{"catalogRevision":"24028ffcfc2b295fa1b08ee6caa84b765f0731b321496bf4f548c49ad2177028","contextIds":["ctrl:aiuc-1:B008","ctrl:aiuc-1:C001","ctrl:aiuc-1:C002","ctrl:aiuc-1:C008","ctrl:aiuc-1:E015","ctrl:ccpa:CCPA-1798.185","ctrl:cobit-2019:APO09","ctrl:cobit-2019:APO10","ctrl:cobit-2019:BAI03","ctrl:cobit-2019:BAI04","ctrl:cobit-2019:BAI06","ctrl:cobit-2019:BAI07","ctrl:cobit-2019:BAI08","ctrl:cobit-2019:BAI10","ctrl:cobit-2019:DSS01","ctrl:cobit-2019:DSS02","ctrl:cobit-2019:DSS03","ctrl:cobit-2019:DSS04","ctrl:cobit-2019:MEA04","ctrl:dora:DORA-Art17-23","ctrl:dora:DORA-Art24-27","ctrl:dora:DORA-Art28-44","ctrl:dora:DORA-Art5","ctrl:dora:DORA-Ch2","ctrl:eu-ai-act:AIA-Art12","ctrl:eu-ai-act:AIA-Art15","ctrl:eu-ai-act:AIA-Art19","ctrl:eu-ai-act:AIA-Art27","ctrl:eu-ai-act:AIA-Art6-7","ctrl:eu-ai-act:AIA-Art72","ctrl:hipaa:HIPAA-164.310","ctrl:iia-2024:Std 9.5","ctrl:iia-pos-2026-three-lines:IIA-POS-TLM-03","ctrl:iso-27001:A.5.11","ctrl:iso-27001:A.5.19","ctrl:iso-27001:A.5.22","ctrl:iso-27001:A.5.23","ctrl:iso-27001:A.5.26","ctrl:iso-27001:A.5.29","ctrl:iso-27001:A.5.30"],"directIds":[],"kind":"bundle","metadata":"/assets/agent_metadata.5c7612c9c5b0b455.json","name":"Business Continuity & Disaster Recovery","next":"/assets/agent_topics-business-continuity-disaster-recovery-2.e5a6cabdc22dee65.json","page":1,"pageSize":40,"records":[{"attributes":{"category":"technical","framework":"aiuc-1","type":"preventive"},"canonicalUrl":"https://controlsmap.com/frameworks/aiuc-1/","description":"Protect AI system deployment environment","details":{"automation":"hybrid","control_category":"technical","control_id":"B008","control_type":"preventive","domains":["AI Governance","Access Control & Identity Management","Secure Development (SDLC) & Application Security"],"framework":"aiuc-1","group":"Security","key_control":false,"requirement_frequency":"Every 12 months","requirement_status":"mandatory","risk_count":8,"source_pages":null,"source_url":"https://www.aiuc-1.com/security/protect-model-deployment-environment"},"direct":false,"htmlUrl":"/agents/records/ctrl-aiuc-1-b008-39c816b1.html","id":"ctrl:aiuc-1:B008","mapUrl":"https://controlsmap.com/?v=1&node=ctrl%3Aaiuc-1%3AB008","sourceIds":["aiuc-1"],"sourceUrl":"https://www.aiuc-1.com/security/protect-model-deployment-environment","title":"B008 — Protect AI system deployment environment","type":"control","url":"/assets/agent_record-ctrl-aiuc-1-b008-39c816b1.d20c1b777cbdcf3a.json"},{"attributes":{"category":"administrative","framework":"aiuc-1","type":"preventive"},"canonicalUrl":"https://controlsmap.com/frameworks/aiuc-1/","description":"Define AI risk taxonomy","details":{"automation":"manual","control_category":"administrative","control_id":"C001","control_type":"preventive","domains":["AI Governance"],"framework":"aiuc-1","group":"Safety","key_control":false,"requirement_frequency":"Every 12 months","requirement_status":"mandatory","risk_count":8,"source_pages":null,"source_url":"https://www.aiuc-1.com/safety/define-ai-risk-taxonomy"},"direct":false,"htmlUrl":"/agents/records/ctrl-aiuc-1-c001-6bc6c173.html","id":"ctrl:aiuc-1:C001","mapUrl":"https://controlsmap.com/?v=1&node=ctrl%3Aaiuc-1%3AC001","sourceIds":["aiuc-1"],"sourceUrl":"https://www.aiuc-1.com/safety/define-ai-risk-taxonomy","title":"C001 — Define AI risk taxonomy","type":"control","url":"/assets/agent_record-ctrl-aiuc-1-c001-6bc6c173.a628dce352165649.json"},{"attributes":{"category":"administrative","framework":"aiuc-1","type":"preventive"},"canonicalUrl":"https://controlsmap.com/frameworks/aiuc-1/","description":"Conduct pre-deployment testing","details":{"automation":"hybrid","control_category":"administrative","control_id":"C002","control_type":"preventive","domains":["AI Governance"],"framework":"aiuc-1","group":"Safety","key_control":false,"requirement_frequency":"Every 12 months","requirement_status":"mandatory","risk_count":6,"source_pages":null,"source_url":"https://www.aiuc-1.com/safety/conduct-pre-deployment-testing"},"direct":false,"htmlUrl":"/agents/records/ctrl-aiuc-1-c002-6c739dcb.html","id":"ctrl:aiuc-1:C002","mapUrl":"https://controlsmap.com/?v=1&node=ctrl%3Aaiuc-1%3AC002","sourceIds":["aiuc-1"],"sourceUrl":"https://www.aiuc-1.com/safety/conduct-pre-deployment-testing","title":"C002 — Conduct pre-deployment testing","type":"control","url":"/assets/agent_record-ctrl-aiuc-1-c002-6c739dcb.9f8944ee1bc83c9e.json"},{"attributes":{"category":"technical","framework":"aiuc-1","type":"detective"},"canonicalUrl":"https://controlsmap.com/frameworks/aiuc-1/","description":"Monitor AI risk categories","details":{"automation":"automated","control_category":"technical","control_id":"C008","control_type":"detective","domains":["AI Governance"],"framework":"aiuc-1","group":"Safety","key_control":false,"requirement_frequency":"Every 12 months","requirement_status":"optional","risk_count":6,"source_pages":null,"source_url":"https://www.aiuc-1.com/safety/monitor-ai-risk-categories"},"direct":false,"htmlUrl":"/agents/records/ctrl-aiuc-1-c008-94bd64f2.html","id":"ctrl:aiuc-1:C008","mapUrl":"https://controlsmap.com/?v=1&node=ctrl%3Aaiuc-1%3AC008","sourceIds":["aiuc-1"],"sourceUrl":"https://www.aiuc-1.com/safety/monitor-ai-risk-categories","title":"C008 — Monitor AI risk categories","type":"control","url":"/assets/agent_record-ctrl-aiuc-1-c008-94bd64f2.762375d4fb6f0a93.json"},{"attributes":{"category":"technical","framework":"aiuc-1","type":"detective"},"canonicalUrl":"https://controlsmap.com/frameworks/aiuc-1/","description":"Log AI system activity","details":{"automation":"automated","control_category":"technical","control_id":"E015","control_type":"detective","domains":["AI Governance","Governance, Policy & Oversight"],"framework":"aiuc-1","group":"Accountability","key_control":false,"requirement_frequency":"Every 12 months","requirement_status":"mandatory","risk_count":6,"source_pages":null,"source_url":"https://www.aiuc-1.com/accountability/log-model-activity"},"direct":false,"htmlUrl":"/agents/records/ctrl-aiuc-1-e015-94a0c8ea.html","id":"ctrl:aiuc-1:E015","mapUrl":"https://controlsmap.com/?v=1&node=ctrl%3Aaiuc-1%3AE015","sourceIds":["aiuc-1"],"sourceUrl":"https://www.aiuc-1.com/accountability/log-model-activity","title":"E015 — Log AI system activity","type":"control","url":"/assets/agent_record-ctrl-aiuc-1-e015-94a0c8ea.656c173a4dbefe3f.json"},{"attributes":{"category":"administrative","framework":"ccpa","type":"detective"},"canonicalUrl":"https://controlsmap.com/frameworks/ccpa/","description":"CPPA regulations: cybersecurity audits and risk assessments","details":{"automation":"manual","control_category":"administrative","control_id":"CCPA-1798.185","control_type":"detective","domains":["Data Protection & Privacy","Compliance, Audit & Assurance","Governance, Policy & Oversight"],"framework":"ccpa","group":"CCPA/CPRA (California Consumer Privacy)","key_control":false,"requirement_frequency":null,"requirement_status":null,"risk_count":2,"source_pages":null,"source_url":null},"direct":false,"htmlUrl":"/agents/records/ctrl-ccpa-ccpa-1798-185-1b524211.html","id":"ctrl:ccpa:CCPA-1798.185","mapUrl":"https://controlsmap.com/?v=1&node=ctrl%3Accpa%3ACCPA-1798.185","sourceIds":["ccpa"],"sourceUrl":null,"title":"CCPA-1798.185 — CPPA regulations: cybersecurity audits and risk assessments","type":"control","url":"/assets/agent_record-ctrl-ccpa-ccpa-1798-185-1b524211.18ee652fbb983ef5.json"},{"attributes":{"category":"administrative","framework":"cobit-2019","type":"preventive"},"canonicalUrl":"https://controlsmap.com/frameworks/cobit-2019/","description":"Managed Service Agreements","details":{"automation":"manual","control_category":"administrative","control_id":"APO09","control_type":"preventive","domains":["Governance, Policy & Oversight","Risk Assessment & Management","Human Resources / Personnel Security","Third-Party / Supply-Chain Risk","Asset Management & Inventory"],"framework":"cobit-2019","group":"Align, Plan and Organize","key_control":false,"requirement_frequency":null,"requirement_status":null,"risk_count":8,"source_pages":null,"source_url":null},"direct":false,"htmlUrl":"/agents/records/ctrl-cobit-2019-apo09-2d1f48e2.html","id":"ctrl:cobit-2019:APO09","mapUrl":"https://controlsmap.com/?v=1&node=ctrl%3Acobit-2019%3AAPO09","sourceIds":["cobit-2019"],"sourceUrl":null,"title":"APO09 — Managed Service Agreements","type":"control","url":"/assets/agent_record-ctrl-cobit-2019-apo09-2d1f48e2.633991f774128f82.json"},{"attributes":{"category":"administrative","framework":"cobit-2019","type":"preventive"},"canonicalUrl":"https://controlsmap.com/frameworks/cobit-2019/","description":"Managed Vendors","details":{"automation":"manual","control_category":"administrative","control_id":"APO10","control_type":"preventive","domains":["Governance, Policy & Oversight","Risk Assessment & Management","Human Resources / Personnel Security","Third-Party / Supply-Chain Risk","Asset Management & Inventory"],"framework":"cobit-2019","group":"Align, Plan and Organize","key_control":false,"requirement_frequency":null,"requirement_status":null,"risk_count":8,"source_pages":null,"source_url":null},"direct":false,"htmlUrl":"/agents/records/ctrl-cobit-2019-apo10-2c3cb0dc.html","id":"ctrl:cobit-2019:APO10","mapUrl":"https://controlsmap.com/?v=1&node=ctrl%3Acobit-2019%3AAPO10","sourceIds":["cobit-2019"],"sourceUrl":null,"title":"APO10 — Managed Vendors","type":"control","url":"/assets/agent_record-ctrl-cobit-2019-apo10-2c3cb0dc.c8d0cf0279298206.json"},{"attributes":{"category":"administrative","framework":"cobit-2019","type":"preventive"},"canonicalUrl":"https://controlsmap.com/frameworks/cobit-2019/","description":"Managed Solutions Identification and Build","details":{"automation":"manual","control_category":"administrative","control_id":"BAI03","control_type":"preventive","domains":["Secure Development (SDLC) & Application Security","Secure Configuration & Change Management","Asset Management & Inventory","Business Continuity & Disaster Recovery"],"framework":"cobit-2019","group":"Build, Acquire and Implement","key_control":false,"requirement_frequency":null,"requirement_status":null,"risk_count":8,"source_pages":null,"source_url":null},"direct":false,"htmlUrl":"/agents/records/ctrl-cobit-2019-bai03-bfe681b0.html","id":"ctrl:cobit-2019:BAI03","mapUrl":"https://controlsmap.com/?v=1&node=ctrl%3Acobit-2019%3ABAI03","sourceIds":["cobit-2019"],"sourceUrl":null,"title":"BAI03 — Managed Solutions Identification and Build","type":"control","url":"/assets/agent_record-ctrl-cobit-2019-bai03-bfe681b0.bf603bc83f14527d.json"},{"attributes":{"category":"administrative","framework":"cobit-2019","type":"preventive"},"canonicalUrl":"https://controlsmap.com/frameworks/cobit-2019/","description":"Managed Availability and Capacity","details":{"automation":"hybrid","control_category":"administrative","control_id":"BAI04","control_type":"preventive","domains":["Secure Development (SDLC) & Application Security","Secure Configuration & Change Management","Asset Management & Inventory","Business Continuity & Disaster Recovery"],"framework":"cobit-2019","group":"Build, Acquire and Implement","key_control":false,"requirement_frequency":null,"requirement_status":null,"risk_count":1,"source_pages":null,"source_url":null},"direct":false,"htmlUrl":"/agents/records/ctrl-cobit-2019-bai04-c6901e71.html","id":"ctrl:cobit-2019:BAI04","mapUrl":"https://controlsmap.com/?v=1&node=ctrl%3Acobit-2019%3ABAI04","sourceIds":["cobit-2019"],"sourceUrl":null,"title":"BAI04 — Managed Availability and Capacity","type":"control","url":"/assets/agent_record-ctrl-cobit-2019-bai04-c6901e71.0ebecd1d62e8c3f1.json"},{"attributes":{"category":"administrative","framework":"cobit-2019","type":"preventive"},"canonicalUrl":"https://controlsmap.com/frameworks/cobit-2019/","description":"Managed IT Changes","details":{"automation":"hybrid","control_category":"administrative","control_id":"BAI06","control_type":"preventive","domains":["Secure Development (SDLC) & Application Security","Secure Configuration & Change Management","Asset Management & Inventory","Business Continuity & Disaster Recovery"],"framework":"cobit-2019","group":"Build, Acquire and Implement","key_control":true,"requirement_frequency":null,"requirement_status":null,"risk_count":6,"source_pages":null,"source_url":null},"direct":false,"htmlUrl":"/agents/records/ctrl-cobit-2019-bai06-306e8a70.html","id":"ctrl:cobit-2019:BAI06","mapUrl":"https://controlsmap.com/?v=1&node=ctrl%3Acobit-2019%3ABAI06","sourceIds":["cobit-2019"],"sourceUrl":null,"title":"BAI06 — Managed IT Changes","type":"control","url":"/assets/agent_record-ctrl-cobit-2019-bai06-306e8a70.e9d535a4b9c13753.json"},{"attributes":{"category":"administrative","framework":"cobit-2019","type":"preventive"},"canonicalUrl":"https://controlsmap.com/frameworks/cobit-2019/","description":"Managed IT Change Acceptance and Transitioning","details":{"automation":"manual","control_category":"administrative","control_id":"BAI07","control_type":"preventive","domains":["Secure Development (SDLC) & Application Security","Secure Configuration & Change Management","Asset Management & Inventory","Business Continuity & Disaster Recovery"],"framework":"cobit-2019","group":"Build, Acquire and