{"catalogRevision":"24028ffcfc2b295fa1b08ee6caa84b765f0731b321496bf4f548c49ad2177028","contextIds":["ctrl:aiuc-1:A003","ctrl:aiuc-1:C001","ctrl:ccpa:CCPA-1798.140","ctrl:cobit-2019:APO07","ctrl:cobit-2019:APO13","ctrl:coso-erm:E5","ctrl:coso-ic:P15","ctrl:coso-ic:P4","ctrl:coso-ic:P5","ctrl:dora:DORA-Art24-27","ctrl:eu-ai-act:AIA-Art27","ctrl:eu-ai-act:AIA-Art6-7","ctrl:gdpr:GDPR-Art28","ctrl:hipaa:HIPAA-164.308","ctrl:hipaa:HIPAA-164.314","ctrl:iia-2024:Principle 1","ctrl:iia-2024:Principle 11","ctrl:iia-2024:Principle 12","ctrl:iia-2024:Principle 2","ctrl:iia-2024:Principle 8","ctrl:iia-2024:Std 1.1","ctrl:iia-2024:Std 1.2","ctrl:iia-2024:Std 1.3","ctrl:iia-2024:Std 11.1","ctrl:iia-2024:Std 11.2","ctrl:iia-2024:Std 12.1","ctrl:iia-2024:Std 12.2","ctrl:iia-2024:Std 2.1","ctrl:iia-2024:Std 2.2","ctrl:iia-2024:Std 2.3","ctrl:iia-2024:Std 8.1","ctrl:iia-2024:Std 8.2","ctrl:iia-2024:Std 8.3","ctrl:iia-pos-2026-erm:IIA-POS-ERM-03","ctrl:iia-pos-2026-three-lines:IIA-POS-TLM-02","ctrl:iso-27001:A.5.15","ctrl:iso-27001:A.5.20","ctrl:iso-27001:A.5.4","ctrl:iso-27001:A.6.1","ctrl:iso-27001:A.6.2"],"directIds":[],"kind":"bundle","metadata":"/assets/agent_metadata.5c7612c9c5b0b455.json","name":"Human Resources / Personnel Security","next":"/assets/agent_topics-human-resources-personnel-security-2.072d18ad15207121.json","page":1,"pageSize":40,"records":[{"attributes":{"category":"technical","framework":"aiuc-1","type":"preventive"},"canonicalUrl":"https://controlsmap.com/frameworks/aiuc-1/","description":"Limit AI agent data access","details":{"automation":"automated","control_category":"technical","control_id":"A003","control_type":"preventive","domains":["AI Governance","Data Protection & Privacy"],"framework":"aiuc-1","group":"Data & Privacy","key_control":false,"requirement_frequency":"Every 12 months","requirement_status":"mandatory","risk_count":7,"source_pages":null,"source_url":"https://www.aiuc-1.com/data-and-privacy/implement-contextual-data-safeguards"},"direct":false,"htmlUrl":"/agents/records/ctrl-aiuc-1-a003-bea61fd9.html","id":"ctrl:aiuc-1:A003","mapUrl":"https://controlsmap.com/?v=1&node=ctrl%3Aaiuc-1%3AA003","sourceIds":["aiuc-1"],"sourceUrl":"https://www.aiuc-1.com/data-and-privacy/implement-contextual-data-safeguards","title":"A003 — Limit AI agent data access","type":"control","url":"/assets/agent_record-ctrl-aiuc-1-a003-bea61fd9.af585433fb30a112.json"},{"attributes":{"category":"administrative","framework":"aiuc-1","type":"preventive"},"canonicalUrl":"https://controlsmap.com/frameworks/aiuc-1/","description":"Define AI risk taxonomy","details":{"automation":"manual","control_category":"administrative","control_id":"C001","control_type":"preventive","domains":["AI Governance"],"framework":"aiuc-1","group":"Safety","key_control":false,"requirement_frequency":"Every 12 months","requirement_status":"mandatory","risk_count":8,"source_pages":null,"source_url":"https://www.aiuc-1.com/safety/define-ai-risk-taxonomy"},"direct":false,"htmlUrl":"/agents/records/ctrl-aiuc-1-c001-6bc6c173.html","id":"ctrl:aiuc-1:C001","mapUrl":"https://controlsmap.com/?v=1&node=ctrl%3Aaiuc-1%3AC001","sourceIds":["aiuc-1"],"sourceUrl":"https://www.aiuc-1.com/safety/define-ai-risk-taxonomy","title":"C001 — Define AI risk taxonomy","type":"control","url":"/assets/agent_record-ctrl-aiuc-1-c001-6bc6c173.a628dce352165649.json"},{"attributes":{"category":"administrative","framework":"ccpa","type":"preventive"},"canonicalUrl":"https://controlsmap.com/frameworks/ccpa/","description":"Service-provider and contractor contract requirements","details":{"automation":"manual","control_category":"administrative","control_id":"CCPA-1798.140","control_type":"preventive","domains":["Data Protection & Privacy","Compliance, Audit & Assurance","Governance, Policy & Oversight"],"framework":"ccpa","group":"CCPA/CPRA (California Consumer Privacy)","key_control":false,"requirement_frequency":null,"requirement_status":null,"risk_count":5,"source_pages":null,"source_url":null},"direct":false,"htmlUrl":"/agents/records/ctrl-ccpa-ccpa-1798-140-775f9cfa.html","id":"ctrl:ccpa:CCPA-1798.140","mapUrl":"https://controlsmap.com/?v=1&node=ctrl%3Accpa%3ACCPA-1798.140","sourceIds":["ccpa"],"sourceUrl":null,"title":"CCPA-1798.140 — Service-provider and contractor contract