_id":"C011","coverage":"full","delta":null,"framework":"aiuc-1","provenance":{"defaultConfidence":"medium","defaultStatus":"active","direction":"canonical_to_source","mapper":"coworkcanvas-compliance-graph","note":"Each member is a documented relationship claim from the canonical unified control to a source control or guidance proposition. relationship: equal|superset_of (full) / intersects_with|subset_of (partial) / informs (guidance). confidence 'medium' = single-mapper, documented, not yet externally corroborated. source_version is the member framework's edition from the standard version register.","reviewDate":"2026-09-07"},"relationship":"superset_of","source_version":"July 15, 2026 release (quarterly update cadence)"},"sourceDetailPath":"/data/v1/records/uc-uc-ai-21-8afd47db.json","sourceId":"uc:UC-AI-21","targetDetailPath":"/data/v1/records/ctrl-aiuc-1-c011-7889db41.json","targetId":"ctrl:aiuc-1:C011","type":"maps_to"},{"expectedCatalogRevision":"24028ffcfc2b295fa1b08ee6caa84b765f0731b321496bf4f548c49ad2177028","id":"rel:74e883a4246ff37ceb111e94ede879200b02479a84eda309b5816228465bece2","properties":{},"sourceDetailPath":"/data/v1/records/ctrl-cobit-2019-dss06-c2b31b0e.json","sourceId":"ctrl:cobit-2019:DSS06","targetDetailPath":"/data/v1/records/std-cobit-2019-2181ce0c.json","targetId":"std:cobit-2019","type":"belongs_to"},{"expectedCatalogRevision":"24028ffcfc2b295fa1b08ee6caa84b765f0731b321496bf4f548c49ad2177028","id":"rel:7600e8066bd80f681f6cdd1adaff667045e6a5a0ff9a75dcdce290af53c5d65d","properties":{"control_id":"HIPAA-164.310","coverage":"partial","delta":"also covers workstation use/security and device and media controls","framework":"hipaa","provenance":{"defaultConfidence":"medium","defaultStatus":"active","direction":"canonical_to_source","mapper":"coworkcanvas-compliance-graph","note":"Each member is a documented relationship claim from the canonical unified control to a source control or guidance proposition. relationship: equal|superset_of (full) / intersects_with|subset_of (partial) / informs (guidance). confidence 'medium' = single-mapper, documented, not yet externally corroborated. source_version is the member framework's edition from the standard version register.","reviewDate":"2026-09-07"},"relationship":"intersects_with","source_version":"45 CFR Parts 160/164 (Security, Privacy, Breach Notification)"},"sourceDetailPath":"/data/v1/records/uc-uc-phys-01-354431a7.json","sourceId":"uc:UC-PHYS-01","targetDetailPath":"/data/v1/records/ctrl-hipaa-hipaa-164-310-9cf84fad.json","targetId":"ctrl:hipaa:HIPAA-164.310","type":"maps_to"},{"expectedCatalogRevision":"24028ffcfc2b295fa1b08ee6caa84b765f0731b321496bf4f548c49ad2177028","id":"rel:7677aeab7f884ba8b21cc4945d4354d344a58e19089c4d325a668392b0e90983","properties":{"control_id":"B006","coverage":"full","delta":null,"framework":"aiuc-1","provenance":{"defaultConfidence":"medium","defaultStatus":"active","direction":"canonical_to_source","mapper":"coworkcanvas-compliance-graph","note":"Each member is a documented relationship claim from the canonical unified control to a source control or guidance proposition. relationship: equal|superset_of (full) / intersects_with|subset_of (partial) / informs (guidance). confidence 'medium' = single-mapper, documented, not yet externally corroborated. source_version is the member framework's edition from the standard version register.","reviewDate":"2026-09-07"},"relationship":"superset_of","source_version":"July 15, 2026 release (quarterly update cadence)"},"sourceDetailPath":"/data/v1/records/uc-uc-ai-19-535f3660.json","sourceId":"uc:UC-AI-19","targetDetailPath":"/data/v1/records/ctrl-aiuc-1-b006-2951b397.json","targetId":"ctrl:aiuc-1:B006","type":"maps_to"},{"expectedCatalogRevision":"24028ffcfc2b295fa1b08ee6caa84b765f0731b321496bf4f548c49ad2177028","id":"rel:771fe71b653da797589e3eeb3d84a995ac2416455b1e8170bcd03ca056f8d16e","properties":{},"sourceDetailPath":"/data/v1/records/ctrl-aiuc-1-d004-21d4eeb4.json","sourceId":"ctrl:aiuc-1:D004","targetDetailPath":"/data/v1/records/std-aiuc-1-d2a8b650.json","targetId":"std:aiuc-1","type":"belongs_to"},{"expectedCatalogRevision":"24028ffcfc2b295fa1b08ee6caa84b765f0731b321496bf4f548c49ad2177028","id":"rel:7dfb9a1bfb567751e34578de3255a09bc8e7897a1a7ea1821bdbc6ce3a7e6f7f","properties":{"control_id":"A.6.5","coverage":"full","delta":null,"framework":"iso-27001","provenance":{"defaultConfidence":"medium","defaultStatus":"active","direction":"canonical_to_source","mapper":"coworkcanvas-compliance-graph","note":"Each