Implement","key_control":false,"requirement_frequency":null,"requirement_status":null,"risk_count":6,"source_pages":null,"source_url":null},"direct":false,"htmlUrl":"/agents/records/ctrl-cobit-2019-bai07-dcabfa26.html","id":"ctrl:cobit-2019:BAI07","mapUrl":"https://controlsmap.com/?v=1&node=ctrl%3Acobit-2019%3ABAI07","sourceIds":["cobit-2019"],"sourceUrl":null,"title":"BAI07 — Managed IT Change Acceptance and Transitioning","type":"control","url":"/assets/agent_record-ctrl-cobit-2019-bai07-dcabfa26.a0ff637dbb16bcb5.json"},{"attributes":{"category":"administrative","framework":"cobit-2019","type":"preventive"},"canonicalUrl":"https://controlsmap.com/frameworks/cobit-2019/","description":"Managed Knowledge","details":{"automation":"manual","control_category":"administrative","control_id":"BAI08","control_type":"preventive","domains":["Secure Development (SDLC) & Application Security","Secure Configuration & Change Management","Asset Management & Inventory","Business Continuity & Disaster Recovery"],"framework":"cobit-2019","group":"Build, Acquire and Implement","key_control":false,"requirement_frequency":null,"requirement_status":null,"risk_count":3,"source_pages":null,"source_url":null},"direct":false,"htmlUrl":"/agents/records/ctrl-cobit-2019-bai08-9f5f3d72.html","id":"ctrl:cobit-2019:BAI08","mapUrl":"https://controlsmap.com/?v=1&node=ctrl%3Acobit-2019%3ABAI08","sourceIds":["cobit-2019"],"sourceUrl":null,"title":"BAI08 — Managed Knowledge","type":"control","url":"/assets/agent_record-ctrl-cobit-2019-bai08-9f5f3d72.7270def696a140ff.json"},{"attributes":{"category":"administrative","framework":"cobit-2019","type":"preventive"},"canonicalUrl":"https://controlsmap.com/frameworks/cobit-2019/","description":"Managed Configuration","details":{"automation":"hybrid","control_category":"administrative","control_id":"BAI10","control_type":"preventive","domains":["Secure Development (SDLC) & Application Security","Secure Configuration & Change Management","Asset Management & Inventory","Business Continuity & Disaster Recovery"],"framework":"cobit-2019","group":"Build, Acquire and Implement","key_control":false,"requirement_frequency":null,"requirement_status":null,"risk_count":7,"source_pages":null,"source_url":null},"direct":false,"htmlUrl":"/agents/records/ctrl-cobit-2019-bai10-40479176.html","id":"ctrl:cobit-2019:BAI10","mapUrl":"https://controlsmap.com/?v=1&node=ctrl%3Acobit-2019%3ABAI10","sourceIds":["cobit-2019"],"sourceUrl":null,"title":"BAI10 — Managed Configuration","type":"control","url":"/assets/agent_record-ctrl-cobit-2019-bai10-40479176.0dd8cba1e3a97830.json"},{"attributes":{"category":"administrative","framework":"cobit-2019","type":"preventive"},"canonicalUrl":"https://controlsmap.com/frameworks/cobit-2019/","description":"Managed Operations","details":{"automation":"hybrid","control_category":"administrative","control_id":"DSS01","control_type":"preventive","domains":["Business Continuity & Disaster Recovery","Incident Management & Response","Logging, Monitoring & Detection","Governance, Policy & Oversight"],"framework":"cobit-2019","group":"Deliver, Service and Support","key_control":false,"requirement_frequency":null,"requirement_status":null,"risk_count":3,"source_pages":null,"source_url":null},"direct":false,"htmlUrl":"/agents/records/ctrl-cobit-2019-dss01-d3ff2961.html","id":"ctrl:cobit-2019:DSS01","mapUrl":"https://controlsmap.com/?v=1&node=ctrl%3Acobit-2019%3ADSS01","sourceIds":["cobit-2019"],"sourceUrl":null,"title":"DSS01 — Managed Operations","type":"control","url":"/assets/agent_record-ctrl-cobit-2019-dss01-d3ff2961.90fbf85675339668.json"},{"attributes":{"category":"administrative","framework":"cobit-2019","type":"corrective"},"canonicalUrl":"https://controlsmap.com/frameworks/cobit-2019/","description":"Managed Service Requests and Incidents","details":{"automation":"hybrid","control_category":"administrative","control_id":"DSS02","control_type":"corrective","domains":["Business Continuity & Disaster Recovery","Incident Management & Response","Logging, Monitoring & Detection","Governance, Policy & Oversight"],"framework":"cobit-2019","group":"Deliver, Service and Support","key_control":false,"requirement_frequency":null,"requirement_status":null,"risk_count":5,"source_pages":null,"source_url":null},"direct":false,"htmlUrl":"/agents/records/ctrl-cobit-2019-dss02-af5bca5d.html","id":"ctrl:cobit-2019:DSS02","mapUrl":"https://controlsmap.com/?v=1&node=ctrl%3Acobit-2019%3ADSS02","sourceIds":["cobit-2019"],"sourceUrl":null,"title":"DSS02 — Managed Service Requests and Incidents","type":"control","url":"/assets/agent_record-ctrl-cobit-2019-dss02-af5bca5d.d9fabf94aa20dc7d.json"},{"attributes":{"category":"administrative","framework":"cobit-2019","type":"corrective"},"canonicalUrl":"https://controlsmap.com/frameworks/cobit-2019/","description":"Managed Problems","details":{"automation":"manual","control_category":"administrative","control_id":"DSS03","control_type":"corrective","domains":["Business Continuity & Disaster Recovery","Incident Management & Response","Logging, Monitoring & Detection","Governance, Policy & Oversight"],"framework":"cobit-2019","group":"Deliver, Service and Support","key_control":false,"requirement_frequency":null,"requirement_status":null,"risk_count":5,"source_pages":null,"source_url":null},"direct":false,"htmlUrl":"/agents/records/ctrl-cobit-2019-dss03-2540740f.html","id":"ctrl:cobit-2019:DSS03","mapUrl":"https://controlsmap.com/?v=1&node=ctrl%3Acobit-2019%3ADSS03","sourceIds":["cobit-2019"],"sourceUrl":null,"title":"DSS03 — Managed Problems","type":"control","url":"/assets/agent_record-ctrl-cobit-2019-dss03-2540740f.0983703d1904b1c5.json"},{"attributes":{"category":"administrative","framework":"cobit-2019","type":"corrective"},"canonicalUrl":"https://controlsmap.com/frameworks/cobit-2019/","description":"Managed Continuity","details":{"automation":"hybrid","control_category":"administrative","control_id":"DSS04","control_type":"corrective","domains":["Business Continuity & Disaster Recovery","Incident Management & Response","Logging, Monitoring & Detection","Governance, Policy & Oversight"],"framework":"cobit-2019","group":"Deliver, Service and Support","key_control":true,"requirement_frequency":null,"requirement_status":null,"risk_count":5,"source_pages":null,"source_url":null},"direct":false,"htmlUrl":"/agents/records/ctrl-cobit-2019-dss04-2d611bca.html","id":"ctrl:cobit-2019:DSS04","mapUrl":"https://controlsmap.com/?v=1&node=ctrl%3Acobit-2019%3ADSS04","sourceIds":["cobit-2019"],"sourceUrl":null,"title":"DSS04 — Managed Continuity","type":"control","url":"/assets/agent_record-ctrl-cobit-2019-dss04-2d611bca.f6686538c00a9f08.json"},{"attributes":{"category":"administrative","framework":"cobit-2019","type":"detective"},"canonicalUrl":"https://controlsmap.com/frameworks/cobit-2019/","description":"Managed Assurance","details":{"automation":"manual","control_category":"administrative","control_id":"MEA04","control_type":"detective","domains":["Compliance, Audit & Assurance","Governance, Policy & Oversight","Risk Assessment & Management"],"framework":"cobit-2019","group":"Monitor, Evaluate and Assess","key_control":false,"requirement_frequency":null,"requirement_status":null,"risk_count":2,"source_pages":null,"source_url":null},"direct":false,"htmlUrl":"/agents/records/ctrl-cobit-2019-mea04-4181ede5.html","id":"ctrl:cobit-2019:MEA04","mapUrl":"https://controlsmap.com/?v=1&node=ctrl%3Acobit-2019%3AMEA04","sourceIds":["cobit-2019"],"sourceUrl":null,"title":"MEA04 — Managed Assurance","type":"control","url":"/assets/agent_record-ctrl-cobit-2019-mea04-4181ede5.788bdc4dff73310c.json"},{"attributes":{"category":"administrative","framework":"dora","type":"corrective"},"canonicalUrl":"https://controlsmap.com/frameworks/dora/","description":"ICT-related incident management, classification and reporting","details":{"automation":"hybrid","control_category":"administrative","control_id":"DORA-Art17-23","control_type":"corrective","domains":["Business Continuity & Disaster Recovery","Incident Management & Response","Third-Party / Supply-Chain Risk","Governance, Policy & Oversight","Risk Assessment & Management"],"framework":"dora","group":"EU DORA (Digital Operational Resilience Act)","key_control":true,"requirement_frequency":null,"requirement_status":null,"risk_count":5,"source_pages":null,"source_url":null},"direct":false,"htmlUrl":"/agents/records/ctrl-dora-dora-art17-23-9aa7977f.html","id":"ctrl:dora:DORA-Art17-23","mapUrl":"https://controlsmap.com/?v=1&node=ctrl%3Adora%3ADORA-Art17-23","sourceIds":["dora"],"sourceUrl":null,"title":"DORA-Art17-23 — ICT-related incident management, classification and reporting","type":"control","url":"/assets/agent_record-ctrl-dora-dora-art17-23-9aa7977f.313cf7638f5cfdb3.json"},{"attributes":{"category":"technical","framework":"dora","type":"detective"},"canonicalUrl":"https://controlsmap.com/frameworks/dora/","description":"Digital operational resilience testing (incl. threat-led penetration testing)","details":{"automation":"hybrid","control_category":"technical","control_id":"DORA-Art24-27","control_type":"detective","domains":["Business Continuity & Disaster Recovery","Incident Management & Response","Third-Party / Supply-Chain Risk","Governance, Policy & Oversight","Risk Assessment & Management"],"framework":"dora","group":"EU DORA (Digital Operational Resilience Act)","key_control":false,"requirement_frequency":null,"requirement_status":null,"risk_count":3,"source_pages":null,"source_url":null},"direct":false,"htmlUrl":"/agents/records/ctrl-dora-dora-art24-27-dc4b8836.html","id":"ctrl:dora:DORA-Art24-27","mapUrl":"https://controlsmap.com/?v=1&node=ctrl%3Adora%3ADORA-Art24-27","sourceIds":["dora"],"sourceUrl":null,"title":"DORA-Art24-27 — Digital operational resilience testing (incl. threat-led penetration testing)","type":"control","url":"/assets/agent_record-ctrl-dora-dora-art24-27-dc4b8836.10b427458b73121d.json"},{"attributes":{"category":"administrative","framework":"dora","type":"preventive"},"canonicalUrl":"https://controlsmap.com/frameworks/dora/","description":"Managing of ICT third-party risk","details":{"automation":"manual","control_category":"administrative","control_id":"DORA-Art28-44","control_type":"preventive","domains":["Business Continuity & Disaster Recovery","Incident Management & Response","Third-Party / Supply-Chain Risk","Governance, Policy & Oversight","Risk Assessment & Management"],"framework":"dora","group":"EU DORA (Digital Operational Resilience Act)","key_control":false,"requirement_frequency":null,"requirement_status":null,"risk_count":8,"source_pages":null,"source_url":null},"direct":false,"htmlUrl":"/agents/records/ctrl-dora-dora-art28-44-d3e89c89.html","id":"ctrl:dora:DORA-Art28-44","mapUrl":"https://controlsmap.com/?v=1&node=ctrl%3Adora%3ADORA-Art28-44","sourceIds":["dora"],"sourceUrl":null,"title":"DORA-Art28-44 — Managing of ICT third-party risk","type":"control","url":"/assets/agent_record-ctrl-dora-dora-art28-44-d3e89c89.a71563b64de05293.json"},{"attributes":{"category":"administrative","framework":"dora","type":"preventive"},"canonicalUrl":"https://controlsmap.com/frameworks/dora/","description":"Governance and organisation (management body responsibility)","details":{"automation":"manual","control_category":"administrative","control_id":"DORA-Art5","control_type":"preventive","domains":["Business Continuity & Disaster Recovery","Incident Management & Response","Third-Party / Supply-Chain Risk","Governance, Policy & Oversight","Risk Assessment & Management"],"framework":"dora","group":"EU DORA (Digital Operational Resilience Act)","key_control":false,"requirement_frequency":null,"requirement_status":null,"risk_count":1,"source_pages":null,"source_url":null},"direct":false,"htmlUrl":"/agents/records/ctrl-dora-dora-art5-3d1842f7.html","id":"ctrl:dora:DORA-Art5","mapUrl":"https://controlsmap.com/?v=1&node=ctrl%3Adora%3ADORA-Art5","sourceIds":["dora"],"sourceUrl":null,"title":"DORA-Art5 — Governance and organisation (management body responsibility)","type":"control","url":"/assets/agent_record-ctrl-dora-dora-art5-3d1842f7.843a5a617cff9f36.json"},{"attributes":{"category":"administrative","framework":"dora","type":"preventive"},"canonicalUrl":"https://controlsmap.com/frameworks/dora/","description":"ICT risk management framework (Art 5-16)","details":{"automation":"manual","control_category":"administrative","control_id":"DORA-Ch2","control_type":"preventive","domains":["Business Continuity & Disaster Recovery","Incident Management & Response","Third-Party / Supply-Chain Risk","Governance, Policy & Oversight","Risk Assessment & Management"],"framework":"dora","group":"EU DORA (Digital Operational Resilience Act)","key_control":false,"requirement_frequency":null,"requirement_status":null,"risk_count":1,"source_pages":null,"source_url":null},"direct":false,"htmlUrl":"/agents/records/ctrl-dora-dora-ch2-891a747a.html","id":"ctrl:dora:DORA-Ch2","mapUrl":"https://controlsmap.com/?v=1&node=ctrl%3Adora%3ADORA-Ch2","sourceIds":["dora"],"sourceUrl":null,"title":"DORA-Ch2 — ICT risk management framework (Art 5-16)","type":"control","url":"/assets/agent_record-ctrl-dora-dora-ch2-891a747a.7f641d4dbc859a90.json"},{"attributes":{"category":"technical","framework":"eu-ai-act","type":"detective"},"canonicalUrl":"https://controlsmap.com/frameworks/eu-ai-act/","description":"Record-keeping / logging (high-risk)","details":{"automation":"automated","control_category":"technical","control_id":"AIA-Art12","control_type":"detective","domains":["AI Governance","Risk Assessment & Management","Governance, Policy & Oversight"],"framework":"eu-ai-act","group":"EU AI Act","key_control":true,"requirement_frequency":null,"requirement_status":null,"risk_count":6,"source_pages":null,"source_url":null},"direct":false,"htmlUrl":"/agents/records/ctrl-eu-ai-act-aia-art12-3714b8af.html","id":"ctrl:eu-ai-act:AIA-Art12","mapUrl":"https://controlsmap.com/?v=1&node=ctrl%3Aeu-ai-act%3AAIA-Art12","sourceIds":["eu-ai-act"],"sourceUrl":null,"title":"AIA-Art12 — Record-keeping / logging (high-risk)","type":"control","url":"/assets/agent_record-ctrl-eu-ai-act-aia-art12-3714b8af.118bd0f6a3053147.json"},{"attributes":{"category":"technical","framework":"eu-ai-act","type":"preventive"},"canonicalUrl":"https://controlsmap.com/frameworks/eu-ai-act/","description":"Accuracy, robustness and cybersecurity (high-risk)","details":{"automation":"hybrid","control_category":"technical","control_id":"AIA-Art15","control_type":"preventive","domains":["AI Governance","Risk Assessment & Management","Governance, Policy & Oversight"],"framework":"eu-ai-act","group":"EU AI Act","key_control":false,"requirement_frequency":null,"requirement_status":null,"risk_count":8,"source_pages":null,"source_url":null},"direct":false,"htmlUrl":"/agents/records/ctrl-eu-ai-act-aia-art15-c3704411.html","id":"ctrl:eu-ai-act:AIA-Art15","mapUrl":"https://controlsmap.com/?v=1&node=ctrl%3Aeu-ai-act%3AAIA-Art15","sourceIds":["eu-ai-act"],"sourceUrl":null,"title":"AIA-Art15 — Accuracy, robustness and cybersecurity (high-risk)","type":"control","url":"/assets/agent_record-ctrl-eu-ai-act-aia-art15-c3704411.8feee43381f296a4.json"},{"attributes":{"category":"technical","framework":"eu-ai-act","type":"detective"},"canonicalUrl":"https://controlsmap.com/frameworks/eu-ai-act/","description":"Automatically generated logs — provider retention of high-risk system logs (minimum six months)","details":{"automation":"automated","control_category":"technical","control_id":"AIA-Art19","control_type":"detective","domains":["AI Governance","Risk Assessment & Management","Governance, Policy & Oversight"],"framework":"eu-ai-act","group":"EU AI Act","key_control":false,"requirement_frequency":null,"requirement_status":null,"risk_count":6,"source_pages":null,"source_url":null},"direct":false,"htmlUrl":"/agents/records/ctrl-eu-ai-act-aia-art19-55451bfa.html","id":"ctrl:eu-ai-act:AIA-Art19","mapUrl":"https://controlsmap.com/?v=1&node=ctrl%3Aeu-ai-act%3AAIA-Art19","sourceIds":["eu-ai-act"],"sourceUrl":null,"title":"AIA-Art19 — Automatically generated logs — provider retention of high-risk system logs (minimum six months)","type":"control","url":"/assets/agent_record-ctrl-eu-ai-act-aia-art19-55451bfa.87a8da9d00d38c01.json"},{"attributes":{"category":"administrative","framework":"eu-ai-act","type":"preventive"},"canonicalUrl":"https://controlsmap.com/frameworks/eu-ai-act/","description":"Fundamental rights impact assessment for high-risk AI systems (deployers)","details":{"automation":"manual","control_category":"administrative","control_id":"AIA-Art27","control_type":"preventive","domains":["AI Governance","Risk Assessment & Management","Governance, Policy & Oversight"],"framework":"eu-ai-act","group":"EU AI Act","key_control":false,"requirement_frequency":null,"requirement_status":null,"risk_count":8,"source_pages":null,"source_url":null},"direct":false,"htmlUrl":"/agents/records/ctrl-eu-ai-act-aia-art27-7b550500.html","id":"ctrl:eu-ai-act:AIA-Art27","mapUrl":"https://controlsmap.com/?v=1&node=ctrl%3Aeu-ai-act%3AAIA-Art27","sourceIds":["eu-ai-act"],"sourceUrl":null,"title":"AIA-Art27 — Fundamental rights impact assessment for high-risk AI systems (deployers)","type":"control","url":"/assets/agent_record-ctrl-eu-ai-act-aia-art27-7b550500.c84e32a15d604ed9.json"},{"attributes":{"category":"administrative","framework":"eu-ai-act","type":"preventive"},"canonicalUrl":"https://controlsmap.com/frameworks/eu-ai-act/","description":"Risk-based classification of high-risk AI systems","details":{"automation":"manual","control_category":"administrative","control_id":"AIA-Art6-7","control_type":"preventive","domains":["AI Governance","Risk Assessment & Management","Governance, Policy & Oversight"],"framework":"eu-ai-act","group":"EU AI Act","key_control":false,"requirement_frequency":null,"requirement_status":null,"risk_count":8,"source_pages":null,"source_url":null},"direct":false,"htmlUrl":"/agents/records/ctrl-eu-ai-act-aia-art6-7-cd7435c0.html","id":"ctrl:eu-ai-act:AIA-Art6-7","mapUrl":"https://controlsmap.com/?v=1&node=ctrl%3Aeu-ai-act%3AAIA-Art6-7","sourceIds":["eu-ai-act"],"sourceUrl":null,"title":"AIA-Art6-7 — Risk-based classification of high-risk AI systems","type":"control","url":"/assets/agent_record-ctrl-eu-ai-act-aia-art6-7-cd7435c0.b842560dde490b21.json"},{"attributes":{"category":"administrative","framework":"eu-ai-act","type":"detective"},"canonicalUrl":"https://controlsmap.com/frameworks/eu-ai-act/","description":"Post-market monitoring by providers of high-risk AI systems","details":{"automation":"hybrid","control_category":"administrative","control_id":"AIA-Art72","control_type":"detective","domains":["AI Governance","Risk Assessment & Management","Governance, Policy & Oversight"],"framework":"eu-ai-act","group":"EU AI Act","key_control":false,"requirement_frequency":null,"requirement_status":null,"risk_count":6,"source_pages":null,"source_url":null},"direct":false,"htmlUrl":"/agents/records/ctrl-eu-ai-act-aia-art72-2866ca15.html","id":"ctrl:eu-ai-act:AIA-Art72","mapUrl":"https://controlsmap.com/?v=1&node=ctrl%3Aeu-ai-act%3AAIA-Art72","sourceIds":["eu-ai-act"],"sourceUrl":null,"title":"AIA-Art72 — Post-market monitoring by providers of high-risk AI systems","type":"control","url":"/assets/agent_record-ctrl-eu-ai-act-aia-art72-2866ca15.6e8db1483b110a8e.json"},{"attributes":{"category":"physical","framework":"hipaa","type":"preventive"},"canonicalUrl":"https://controlsmap.com/frameworks/hipaa/","description":"Physical safeguards (facility access controls, workstation use/security, device and media controls)","details":{"automation":"hybrid","control_category":"physical","control_id":"HIPAA-164.310","control_type":"preventive","domains":["Governance, Policy & Oversight","Risk Assessment & Management","Access Control & Identity Management","Physical & Environmental Security","Logging, Monitoring & Detection","Business Continuity & Disaster Recovery","Third-Party / Supply-Chain Risk","Data Protection & Privacy"],"framework":"hipaa","group":"HIPAA Security Rule","key_control":false,"requirement_frequency":null,"requirement_status":null,"risk_count":3,"source_pages":null,"source_url":null},"direct":false,"htmlUrl":"/agents/records/ctrl-hipaa-hipaa-164-310-9cf84fad.html","id":"ctrl:hipaa:HIPAA-164.310","mapUrl":"https://controlsmap.com/?v=1&node=ctrl%3Ahipaa%3AHIPAA-164.310","sourceIds":["hipaa"],"sourceUrl":null,"title":"HIPAA-164.310 — Physical safeguards (facility access controls, workstation use/security, device and media controls)","type":"control","url":"/assets/agent_record-ctrl-hipaa-hipaa-164-310-9cf84fad.0d7044dffd909ae9.json"},{"attributes":{"category":"administrative","framework":"iia-2024","type":"preventive"},"canonicalUrl":"https://controlsmap.com/frameworks/iia-2024/","description":"Coordination and Reliance","details":{"automation":"manual","control_category":"administrative","control_id":"Std 9.5","control_type":"preventive","domains":["Compliance, Audit & Assurance","Governance, Policy & Oversight","Risk Assessment & Management"],"framework":"iia-2024","group":"Domain IV — Managing the Internal Audit Function","key_control":false,"requirement_frequency":null,"requirement_status":null,"risk_count":2,"source_pages":null,"source_url":null},"direct":false,"htmlUrl":"/agents/records/ctrl-iia-2024-std-9-5-0fb8f00f.html","id":"ctrl:iia-2024:Std 9.5","mapUrl":"https://controlsmap.com/?v=1&node=ctrl%3Aiia-2024%3AStd+9.5","sourceIds":["iia-2024"],"sourceUrl":null,"title":"Std 9.5 — Coordination and Reliance","type":"control","url":"/assets/agent_record-ctrl-iia-2024-std-9-5-0fb8f00f.c67ce368d907c81f.json"},{"attributes":{"category":"administrative","framework":"iia-pos-2026-three-lines","type":"detective"},"canonicalUrl":"https://controlsmap.com/frameworks/iia-pos-2026-three-lines/","description":"Assurance providers coordinate and rely on one another only where independence, competence, evidence, and coverage support reliance; gaps and duplication remain visible to the board.","details":{"automation":"manual","control_category":"administrative","control_id":"IIA-POS-TLM-03","control_type":"detective","domains":[],"framework":"iia-pos-2026-three-lines","group":"Three Lines Role Integrity","key_control":false,"requirement_frequency":null,"requirement_status":null,"risk_count":2,"source_pages":"Three Lines pp. 15–16, 18–19","source_url":null,"statement":"Assurance providers coordinate and rely on one another only where independence, competence, evidence, and coverage support reliance; gaps and duplication remain visible to the board."},"direct":false,"htmlUrl":"/agents/records/ctrl-iia-pos-2026-three-lines-iia-pos-tlm-03-95334e6e.html","id":"ctrl:iia-pos-2026-three-lines:IIA-POS-TLM-03","mapUrl":"https://controlsmap.com/?v=1&node=ctrl%3Aiia-pos-2026-three-lines%3AIIA-POS-TLM-03","sourceIds":["iia-pos-2026-three-lines"],"sourceUrl":null,"title":"IIA-POS-TLM-03 — Assurance Coordination and Reliance","type":"control","url":"/assets/agent_record-ctrl-iia-pos-2026-three-lines-iia-pos-tlm-03-95334e6e.efbc41e7c5cdc1d5.json"},{"attributes":{"category":"administrative","framework":"iso-27001","type":"preventive"},"canonicalUrl":"https://controlsmap.com/frameworks/iso-27001/","description":"Return of assets","details":{"automation":"manual","control_category":"administrative","control_id":"A.5.11","control_type":"preventive","domains":["Asset Management & Inventory"],"framework":"iso-27001","group":"Organizational controls","key_control":false,"requirement_frequency":null,"requirement_status":null,"risk_count":4,"source_pages":null,"source_url":null},"direct":false,"htmlUrl":"/agents/records/ctrl-iso-27001-a-5-11-07680424.html","id":"ctrl:iso-27001:A.5.11","mapUrl":"https://controlsmap.com/?v=1&node=ctrl%3Aiso-27001%3AA.5.11","sourceIds":["iso-27001"],"sourceUrl":null,"title":"A.5.11 — Return of assets","type":"control","url":"/assets/agent_record-ctrl-iso-27001-a-5-11-07680424.e29c61129efc0ae8.json"},{"attributes":{"category":"administrative","framework":"iso-27001","type":"preventive"},"canonicalUrl":"https://controlsmap.com/frameworks/iso-27001/","description":"Information security in supplier relationships","details":{"automation":"manual","control_category":"administrative","control_id":"A.5.19","control_type":"preventive","domains":["Third-Party / Supply-Chain Risk"],"framework":"iso-27001","group":"Organizational controls","key_control":false,"requirement_frequency":null,"requirement_status":null,"risk_count":8,"source_pages":null,"source_url":null},"direct":false,"htmlUrl":"/agents/records/ctrl-iso-27001-a-5-19-d8db0691.html","id":"ctrl:iso-27001:A.5.19","mapUrl":"https://controlsmap.com/?v=1&node=ctrl%3Aiso-27001%3AA.5.19","sourceIds":["iso-27001"],"sourceUrl":null,"title":"A.5.19 — Information security in supplier relationships","type":"control","url":"/assets/agent_record-ctrl-iso-27001-a-5-19-d8db0691.de7b110d8bf84811.json"},{"attributes":{"category":"administrative","framework":"iso-27001","type":"detective"},"canonicalUrl":"https://controlsmap.com/frameworks/iso-27001/","description":"Monitoring, review and change management of supplier services","details":{"automation":"manual","control_category":"administrative","control_id":"A.5.22","control_type":"detective","domains":["Third-Party / Supply-Chain Risk"],"framework":"iso-27001","group":"Organizational controls","key_control":false,"requirement_frequency":null,"requirement_status":null,"risk_count":4,"source_pages":null,"source_url":null},"direct":false,"htmlUrl":"/agents/records/ctrl-iso-27001-a-5-22-bb292d09.html","id":"ctrl:iso-27001:A.5.22","mapUrl":"https://controlsmap.com/?v=1&node=ctrl%3Aiso-27001%3AA.5.22","sourceIds":["iso-27001"],"sourceUrl":null,"title":"A.5.22 — Monitoring, review and change management of supplier services","type":"control","url":"/assets/agent_record-ctrl-iso-27001-a-5-22-bb292d09.93c2f51c859bb64f.json"},{"attributes":{"category":"administrative","framework":"iso-27001","type":"preventive"},"canonicalUrl":"https://controlsmap.com/frameworks/iso-27001/","description":"Information security for use of cloud services","details":{"automation":"manual","control_category":"administrative","control_id":"A.5.23","control_type":"preventive","domains":["Third-Party / Supply-Chain Risk"],"framework":"iso-27001","group":"Organizational controls","key_control":false,"requirement_frequency":null,"requirement_status":null,"risk_count":4,"source_pages":null,"source_url":null},"direct":false,"htmlUrl":"/agents/records/ctrl-iso-27001-a-5-23-b73e5b7d.html","id":"ctrl:iso-27001:A.5.23","mapUrl":"https://controlsmap.com/?v=1&node=ctrl%3Aiso-27001%3AA.5.23","sourceIds":["iso-27001"],"sourceUrl":null,"title":"A.5.23 — Information security for use of cloud services","type":"control","url":"/assets/agent_record-ctrl-iso-27001-a-5-23-b73e5b7d.8d6531b3d5e3a459.json"},{"attributes":{"category":"administrative","framework":"iso-27001","type":"corrective"},"canonicalUrl":"https://controlsmap.com/frameworks/iso-27001/","description":"Response to information security incidents","details":{"automation":"manual","control_category":"administrative","control_id":"A.5.26","control_type":"corrective","domains":["Incident Management & Response"],"framework":"iso-27001","group":"Organizational controls","key_control":false,"requirement_frequency":null,"requirement_status":null,"risk_count":3,"source_pages":null,"source_url":null},"direct":false,"htmlUrl":"/agents/records/ctrl-iso-27001-a-5-26-863e832e.html","id":"ctrl:iso-27001:A.5.26","mapUrl":"https://controlsmap.com/?v=1&node=ctrl%3Aiso-27001%3AA.5.26","sourceIds":["iso-27001"],"sourceUrl":null,"title":"A.5.26 — Response to information security incidents","type":"control","url":"/assets/agent_record-ctrl-iso-27001-a-5-26-863e832e.4d7659d97c4996db.json"},{"attributes":{"category":"administrative","framework":"iso-27001","type":"corrective"},"canonicalUrl":"https://controlsmap.com/frameworks/iso-27001/","description":"Information security during disruption","details":{"automation":"manual","control_category":"administrative","control_id":"A.5.29","control_type":"corrective","domains":["Business Continuity & Disaster Recovery"],"framework":"iso-27001","group":"Organizational controls","key_control":false,"requirement_frequency":null,"requirement_status":null,"risk_count":5,"source_pages":null,"source_url":null},"direct":false,"htmlUrl":"/agents/records/ctrl-iso-27001-a-5-29-e6db7f58.html","id":"ctrl:iso-27001:A.5.29","mapUrl":"https://controlsmap.com/?v=1&node=ctrl%3Aiso-27001%3AA.5.29","sourceIds":["iso-27001"],"sourceUrl":null,"title":"A.5.29 — Information security during disruption","type":"control","url":"/assets/agent_record-ctrl-iso-27001-a-5-29-e6db7f58.f63f3674e6d4f33e.json"},{"attributes":{"category":"administrative","framework":"iso-27001","type":"corrective"},"canonicalUrl":"https://controlsmap.com/frameworks/iso-27001/","description":"ICT readiness for business continuity","details":{"automation":"manual","control_category":"administrative","control_id":"A.5.30","control_type":"corrective","domains":["Business Continuity & Disaster Recovery"],"framework":"iso-27001","group":"Organizational controls","key_control":false,"requirement_frequency":null,"requirement_status":null,"risk_count":5,"source_pages":null,"source_url":null},"direct":false,"htmlUrl":"/agents/records/ctrl-iso-27001-a-5-30-08880829.html","id":"ctrl:iso-27001:A.5.30","mapUrl":"https://controlsmap.com/?v=1&node=ctrl%3Aiso-27001%3AA.5.30","sourceIds":["iso-27001"],"sourceUrl":null,"title":"A.5.30 — ICT readiness for business continuity","type":"control","url":"/assets/agent_record-ctrl-iso-27001-a-5-30-08880829.25c6100e9bf5a4b0.json"}],"relationships":[{"expectedCatalogRevision":"24028ffcfc2b295fa1b08ee6caa84b765f0731b321496bf4f548c49ad2177028","id":"rel:05f47708636fcc22888663483542bc3e8693875eea819fc13c46fbd1ba60f18f","properties":{},"sourceDetailPath":"/data/v1/records/ctrl-cobit-2019-apo09-2d1f48e2.json","sourceId":"ctrl:cobit-2019:APO09","targetDetailPath":"/data/v1/records/std-cobit-2019-2181ce0c.json","targetId":"std:cobit-2019","type":"belongs_to"},{"expectedCatalogRevision":"24028ffcfc2b295fa1b08ee6caa84b765f0731b321496bf4f548c49ad2177028","id":"rel:076722c10b06e43d9f84521802be10ef1863a351ae38466b1fca083ff7a9fda1","properties":{},"sourceDetailPath":"/data/v1/records/ctrl-aiuc-1-c008-94bd64f2.json","sourceId":"ctrl:aiuc-1:C008","targetDetailPath":"/data/v1/records/std-aiuc-1-d2a8b650.json","targetId":"std:aiuc-1","type":"belongs_to"},{"expectedCatalogRevision":"24028ffcfc2b295fa1b08ee6caa84b765f0731b321496bf4f548c49ad2177028","id":"rel:154d032b8c8a51251df0659b39df888301f7cb7aae1f872ad0aa66f4279be75b","properties":{},"sourceDetailPath":"/data/v1/records/ctrl-hipaa-hipaa-164-310-9cf84fad.json","sourceId":"ctrl:hipaa:HIPAA-164.310","targetDetailPath":"/data/v1/records/std-hipaa-a825d271.json","targetId":"std:hipaa","type":"belongs_to"},{"expectedCatalogRevision":"24028ffcfc2b295fa1b08ee6caa84b765f0731b321496bf4f548c49ad2177028","id":"rel:176888462abb754dc37b3a4a12b0775af91b62a797ccf757969e2c9fc7078651","properties":{},"sourceDetailPath":"/data/v1/records/ctrl-aiuc-1-e015-94a0c8ea.json","sourceId":"ctrl:aiuc-1:E015","targetDetailPath":"/data/v1/records/std-aiuc-1-d2a8b650.json","targetId":"std:aiuc-1","type":"belongs_to"},{"expectedCatalogRevision":"24028ffcfc2b295fa1b08ee6caa84b765f0731b321496bf4f548c49ad2177028","id":"rel:1b1ee959cc26f4a87a9386efa482ae23a1501dc8f85d4ce4a62122317e320641","properties":{"control_id":"AIA-Art72","coverage":"partial","delta":"a documented post-market monitoring plan, proportionate to the system's risk, that actively collects and analyses lifetime performance data including interaction with other AI systems","framework":"eu-ai-act","provenance":{"defaultConfidence":"medium","defaultStatus":"active","direction":"canonical_to_source","mapper":"coworkcanvas-compliance-graph","note":"Each member is a documented relationship claim from the canonical unified control to a source control or guidance proposition. relationship: equal|superset_of (full) / intersects_with|subset_of (partial) / informs (guidance). confidence 'medium' = single-mapper, documented, not yet externally corroborated. source_version is the member framework's edition from the standard version register.","reviewDate":"2026-09-07"},"relationship":"intersects_with","source_version":"Regulation (EU) 2024/1689"},"sourceDetailPath":"/data/v1/records/uc-uc-ai-08-fada68b7.json","sourceId":"uc:UC-AI-08","targetDetailPath":"/data/v1/records/ctrl-eu-ai-act-aia-art72-2866ca15.json","targetId":"ctrl:eu-ai-act:AIA-Art72","type":"maps_to"},{"expectedCatalogRevision":"24028ffcfc2b295fa1b08ee6caa84b765f0731b321496bf4f548c49ad2177028","id":"rel:1bb99a7220444665b11dad31e587befeb9ef3f26c3fb61bf4ac73c2b49cf1faa","properties":{"control_id":"C002","coverage":"full","delta":null,"framework":"aiuc-1","provenance":{"defaultConfidence":"medium","defaultStatus":"active","direction":"canonical_to_source","mapper":"coworkcanvas-compliance-graph","note":"Each member is a documented relationship claim from the canonical unified control to a source control or guidance proposition. relationship: equal|superset_of (full) / intersects_with|subset_of (partial) / informs (guidance). confidence 'medium' = single-mapper, documented, not yet externally corroborated. source_version is the member framework's edition from the standard version register.","reviewDate":"2026-09-07"},"relationship":"superset_of","source_version":"July 15, 2026 release (quarterly update cadence)"},"sourceDetailPath":"/data/v1/records/uc-uc-ai-07-9c5c9573.json","sourceId":"uc:UC-AI-07","targetDetailPath":"/data/v1/records/ctrl-aiuc-1-c002-6c739dcb.json","targetId":"ctrl:aiuc-1:C002","type":"maps_to"},{"expectedCatalogRevision":"24028ffcfc2b295fa1b08ee6caa84b765f0731b321496bf4f548c49ad2177028","id":"rel:1cbe84b3d02248a688536c82e7822f036836bb524da8e6cbd17b9c0c80bf40af","properties":{},"sourceDetailPath":"/data/v1/records/ctrl-aiuc-1-c001-6bc6c173.json","sourceId":"ctrl:aiuc-1:C001","targetDetailPath":"/data/v1/records/std-aiuc-1-d2a8b650.json","targetId":"std:aiuc-1","type":"belongs_to"},{"expectedCatalogRevision":"24028ffcfc2b295fa1b08ee6caa84b765f0731b321496bf4f548c49ad2177028","id":"rel:20e4b2a31e5517b32fa223ea9b1b8fd79f1f9756c4fd2ee3519a688b1e5e002f","properties":{"control_id":"DSS02","coverage":"full","delta":null,"framework":"cobit-2019","provenance":{"defaultConfidence":"medium","defaultStatus":"active","direction":"canonical_to_source","mapper":"coworkcanvas-compliance-graph","note":"Each member is a documented relationship claim from the canonical unified control to a source control or guidance proposition. relationship: equal|superset_of (full) / intersects_with|subset_of (partial) / informs (guidance). confidence 'medium' = single-mapper, documented, not yet externally corroborated. source_version is the member framework's edition from the standard version register.","reviewDate":"2026-09-07"},"relationship":"superset_of","source_version":"2019"},"sourceDetailPath":"/data/v1/records/uc-uc-bcdr-06-c505e5bd.json","sourceId":"uc:UC-BCDR-06","targetDetailPath":"/data/v1/records/ctrl-cobit-2019-dss02-af5bca5d.json","targetId":"ctrl:cobit-2019:DSS02","type":"maps_to"},{"expectedCatalogRevision":"24028ffcfc2b295fa1b08ee6caa84b765f0731b321496bf4f548c49ad2177028","id":"rel:266413b704059cefdeb68ba76808b5444e25095d835aa595a43d1476260b7d3e","properties":{"control_id":"BAI10","coverage":"full","delta":null,"framework":"cobit-2019","provenance":{"defaultConfidence":"medium","defaultStatus":"active","direction":"canonical_to_source","mapper":"coworkcanvas-compliance-graph","note":"Each member is a documented relationship claim from the canonical unified control to a source control or guidance proposition. relationship: equal|superset_of (full) / intersects_with|subset_of (partial) / informs (guidance). confidence 'medium' = single-mapper, documented, not yet externally corroborated. source_version is the member framework's edition from the standard version register.","reviewDate":"2026-09-07"},"relationship":"superset_of","source_version":"2019"},"sourceDetailPath":"/data/v1/records/uc-uc-sdlc-06-c1afc713.json","sourceId":"uc:UC-SDLC-06","targetDetailPath":"/data/v1/records/ctrl-cobit-2019-bai10-40479176.json","targetId":"ctrl:cobit-2019:BAI10","type":"maps_to"},{"expectedCatalogRevision":"24028ffcfc2b295fa1b08ee6caa84b765f0731b321496bf4f548c49ad2177028","id":"rel:28cbc076c691c4481111652ba581b69d65bc7b35b4c1947853f1515157a6896e","properties":{},"sourceDetailPath":"/data/v1/records/ctrl-cobit-2019-dss04-2d611bca.json","sourceId":"ctrl:cobit-2019:DSS04","targetDetailPath":"/data/v1/records/std-cobit-2019-2181ce0c.json","targetId":"std:cobit-2019","type":"belongs_to"},{"expectedCatalogRevision":"24028ffcfc2b295fa1b08ee6caa84b765f0731b321496bf4f548c49ad2177028","id":"rel:2e1dd368ab61117184f962a4423da9347a8dc7bd50f9574314804ebded1af983","properties":{},"sourceDetailPath":"/data/v1/records/ctrl-dora-dora-art28-44-d3e89c89.json","sourceId":"ctrl:dora:DORA-Art28-44","targetDetailPath":"/data/v1/records/std-dora-95cf939d.json","targetId":"std:dora","type":"belongs_to"},{"expectedCatalogRevision":"24028ffcfc2b295fa1b08ee6caa84b765f0731b321496bf4f548c49ad2177028","id":"rel:2fa9ee745188901dc9cf334d826e8e52a294a06c63ae786f99df85acdb98780d","properties":{},"sourceDetailPath":"/data/v1/records/ctrl-cobit-2019-dss02-af5bca5d.json","sourceId":"ctrl:cobit-2019:DSS02","targetDetailPath":"/data/v1/records/std-cobit-2019-2181ce0c.json","targetId":"std:cobit-2019","type":"belongs_to"},{"expectedCatalogRevision":"24028ffcfc2b295fa1b08ee6caa84b765f0731b321496bf4f548c49ad2177028","id":"rel:31b0cb3f6fd4cc5c3cacf66348964c70a77844f16d0c7a4935fdc668c74d1981","properties":{},"sourceDetailPath":"/data/v1/records/ctrl-iso-27001-a-5-23-b73e5b7d.json","sourceId":"ctrl:iso-27001:A.5.23","targetDetailPath":"/data/v1/records/std-iso-27001-656201bd.json","targetId":"std:iso-27001","type":"belongs_to"},{"expectedCatalogRevision":"24028ffcfc2b295fa1b08ee6caa84b765f0731b321496bf4f548c49ad2177028","id":"rel:34442316db48f111db9f970498059929690de3050b20fcf535d7a55c5ad0f887","properties":{"control_id":"DORA-Art5","coverage":"full","delta":null,"framework":"dora","provenance":{"defaultConfidence":"medium","defaultStatus":"active","direction":"canonical_to_source","mapper":"coworkcanvas-compliance-graph","note":"Each member is a documented relationship claim from the canonical unified control to a source control or guidance proposition. relationship: equal|superset_of (full) / intersects_with|subset_of (partial) / informs (guidance). confidence 'medium' = single-mapper, documented, not yet externally corroborated. source_version is the member framework's edition from the standard version register.","reviewDate":"2026-09-07"},"relationship":"superset_of","source_version":"Regulation (EU) 