requirements","type":"control","url":"/assets/agent_record-ctrl-ccpa-ccpa-1798-140-775f9cfa.b5ef741dc3aa2c1d.json"},{"attributes":{"category":"administrative","framework":"cobit-2019","type":"preventive"},"canonicalUrl":"https://controlsmap.com/frameworks/cobit-2019/","description":"Managed Human Resources","details":{"automation":"manual","control_category":"administrative","control_id":"APO07","control_type":"preventive","domains":["Governance, Policy & Oversight","Risk Assessment & Management","Human Resources / Personnel Security","Third-Party / Supply-Chain Risk","Asset Management & Inventory"],"framework":"cobit-2019","group":"Align, Plan and Organize","key_control":false,"requirement_frequency":null,"requirement_status":null,"risk_count":2,"source_pages":null,"source_url":null},"direct":false,"htmlUrl":"/agents/records/ctrl-cobit-2019-apo07-20c9bdf0.html","id":"ctrl:cobit-2019:APO07","mapUrl":"https://controlsmap.com/?v=1&node=ctrl%3Acobit-2019%3AAPO07","sourceIds":["cobit-2019"],"sourceUrl":null,"title":"APO07 — Managed Human Resources","type":"control","url":"/assets/agent_record-ctrl-cobit-2019-apo07-20c9bdf0.8ce7c088d2a3c554.json"},{"attributes":{"category":"administrative","framework":"cobit-2019","type":"preventive"},"canonicalUrl":"https://controlsmap.com/frameworks/cobit-2019/","description":"Managed Security","details":{"automation":"manual","control_category":"administrative","control_id":"APO13","control_type":"preventive","domains":["Governance, Policy & Oversight","Risk Assessment & Management","Human Resources / Personnel Security","Third-Party / Supply-Chain Risk","Asset Management & Inventory"],"framework":"cobit-2019","group":"Align, Plan and Organize","key_control":false,"requirement_frequency":null,"requirement_status":null,"risk_count":2,"source_pages":null,"source_url":null},"direct":false,"htmlUrl":"/agents/records/ctrl-cobit-2019-apo13-b83b9404.html","id":"ctrl:cobit-2019:APO13","mapUrl":"https://controlsmap.com/?v=1&node=ctrl%3Acobit-2019%3AAPO13","sourceIds":["cobit-2019"],"sourceUrl":null,"title":"APO13 — Managed Security","type":"control","url":"/assets/agent_record-ctrl-cobit-2019-apo13-b83b9404.ebdf8420c42e7c7d.json"},{"attributes":{"category":"administrative","framework":"coso-erm","type":"preventive"},"canonicalUrl":"https://controlsmap.com/frameworks/coso-erm/","description":"Attracts, Develops, and Retains Capable Individuals","details":{"automation":"manual","control_category":"administrative","control_id":"E5","control_type":"preventive","domains":["Governance, Policy & Oversight","Human Resources / Personnel Security","Risk Assessment & Management"],"framework":"coso-erm","group":"Governance & Culture","key_control":false,"requirement_frequency":null,"requirement_status":null,"risk_count":2,"source_pages":null,"source_url":null},"direct":false,"htmlUrl":"/agents/records/ctrl-coso-erm-e5-9038c819.html","id":"ctrl:coso-erm:E5","mapUrl":"https://controlsmap.com/?v=1&node=ctrl%3Acoso-erm%3AE5","sourceIds":["coso-erm"],"sourceUrl":null,"title":"E5 — Attracts, Develops, and Retains Capable Individuals","type":"control","url":"/assets/agent_record-ctrl-coso-erm-e5-9038c819.e36d29a87b5578a9.json"},{"attributes":{"category":"administrative","framework":"coso-ic","type":"preventive"},"canonicalUrl":"https://controlsmap.com/frameworks/coso-ic/","description":"The organization communicates with external parties regarding matters affecting the functioning of internal control.","details":{"automation":"manual","control_category":"administrative","control_id":"P15","control_type":"preventive","domains":["Compliance, Audit & Assurance","Financial Reporting Controls (SOX)"],"framework":"coso-ic","group":"Information & Communication","key_control":false,"requirement_frequency":null,"requirement_status":null,"risk_count":2,"source_pages":null,"source_url":null},"direct":false,"htmlUrl":"/agents/records/ctrl-coso-ic-p15-04537dd0.html","id":"ctrl:coso-ic:P15","mapUrl":"https://controlsmap.com/?v=1&node=ctrl%3Acoso-ic%3AP15","sourceIds":["coso-ic"],"sourceUrl":null,"title":"P15 — The organization communicates with external parties regarding matters affecting the functioning of internal control.","type":"control","url":"/assets/agent_record-ctrl-coso-ic-p15-04537dd0.cd4963c320fdfc50.json"},{"attributes":{"category":"administrative","framework":"coso-ic","type":"preventive"},"canonicalUrl":"https://controlsmap.com/frameworks/coso-ic/","description":"The