member is a documented relationship claim from the canonical unified control to a source control or guidance proposition. relationship: equal|superset_of (full) / intersects_with|subset_of (partial) / informs (guidance). confidence 'medium' = single-mapper, documented, not yet externally corroborated. source_version is the member framework's edition from the standard version register.","reviewDate":"2026-09-07"},"relationship":"superset_of","source_version":"2022"},"sourceDetailPath":"/data/v1/records/uc-uc-hr-03-1f58d8f9.json","sourceId":"uc:UC-HR-03","targetDetailPath":"/data/v1/records/ctrl-iso-27001-a-6-5-0eefa5a7.json","targetId":"ctrl:iso-27001:A.6.5","type":"maps_to"},{"expectedCatalogRevision":"24028ffcfc2b295fa1b08ee6caa84b765f0731b321496bf4f548c49ad2177028","id":"rel:7fe14f045eb5b989ed2b172e29123795c887a077790aec281603ac0cb5b7b76a","properties":{},"sourceDetailPath":"/data/v1/records/ctrl-aiuc-1-c010-b0a758b4.json","sourceId":"ctrl:aiuc-1:C010","targetDetailPath":"/data/v1/records/std-aiuc-1-d2a8b650.json","targetId":"std:aiuc-1","type":"belongs_to"},{"expectedCatalogRevision":"24028ffcfc2b295fa1b08ee6caa84b765f0731b321496bf4f548c49ad2177028","id":"rel:831bb87ed52b4b8496a2df0763736f691983d642227954b2a9794574ad122e52","properties":{},"sourceDetailPath":"/data/v1/records/ctrl-iso-27001-a-5-15-b8587804.json","sourceId":"ctrl:iso-27001:A.5.15","targetDetailPath":"/data/v1/records/std-iso-27001-656201bd.json","targetId":"std:iso-27001","type":"belongs_to"},{"expectedCatalogRevision":"24028ffcfc2b295fa1b08ee6caa84b765f0731b321496bf4f548c49ad2177028","id":"rel:89206e47cbd4bf028123c0d6072f24d0408b695ea872f1bf5bc128ad8cd1c09c","properties":{},"sourceDetailPath":"/data/v1/records/ctrl-iso-27001-a-5-17-b45de021.json","sourceId":"ctrl:iso-27001:A.5.17","targetDetailPath":"/data/v1/records/std-iso-27001-656201bd.json","targetId":"std:iso-27001","type":"belongs_to"},{"expectedCatalogRevision":"24028ffcfc2b295fa1b08ee6caa84b765f0731b321496bf4f548c49ad2177028","id":"rel:8ad43eeb9707d403a42533306a14908e951226d382dfc555c22e8baefaf7633b","properties":{"control_id":"A.5.17","coverage":"partial","delta":"advising personnel on proper handling and protection of authentication information","framework":"iso-27001","provenance":{"defaultConfidence":"medium","defaultStatus":"active","direction":"canonical_to_source","mapper":"coworkcanvas-compliance-graph","note":"Each member is a documented relationship claim from the canonical unified control to a source control or guidance proposition. relationship: equal|superset_of (full) / intersects_with|subset_of (partial) / informs (guidance). confidence 'medium' = single-mapper, documented, not yet externally corroborated. source_version is the member framework's edition from the standard version register.","reviewDate":"2026-09-07"},"relationship":"intersects_with","source_version":"2022"},"sourceDetailPath":"/data/v1/records/uc-uc-access-08-7c9dc13e.json","sourceId":"uc:UC-ACCESS-08","targetDetailPath":"/data/v1/records/ctrl-iso-27001-a-5-17-b45de021.json","targetId":"ctrl:iso-27001:A.5.17","type":"maps_to"},{"expectedCatalogRevision":"24028ffcfc2b295fa1b08ee6caa84b765f0731b321496bf4f548c49ad2177028","id":"rel:8cf6a557412855d991f5fbe276861808067d53cad6d0a3017419b255fa47e568","properties":{"control_id":"A.5.15","coverage":"partial","delta":"also requires rules controlling physical access to information and assets","framework":"iso-27001","provenance":{"defaultConfidence":"medium","defaultStatus":"active","direction":"canonical_to_source","mapper":"coworkcanvas-compliance-graph","note":"Each member is a documented relationship claim from the canonical unified control to a source control or guidance proposition. relationship: equal|superset_of (full) / intersects_with|subset_of (partial) / informs (guidance). confidence 'medium' = single-mapper, documented, not yet externally corroborated. source_version is the member framework's edition from the standard version