2022/2554"},"sourceDetailPath":"/data/v1/records/uc-uc-bcdr-02-2a51c24c.json","sourceId":"uc:UC-BCDR-02","targetDetailPath":"/data/v1/records/ctrl-dora-dora-art5-3d1842f7.json","targetId":"ctrl:dora:DORA-Art5","type":"maps_to"},{"expectedCatalogRevision":"24028ffcfc2b295fa1b08ee6caa84b765f0731b321496bf4f548c49ad2177028","id":"rel:38b71db227415791cd2d208547a6ed1dc84004cc6f116e18ba9e5a584fcb4a0e","properties":{},"sourceDetailPath":"/data/v1/records/ctrl-cobit-2019-mea04-4181ede5.json","sourceId":"ctrl:cobit-2019:MEA04","targetDetailPath":"/data/v1/records/std-cobit-2019-2181ce0c.json","targetId":"std:cobit-2019","type":"belongs_to"},{"expectedCatalogRevision":"24028ffcfc2b295fa1b08ee6caa84b765f0731b321496bf4f548c49ad2177028","id":"rel:3b9ed6f05fd9d237f6102e13c13ce5fc7df7836d69f775bccdc377d4039dfeed","properties":{},"sourceDetailPath":"/data/v1/records/ctrl-eu-ai-act-aia-art6-7-cd7435c0.json","sourceId":"ctrl:eu-ai-act:AIA-Art6-7","targetDetailPath":"/data/v1/records/std-eu-ai-act-54986689.json","targetId":"std:eu-ai-act","type":"belongs_to"},{"expectedCatalogRevision":"24028ffcfc2b295fa1b08ee6caa84b765f0731b321496bf4f548c49ad2177028","id":"rel:3c511ac1363b3cf7707cbe89a44ceff9ac1a631ccce30cd2f437a7b52ab0cf44","properties":{},"sourceDetailPath":"/data/v1/records/ctrl-eu-ai-act-aia-art72-2866ca15.json","sourceId":"ctrl:eu-ai-act:AIA-Art72","targetDetailPath":"/data/v1/records/std-eu-ai-act-54986689.json","targetId":"std:eu-ai-act","type":"belongs_to"},{"expectedCatalogRevision":"24028ffcfc2b295fa1b08ee6caa84b765f0731b321496bf4f548c49ad2177028","id":"rel:3cdceed58717a8955895a09f9613a3e23c9f0f9b2ca82d5699366641c3d670d2","properties":{"control_id":"A.5.11","coverage":"full","delta":null,"framework":"iso-27001","provenance":{"defaultConfidence":"medium","defaultStatus":"active","direction":"canonical_to_source","mapper":"coworkcanvas-compliance-graph","note":"Each member is a documented relationship claim from the canonical unified control to a source control or guidance proposition. relationship: equal|superset_of (full) / intersects_with|subset_of (partial) / informs (guidance). confidence 'medium' = single-mapper, documented, not yet externally corroborated. source_version is the member framework's edition from the standard version register.","reviewDate":"2026-09-07"},"relationship":"superset_of","source_version":"2022"},"sourceDetailPath":"/data/v1/records/uc-uc-asset-07-5039208b.json","sourceId":"uc:UC-ASSET-07","targetDetailPath":"/data/v1/records/ctrl-iso-27001-a-5-11-07680424.json","targetId":"ctrl:iso-27001:A.5.11","type":"maps_to"},{"expectedCatalogRevision":"24028ffcfc2b295fa1b08ee6caa84b765f0731b321496bf4f548c49ad2177028","id":"rel:41e2f7c3bbdb79c83f3d756c399e0ab252e00ec7add49757cef7164b72148cc1","properties":{"control_id":"AIA-Art15","coverage":"partial","delta":"AI-specific accuracy metrics and lifecycle-consistent performance require dedicated AI controls","framework":"eu-ai-act","provenance":{"defaultConfidence":"medium","defaultStatus":"active","direction":"canonical_to_source","mapper":"coworkcanvas-compliance-graph","note":"Each member is a documented relationship claim from the canonical unified control to a source control or guidance proposition. relationship: equal|superset_of (full) / intersects_with|subset_of (partial) / informs (guidance). confidence 'medium' = single-mapper, documented, not yet externally corroborated. source_version is the member framework's edition from the standard version register.","reviewDate":"2026-09-07"},"relationship":"intersects_with","source_version":"Regulation (EU) 2024/1689"},"sourceDetailPath":"/data/v1/records/uc-uc-sdlc-04-ee9d76b1.json","sourceId":"uc:UC-SDLC-04","targetDetailPath":"/data/v1/records/ctrl-eu-ai-act-aia-art15-c3704411.json","targetId":"ctrl:eu-ai-act:AIA-Art15","type":"maps_to"},{"expectedCatalogRevision":"24028ffcfc2b295fa1b08ee6caa84b765f0731b321496bf4f548c49ad2177028","id":"rel:44dc68982ac8ee2356ccbec7838c36ea26afaf9fac1cd6a6cb6fbe8df4fc9454","properties":{},"sourceDetailPath":"/data/v1/records/ctrl-iia-2024-std-9-5-0fb8f00f.json","sourceId":"ctrl:iia-2024:Std 9.5","targetDetailPath":"/data/v1/records/std-iia-2024-1687734b.json","targetId":"std:iia-2024","type":"belongs_to"},{"expectedCatalogRevision":"24028ffcfc2b295fa1b08ee6caa84b765f0731b321496bf4f548c49ad2177028","id":"rel:47bc91a357dabf951399db5e73d90410a16ea531245923ce66ba8d2c4e5a6628","properties":{},"sourceDetailPath":"/data/v1/records/ctrl-eu-ai-act-aia-art12-3714b8af.json","sourceId":"ctrl:eu-ai-act:AIA-Art12","targetDetailPath":"/data/v1/records/std-eu-ai-act-54986689.json","targetId":"std:eu-ai-act","type":"belongs_to"},{"expectedCatalogRevision":"24028ffcfc2b295fa1b08ee6caa84b765f0731b321496bf4f548c49ad2177028","id":"rel:494f71c171b62c71568247a14a50ed91f12978cf48211592b92b04d4f030328e","properties":{"control_id":"BAI03","coverage":"partial","delta":"full solution build, component, and maintenance life cycle satisfied by companion controls","framework":"cobit-2019","provenance":{"defaultConfidence":"medium","defaultStatus":"active","direction":"canonical_to_source","mapper":"coworkcanvas-compliance-graph","note":"Each member is a documented relationship claim from the canonical unified control to a source control or guidance proposition. relationship: equal|superset_of (full) / intersects_with|subset_of (partial) / informs (guidance). confidence 'medium' = single-mapper, documented, not yet externally corroborated. source_version is the member framework's edition from the standard version register.","reviewDate":"2026-09-07"},"relationship":"intersects_with","source_version":"2019"},"sourceDetailPath":"/data/v1/records/uc-uc-sdlc-04-ee9d76b1.json","sourceId":"uc:UC-SDLC-04","targetDetailPath":"/data/v1/records/ctrl-cobit-2019-bai03-bfe681b0.json","targetId":"ctrl:cobit-2019:BAI03","type":"maps_to"},{"expectedCatalogRevision":"24028ffcfc2b295fa1b08ee6caa84b765f0731b321496bf4f548c49ad2177028","id":"rel:4c619442506fe595907cec0c29140d76d135eac51922f06e18251d204d100750","properties":{"control_id":"A.5.30","coverage":"partial","delta":"periodic ICT readiness testing satisfied by the testing control","framework":"iso-27001","provenance":{"defaultConfidence":"medium","defaultStatus":"active","direction":"canonical_to_source","mapper":"coworkcanvas-compliance-graph","note":"Each member is a documented relationship claim from the canonical unified control to a source control or guidance proposition. relationship: equal|superset_of (full) / intersects_with|subset_of (partial) / informs (guidance). confidence 'medium' = single-mapper, documented, not yet externally corroborated. source_version is the member framework's edition from the standard version register.","reviewDate":"2026-09-07"},"relationship":"intersects_with","source_version":"2022"},"sourceDetailPath":"/data/v1/records/uc-uc-bcdr-01-428f23d3.json","sourceId":"uc:UC-BCDR-01","targetDetailPath":"/data/v1/records/ctrl-iso-27001-a-5-30-08880829.json","targetId":"ctrl:iso-27001:A.5.30","type":"maps_to"},{"expectedCatalogRevision":"24028ffcfc2b295fa1b08ee6caa84b765f0731b321496bf4f548c49ad2177028","id":"rel:4f4bfb919d761c9352da8a35038bb54e93595b16f4e9d3163a8df47218198b62","properties":{},"sourceDetailPath":"/data/v1/records/ctrl-aiuc-1-c002-6c739dcb.json","sourceId":"ctrl:aiuc-1:C002","targetDetailPath":"/data/v1/records/std-aiuc-1-d2a8b650.json","targetId":"std:aiuc-1","type":"belongs_to"},{"expectedCatalogRevision":"24028ffcfc2b295fa1b08ee6caa84b765f0731b321496bf4f548c49ad2177028","id":"rel:512ba21439e87bc291748f791f63165c51c302598232ea229c29542a3578a201","properties":{},"sourceDetailPath":"/data/v1/records/ctrl-cobit-2019-dss03-2540740f.json","sourceId":"ctrl:cobit-2019:DSS03","targetDetailPath":"/data/v1/records/std-cobit-2019-2181ce0c.json","targetId":"std:cobit-2019","type":"belongs_to"},{"expectedCatalogRevision":"24028ffcfc2b295fa1b08ee6caa84b765f0731b321496bf4f548c49ad2177028","id":"rel:5fceaa2dafcc802e8d6e37db2ad1e88f71871195dda76c9a02a17a6fa4776b55","properties":{},"sourceDetailPath":"/data/v1/records/ctrl-iia-pos-2026-three-lines-iia-pos-tlm-03-95334e6e.json","sourceId":"ctrl:iia-pos-2026-three-lines:IIA-POS-TLM-03","targetDetailPath":"/data/v1/records/std-iia-pos-2026-three-lines-1138e7ab.json","targetId":"std:iia-pos-2026-three-lines","type":"belongs_to"},{"expectedCatalogRevision":"24028ffcfc2b295fa1b08ee6caa84b765f0731b321496bf4f548c49ad2177028","id":"rel:60f2083b85eec41e5629c01567e3bc03ebc043b72a575f38df3d7bd42caa9029","properties":{"control_id":"A.5.26","coverage":"full","delta":null,"framework":"iso-27001","provenance":{"defaultConfidence":"medium","defaultStatus":"active","direction":"canonical_to_source","mapper":"coworkcanvas-compliance-graph","note":"Each member is a documented relationship claim from the canonical unified control to a source control or guidance proposition. relationship: equal|superset_of (full) / intersects_with|subset_of (partial) / informs (guidance). confidence 'medium' = single-mapper, documented, not yet externally corroborated. source_version is the member framework's edition from the standard version register.","reviewDate":"2026-09-07"},"relationship":"superset_of","source_version":"2022"},"sourceDetailPath":"/data/v1/records/uc-uc-ir-06-0b166c2a.json","sourceId":"uc:UC-IR-06","targetDetailPath":"/data/v1/records/ctrl-iso-27001-a-5-26-863e832e.json","targetId":"ctrl:iso-27001:A.5.26","type":"maps_to"},{"expectedCatalogRevision":"24028ffcfc2b295fa1b08ee6caa84b765f0731b321496bf4f548c49ad2177028","id":"rel:6252394509c8c804491c1fe1521212654ee25ae53402cf5d638e32cf5bbce973","properties":{},"sourceDetailPath":"/data/v1/records/ctrl-iso-27001-a-5-19-d8db0691.json","sourceId":"ctrl:iso-27001:A.5.19","targetDetailPath":"/data/v1/records/std-iso-27001-656201bd.json","targetId":"std:iso-27001","type":"belongs_to"},{"expectedCatalogRevision":"24028ffcfc2b295fa1b08ee6caa84b765f0731b321496bf4f548c49ad2177028","id":"rel:62a6fd6b6e2a9e76fd2322f78498159ad83a219fdb36c5d6f7523a98e64315fd","properties":{"control_id":"B008","coverage":"partial","delta":"hardening of the model-serving and agent runtime environment, including model-artifact protection and isolation from other workloads","framework":"aiuc-1","provenance":{"defaultConfidence":"medium","defaultStatus":"active","direction":"canonical_to_source","mapper":"coworkcanvas-compliance-graph","note":"Each member is a documented relationship claim from the canonical unified control to a source control or guidance proposition. relationship: equal|superset_of (full) / intersects_with|subset_of (partial) / informs (guidance). confidence 'medium' = single-mapper, documented, not yet externally corroborated. source_version is the member framework's edition from the standard version register.","reviewDate":"2026-09-07"},"relationship":"intersects_with","source_version":"July 15, 2026 release (quarterly update cadence)"},"sourceDetailPath":"/data/v1/records/uc-uc-sdlc-04-ee9d76b1.json","sourceId":"uc:UC-SDLC-04","targetDetailPath":"/data/v1/records/ctrl-aiuc-1-b008-39c816b1.json","targetId":"ctrl:aiuc-1:B008","type":"maps_to"},{"expectedCatalogRevision":"24028ffcfc2b295fa1b08ee6caa84b765f0731b321496bf4f548c49ad2177028","id":"rel:66c476cbded0770a1dfb5dac88dbddc813fd47b5a6cffddb59a967f1f0fe2087","properties":{},"sourceDetailPath":"/data/v1/records/ctrl-cobit-2019-bai10-40479176.json","sourceId":"ctrl:cobit-2019:BAI10","targetDetailPath":"/data/v1/records/std-cobit-2019-2181ce0c.json","targetId":"std:cobit-2019","type":"belongs_to"},{"expectedCatalogRevision":"24028ffcfc2b295fa1b08ee6caa84b765f0731b321496bf4f548c49ad2177028","id":"rel:6a23db00aa832f70449f5331387a49a9848a48c33ed9aec1c9cbbd1cfd41d482","properties":{},"sourceDetailPath":"/data/v1/records/ctrl-cobit-2019-bai04-c6901e71.json","sourceId":"ctrl:cobit-2019:BAI04","targetDetailPath":"/data/v1/records/std-cobit-2019-2181ce0c.json","targetId":"std:cobit-2019","type":"belongs_to"},{"expectedCatalogRevision":"24028ffcfc2b295fa1b08ee6caa84b765f0731b321496bf4f548c49ad2177028","id":"rel:6cd89c31a0f6722453e9f1cb4ee69e4fdb4992f60f3243d03259b9058b5738c2","properties":{"control_id":"DSS01","coverage":"full","delta":null,"framework":"cobit-2019","provenance":{"defaultConfidence":"medium","defaultStatus":"active","direction":"canonical_to_source","mapper":"coworkcanvas-compliance-graph","note":"Each member is a documented relationship claim from the canonical unified control to a source control or guidance proposition. relationship: equal|superset_of (full) / intersects_with|subset_of (partial) / informs (guidance). confidence 'medium' = single-mapper, documented, not yet externally corroborated. source_version is the member framework's edition from the standard version register.","reviewDate":"2026-09-07"},"relationship":"equal","source_version":"2019"},"sourceDetailPath":"/data/v1/records/uc-uc-bcdr-12-0d9cc358.json","sourceId":"uc:UC-BCDR-12","targetDetailPath":"/data/v1/records/ctrl-cobit-2019-dss01-d3ff2961.json","targetId":"ctrl:cobit-2019:DSS01","type":"maps_to"},{"expectedCatalogRevision":"24028ffcfc2b295fa1b08ee6caa84b765f0731b321496bf4f548c49ad2177028","id":"rel:711a1e90cc08e74c4fa39e7c5ba0baed9abb795e999c10d2a47d3e0db122c51f","properties":{"control_id":"AIA-Art12","coverage":"full","delta":null,"framework":"eu-ai-act","provenance":{"defaultConfidence":"medium","defaultStatus":"active","direction":"canonical_to_source","mapper":"coworkcanvas-compliance-graph","note":"Each member is a documented relationship claim from the canonical unified control to a source control or guidance proposition. relationship: equal|superset_of (full) / intersects_with|subset_of (partial) / informs (guidance). confidence 'medium' = single-mapper, documented, not yet externally corroborated. source_version is the member framework's edition from the standard version register.","reviewDate":"2026-09-07"},"relationship":"superset_of","source_version":"Regulation (EU) 