organization demonstrates a commitment to attract, develop, and retain competent individuals in alignment with objectives.","details":{"automation":"manual","control_category":"administrative","control_id":"P4","control_type":"preventive","domains":["Awareness & Training","Governance, Policy & Oversight","Human Resources / Personnel Security"],"framework":"coso-ic","group":"Control Environment","key_control":false,"requirement_frequency":null,"requirement_status":null,"risk_count":2,"source_pages":null,"source_url":null},"direct":false,"htmlUrl":"/agents/records/ctrl-coso-ic-p4-8da1f64c.html","id":"ctrl:coso-ic:P4","mapUrl":"https://controlsmap.com/?v=1&node=ctrl%3Acoso-ic%3AP4","sourceIds":["coso-ic"],"sourceUrl":null,"title":"P4 — The organization demonstrates a commitment to attract, develop, and retain competent individuals in alignment with objectives.","type":"control","url":"/assets/agent_record-ctrl-coso-ic-p4-8da1f64c.dd7a3ea8c36e469d.json"},{"attributes":{"category":"administrative","framework":"coso-ic","type":"preventive"},"canonicalUrl":"https://controlsmap.com/frameworks/coso-ic/","description":"The organization holds individuals accountable for their internal control responsibilities in the pursuit of objectives.","details":{"automation":"manual","control_category":"administrative","control_id":"P5","control_type":"preventive","domains":["Governance, Policy & Oversight","Human Resources / Personnel Security"],"framework":"coso-ic","group":"Control Environment","key_control":false,"requirement_frequency":null,"requirement_status":null,"risk_count":3,"source_pages":null,"source_url":null},"direct":false,"htmlUrl":"/agents/records/ctrl-coso-ic-p5-7f62f522.html","id":"ctrl:coso-ic:P5","mapUrl":"https://controlsmap.com/?v=1&node=ctrl%3Acoso-ic%3AP5","sourceIds":["coso-ic"],"sourceUrl":null,"title":"P5 — The organization holds individuals accountable for their internal control responsibilities in the pursuit of objectives.","type":"control","url":"/assets/agent_record-ctrl-coso-ic-p5-7f62f522.36791ace8dd5f10f.json"},{"attributes":{"category":"technical","framework":"dora","type":"detective"},"canonicalUrl":"https://controlsmap.com/frameworks/dora/","description":"Digital operational resilience testing (incl. threat-led penetration testing)","details":{"automation":"hybrid","control_category":"technical","control_id":"DORA-Art24-27","control_type":"detective","domains":["Business Continuity & Disaster Recovery","Incident Management & Response","Third-Party / Supply-Chain Risk","Governance, Policy & Oversight","Risk Assessment & Management"],"framework":"dora","group":"EU DORA (Digital Operational Resilience Act)","key_control":false,"requirement_frequency":null,"requirement_status":null,"risk_count":3,"source_pages":null,"source_url":null},"direct":false,"htmlUrl":"/agents/records/ctrl-dora-dora-art24-27-dc4b8836.html","id":"ctrl:dora:DORA-Art24-27","mapUrl":"https://controlsmap.com/?v=1&node=ctrl%3Adora%3ADORA-Art24-27","sourceIds":["dora"],"sourceUrl":null,"title":"DORA-Art24-27 — Digital operational resilience testing (incl. threat-led penetration testing)","type":"control","url":"/assets/agent_record-ctrl-dora-dora-art24-27-dc4b8836.10b427458b73121d.json"},{"attributes":{"category":"administrative","framework":"eu-ai-act","type":"preventive"},"canonicalUrl":"https://controlsmap.com/frameworks/eu-ai-act/","description":"Fundamental rights impact assessment for high-risk AI systems (deployers)","details":{"automation":"manual","control_category":"administrative","control_id":"AIA-Art27","control_type":"preventive","domains":["AI Governance","Risk Assessment & Management","Governance, Policy & Oversight"],"framework":"eu-ai-act","group":"EU AI Act","key_control":false,"requirement_frequency":null,"requirement_status":null,"risk_count":8,"source_pages":null,"source_url":null},"direct":false,"htmlUrl":"/agents/records/ctrl-eu-ai-act-aia-art27-7b550500.html","id":"ctrl:eu-ai-act:AIA-Art27","mapUrl":"https://controlsmap.com/?v=1&node=ctrl%3Aeu-ai-act%3AAIA-Art27","sourceIds":["eu-ai-act"],"sourceUrl":null,"title":"AIA-Art27 — Fundamental rights impact assessment for high-risk AI systems (deployers)","type":"control","url":"/assets/agent_record-ctrl-eu-ai-act-aia-art27-7b550500.c84e32a15d604ed9.json"},{"attributes":{"category":"administrative","framework":"eu-ai-act","type":"preventive"},"canonicalUrl":"https://controlsmap.com/frameworks/eu-ai-act/","description":"Risk-based classification of high-risk AI systems","details":{"automation":"manual","control_category":"administrative","control_id":"AIA-Art6-7","control_type":"preventive","domains":["AI Governance","Risk Assessment & Management","Governance, Policy & Oversight"],"framework":"eu-ai-act","group":"EU AI Act","key_control":false,"requirement_frequency":null,"requirement_status":null,"risk_count":8,"source_pages":null,"source_url":null},"direct":false,"htmlUrl":"/agents/records/ctrl-eu-ai-act-aia-art6-7-cd7435c0.html","id":"ctrl:eu-ai-act:AIA-Art6-7","mapUrl":"https://controlsmap.com/?v=1&node=ctrl%3Aeu-ai-act%3AAIA-Art6-7","sourceIds":["eu-ai-act"],"sourceUrl":null,"title":"AIA-Art6-7 — Risk-based classification of high-risk AI systems","type":"control","url":"/assets/agent_record-ctrl-eu-ai-act-aia-art6-7-cd7435c0.b842560dde490b21.json"},{"attributes":{"category":"administrative","framework":"gdpr","type":"preventive"},"canonicalUrl":"https://controlsmap.com/frameworks/gdpr/","description":"Processor obligations and data processing agreements","details":{"automation":"manual","control_category":"administrative","control_id":"GDPR-Art28","control_type":"preventive","domains":["Data Protection & Privacy","Governance, Policy & Oversight","Incident Management & Response","Third-Party / Supply-Chain Risk","Risk Assessment & Management"],"framework":"gdpr","group":"EU GDPR","key_control":false,"requirement_frequency":null,"requirement_status":null,"risk_count":5,"source_pages":null,"source_url":null},"direct":false,"htmlUrl":"/agents/records/ctrl-gdpr-gdpr-art28-e21fee94.html","id":"ctrl:gdpr:GDPR-Art28","mapUrl":"https://controlsmap.com/?v=1&node=ctrl%3Agdpr%3AGDPR-Art28","sourceIds":["gdpr"],"sourceUrl":null,"title":"GDPR-Art28 — Processor obligations and data processing agreements","type":"control","url":"/assets/agent_record-ctrl-gdpr-gdpr-art28-e21fee94.5ea41d93b9f5d85d.json"},{"attributes":{"category":"administrative","framework":"hipaa","type":"preventive"},"canonicalUrl":"https://controlsmap.com/frameworks/hipaa/","description":"Administrative safeguards (security management, risk analysis, workforce security, training, contingency plan, evaluation, BAAs)","details":{"automation":"manual","control_category":"administrative","control_id":"HIPAA-164.308","control_type":"preventive","domains":["Governance, Policy & Oversight","Risk Assessment & Management","Access Control & Identity Management","Physical & Environmental Security","Logging, Monitoring & Detection","Business Continuity & Disaster Recovery","Third-Party / Supply-Chain Risk","Data Protection & Privacy"],"framework":"hipaa","group":"HIPAA Security Rule","key_control":false,"requirement_frequency":null,"requirement_status":null,"risk_count":2,"source_pages":null,"source_url":null},"direct":false,"htmlUrl":"/agents/records/ctrl-hipaa-hipaa-164-308-d26b6932.html","id":"ctrl:hipaa:HIPAA-164.308","mapUrl":"https://controlsmap.com/?v=1&node=ctrl%3Ahipaa%3AHIPAA-164.308","sourceIds":["hipaa"],"sourceUrl":null,"title":"HIPAA-164.308 — Administrative safeguards (security management, risk analysis, workforce security, training, contingency plan, evaluation, BAAs)","type":"control","url":"/assets/agent_record-ctrl-hipaa-hipaa-164-308-d26b6932.22ddccedcaa2755e.json"},{"attributes":{"category":"administrative","framework":"hipaa","type":"preventive"},"canonicalUrl":"https://controlsmap.com/frameworks/hipaa/","description":"Organizational requirements (business associate contracts, group health plan requirements)","details":{"automation":"manual","control_category":"administrative","control_id":"HIPAA-164.314","control_type":"preventive","domains":["Governance, Policy & Oversight","Risk Assessment & Management","Access Control & Identity Management","Physical & Environmental Security","Logging, Monitoring & Detection","Business Continuity & Disaster Recovery","Third-Party / Supply-Chain Risk","Data Protection & Privacy"],"framework":"hipaa","group":"HIPAA Security Rule","key_control":false,"requirement_frequency":null,"requirement_status":null,"risk_count":5,"source_pages":null,"source_url":null},"direct":false,"htmlUrl":"/agents/records/ctrl-hipaa-hipaa-164-314-0b44ffa8.html","id":"ctrl:hipaa:HIPAA-164.314","mapUrl":"https://controlsmap.com/?v=1&node=ctrl%3Ahipaa%3AHIPAA-164.314","sourceIds":["hipaa"],"sourceUrl":null,"title":"HIPAA-164.314 — Organizational requirements (business associate contracts, group health plan requirements)","type":"control","url":"/assets/agent_record-ctrl-hipaa-hipaa-164-314-0b44ffa8.99cd944bf9558eae.json"},{"attributes":{"category":"administrative","framework":"iia-2024","type":"preventive"},"canonicalUrl":"https://controlsmap.com/frameworks/iia-2024/","description":"Demonstrate Integrity","details":{"automation":"manual","control_category":"administrative","control_id":"Principle 1","control_type":"preventive","domains":["Compliance, Audit & Assurance","Governance, Policy & Oversight"],"framework":"iia-2024","group":"Domain II — Ethics and Professionalism","key_control":false,"requirement_frequency":null,"requirement_status":null,"risk_count":2,"source_pages":null,"source_url":null},"direct":false,"htmlUrl":"/agents/records/ctrl-iia-2024-principle-1-97822cbc.html","id":"ctrl:iia-2024:Principle 1","mapUrl":"https://controlsmap.com/?v=1&node=ctrl%3Aiia-2024%3APrinciple+1","sourceIds":["iia-2024"],"sourceUrl":null,"title":"Principle 1 — Demonstrate Integrity","type":"control","url":"/assets/agent_record-ctrl-iia-2024-principle-1-97822cbc.a39b0275f896524f.json"},{"attributes":{"category":"administrative","framework":"iia-2024","type":"preventive"},"canonicalUrl":"https://controlsmap.com/frameworks/iia-2024/","description":"Communicate Effectively","details":{"automation":"manual","control_category":"administrative","control_id":"Principle 11","control_type":"preventive","domains":["Compliance, Audit & Assurance","Governance, Policy & Oversight","Risk Assessment & Management"],"framework":"iia-2024","group":"Domain IV — Managing the Internal Audit Function","key_control":false,"requirement_frequency":null,"requirement_status":null,"risk_count":2,"source_pages":null,"source_url":null},"direct":false,"htmlUrl":"/agents/records/ctrl-iia-2024-principle-11-9a00dcd8.html","id":"ctrl:iia-2024:Principle 11","mapUrl":"https://controlsmap.com/?v=1&node=ctrl%3Aiia-2024%3APrinciple+11","sourceIds":["iia-2024"],"sourceUrl":null,"title":"Principle 11 — Communicate Effectively","type":"control","url":"/assets/agent_record-ctrl-iia-2024-principle-11-9a00dcd8.3ee343f37f020ae3.json"},{"attributes":{"category":"administrative","framework":"iia-2024","type":"detective"},"canonicalUrl":"https://controlsmap.com/frameworks/iia-2024/","description":"Enhance Quality","details":{"automation":"manual","control_category":"administrative","control_id":"Principle 12","control_type":"detective","domains":["Compliance, Audit & Assurance","Governance, Policy & Oversight","Risk Assessment & Management"],"framework":"iia-2024","group":"Domain IV — Managing the Internal Audit Function","key_control":false,"requirement_frequency":null,"requirement_status":null,"risk_count":2,"source_pages":null,"source_url":null},"direct":false,"htmlUrl":"/agents/records/ctrl-iia-2024-principle-12-ef0f1834.html","id":"ctrl:iia-2024:Principle 12","mapUrl":"https://controlsmap.com/?v=1&node=ctrl%3Aiia-2024%3APrinciple+12","sourceIds":["iia-2024"],"sourceUrl":null,"title":"Principle 12 — Enhance Quality","type":"control","url":"/assets/agent_record-ctrl-iia-2024-principle-12-ef0f1834.cfae2cd589424cae.json"},{"attributes":{"category":"administrative","framework":"iia-2024","type":"preventive"},"canonicalUrl":"https://controlsmap.com/frameworks/iia-2024/","description":"Maintain Objectivity","details":{"automation":"manual","control_category":"administrative","control_id":"Principle 2","control_type":"preventive","domains":["Compliance, Audit & Assurance","Governance, Policy & Oversight"],"framework":"iia-2024","group":"Domain II — Ethics and Professionalism","key_control":false,"requirement_frequency":null,"requirement_status":null,"risk_count":2,"source_pages":null,"source_url":null},"direct":false,"htmlUrl":"/agents/records/ctrl-iia-2024-principle-2-88ab9637.html","id":"ctrl:iia-2024:Principle 2","mapUrl":"https://controlsmap.com/?v=1&node=ctrl%3Aiia-2024%3APrinciple+2","sourceIds":["iia-2024"],"sourceUrl":null,"title":"Principle 2 — Maintain