register.","reviewDate":"2026-09-07"},"relationship":"intersects_with","source_version":"2022"},"sourceDetailPath":"/data/v1/records/uc-uc-access-03-43eeb212.json","sourceId":"uc:UC-ACCESS-03","targetDetailPath":"/data/v1/records/ctrl-iso-27001-a-5-15-b8587804.json","targetId":"ctrl:iso-27001:A.5.15","type":"maps_to"},{"expectedCatalogRevision":"24028ffcfc2b295fa1b08ee6caa84b765f0731b321496bf4f548c49ad2177028","id":"rel:8ff93d7e4e334d9453ecbad99b8cd3527f3de070de51c8adc3daad60b069d2b6","properties":{"control_id":"A.6.3","coverage":"full","delta":null,"framework":"iso-27001","provenance":{"defaultConfidence":"medium","defaultStatus":"active","direction":"canonical_to_source","mapper":"coworkcanvas-compliance-graph","note":"Each member is a documented relationship claim from the canonical unified control to a source control or guidance proposition. relationship: equal|superset_of (full) / intersects_with|subset_of (partial) / informs (guidance). confidence 'medium' = single-mapper, documented, not yet externally corroborated. source_version is the member framework's edition from the standard version register.","reviewDate":"2026-09-07"},"relationship":"superset_of","source_version":"2022"},"sourceDetailPath":"/data/v1/records/uc-uc-train-01-5f513831.json","sourceId":"uc:UC-TRAIN-01","targetDetailPath":"/data/v1/records/ctrl-iso-27001-a-6-3-b9bb8fbd.json","targetId":"ctrl:iso-27001:A.6.3","type":"maps_to"},{"expectedCatalogRevision":"24028ffcfc2b295fa1b08ee6caa84b765f0731b321496bf4f548c49ad2177028","id":"rel:9962087408a38ed91d9d5610b5adb499a297449fbbb3b3edcbf42d823c9091e8","properties":{},"sourceDetailPath":"/data/v1/records/ctrl-iso-27001-a-7-8-9ee41158.json","sourceId":"ctrl:iso-27001:A.7.8","targetDetailPath":"/data/v1/records/std-iso-27001-656201bd.json","targetId":"std:iso-27001","type":"belongs_to"},{"expectedCatalogRevision":"24028ffcfc2b295fa1b08ee6caa84b765f0731b321496bf4f548c49ad2177028","id":"rel:9b1a000fb0bc87b17f9c36c3bac7b6635fafd307d5e9101ecb04b57d5c2f6904","properties":{},"sourceDetailPath":"/data/v1/records/ctrl-aiuc-1-b006-2951b397.json","sourceId":"ctrl:aiuc-1:B006","targetDetailPath":"/data/v1/records/std-aiuc-1-d2a8b650.json","targetId":"std:aiuc-1","type":"belongs_to"},{"expectedCatalogRevision":"24028ffcfc2b295fa1b08ee6caa84b765f0731b321496bf4f548c49ad2177028","id":"rel:9cf7441a234b2e10473c8821a2cd7077ba4c41b418d5433379f0fdd638b535e2","properties":{},"sourceDetailPath":"/data/v1/records/ctrl-iso-27001-a-7-6-3e5f12bc.json","sourceId":"ctrl:iso-27001:A.7.6","targetDetailPath":"/data/v1/records/std-iso-27001-656201bd.json","targetId":"std:iso-27001","type":"belongs_to"},{"expectedCatalogRevision":"24028ffcfc2b295fa1b08ee6caa84b765f0731b321496bf4f548c49ad2177028","id":"rel:a075640567e71c306d81eb0ec0d0289a0a47f92351480c0bea4593d363664d45","properties":{},"sourceDetailPath":"/data/v1/records/ctrl-iso-27001-a-6-4-33939a57.json","sourceId":"ctrl:iso-27001:A.6.4","targetDetailPath":"/data/v1/records/std-iso-27001-656201bd.json","targetId":"std:iso-27001","type":"belongs_to"},{"expectedCatalogRevision":"24028ffcfc2b295fa1b08ee6caa84b765f0731b321496bf4f548c49ad2177028","id":"rel:a0c14c0293d1afba8a4199022904af26b4f4095f4319e0f53f6796d1a5facba9","properties":{},"sourceDetailPath":"/data/v1/records/ctrl-aiuc-1-b007-151dfcd3.json","sourceId":"ctrl:aiuc-1:B007","targetDetailPath":"/data/v1/records/std-aiuc-1-d2a8b650.json","targetId":"std:aiuc-1","type":"belongs_to"},{"expectedCatalogRevision":"24028ffcfc2b295fa1b08ee6caa84b765f0731b321496bf4f548c49ad2177028","id":"rel:a2a316f5916d3671f160c275b17626637917d041fef59df212398e607e152aa4","properties":{"control_id":"A.8.15","coverage":"partial","delta":"also requires protecting, storing, and analysing produced logs","framework":"iso-27001","provenance":{"defaultConfidence":"medium","defaultStatus":"active","direction":"canonical_to_source","mapper":"coworkcanvas-compliance-graph","note":"Each member is a documented relationship claim from the canonical unified control to a source control or guidance proposition. relationship: equal|superset_of (full) / intersects_with|subset_of (partial) / informs (guidance). confidence 'medium' = single-mapper, documented, not yet externally corroborated. source_version is the member framework's edition from the standard version