2024/1689"},"sourceDetailPath":"/data/v1/records/uc-uc-ai-08-fada68b7.json","sourceId":"uc:UC-AI-08","targetDetailPath":"/data/v1/records/ctrl-eu-ai-act-aia-art12-3714b8af.json","targetId":"ctrl:eu-ai-act:AIA-Art12","type":"maps_to"},{"expectedCatalogRevision":"24028ffcfc2b295fa1b08ee6caa84b765f0731b321496bf4f548c49ad2177028","id":"rel:74bc65e8e9aa1bfb54f93555a389e7974ee95deaf69f27e0c445b8aa95797baf","properties":{},"sourceDetailPath":"/data/v1/records/ctrl-eu-ai-act-aia-art27-7b550500.json","sourceId":"ctrl:eu-ai-act:AIA-Art27","targetDetailPath":"/data/v1/records/std-eu-ai-act-54986689.json","targetId":"std:eu-ai-act","type":"belongs_to"},{"expectedCatalogRevision":"24028ffcfc2b295fa1b08ee6caa84b765f0731b321496bf4f548c49ad2177028","id":"rel:75a79039f825fe12949becc0699504543d81d39d52729d9e782eea75558bc642","properties":{"control_id":"MEA04","coverage":"full","delta":null,"framework":"cobit-2019","provenance":{"defaultConfidence":"medium","defaultStatus":"active","direction":"canonical_to_source","mapper":"coworkcanvas-compliance-graph","note":"Each member is a documented relationship claim from the canonical unified control to a source control or guidance proposition. relationship: equal|superset_of (full) / intersects_with|subset_of (partial) / informs (guidance). confidence 'medium' = single-mapper, documented, not yet externally corroborated. source_version is the member framework's edition from the standard version register.","reviewDate":"2026-09-07"},"relationship":"superset_of","source_version":"2019"},"sourceDetailPath":"/data/v1/records/uc-uc-audit-23-124d94d5.json","sourceId":"uc:UC-AUDIT-23","targetDetailPath":"/data/v1/records/ctrl-cobit-2019-mea04-4181ede5.json","targetId":"ctrl:cobit-2019:MEA04","type":"maps_to"},{"expectedCatalogRevision":"24028ffcfc2b295fa1b08ee6caa84b765f0731b321496bf4f548c49ad2177028","id":"rel:7600e8066bd80f681f6cdd1adaff667045e6a5a0ff9a75dcdce290af53c5d65d","properties":{"control_id":"HIPAA-164.310","coverage":"partial","delta":"also covers workstation use/security and device and media controls","framework":"hipaa","provenance":{"defaultConfidence":"medium","defaultStatus":"active","direction":"canonical_to_source","mapper":"coworkcanvas-compliance-graph","note":"Each member is a documented relationship claim from the canonical unified control to a source control or guidance proposition. relationship: equal|superset_of (full) / intersects_with|subset_of (partial) / informs (guidance). confidence 'medium' = single-mapper, documented, not yet externally corroborated. source_version is the member framework's edition from the standard version register.","reviewDate":"2026-09-07"},"relationship":"intersects_with","source_version":"45 CFR Parts 160/164 (Security, Privacy, Breach Notification)"},"sourceDetailPath":"/data/v1/records/uc-uc-phys-01-354431a7.json","sourceId":"uc:UC-PHYS-01","targetDetailPath":"/data/v1/records/ctrl-hipaa-hipaa-164-310-9cf84fad.json","targetId":"ctrl:hipaa:HIPAA-164.310","type":"maps_to"},{"expectedCatalogRevision":"24028ffcfc2b295fa1b08ee6caa84b765f0731b321496bf4f548c49ad2177028","id":"rel:7843c3f12abcbdae8c0226c23f8a2d755a402c4d56140aecef697acc9b4fe5df","properties":{"control_id":"DSS04","coverage":"partial","delta":"continuity testing, training, and post-incident review satisfied by companion controls","framework":"cobit-2019","provenance":{"defaultConfidence":"medium","defaultStatus":"active","direction":"canonical_to_source","mapper":"coworkcanvas-compliance-graph","note":"Each member is a documented relationship claim from the canonical unified control to a source control or guidance proposition. relationship: equal|superset_of (full) / intersects_with|subset_of (partial) / informs (guidance). confidence 'medium' = single-mapper, documented, not yet externally corroborated. source_version is the member framework's edition from the standard version register.","reviewDate":"2026-09-07"},"relationship":"intersects_with","source_version":"2019"},"sourceDetailPath":"/data/v1/records/uc-uc-bcdr-01-428f23d3.json","sourceId":"uc:UC-BCDR-01","targetDetailPath":"/data/v1/records/ctrl-cobit-2019-dss04-2d611bca.json","targetId":"ctrl:cobit-2019:DSS04","type":"maps_to"},{"expectedCatalogRevision":"24028ffcfc2b295fa1b08ee6caa84b765f0731b321496bf4f548c49ad2177028","id":"rel:7c4757cbea8a44d57e05fb416fa000732b28c508b262641ae99493be0ed4c882","properties":{},"sourceDetailPath":"/data/v1/records/ctrl-iso-27001-a-5-11-07680424.json","sourceId":"ctrl:iso-27001:A.5.11","targetDetailPath":"/data/v1/records/std-iso-27001-656201bd.json","targetId":"std:iso-27001","type":"belongs_to"},{"expectedCatalogRevision":"24028ffcfc2b295fa1b08ee6caa84b765f0731b321496bf4f548c49ad2177028","id":"rel:81d44294f99278af7978ea2c1252664038b73ac319ebe9256bebcaf995fe82a1","properties":{},"sourceDetailPath":"/data/v1/records/ctrl-eu-ai-act-aia-art15-c3704411.json","sourceId":"ctrl:eu-ai-act:AIA-Art15","targetDetailPath":"/data/v1/records/std-eu-ai-act-54986689.json","targetId":"std:eu-ai-act","type":"belongs_to"},{"expectedCatalogRevision":"24028ffcfc2b295fa1b08ee6caa84b765f0731b321496bf4f548c49ad2177028","id":"rel:82c40a552cf2e27f24846e459e9b2a1e347e530e140706bfaaa950dca104839a","properties":{"control_id":"A.5.19","coverage":"full","delta":null,"framework":"iso-27001","provenance":{"defaultConfidence":"medium","defaultStatus":"active","direction":"canonical_to_source","mapper":"coworkcanvas-compliance-graph","note":"Each member is a documented relationship claim from the canonical unified control to a source control or guidance proposition. relationship: equal|superset_of (full) / intersects_with|subset_of (partial) / informs (guidance). confidence 'medium' = single-mapper, documented, not yet externally corroborated. source_version is the member framework's edition from the standard version register.","reviewDate":"2026-09-07"},"relationship":"superset_of","source_version":"2022"},"sourceDetailPath":"/data/v1/records/uc-uc-tprm-01-16b62053.json","sourceId":"uc:UC-TPRM-01","targetDetailPath":"/data/v1/records/ctrl-iso-27001-a-5-19-d8db0691.json","targetId":"ctrl:iso-27001:A.5.19","type":"maps_to"},{"expectedCatalogRevision":"24028ffcfc2b295fa1b08ee6caa84b765f0731b321496bf4f548c49ad2177028","id":"rel:8924d29b1c62b03926542f6e3877260c21d06450f2ff3ea29626fed327bfb6f6","properties":{},"sourceDetailPath":"/data/v1/records/ctrl-iso-27001-a-5-30-08880829.json","sourceId":"ctrl:iso-27001:A.5.30","targetDetailPath":"/data/v1/records/std-iso-27001-656201bd.json","targetId":"std:iso-27001","type":"belongs_to"},{"expectedCatalogRevision":"24028ffcfc2b295fa1b08ee6caa84b765f0731b321496bf4f548c49ad2177028","id":"rel:8b9de4df2b9b11f4758d16caba3a14418486d52562080438d56995febeaf4511","properties":{"control_id":"DORA-Art17-23","coverage":"partial","delta":"major-incident report clocks: initial 24h, intermediate 72h, final 1 month","framework":"dora","provenance":{"defaultConfidence":"medium","defaultStatus":"active","direction":"canonical_to_source","mapper":"coworkcanvas-compliance-graph","note":"Each member is a documented relationship claim from the canonical unified control to a source control or guidance proposition. relationship: equal|superset_of (full) / intersects_with|subset_of (partial) / informs (guidance). confidence 'medium' = single-mapper, documented, not yet externally corroborated. source_version is the member framework's edition from the standard version register.","reviewDate":"2026-09-07"},"relationship":"intersects_with","source_version":"Regulation (EU) 2022/2554"},"sourceDetailPath":"/data/v1/records/uc-uc-bcdr-06-c505e5bd.json","sourceId":"uc:UC-BCDR-06","targetDetailPath":"/data/v1/records/ctrl-dora-dora-art17-23-9aa7977f.json","targetId":"ctrl:dora:DORA-Art17-23","type":"maps_to"},{"expectedCatalogRevision":"24028ffcfc2b295fa1b08ee6caa84b765f0731b321496bf4f548c49ad2177028","id":"rel:8fdc7830079a5918f12dfa65dd2161ce222fcb194b0dc79ac6ab41841a9a5717","properties":{"control_id":"BAI06","coverage":"full","delta":null,"framework":"cobit-2019","provenance":{"defaultConfidence":"medium","defaultStatus":"active","direction":"canonical_to_source","mapper":"coworkcanvas-compliance-graph","note":"Each member is a documented relationship claim from the canonical unified control to a source control or guidance proposition. relationship: equal|superset_of (full) / intersects_with|subset_of (partial) / informs (guidance). confidence 'medium' = single-mapper, documented, not yet externally corroborated. source_version is the member framework's edition from the standard version register.","reviewDate":"2026-09-07"},"relationship":"superset_of","source_version":"2019"},"sourceDetailPath":"/data/v1/records/uc-uc-sdlc-07-22470d8b.json","sourceId":"uc:UC-SDLC-07","targetDetailPath":"/data/v1/records/ctrl-cobit-2019-bai06-306e8a70.json","targetId":"ctrl:cobit-2019:BAI06","type":"maps_to"},{"expectedCatalogRevision":"24028ffcfc2b295fa1b08ee6caa84b765f0731b321496bf4f548c49ad2177028","id":"rel:96f2fb180f84f99fb86941c3b49202eb0caef57d3105f6680d156665adeddebd","properties":{},"sourceDetailPath":"/data/v1/records/ctrl-cobit-2019-dss01-d3ff2961.json","sourceId":"ctrl:cobit-2019:DSS01","targetDetailPath":"/data/v1/records/std-cobit-2019-2181ce0c.json","targetId":"std:cobit-2019","type":"belongs_to"},{"expectedCatalogRevision":"24028ffcfc2b295fa1b08ee6caa84b765f0731b321496bf4f548c49ad2177028","id":"rel:96fe8cd5e6550663eb4ec5bf19b88679bf108221016937cf868e836905365c8f","properties":{"control_id":"BAI07","coverage":"full","delta":null,"framework":"cobit-2019","provenance":{"defaultConfidence":"medium","defaultStatus":"active","direction":"canonical_to_source","mapper":"coworkcanvas-compliance-graph","note":"Each member is a documented relationship claim from the canonical unified control to a source control or guidance proposition. relationship: equal|superset_of (full) / intersects_with|subset_of (partial) / informs (guidance). confidence 'medium' = single-mapper, documented, not yet externally corroborated. source_version is the member framework's edition from the standard version register.","reviewDate":"2026-09-07"},"relationship":"superset_of","source_version":"2019"},"sourceDetailPath":"/data/v1/records/uc-uc-sdlc-07-22470d8b.json","sourceId":"uc:UC-SDLC-07","targetDetailPath":"/data/v1/records/ctrl-cobit-2019-bai07-dcabfa26.json","targetId":"ctrl:cobit-2019:BAI07","type":"maps_to"},{"expectedCatalogRevision":"24028ffcfc2b295fa1b08ee6caa84b765f0731b321496bf4f548c49ad2177028","id":"rel:98948334f16c82e75fc7875acb9c6157cf1ad71bc9ad5f00b29cd6d8000c1963","properties":{},"sourceDetailPath":"/data/v1/records/ctrl-cobit-2019-bai06-306e8a70.json","sourceId":"ctrl:cobit-2019:BAI06","targetDetailPath":"/data/v1/records/std-cobit-2019-2181ce0c.json","targetId":"std:cobit-2019","type":"belongs_to"},{"expectedCatalogRevision":"24028ffcfc2b295fa1b08ee6caa84b765f0731b321496bf4f548c49ad2177028","id":"rel:9b1ac6bfa799e9a878a2f3298cc3d84973dc3ed7da85beabe618a4380720ef55","properties":{},"sourceDetailPath":"/data/v1/records/ctrl-cobit-2019-bai03-bfe681b0.json","sourceId":"ctrl:cobit-2019:BAI03","targetDetailPath":"/data/v1/records/std-cobit-2019-2181ce0c.json","targetId":"std:cobit-2019","type":"belongs_to"},{"expectedCatalogRevision":"24028ffcfc2b295fa1b08ee6caa84b765f0731b321496bf4f548c49ad2177028","id":"rel:9f229e45003f2c7c825f7932294437466bf8be9e39c6c4ab0bcb25d8dc6b2192","properties":{},"sourceDetailPath":"/data/v1/records/ctrl-dora-dora-art17-23-9aa7977f.json","sourceId":"ctrl:dora:DORA-Art17-23","targetDetailPath":"/data/v1/records/std-dora-95cf939d.json","targetId":"std:dora","type":"belongs_to"},{"expectedCatalogRevision":"24028ffcfc2b295fa1b08ee6caa84b765f0731b321496bf4f548c49ad2177028","id":"rel:a092db43ec68d7cc5bf48c7b8adcbc0c9aeff13ff38233c27c9ff01bc82eaab7","properties":{"control_id":"CCPA-1798.185","coverage":"partial","delta":"risk-assessment submission obligations handled under risk management controls","framework":"ccpa","provenance":{"defaultConfidence":"medium","defaultStatus":"active","direction":"canonical_to_source","mapper":"coworkcanvas-compliance-graph","note":"Each member is a documented relationship claim from the canonical unified control to a source control or guidance proposition. relationship: equal|superset_of (full) / intersects_with|subset_of (partial) / informs (guidance). confidence 'medium' = single-mapper, documented, not yet externally corroborated. source_version is the member framework's edition from the standard version register.","reviewDate":"2026-09-07"},"relationship":"intersects_with","source_version":"CCPA (2018) as amended by CPRA (2020)"},"sourceDetailPath":"/data/v1/records/uc-uc-audit-23-124d94d5.json","sourceId":"uc:UC-AUDIT-23","targetDetailPath":"/data/v1/records/ctrl-ccpa-ccpa-1798-185-1b524211.json","targetId":"ctrl:ccpa:CCPA-1798.185","type":"maps_to"},{"expectedCatalogRevision":"24028ffcfc2b295fa1b08ee6caa84b765f0731b321496bf4f548c49ad2177028","id":"rel:a4b2f502292f978777af5dfd48e8999c55e77d6f23ea481d1933266e011e2a12","properties":{},"sourceDetailPath":"/data/v1/records/ctrl-cobit-2019-bai08-9f5f3d72.json","sourceId":"ctrl:cobit-2019:BAI08","targetDetailPath":"/data/v1/records/std-cobit-2019-2181ce0c.json","targetId":"std:cobit-2019","type":"belongs_to"},{"expectedCatalogRevision":"24028ffcfc2b295fa1b08ee6caa84b765f0731b321496bf4f548c49ad2177028","id":"rel:a4c26665256fb8b683e42d6fddf701ba8402c798e480743cd68a6777bb166de3","properties":{},"sourceDetailPath":"/data/v1/records/ctrl-iso-27001-a-5-22-bb292d09.json","sourceId":"ctrl:iso-27001:A.5.22","targetDetailPath":"/data/v1/records/std-iso-27001-656201bd.json","targetId":"std:iso-27001","type":"belongs_to"},{"expectedCatalogRevision":"24028ffcfc2b295fa1b08ee6caa84b765f0731b321496bf4f548c49ad2177028","id":"rel:a74af9c3e6f125055de8d642a9daf7c64db8af1b078ca424106bf9353a63b6c0","properties":{"control_id":"BAI04","coverage":"full","delta":null,"framework":"cobit-2019","provenance":{"defaultConfidence":"medium","defaultStatus":"active","direction":"canonical_to_source","mapper":"coworkcanvas-compliance-graph","note":"Each