Objectivity","type":"control","url":"/assets/agent_record-ctrl-iia-2024-principle-2-88ab9637.90e0b3808ff1c49f.json"},{"attributes":{"category":"administrative","framework":"iia-2024","type":"preventive"},"canonicalUrl":"https://controlsmap.com/frameworks/iia-2024/","description":"Overseen by the Board","details":{"automation":"manual","control_category":"administrative","control_id":"Principle 8","control_type":"preventive","domains":["Compliance, Audit & Assurance","Governance, Policy & Oversight"],"framework":"iia-2024","group":"Domain III — Governing the Internal Audit Function","key_control":false,"requirement_frequency":null,"requirement_status":null,"risk_count":2,"source_pages":null,"source_url":null},"direct":false,"htmlUrl":"/agents/records/ctrl-iia-2024-principle-8-f2747c36.html","id":"ctrl:iia-2024:Principle 8","mapUrl":"https://controlsmap.com/?v=1&node=ctrl%3Aiia-2024%3APrinciple+8","sourceIds":["iia-2024"],"sourceUrl":null,"title":"Principle 8 — Overseen by the Board","type":"control","url":"/assets/agent_record-ctrl-iia-2024-principle-8-f2747c36.6fafa877f8940b56.json"},{"attributes":{"category":"administrative","framework":"iia-2024","type":"preventive"},"canonicalUrl":"https://controlsmap.com/frameworks/iia-2024/","description":"Honesty and Professional Courage","details":{"automation":"manual","control_category":"administrative","control_id":"Std 1.1","control_type":"preventive","domains":["Compliance, Audit & Assurance","Governance, Policy & Oversight"],"framework":"iia-2024","group":"Domain II — Ethics and Professionalism","key_control":false,"requirement_frequency":null,"requirement_status":null,"risk_count":2,"source_pages":null,"source_url":null},"direct":false,"htmlUrl":"/agents/records/ctrl-iia-2024-std-1-1-e8b262ce.html","id":"ctrl:iia-2024:Std 1.1","mapUrl":"https://controlsmap.com/?v=1&node=ctrl%3Aiia-2024%3AStd+1.1","sourceIds":["iia-2024"],"sourceUrl":null,"title":"Std 1.1 — Honesty and Professional Courage","type":"control","url":"/assets/agent_record-ctrl-iia-2024-std-1-1-e8b262ce.a1ae1a08c7125ef8.json"},{"attributes":{"category":"administrative","framework":"iia-2024","type":"preventive"},"canonicalUrl":"https://controlsmap.com/frameworks/iia-2024/","description":"Organization's Ethical Expectations","details":{"automation":"manual","control_category":"administrative","control_id":"Std 1.2","control_type":"preventive","domains":["Compliance, Audit & Assurance","Governance, Policy & Oversight"],"framework":"iia-2024","group":"Domain II — Ethics and Professionalism","key_control":false,"requirement_frequency":null,"requirement_status":null,"risk_count":2,"source_pages":null,"source_url":null},"direct":false,"htmlUrl":"/agents/records/ctrl-iia-2024-std-1-2-da892b84.html","id":"ctrl:iia-2024:Std 1.2","mapUrl":"https://controlsmap.com/?v=1&node=ctrl%3Aiia-2024%3AStd+1.2","sourceIds":["iia-2024"],"sourceUrl":null,"title":"Std 1.2 — Organization's Ethical Expectations","type":"control","url":"/assets/agent_record-ctrl-iia-2024-std-1-2-da892b84.37954ef6c48d4516.json"},{"attributes":{"category":"administrative","framework":"iia-2024","type":"preventive"},"canonicalUrl":"https://controlsmap.com/frameworks/iia-2024/","description":"Legal and Ethical Behavior","details":{"automation":"manual","control_category":"administrative","control_id":"Std 1.3","control_type":"preventive","domains":["Compliance, Audit & Assurance","Governance, Policy & Oversight"],"framework":"iia-2024","group":"Domain II — Ethics and Professionalism","key_control":false,"requirement_frequency":null,"requirement_status":null,"risk_count":2,"source_pages":null,"source_url":null},"direct":false,"htmlUrl":"/agents/records/ctrl-iia-2024-std-1-3-d38479a0.html","id":"ctrl:iia-2024:Std 1.3","mapUrl":"https://controlsmap.com/?v=1&node=ctrl%3Aiia-2024%3AStd+1.3","sourceIds":["iia-2024"],"sourceUrl":null,"title":"Std 1.3 — Legal and Ethical Behavior","type":"control","url":"/assets/agent_record-ctrl-iia-2024-std-1-3-d38479a0.643dab09874478e5.json"},{"attributes":{"category":"administrative","framework":"iia-2024","type":"preventive"},"canonicalUrl":"https://controlsmap.com/frameworks/iia-2024/","description":"Building Relationships and Communicating with Stakeholders","details":{"automation":"manual","control_category":"administrative","control_id":"Std 11.1","control_type":"preventive","domains":["Compliance, Audit & Assurance","Governance, Policy & Oversight","Risk Assessment & Management"],"framework":"iia-2024","group":"Domain IV — Managing the Internal Audit Function","key_control":false,"requirement_frequency":null,"requirement_status":null,"risk_count":2,"source_pages":null,"source_url":null},"direct":false,"htmlUrl":"/agents/records/ctrl-iia-2024-std-11-1-ae43870c.html","id":"ctrl:iia-2024:Std 11.1","mapUrl":"https://controlsmap.com/?v=1&node=ctrl%3Aiia-2024%3AStd+11.1","sourceIds":["iia-2024"],"sourceUrl":null,"title":"Std 11.1 — Building Relationships and Communicating with Stakeholders","type":"control","url":"/assets/agent_record-ctrl-iia-2024-std-11-1-ae43870c.30c92ce46abb789a.json"},{"attributes":{"category":"administrative","framework":"iia-2024","type":"preventive"},"canonicalUrl":"https://controlsmap.com/frameworks/iia-2024/","description":"Effective Communication","details":{"automation":"manual","control_category":"administrative","control_id":"Std 11.2","control_type":"preventive","domains":["Compliance, Audit & Assurance","Governance, Policy & Oversight","Risk Assessment & Management"],"framework":"iia-2024","group":"Domain IV — Managing the Internal Audit Function","key_control":false,"requirement_frequency":null,"requirement_status":null,"risk_count":2,"source_pages":null,"source_url":null},"direct":false,"htmlUrl":"/agents/records/ctrl-iia-2024-std-11-2-36c386cb.html","id":"ctrl:iia-2024:Std 11.2","mapUrl":"https://controlsmap.com/?v=1&node=ctrl%3Aiia-2024%3AStd+11.2","sourceIds":["iia-2024"],"sourceUrl":null,"title":"Std 11.2 — Effective Communication","type":"control","url":"/assets/agent_record-ctrl-iia-2024-std-11-2-36c386cb.80f6cf7c808bb2b6.json"},{"attributes":{"category":"administrative","framework":"iia-2024","type":"detective"},"canonicalUrl":"https://controlsmap.com/frameworks/iia-2024/","description":"Internal Quality Assessment","details":{"automation":"manual","control_category":"administrative","control_id":"Std 12.1","control_type":"detective","domains":["Compliance, Audit & Assurance","Governance, Policy & Oversight","Risk Assessment & Management"],"framework":"iia-2024","group":"Domain IV — Managing the Internal Audit Function","key_control":false,"requirement_frequency":null,"requirement_status":null,"risk_count":2,"source_pages":null,"source_url":null},"direct":false,"htmlUrl":"/agents/records/ctrl-iia-2024-std-12-1-5f2fe558.html","id":"ctrl:iia-2024:Std 12.1","mapUrl":"https://controlsmap.com/?v=1&node=ctrl%3Aiia-2024%3AStd+12.1","sourceIds":["iia-2024"],"sourceUrl":null,"title":"Std 12.1 — Internal Quality Assessment","type":"control","url":"/assets/agent_record-ctrl-iia-2024-std-12-1-5f2fe558.b1a8e274b5d70c2d.json"},{"attributes":{"category":"administrative","framework":"iia-2024","type":"detective"},"canonicalUrl":"https://controlsmap.com/frameworks/iia-2024/","description":"Performance Measurement","details":{"automation":"manual","control_category":"administrative","control_id":"Std 12.2","control_type":"detective","domains":["Compliance, Audit & Assurance","Governance, Policy & Oversight","Risk Assessment & Management"],"framework":"iia-2024","group":"Domain IV — Managing the Internal Audit Function","key_control":false,"requirement_frequency":null,"requirement_status":null,"risk_count":2,"source_pages":null,"source_url":null},"direct":false,"htmlUrl":"/agents/records/ctrl-iia-2024-std-12-2-9e51df17.html","id":"ctrl:iia-2024:Std 12.2","mapUrl":"https://controlsmap.com/?v=1&node=ctrl%3Aiia-2024%3AStd+12.2","sourceIds":["iia-2024"],"sourceUrl":null,"title":"Std 12.2 — Performance Measurement","type":"control","url":"/assets/agent_record-ctrl-iia-2024-std-12-2-9e51df17.dac3a936005ff972.json"},{"attributes":{"category":"administrative","framework":"iia-2024","type":"preventive"},"canonicalUrl":"https://controlsmap.com/frameworks/iia-2024/","description":"Individual Objectivity","details":{"automation":"manual","control_category":"administrative","control_id":"Std 2.1","control_type":"preventive","domains":["Compliance, Audit & Assurance","Governance, Policy & Oversight"],"framework":"iia-2024","group":"Domain II — Ethics and Professionalism","key_control":false,"requirement_frequency":null,"requirement_status":null,"risk_count":2,"source_pages":null,"source_url":null},"direct":false,"htmlUrl":"/agents/records/ctrl-iia-2024-std-2-1-bd937208.html","id":"ctrl:iia-2024:Std 