register.","reviewDate":"2026-09-07"},"relationship":"intersects_with","source_version":"2022"},"sourceDetailPath":"/data/v1/records/uc-uc-log-01-022e9745.json","sourceId":"uc:UC-LOG-01","targetDetailPath":"/data/v1/records/ctrl-iso-27001-a-8-15-ab7dd8ce.json","targetId":"ctrl:iso-27001:A.8.15","type":"maps_to"},{"expectedCatalogRevision":"24028ffcfc2b295fa1b08ee6caa84b765f0731b321496bf4f548c49ad2177028","id":"rel:a34d1b95310d02df2f38016789331618ad71256de254d7d5290a8d14dc84ba75","properties":{},"sourceDetailPath":"/data/v1/records/ctrl-iso-27001-a-7-2-7f774ee6.json","sourceId":"ctrl:iso-27001:A.7.2","targetDetailPath":"/data/v1/records/std-iso-27001-656201bd.json","targetId":"std:iso-27001","type":"belongs_to"},{"expectedCatalogRevision":"24028ffcfc2b295fa1b08ee6caa84b765f0731b321496bf4f548c49ad2177028","id":"rel:a663d636ace716e1441d87cd25897840f98c0c489bea339a8e1d75115860ac39","properties":{},"sourceDetailPath":"/data/v1/records/ctrl-iso-27001-a-6-3-b9bb8fbd.json","sourceId":"ctrl:iso-27001:A.6.3","targetDetailPath":"/data/v1/records/std-iso-27001-656201bd.json","targetId":"std:iso-27001","type":"belongs_to"},{"expectedCatalogRevision":"24028ffcfc2b295fa1b08ee6caa84b765f0731b321496bf4f548c49ad2177028","id":"rel:ae3606ca696844c9184d3116249072898cb52510ebf01f819f56d944939af325","properties":{},"sourceDetailPath":"/data/v1/records/ctrl-iso-27001-a-8-15-ab7dd8ce.json","sourceId":"ctrl:iso-27001:A.8.15","targetDetailPath":"/data/v1/records/std-iso-27001-656201bd.json","targetId":"std:iso-27001","type":"belongs_to"},{"expectedCatalogRevision":"24028ffcfc2b295fa1b08ee6caa84b765f0731b321496bf4f548c49ad2177028","id":"rel:b49441ad04e7bb2572f9ca20f5e87f347a22f75d23a7969d40c00117e61d6d09","properties":{"control_id":"D004","coverage":"full","delta":null,"framework":"aiuc-1","provenance":{"defaultConfidence":"medium","defaultStatus":"active","direction":"canonical_to_source","mapper":"coworkcanvas-compliance-graph","note":"Each member is a documented relationship claim from the canonical unified control to a source control or guidance proposition. relationship: equal|superset_of (full) / intersects_with|subset_of (partial) / informs (guidance). confidence 'medium' = single-mapper, documented, not yet externally corroborated. source_version is the member framework's edition from the standard version register.","reviewDate":"2026-09-07"},"relationship":"superset_of","source_version":"July 15, 2026 release (quarterly update cadence)"},"sourceDetailPath":"/data/v1/records/uc-uc-ai-21-8afd47db.json","sourceId":"uc:UC-AI-21","targetDetailPath":"/data/v1/records/ctrl-aiuc-1-d004-21d4eeb4.json","targetId":"ctrl:aiuc-1:D004","type":"maps_to"},{"expectedCatalogRevision":"24028ffcfc2b295fa1b08ee6caa84b765f0731b321496bf4f548c49ad2177028","id":"rel:b8ac22db464c1e05c1286c62ad846d099b579a8246dde5212f64d48d01418e67","properties":{"control_id":"HIPAA-164.308","coverage":"partial","delta":"risk analysis, training, contingency, evaluation, and BAAs satisfied in other domains","framework":"hipaa","provenance":{"defaultConfidence":"medium","defaultStatus":"active","direction":"canonical_to_source","mapper":"coworkcanvas-compliance-graph","note":"Each member is a documented relationship claim from the canonical unified control to a source control or guidance proposition. relationship: equal|superset_of (full) / intersects_with|subset_of (partial) / informs (guidance). confidence 'medium' = single-mapper, documented, not yet externally corroborated. source_version is the member framework's edition from the standard version register.","reviewDate":"2026-09-07"},"relationship":"intersects_with","source_version":"45 CFR Parts 160/164 (Security, Privacy, Breach Notification)"},"sourceDetailPath":"/data/v1/records/uc-uc-hr-01-c7e14dc5.json","sourceId":"uc:UC-HR-01","targetDetailPath":"/data/v1/records/ctrl-hipaa-hipaa-164-308-d26b6932.json","targetId":"ctrl:hipaa:HIPAA-164.308","type":"maps_to"},{"expectedCatalogRevision":"24028ffcfc2b295fa1b08ee6caa84b765f0731b321496bf4f548c49ad2177028","id":"rel:bb81974adc1ada5498944c8d63e01254f1dd56c1067d93f111a7108e053a2b5f","properties":{},"sourceDetailPath":"/data/v1/records/ctrl-iso-27001-a-7-4-9f51f324.json","sourceId":"ctrl:iso-27001:A.7.4","targetDetailPath":"/data/v1/records/std-iso-27001-656201bd.json","targetId":"std:iso-27001","type":"belongs_to"},{"expectedCatalogRevision":"24028ffcfc2b295fa1b08ee6caa84b765f0731b321496bf4f548c49ad2177028","id":"rel:bbb58faf8b3bbc3d66ef9d7bdeb1609b34fe95674799e8fafe7397a3eb61191b","properties":{"control_id":"D003","coverage":"full","delta":null,"framework":"aiuc-1","provenance":{"defaultConfidence":"medium","defaultStatus":"active","direction":"canonical_to_source","mapper":"coworkcanvas-compliance-graph","note":"Each