member is a documented relationship claim from the canonical unified control to a source control or guidance proposition. relationship: equal|superset_of (full) / intersects_with|subset_of (partial) / informs (guidance). confidence 'medium' = single-mapper, documented, not yet externally corroborated. source_version is the member framework's edition from the standard version register.","reviewDate":"2026-09-07"},"relationship":"equal","source_version":"2019"},"sourceDetailPath":"/data/v1/records/uc-uc-sdlc-13-ae800997.json","sourceId":"uc:UC-SDLC-13","targetDetailPath":"/data/v1/records/ctrl-cobit-2019-bai04-c6901e71.json","targetId":"ctrl:cobit-2019:BAI04","type":"maps_to"},{"expectedCatalogRevision":"24028ffcfc2b295fa1b08ee6caa84b765f0731b321496bf4f548c49ad2177028","id":"rel:a9c21cb9b25d0672e34ba3509ac1069d58338117d3fe68376e2e33f9616b19e6","properties":{},"sourceDetailPath":"/data/v1/records/ctrl-cobit-2019-bai07-dcabfa26.json","sourceId":"ctrl:cobit-2019:BAI07","targetDetailPath":"/data/v1/records/std-cobit-2019-2181ce0c.json","targetId":"std:cobit-2019","type":"belongs_to"},{"expectedCatalogRevision":"24028ffcfc2b295fa1b08ee6caa84b765f0731b321496bf4f548c49ad2177028","id":"rel:aa2bb7ba717c5ce844028d7bbfbbb392a9b458f4a4f55e65abf03c53175313f7","properties":{},"sourceDetailPath":"/data/v1/records/ctrl-eu-ai-act-aia-art19-55451bfa.json","sourceId":"ctrl:eu-ai-act:AIA-Art19","targetDetailPath":"/data/v1/records/std-eu-ai-act-54986689.json","targetId":"std:eu-ai-act","type":"belongs_to"},{"expectedCatalogRevision":"24028ffcfc2b295fa1b08ee6caa84b765f0731b321496bf4f548c49ad2177028","id":"rel:ad79ca3242cac5551158b9c9ff960685018e66075adf393b637d03e7c34308b8","properties":{},"sourceDetailPath":"/data/v1/records/ctrl-aiuc-1-b008-39c816b1.json","sourceId":"ctrl:aiuc-1:B008","targetDetailPath":"/data/v1/records/std-aiuc-1-d2a8b650.json","targetId":"std:aiuc-1","type":"belongs_to"},{"expectedCatalogRevision":"24028ffcfc2b295fa1b08ee6caa84b765f0731b321496bf4f548c49ad2177028","id":"rel:b16d94a2172ca8f0cd1a12637021852d2064f9132dd64f4ad2453c881c7973b1","properties":{},"sourceDetailPath":"/data/v1/records/ctrl-iso-27001-a-5-26-863e832e.json","sourceId":"ctrl:iso-27001:A.5.26","targetDetailPath":"/data/v1/records/std-iso-27001-656201bd.json","targetId":"std:iso-27001","type":"belongs_to"},{"expectedCatalogRevision":"24028ffcfc2b295fa1b08ee6caa84b765f0731b321496bf4f548c49ad2177028","id":"rel:b2e15eeb0ac5f83bb68af516e5314a9cb224d33ccdde9514a89d4b0fdb9a8636","properties":{"control_id":"A.5.23","coverage":"full","delta":null,"framework":"iso-27001","provenance":{"defaultConfidence":"medium","defaultStatus":"active","direction":"canonical_to_source","mapper":"coworkcanvas-compliance-graph","note":"Each member is a documented relationship claim from the canonical unified control to a source control or guidance proposition. relationship: equal|superset_of (full) / intersects_with|subset_of (partial) / informs (guidance). confidence 'medium' = single-mapper, documented, not yet externally corroborated. source_version is the member framework's edition from the standard version register.","reviewDate":"2026-09-07"},"relationship":"superset_of","source_version":"2022"},"sourceDetailPath":"/data/v1/records/uc-uc-tprm-08-6de49908.json","sourceId":"uc:UC-TPRM-08","targetDetailPath":"/data/v1/records/ctrl-iso-27001-a-5-23-b73e5b7d.json","targetId":"ctrl:iso-27001:A.5.23","type":"maps_to"},{"expectedCatalogRevision":"24028ffcfc2b295fa1b08ee6caa84b765f0731b321496bf4f548c49ad2177028","id":"rel:b3bfaef213094c94a8d4b5b1d32b765d8d25c6a7c1bf939b43b5927b5e690830","properties":{"control_id":"DORA-Ch2","coverage":"partial","delta":"detailed protection, backup, and recovery capabilities implemented via companion controls","framework":"dora","provenance":{"defaultConfidence":"medium","defaultStatus":"active","direction":"canonical_to_source","mapper":"coworkcanvas-compliance-graph","note":"Each member is a documented relationship claim from the canonical unified control to a source control or guidance proposition. relationship: equal|superset_of (full) / intersects_with|subset_of (partial) / informs (guidance). confidence 'medium' = single-mapper, documented, not yet externally corroborated. source_version is the member framework's edition from the standard version register.","reviewDate":"2026-09-07"},"relationship":"intersects_with","source_version":"Regulation (EU) 2022/2554"},"sourceDetailPath":"/data/v1/records/uc-uc-bcdr-02-2a51c24c.json","sourceId":"uc:UC-BCDR-02","targetDetailPath":"/data/v1/records/ctrl-dora-dora-ch2-891a747a.json","targetId":"ctrl:dora:DORA-Ch2","type":"maps_to"},{"expectedCatalogRevision":"24028ffcfc2b295fa1b08ee6caa84b765f0731b321496bf4f548c49ad2177028","id":"rel:b48d208fc579b8bfaf3f263db5da6c421457ede838fd19c511096175349f2716","properties":{"control_id":"APO10","coverage":"partial","delta":"day-to-day vendor performance monitoring and contract administration","framework":"cobit-2019","provenance":{"defaultConfidence":"medium","defaultStatus":"active","direction":"canonical_to_source","mapper":"coworkcanvas-compliance-graph","note":"Each member is a documented relationship claim from the canonical unified control to a source control or guidance proposition. relationship: equal|superset_of (full) / intersects_with|subset_of (partial) / informs (guidance). confidence 'medium' = single-mapper, documented, not yet externally corroborated. source_version is the member framework's edition from the standard version register.","reviewDate":"2026-09-07"},"relationship":"intersects_with","source_version":"2019"},"sourceDetailPath":"/data/v1/records/uc-uc-tprm-01-16b62053.json","sourceId":"uc:UC-TPRM-01","targetDetailPath":"/data/v1/records/ctrl-cobit-2019-apo10-2c3cb0dc.json","targetId":"ctrl:cobit-2019:APO10","type":"maps_to"},{"expectedCatalogRevision":"24028ffcfc2b295fa1b08ee6caa84b765f0731b321496bf4f548c49ad2177028","id":"rel:bb8674403229a0ce2c5ec8c9080da85bd8087859e0a852a85af0bac50d670a98","properties":{"control_id":"DORA-Art24-27","coverage":"partial","delta":"vulnerability assessments and the Art 25 security-testing catalogue satisfied by companion controls; TLPT regime specifics - three-yearly cadence, authority-approved scope, independent/certified testers (Arts 26-27), and tester independence (Art 24(4)) - require dedicated controls","framework":"dora","provenance":{"defaultConfidence":"medium","defaultStatus":"active","direction":"canonical_to_source","mapper":"coworkcanvas-compliance-graph","note":"Each member is a documented relationship claim from the canonical unified control to a source control or guidance proposition. relationship: equal|superset_of (full) / intersects_with|subset_of (partial) / informs (guidance). confidence 'medium' = single-mapper, documented, not yet externally corroborated. source_version is the member framework's edition from the standard version register.","reviewDate":"2026-09-07"},"relationship":"intersects_with","source_version":"Regulation (EU) 2022/2554"},"sourceDetailPath":"/data/v1/records/uc-uc-bcdr-10-602160e4.json","sourceId":"uc:UC-BCDR-10","targetDetailPath":"/data/v1/records/ctrl-dora-dora-art24-27-dc4b8836.json","targetId":"ctrl:dora:DORA-Art24-27","type":"maps_to"},{"expectedCatalogRevision":"24028ffcfc2b295fa1b08ee6caa84b765f0731b321496bf4f548c49ad2177028","id":"rel:bd3d4679a51e4456a526dc8287d9adfe70592a44844d9d0b698e73121dd3757e","properties":{},"sourceDetailPath":"/data/v1/records/ctrl-ccpa-ccpa-1798-185-1b524211.json","sourceId":"ctrl:ccpa:CCPA-1798.185","targetDetailPath":"/data/v1/records/std-ccpa-55f3fd20.json","targetId":"std:ccpa","type":"belongs_to"},{"expectedCatalogRevision":"24028ffcfc2b295fa1b08ee6caa84b765f0731b321496bf4f548c49ad2177028","id":"rel:be5aeb5693e3be70bce1e031c4ec9c7937b924cdf5a63cc744b28e91df38b3f7","properties":{"control_id":"Std 9.5","coverage":"full","delta":null,"framework":"iia-2024","provenance":{"defaultConfidence":"medium","defaultStatus":"active","direction":"canonical_to_source","mapper":"coworkcanvas-compliance-graph","note":"Each member is a documented relationship claim from the canonical unified control to a source control or guidance proposition. relationship: equal|superset_of (full) / intersects_with|subset_of (partial) / informs (guidance). confidence 'medium' = single-mapper, documented, not yet externally corroborated. source_version is the member framework's edition from the standard version register.","reviewDate":"2026-09-07"},"relationship":"superset_of","source_version":"2024 edition"},"sourceDetailPath":"/data/v1/records/uc-uc-audit-23-124d94d5.json","sourceId":"uc:UC-AUDIT-23","targetDetailPath":"/data/v1/records/ctrl-iia-2024-std-9-5-0fb8f00f.json","targetId":"ctrl:iia-2024:Std 9.5","type":"maps_to"},{"expectedCatalogRevision":"24028ffcfc2b295fa1b08ee6caa84b765f0731b321496bf4f548c49ad2177028","id":"rel:bfb7de3a8015b3a23a00a22565f5ec4ed0ddcdd12489f4bb54574cd8ddbc7472","properties":{"control_id":"DSS03","coverage":"full","delta":null,"framework":"cobit-2019","provenance":{"defaultConfidence":"medium","defaultStatus":"active","direction":"canonical_to_source","mapper":"coworkcanvas-compliance-graph","note":"Each member is a documented relationship claim from the canonical unified control to a source control or guidance proposition. relationship: equal|superset_of (full) / intersects_with|subset_of (partial) / informs (guidance). confidence 'medium' = single-mapper, documented, not yet externally corroborated. source_version is the member framework's edition from the standard version register.","reviewDate":"2026-09-07"},"relationship":"superset_of","source_version":"2019"},"sourceDetailPath":"/data/v1/records/uc-uc-bcdr-06-c505e5bd.json","sourceId":"uc:UC-BCDR-06","targetDetailPath":"/data/v1/records/ctrl-cobit-2019-dss03-2540740f.json","targetId":"ctrl:cobit-2019:DSS03","type":"maps_to"},{"expectedCatalogRevision":"24028ffcfc2b295fa1b08ee6caa84b765f0731b321496bf4f548c49ad2177028","id":"rel:c004356ed83fe24ae6123dec85b7ce5b0a8df574641f5cf6abb86bf0567cdd12","properties":{"control_id":"E015","coverage":"full","delta":null,"framework":"aiuc-1","provenance":{"defaultConfidence":"medium","defaultStatus":"active","direction":"canonical_to_source","mapper":"coworkcanvas-compliance-graph","note":"Each member is a documented relationship claim from the canonical unified control to a source control or guidance proposition. relationship: equal|superset_of (full) / intersects_with|subset_of (partial) / informs (guidance). confidence 'medium' = single-mapper, documented, not yet externally corroborated. source_version is the member framework's edition from the standard version register.","reviewDate":"2026-09-07"},"relationship":"superset_of","source_version":"July 15, 2026 release (quarterly update cadence)"},"sourceDetailPath":"/data/v1/records/uc-uc-ai-08-fada68b7.json","sourceId":"uc:UC-AI-08","targetDetailPath":"/data/v1/records/ctrl-aiuc-1-e015-94a0c8ea.json","targetId":"ctrl:aiuc-1:E015","type":"maps_to"},{"expectedCatalogRevision":"24028ffcfc2b295fa1b08ee6caa84b765f0731b321496bf4f548c49ad2177028","id":"rel:c7e7cd6a2b9b5bf85a122d9970f37b1ec15b114f5b816136f898d82252b7ae92","properties":{"control_id":"IIA-POS-TLM-03","coverage":"guidance","delta":null,"framework":"iia-pos-2026-three-lines","provenance":{"defaultConfidence":"medium","defaultStatus":"active","direction":"canonical_to_source","mapper":"coworkcanvas-compliance-graph","note":"Each member is a documented relationship claim from the canonical unified control to a source control or guidance proposition. relationship: equal|superset_of (full) / intersects_with|subset_of (partial) / informs (guidance). confidence 'medium' = single-mapper, documented, not yet externally corroborated. source_version is the member framework's edition from the standard version register.","reviewDate":"2026-09-07"},"relationship":"informs","sourcePages":"Three Lines pp. 15–16, 18–19","source_version":"2026"},"sourceDetailPath":"/data/v1/records/uc-uc-audit-23-124d94d5.json","sourceId":"uc:UC-AUDIT-23","targetDetailPath":"/data/v1/records/ctrl-iia-pos-2026-three-lines-iia-pos-tlm-03-95334e6e.json","targetId":"ctrl:iia-pos-2026-three-lines:IIA-POS-TLM-03","type":"informed_by"},{"expectedCatalogRevision":"24028ffcfc2b295fa1b08ee6caa84b765f0731b321496bf4f548c49ad2177028","id":"rel:cff1193b4288fe551157bf960ab5acccac13ae290735955d5c5e704f34cab9db","properties":{},"sourceDetailPath":"/data/v1/records/ctrl-dora-dora-art24-27-dc4b8836.json","sourceId":"ctrl:dora:DORA-Art24-27","targetDetailPath":"/data/v1/records/std-dora-95cf939d.json","targetId":"std:dora","type":"belongs_to"},{"expectedCatalogRevision":"24028ffcfc2b295fa1b08ee6caa84b765f0731b321496bf4f548c49ad2177028","id":"rel:d23c16c0475ddff17cb84767adaa69eb11e7677c2c55a2aa5d8ac340b162dc89","properties":{"control_id":"C001","coverage":"partial","delta":"a