member is a documented relationship claim from the canonical unified control to a source control or guidance proposition. relationship: equal|superset_of (full) / intersects_with|subset_of (partial) / informs (guidance). confidence 'medium' = single-mapper, documented, not yet externally corroborated. source_version is the member framework's edition from the standard version register.","reviewDate":"2026-09-07"},"relationship":"superset_of","source_version":"July 15, 2026 release (quarterly update cadence)"},"sourceDetailPath":"/data/v1/records/uc-uc-ai-19-535f3660.json","sourceId":"uc:UC-AI-19","targetDetailPath":"/data/v1/records/ctrl-aiuc-1-d003-9f8f52f3.json","targetId":"ctrl:aiuc-1:D003","type":"maps_to"},{"expectedCatalogRevision":"24028ffcfc2b295fa1b08ee6caa84b765f0731b321496bf4f548c49ad2177028","id":"rel:bf5f7706b3e73a46db661616cf5be6eac2a75128746032843f715220ed4b0d51","properties":{"control_id":"HIPAA-164.312(b)","coverage":"full","delta":null,"framework":"hipaa","provenance":{"defaultConfidence":"medium","defaultStatus":"active","direction":"canonical_to_source","mapper":"coworkcanvas-compliance-graph","note":"Each member is a documented relationship claim from the canonical unified control to a source control or guidance proposition. relationship: equal|superset_of (full) / intersects_with|subset_of (partial) / informs (guidance). confidence 'medium' = single-mapper, documented, not yet externally corroborated. source_version is the member framework's edition from the standard version register.","reviewDate":"2026-09-07"},"relationship":"superset_of","source_version":"45 CFR Parts 160/164 (Security, Privacy, Breach Notification)"},"sourceDetailPath":"/data/v1/records/uc-uc-log-01-022e9745.json","sourceId":"uc:UC-LOG-01","targetDetailPath":"/data/v1/records/ctrl-hipaa-hipaa-164-312-b-7272303c.json","targetId":"ctrl:hipaa:HIPAA-164.312(b)","type":"maps_to"},{"expectedCatalogRevision":"24028ffcfc2b295fa1b08ee6caa84b765f0731b321496bf4f548c49ad2177028","id":"rel:cef3659c19b299952916eb1c72046246e40f0deee302865659cc3f0729e3018d","properties":{"control_id":"A.5.18","coverage":"partial","delta":"provisioning, adjustment, and revocation satisfied by the account lifecycle control","framework":"iso-27001","provenance":{"defaultConfidence":"medium","defaultStatus":"active","direction":"canonical_to_source","mapper":"coworkcanvas-compliance-graph","note":"Each member is a documented relationship claim from the canonical unified control to a source control or guidance proposition. relationship: equal|superset_of (full) / intersects_with|subset_of (partial) / informs (guidance). confidence 'medium' = single-mapper, documented, not yet externally corroborated. source_version is the member framework's edition from the standard version register.","reviewDate":"2026-09-07"},"relationship":"intersects_with","source_version":"2022"},"sourceDetailPath":"/data/v1/records/uc-uc-access-02-0132e278.json","sourceId":"uc:UC-ACCESS-02","targetDetailPath":"/data/v1/records/ctrl-iso-27001-a-5-18-472ef6f1.json","targetId":"ctrl:iso-27001:A.5.18","type":"maps_to"},{"expectedCatalogRevision":"24028ffcfc2b295fa1b08ee6caa84b765f0731b321496bf4f548c49ad2177028","id":"rel:d16f10ed1a0c7529a9cb3f843113b2246df77c34d6c0e5cdc78c5c436dd87122","properties":{"control_id":"A.5.7","coverage":"full","delta":null,"framework":"iso-27001","provenance":{"defaultConfidence":"medium","defaultStatus":"active","direction":"canonical_to_source","mapper":"coworkcanvas-compliance-graph","note":"Each member is a documented relationship claim from the canonical unified control to a source control or guidance proposition. relationship: equal|superset_of (full) / intersects_with|subset_of (partial) / informs (guidance). confidence 'medium' = single-mapper, documented, not yet externally corroborated. source_version is the member framework's edition from the standard version register.","reviewDate":"2026-09-07"},"relationship":"superset_of","source_version":"2022"},"sourceDetailPath":"/data/v1/records/uc-uc-risk-17-4ea73b39.json","sourceId":"uc:UC-RISK-17","targetDetailPath":"/data/v1/records/ctrl-iso-27001-a-5-7-0328fe6b.json","targetId":"ctrl:iso-27001:A.5.7","type":"maps_to"},{"expectedCatalogRevision":"24028ffcfc2b295fa1b08ee6caa84b765f0731b321496bf4f548c49ad2177028","id":"rel:d339e5a33703ddad17fd5c96450d2811a5fe1041841048ee938ee15e9f51f524","properties":{},"sourceDetailPath":"/data/v1/records/ctrl-iso-27001-a-5-20-fcee3b34.json","sourceId":"ctrl:iso-27001:A.5.20","targetDetailPath":"/data/v1/records/std-iso-27001-656201bd.json","targetId":"std:iso-27001","type":"belongs_to"},{"expectedCatalogRevision":"24028ffcfc2b295fa1b08ee6caa84b765f0731b321496bf4f548c49ad2177028","id":"rel:d7c540e0e30389753220c9e87a3a03115910e175f852bc36cfca2ad58ad503f3","properties":{"control_id":"C007","coverage":"partial","delta":"automated flagging of high-risk outputs with routing to a human reviewer before the output takes effect","framework":"aiuc-1","provenance":{"defaultConfidence":"medium","defaultStatus":"active","direction":"canonical_to_source","mapper":"coworkcanvas-compliance-graph","note":"Each member is a documented relationship claim from the canonical unified control to a source control or guidance proposition. relationship: equal|superset_of (full) / intersects_with|subset_of (partial) / informs (guidance). confidence 'medium' = single-mapper, documented, not yet externally corroborated. source_version is the member framework's edition from the standard version register.","reviewDate":"2026-09-07"},"relationship":"intersects_with","source_version":"July 15, 2026 release (quarterly update cadence)"},"sourceDetailPath":"/data/v1/records/uc-uc-ai-16-b95e2895.json","sourceId":"uc:UC-AI-16","targetDetailPath":"/data/v1/records/ctrl-aiuc-1-c007-ebb82753.json","targetId":"ctrl:aiuc-1:C007","type":"maps_to"},{"expectedCatalogRevision":"24028ffcfc2b295fa1b08ee6caa84b765f0731b321496bf4f548c49ad2177028","id":"rel:ddc52a3e4e143989b6eafea19376f24a04235bec1d452011589e6ebfc946cb37","properties":{},"sourceDetailPath":"/data/v1/records/ctrl-aiuc-1-d002-34554b38.json","sourceId":"ctrl:aiuc-1:D002","targetDetailPath":"/data/v1/records/std-aiuc-1-d2a8b650.json","targetId":"std:aiuc-1","type":"belongs_to"},{"expectedCatalogRevision":"24028ffcfc2b295fa1b08ee6caa84b765f0731b321496bf4f548c49ad2177028","id":"rel:e115412b6dbd6e8acfd6e03c6f5a8f3d855469e2439b614314f3c5731fa7e439","properties":{"control_id":"A.5.9","coverage":"partial","delta":"inventorying information (data) assets themselves, addressed by the data-inventory control","framework":"iso-27001","provenance":{"defaultConfidence":"medium","defaultStatus":"active","direction":"canonical_to_source","mapper":"coworkcanvas-compliance-graph","note":"Each member is a documented relationship claim from the canonical unified control to a source control or guidance proposition. relationship: equal|superset_of (full) / intersects_with|subset_of (partial) / informs (guidance). confidence 'medium' = single-mapper, documented, not yet externally corroborated. source_version is the member framework's edition from the standard version register.","reviewDate":"2026-09-07"},"relationship":"intersects_with","source_version":"2022"},"sourceDetailPath":"/data/v1/records/uc-uc-asset-01-04dbd5db.json","sourceId":"uc:UC-ASSET-01","targetDetailPath":"/data/v1/records/ctrl-iso-27001-a-5-9-64706ee7.json","targetId":"ctrl:iso-27001:A.5.9","type":"maps_to"},{"expectedCatalogRevision":"24028ffcfc2b295fa1b08ee6caa84b765f0731b321496bf4f548c49ad2177028","id":"rel:e1d3b60ec55d2ba06662780df041b309092dbbf76738f7d5a030fa2f637b11dc","properties":{"control_id":"DSS06","coverage":"full","delta":null,"framework":"cobit-2019","provenance":{"defaultConfidence":"medium","defaultStatus":"active","direction":"canonical_to_source","mapper":"coworkcanvas-compliance-graph","note":"Each member is a documented relationship claim from the canonical unified control to a source control or guidance proposition. relationship: equal|superset_of (full) / intersects_with|subset_of (partial) / informs (guidance). confidence 'medium' = single-mapper, documented, not yet externally corroborated. source_version is the member framework's edition from the standard version