system-specific AI risk taxonomy with severity tiers that drives output filtering, monitoring categories, and third-party test scope","framework":"aiuc-1","provenance":{"defaultConfidence":"medium","defaultStatus":"active","direction":"canonical_to_source","mapper":"coworkcanvas-compliance-graph","note":"Each member is a documented relationship claim from the canonical unified control to a source control or guidance proposition. relationship: equal|superset_of (full) / intersects_with|subset_of (partial) / informs (guidance). confidence 'medium' = single-mapper, documented, not yet externally corroborated. source_version is the member framework's edition from the standard version register.","reviewDate":"2026-09-07"},"relationship":"intersects_with","source_version":"July 15, 2026 release (quarterly update cadence)"},"sourceDetailPath":"/data/v1/records/uc-uc-ai-04-b35afd39.json","sourceId":"uc:UC-AI-04","targetDetailPath":"/data/v1/records/ctrl-aiuc-1-c001-6bc6c173.json","targetId":"ctrl:aiuc-1:C001","type":"maps_to"},{"expectedCatalogRevision":"24028ffcfc2b295fa1b08ee6caa84b765f0731b321496bf4f548c49ad2177028","id":"rel:d48739629f27ebf74e1abf8e7ac546403e3835cefc31839403687da5212a0e56","properties":{},"sourceDetailPath":"/data/v1/records/ctrl-cobit-2019-apo10-2c3cb0dc.json","sourceId":"ctrl:cobit-2019:APO10","targetDetailPath":"/data/v1/records/std-cobit-2019-2181ce0c.json","targetId":"std:cobit-2019","type":"belongs_to"},{"expectedCatalogRevision":"24028ffcfc2b295fa1b08ee6caa84b765f0731b321496bf4f548c49ad2177028","id":"rel:d55547e0001aae58a60b2bb584f30c2d2c4026873922f47cfc850a87b0365ac9","properties":{},"sourceDetailPath":"/data/v1/records/ctrl-dora-dora-ch2-891a747a.json","sourceId":"ctrl:dora:DORA-Ch2","targetDetailPath":"/data/v1/records/std-dora-95cf939d.json","targetId":"std:dora","type":"belongs_to"},{"expectedCatalogRevision":"24028ffcfc2b295fa1b08ee6caa84b765f0731b321496bf4f548c49ad2177028","id":"rel:edc524182fec3365afded04e66505533a46f61f318adf773398145e3a01d5efc","properties":{"control_id":"AIA-Art27","coverage":"full","delta":null,"framework":"eu-ai-act","provenance":{"defaultConfidence":"medium","defaultStatus":"active","direction":"canonical_to_source","mapper":"coworkcanvas-compliance-graph","note":"Each member is a documented relationship claim from the canonical unified control to a source control or guidance proposition. relationship: equal|superset_of (full) / intersects_with|subset_of (partial) / informs (guidance). confidence 'medium' = single-mapper, documented, not yet externally corroborated. source_version is the member framework's edition from the standard version register.","reviewDate":"2026-09-07"},"relationship":"superset_of","source_version":"Regulation (EU) 2024/1689"},"sourceDetailPath":"/data/v1/records/uc-uc-ai-04-b35afd39.json","sourceId":"uc:UC-AI-04","targetDetailPath":"/data/v1/records/ctrl-eu-ai-act-aia-art27-7b550500.json","targetId":"ctrl:eu-ai-act:AIA-Art27","type":"maps_to"},{"expectedCatalogRevision":"24028ffcfc2b295fa1b08ee6caa84b765f0731b321496bf4f548c49ad2177028","id":"rel:f08b3091da2f2ebef68bbc42112348fdd319a558f738645d33dbdb66a0e005e4","properties":{"control_id":"AIA-Art6-7","coverage":"full","delta":null,"framework":"eu-ai-act","provenance":{"defaultConfidence":"medium","defaultStatus":"active","direction":"canonical_to_source","mapper":"coworkcanvas-compliance-graph","note":"Each member is a documented relationship claim from the canonical unified control to a source control or guidance proposition. relationship: equal|superset_of (full) / intersects_with|subset_of (partial) / informs (guidance). confidence 'medium' = single-mapper, documented, not yet externally corroborated. source_version is the member framework's edition from the standard version register.","reviewDate":"2026-09-07"},"relationship":"superset_of","source_version":"Regulation (EU) 2024/1689"},"sourceDetailPath":"/data/v1/records/uc-uc-ai-04-b35afd39.json","sourceId":"uc:UC-AI-04","targetDetailPath":"/data/v1/records/ctrl-eu-ai-act-aia-art6-7-cd7435c0.json","targetId":"ctrl:eu-ai-act:AIA-Art6-7","type":"maps_to"},{"expectedCatalogRevision":"24028ffcfc2b295fa1b08ee6caa84b765f0731b321496bf4f548c49ad2177028","id":"rel:f26464c19c5287e54a6d2bf630191ccc3b3196567844c1979896c115397f8603","properties":{"control_id":"C008","coverage":"partial","delta":"monitoring keyed to the AI risk taxonomy categories with per-category alert thresholds and response actions","framework":"aiuc-1","provenance":{"defaultConfidence":"medium","defaultStatus":"active","direction":"canonical_to_source","mapper":"coworkcanvas-compliance-graph","note":"Each member is a documented relationship claim from the canonical unified control to a source control or guidance proposition. relationship: equal|superset_of (full) / intersects_with|subset_of (partial) / informs (guidance). confidence 'medium' = single-mapper, documented, not yet externally corroborated. source_version is the member framework's edition from the standard version register.","reviewDate":"2026-09-07"},"relationship":"intersects_with","source_version":"July 15, 2026 release (quarterly update cadence)"},"sourceDetailPath":"/data/v1/records/uc-uc-ai-08-fada68b7.json","sourceId":"uc:UC-AI-08","targetDetailPath":"/data/v1/records/ctrl-aiuc-1-c008-94bd64f2.json","targetId":"ctrl:aiuc-1:C008","type":"maps_to"},{"expectedCatalogRevision":"24028ffcfc2b295fa1b08ee6caa84b765f0731b321496bf4f548c49ad2177028","id":"rel:f2e2e7b72bc628ac1dc26cf6544d63f62633d9a1276598c3474fe2e52c916f16","properties":{"control_id":"DORA-Art28-44","coverage":"partial","delta":"DORA-specific regulator obligations (register of information format, competent-authority/Lead Overseer interactions) beyond the general third-party program","framework":"dora","provenance":{"defaultConfidence":"medium","defaultStatus":"active","direction":"canonical_to_source","mapper":"coworkcanvas-compliance-graph","note":"Each member is a documented relationship claim from the canonical unified control to a source control or guidance proposition. relationship: equal|superset_of (full) / intersects_with|subset_of (partial) / informs (guidance). confidence 'medium' = single-mapper, documented, not yet externally corroborated. source_version is the member framework's edition from the standard version register.","reviewDate":"2026-09-07"},"relationship":"intersects_with","source_version":"Regulation (EU) 2022/2554"},"sourceDetailPath":"/data/v1/records/uc-uc-tprm-01-16b62053.json","sourceId":"uc:UC-TPRM-01","targetDetailPath":"/data/v1/records/ctrl-dora-dora-art28-44-d3e89c89.json","targetId":"ctrl:dora:DORA-Art28-44","type":"maps_to"},{"expectedCatalogRevision":"24028ffcfc2b295fa1b08ee6caa84b765f0731b321496bf4f548c49ad2177028","id":"rel:f4913757b9a3f79e7cec28d3765d3acb63ca365f9150bfe794f91c4ecdd4fe6c","properties":{"control_id":"BAI08","coverage":"partial","delta":"enterprise-wide knowledge management extends beyond system documentation","framework":"cobit-2019","provenance":{"defaultConfidence":"medium","defaultStatus":"active","direction":"canonical_to_source","mapper":"coworkcanvas-compliance-graph","note":"Each member is a documented relationship claim from the canonical unified control to a source control or guidance proposition. relationship: equal|superset_of (full) / intersects_with|subset_of (partial) / informs (guidance). confidence 'medium' = single-mapper, documented, not yet externally corroborated. source_version is the member framework's edition from the standard version register.","reviewDate":"2026-09-07"},"relationship":"intersects_with","source_version":"2019"},"sourceDetailPath":"/data/v1/records/uc-uc-sdlc-08-29ce69df.json","sourceId":"uc:UC-SDLC-08","targetDetailPath":"/data/v1/records/ctrl-cobit-2019-bai08-9f5f3d72.json","targetId":"ctrl:cobit-2019:BAI08","type":"maps_to"},{"expectedCatalogRevision":"24028ffcfc2b295fa1b08ee6caa84b765f0731b321496bf4f548c49ad2177028","id":"rel:f8611c3a55644212e48bf360d4c2a232964e53b4e26a9d51bb92b53b3cee9daf","properties":{"control_id":"A.5.29","coverage":"full","delta":null,"framework":"iso-27001","provenance":{"defaultConfidence":"medium","defaultStatus":"active","direction":"canonical_to_source","mapper":"coworkcanvas-compliance-graph","note":"Each member is a documented relationship claim from the canonical unified control to a source control or guidance proposition. relationship: equal|superset_of (full) / intersects_with|subset_of (partial) / informs (guidance). confidence 'medium' = single-mapper, documented, not yet externally corroborated. source_version is the member framework's edition from the standard version register.","reviewDate":"2026-09-07"},"relationship":"superset_of","source_version":"2022"},"sourceDetailPath":"/data/v1/records/uc-uc-bcdr-01-428f23d3.json","sourceId":"uc:UC-BCDR-01","targetDetailPath":"/data/v1/records/ctrl-iso-27001-a-5-29-e6db7f58.json","targetId":"ctrl:iso-27001:A.5.29","type":"maps_to"},{"expectedCatalogRevision":"24028ffcfc2b295fa1b08ee6caa84b765f0731b321496bf4f548c49ad2177028","id":"rel:f8a5ee844e2fad35f8c77e9177a20cab901b502a00aa51b12b1b7fd1ffeac03d","properties":{},"sourceDetailPath":"/data/v1/records/ctrl-dora-dora-art5-3d1842f7.json","sourceId":"ctrl:dora:DORA-Art5","targetDetailPath":"/data/v1/records/std-dora-95cf939d.json","targetId":"std:dora","type":"belongs_to"},{"expectedCatalogRevision":"24028ffcfc2b295fa1b08ee6caa84b765f0731b321496bf4f548c49ad2177028","id":"rel:fa1e03375b19113343f4dead8c7384d2ce6473a62a0177095daa5a8303d69ee2","properties":{"control_id":"APO09","coverage":"partial","delta":"service catalog definition and SLA lifecycle management","framework":"cobit-2019","provenance":{"defaultConfidence":"medium","defaultStatus":"active","direction":"canonical_to_source","mapper":"coworkcanvas-compliance-graph","note":"Each member is a documented relationship claim from the canonical unified control to a source control or guidance proposition. relationship: equal|superset_of (full) / intersects_with|subset_of (partial) / informs (guidance). confidence 'medium' = single-mapper, documented, not yet externally corroborated. source_version is the member framework's edition from the standard version register.","reviewDate":"2026-09-07"},"relationship":"intersects_with","source_version":"2019"},"sourceDetailPath":"/data/v1/records/uc-uc-tprm-01-16b62053.json","sourceId":"uc:UC-TPRM-01","targetDetailPath":"/data/v1/records/ctrl-cobit-2019-apo09-2d1f48e2.json","targetId":"ctrl:cobit-2019:APO09","type":"maps_to"},{"expectedCatalogRevision":"24028ffcfc2b295fa1b08ee6caa84b765f0731b321496bf4f548c49ad2177028","id":"rel:faaa84666a0a8ed0d3fcc11ce04b8b4ec70c8e96aae124692bdf43e95c3b7273","properties":{"control_id":"A.5.22","coverage":"full","delta":null,"framework":"iso-27001","provenance":{"defaultConfidence":"medium","defaultStatus":"active","direction":"canonical_to_source","mapper":"coworkcanvas-compliance-graph","note":"Each member is a documented relationship claim from the canonical unified control to a source control or guidance proposition. relationship: equal|superset_of (full) / intersects_with|subset_of (partial) / informs (guidance). confidence 'medium' = single-mapper, documented, not yet externally corroborated. source_version is the member framework's edition from the standard version register.","reviewDate":"2026-09-07"},"relationship":"superset_of","source_version":"2022"},"sourceDetailPath":"/data/v1/records/uc-uc-tprm-04-e6aef252.json","sourceId":"uc:UC-TPRM-04","targetDetailPath":"/data/v1/records/ctrl-iso-27001-a-5-22-bb292d09.json","targetId":"ctrl:iso-27001:A.5.22","type":"maps_to"},{"expectedCatalogRevision":"24028ffcfc2b295fa1b08ee6caa84b765f0731b321496bf4f548c49ad2177028","id":"rel:fb1c8dd28ee831d63f9bbf5d171a0a088378fd7d5d6fc7e7be7195d57e5b27f1","properties":{"control_id":"AIA-Art19","coverage":"full","delta":null,"framework":"eu-ai-act","provenance":{"defaultConfidence":"medium","defaultStatus":"active","direction":"canonical_to_source","mapper":"coworkcanvas-compliance-graph","note":"Each member is a documented relationship claim from the canonical unified control to a source control or guidance proposition. relationship: equal|superset_of (full) / intersects_with|subset_of (partial) / informs (guidance). confidence 'medium' = single-mapper, documented, not yet externally corroborated. source_version is the member framework's edition from the standard version register.","reviewDate":"2026-09-07"},"relationship":"superset_of","source_version":"Regulation (EU) 2024/1689"},"sourceDetailPath":"/data/v1/records/uc-uc-ai-08-fada68b7.json","sourceId":"uc:UC-AI-08","targetDetailPath":"/data/v1/records/ctrl-eu-ai-act-aia-art19-55451bfa.json","targetId":"ctrl:eu-ai-act:AIA-Art19","type":"maps_to"},{"expectedCatalogRevision":"24028ffcfc2b295fa1b08ee6caa84b765f0731b321496bf4f548c49ad2177028","id":"rel:fb60df474bd25dd7bb113762fde8f6b535a89ace97bad9f668f8f5d820620d3e","properties":{},"sourceDetailPath":"/data/v1/records/ctrl-iso-27001-a-5-29-e6db7f58.json","sourceId":"ctrl:iso-27001:A.5.29","targetDetailPath":"/data/v1/records/std-iso-27001-656201bd.json","targetId":"std:iso-27001","type":"belongs_to"}],"schemaVersion":1,"scope":"topics","total":336}