register.","reviewDate":"2026-09-07"},"relationship":"equal","source_version":"2019"},"sourceDetailPath":"/data/v1/records/uc-uc-bcdr-14-997de451.json","sourceId":"uc:UC-BCDR-14","targetDetailPath":"/data/v1/records/ctrl-cobit-2019-dss06-c2b31b0e.json","targetId":"ctrl:cobit-2019:DSS06","type":"maps_to"},{"expectedCatalogRevision":"24028ffcfc2b295fa1b08ee6caa84b765f0731b321496bf4f548c49ad2177028","id":"rel:e2434c28f2fe20351c49b1b37d1e5c1a53d736d8c7ee0137874ed09f39991211","properties":{"control_id":"A.7.8","coverage":"full","delta":null,"framework":"iso-27001","provenance":{"defaultConfidence":"medium","defaultStatus":"active","direction":"canonical_to_source","mapper":"coworkcanvas-compliance-graph","note":"Each member is a documented relationship claim from the canonical unified control to a source control or guidance proposition. relationship: equal|superset_of (full) / intersects_with|subset_of (partial) / informs (guidance). confidence 'medium' = single-mapper, documented, not yet externally corroborated. source_version is the member framework's edition from the standard version register.","reviewDate":"2026-09-07"},"relationship":"superset_of","source_version":"2022"},"sourceDetailPath":"/data/v1/records/uc-uc-phys-04-91db5045.json","sourceId":"uc:UC-PHYS-04","targetDetailPath":"/data/v1/records/ctrl-iso-27001-a-7-8-9ee41158.json","targetId":"ctrl:iso-27001:A.7.8","type":"maps_to"},{"expectedCatalogRevision":"24028ffcfc2b295fa1b08ee6caa84b765f0731b321496bf4f548c49ad2177028","id":"rel:e3979cad3aae98c36674c4c9e4f6fe29e92ecc89cb8c15aa375b41159c15c131","properties":{},"sourceDetailPath":"/data/v1/records/ctrl-iso-27001-a-6-5-0eefa5a7.json","sourceId":"ctrl:iso-27001:A.6.5","targetDetailPath":"/data/v1/records/std-iso-27001-656201bd.json","targetId":"std:iso-27001","type":"belongs_to"},{"expectedCatalogRevision":"24028ffcfc2b295fa1b08ee6caa84b765f0731b321496bf4f548c49ad2177028","id":"rel:e606dc337059883eca825fc58e55c1db8da105553e224d4723b18417ca8583ac","properties":{"control_id":"B001","coverage":"full","delta":null,"framework":"aiuc-1","provenance":{"defaultConfidence":"medium","defaultStatus":"active","direction":"canonical_to_source","mapper":"coworkcanvas-compliance-graph","note":"Each member is a documented relationship claim from the canonical unified control to a source control or guidance proposition. relationship: equal|superset_of (full) / intersects_with|subset_of (partial) / informs (guidance). confidence 'medium' = single-mapper, documented, not yet externally corroborated. source_version is the member framework's edition from the standard version register.","reviewDate":"2026-09-07"},"relationship":"superset_of","source_version":"July 15, 2026 release (quarterly update cadence)"},"sourceDetailPath":"/data/v1/records/uc-uc-ai-21-8afd47db.json","sourceId":"uc:UC-AI-21","targetDetailPath":"/data/v1/records/ctrl-aiuc-1-b001-19a54ee3.json","targetId":"ctrl:aiuc-1:B001","type":"maps_to"},{"expectedCatalogRevision":"24028ffcfc2b295fa1b08ee6caa84b765f0731b321496bf4f548c49ad2177028","id":"rel:e6c399ff0ee25c27146451e6ddd253be33a84b22c7801d7cd382e03242436fa9","properties":{"control_id":"C009","coverage":"partial","delta":"in-product user controls to pause, stop, or override the system and to submit feedback in real time","framework":"aiuc-1","provenance":{"defaultConfidence":"medium","defaultStatus":"active","direction":"canonical_to_source","mapper":"coworkcanvas-compliance-graph","note":"Each member is a documented relationship claim from the canonical unified control to a source control or guidance proposition. relationship: equal|superset_of (full) / intersects_with|subset_of (partial) / informs (guidance). confidence 'medium' = single-mapper, documented, not yet externally corroborated. source_version is the member framework's edition from the standard version register.","reviewDate":"2026-09-07"},"relationship":"intersects_with","source_version":"July 15, 2026 release (quarterly update cadence)"},"sourceDetailPath":"/data/v1/records/uc-uc-ai-16-b95e2895.json","sourceId":"uc:UC-AI-16","targetDetailPath":"/data/v1/records/ctrl-aiuc-1-c009-d98e532e.json","targetId":"ctrl:aiuc-1:C009","type":"maps_to"},{"expectedCatalogRevision":"24028ffcfc2b295fa1b08ee6caa84b765f0731b321496bf4f548c49ad2177028","id":"rel:e79ff0a9d2787c6074c3ba824d0c2619a9050847fe531869971e71b589cdf0f6","properties":{"control_id":"AIA-Art14","coverage":"full","delta":null,"framework":"eu-ai-act","provenance":{"defaultConfidence":"medium","defaultStatus":"active","direction":"canonical_to_source","mapper":"coworkcanvas-compliance-graph","note":"Each member is a documented relationship claim from the canonical unified control to a source control or guidance proposition. relationship: equal|superset_of (full) / intersects_with|subset_of (partial) / informs (guidance). confidence 'medium' = single-mapper, documented, not yet externally corroborated. source_version is the member framework's edition from the standard version register.","reviewDate":"2026-09-07"},"relationship":"equal","source_version":"Regulation (EU) 2024/1689"},"sourceDetailPath":"/data/v1/records/uc-uc-ai-16-b95e2895.json","sourceId":"uc:UC-AI-16","targetDetailPath":"/data/v1/records/ctrl-eu-ai-act-aia-art14-4b7ae8a7.json","targetId":"ctrl:eu-ai-act:AIA-Art14","type":"maps_to"},{"expectedCatalogRevision":"24028ffcfc2b295fa1b08ee6caa84b765f0731b321496bf4f548c49ad2177028","id":"rel:eb0ed37196560f352a362b415b0bec4f7d604169244d4e8fe9f149661b959caf","properties":{},"sourceDetailPath":"/data/v1/records/ctrl-aiuc-1-c011-7889db41.json","sourceId":"ctrl:aiuc-1:C011","targetDetailPath":"/data/v1/records/std-aiuc-1-d2a8b650.json","targetId":"std:aiuc-1","type":"belongs_to"},{"expectedCatalogRevision":"24028ffcfc2b295fa1b08ee6caa84b765f0731b321496bf4f548c49ad2177028","id":"rel:ee4bd0b0aeceb95a424afa36ad02e6d4451caa9c510d9f33e0677397d55ea5fa","properties":{},"sourceDetailPath":"/data/v1/records/ctrl-iso-27001-a-6-7-74bc3cd8.json","sourceId":"ctrl:iso-27001:A.6.7","targetDetailPath":"/data/v1/records/std-iso-27001-656201bd.json","targetId":"std:iso-27001","type":"belongs_to"},{"expectedCatalogRevision":"24028ffcfc2b295fa1b08ee6caa84b765f0731b321496bf4f548c49ad2177028","id":"rel:ef5185bbce3dbf923fdad99dd5a87039f799656b92a6080d431a438782afac6b","properties":{},"sourceDetailPath":"/data/v1/records/ctrl-aiuc-1-c007-ebb82753.json","sourceId":"ctrl:aiuc-1:C007","targetDetailPath":"/data/v1/records/std-aiuc-1-d2a8b650.json","targetId":"std:aiuc-1","type":"belongs_to"},{"expectedCatalogRevision":"24028ffcfc2b295fa1b08ee6caa84b765f0731b321496bf4f548c49ad2177028","id":"rel:efbecca0067d4b5e71855e96df269f75abb2c761110802fdd48ee12236e59f31","properties":{},"sourceDetailPath":"/data/v1/records/ctrl-aiuc-1-b003-8c740cc9.json","sourceId":"ctrl:aiuc-1:B003","targetDetailPath":"/data/v1/records/std-aiuc-1-d2a8b650.json","targetId":"std:aiuc-1","type":"belongs_to"},{"expectedCatalogRevision":"24028ffcfc2b295fa1b08ee6caa84b765f0731b321496bf4f548c49ad2177028","id":"rel:f2dc4ec8b339793b1bff17301c96cd06c5e9a52ec5e53e22202d4a3ea2c5932c","properties":{},"sourceDetailPath":"/data/v1/records/ctrl-iso-27001-a-5-16-46fc8420.json","sourceId":"ctrl:iso-27001:A.5.16","targetDetailPath":"/data/v1/records/std-iso-27001-656201bd.json","targetId":"std:iso-27001","type":"belongs_to"},{"expectedCatalogRevision":"24028ffcfc2b295fa1b08ee6caa84b765f0731b321496bf4f548c49ad2177028","id":"rel:fa025a0315b5823b158620adb1e426d69f3be952af40edb9d2b815f9a31e2bc6","properties":{"control_id":"A003","coverage":"partial","delta":"agent-specific enforcement: data access scoped per task, user role, agent role, and context at inference time","framework":"aiuc-1","provenance":{"defaultConfidence":"medium","defaultStatus":"active","direction":"canonical_to_source","mapper":"coworkcanvas-compliance-graph","note":"Each member is a documented relationship claim from the canonical unified control to a source control or guidance proposition. relationship: equal|superset_of (full) / intersects_with|subset_of (partial) / informs (guidance). confidence 'medium' = single-mapper, documented, not yet externally corroborated. source_version is the member framework's edition from the standard version register.","reviewDate":"2026-09-07"},"relationship":"intersects_with","source_version":"July 15, 2026 release (quarterly update cadence)"},"sourceDetailPath":"/data/v1/records/uc-uc-access-03-43eeb212.json","sourceId":"uc:UC-ACCESS-03","targetDetailPath":"/data/v1/records/ctrl-aiuc-1-a003-bea61fd9.json","targetId":"ctrl:aiuc-1:A003","type":"maps_to"}],"schemaVersion":1,"scope":"topics","total":294}