2.1","mapUrl":"https://controlsmap.com/?v=1&node=ctrl%3Aiia-2024%3AStd+2.1","sourceIds":["iia-2024"],"sourceUrl":null,"title":"Std 2.1 — Individual Objectivity","type":"control","url":"/assets/agent_record-ctrl-iia-2024-std-2-1-bd937208.b33984e3bfbdf8a5.json"},{"attributes":{"category":"administrative","framework":"iia-2024","type":"preventive"},"canonicalUrl":"https://controlsmap.com/frameworks/iia-2024/","description":"Safeguarding Objectivity","details":{"automation":"manual","control_category":"administrative","control_id":"Std 2.2","control_type":"preventive","domains":["Compliance, Audit & Assurance","Governance, Policy & Oversight"],"framework":"iia-2024","group":"Domain II — Ethics and Professionalism","key_control":false,"requirement_frequency":null,"requirement_status":null,"risk_count":2,"source_pages":null,"source_url":null},"direct":false,"htmlUrl":"/agents/records/ctrl-iia-2024-std-2-2-521156a0.html","id":"ctrl:iia-2024:Std 2.2","mapUrl":"https://controlsmap.com/?v=1&node=ctrl%3Aiia-2024%3AStd+2.2","sourceIds":["iia-2024"],"sourceUrl":null,"title":"Std 2.2 — Safeguarding Objectivity","type":"control","url":"/assets/agent_record-ctrl-iia-2024-std-2-2-521156a0.26e31dd63102f83e.json"},{"attributes":{"category":"administrative","framework":"iia-2024","type":"detective"},"canonicalUrl":"https://controlsmap.com/frameworks/iia-2024/","description":"Disclosing Impairments to Objectivity","details":{"automation":"manual","control_category":"administrative","control_id":"Std 2.3","control_type":"detective","domains":["Compliance, Audit & Assurance","Governance, Policy & Oversight"],"framework":"iia-2024","group":"Domain II — Ethics and Professionalism","key_control":false,"requirement_frequency":null,"requirement_status":null,"risk_count":2,"source_pages":null,"source_url":null},"direct":false,"htmlUrl":"/agents/records/ctrl-iia-2024-std-2-3-44f8f5b2.html","id":"ctrl:iia-2024:Std 2.3","mapUrl":"https://controlsmap.com/?v=1&node=ctrl%3Aiia-2024%3AStd+2.3","sourceIds":["iia-2024"],"sourceUrl":null,"title":"Std 2.3 — Disclosing Impairments to Objectivity","type":"control","url":"/assets/agent_record-ctrl-iia-2024-std-2-3-44f8f5b2.849b1c05e02948bc.json"},{"attributes":{"category":"administrative","framework":"iia-2024","type":"preventive"},"canonicalUrl":"https://controlsmap.com/frameworks/iia-2024/","description":"Board Interaction","details":{"automation":"manual","control_category":"administrative","control_id":"Std 8.1","control_type":"preventive","domains":["Compliance, Audit & Assurance","Governance, Policy & Oversight"],"framework":"iia-2024","group":"Domain III — Governing the Internal Audit Function","key_control":false,"requirement_frequency":null,"requirement_status":null,"risk_count":2,"source_pages":null,"source_url":null},"direct":false,"htmlUrl":"/agents/records/ctrl-iia-2024-std-8-1-fcaabb3b.html","id":"ctrl:iia-2024:Std 8.1","mapUrl":"https://controlsmap.com/?v=1&node=ctrl%3Aiia-2024%3AStd+8.1","sourceIds":["iia-2024"],"sourceUrl":null,"title":"Std 8.1 — Board Interaction","type":"control","url":"/assets/agent_record-ctrl-iia-2024-std-8-1-fcaabb3b.2ead951eaf0042a9.json"},{"attributes":{"category":"administrative","framework":"iia-2024","type":"preventive"},"canonicalUrl":"https://controlsmap.com/frameworks/iia-2024/","description":"Resources","details":{"automation":"manual","control_category":"administrative","control_id":"Std 8.2","control_type":"preventive","domains":["Compliance, Audit & Assurance","Governance, Policy & Oversight"],"framework":"iia-2024","group":"Domain III — Governing the Internal Audit Function","key_control":false,"requirement_frequency":null,"requirement_status":null,"risk_count":2,"source_pages":null,"source_url":null},"direct":false,"htmlUrl":"/agents/records/ctrl-iia-2024-std-8-2-6259e7c5.html","id":"ctrl:iia-2024:Std 8.2","mapUrl":"https://controlsmap.com/?v=1&node=ctrl%3Aiia-2024%3AStd+8.2","sourceIds":["iia-2024"],"sourceUrl":null,"title":"Std 8.2 — Resources","type":"control","url":"/assets/agent_record-ctrl-iia-2024-std-8-2-6259e7c5.ea73af74509c99ae.json"},{"attributes":{"category":"administrative","framework":"iia-2024","type":"detective"},"canonicalUrl":"https://controlsmap.com/frameworks/iia-2024/","description":"Quality","details":{"automation":"manual","control_category":"administrative","control_id":"Std 8.3","control_type":"detective","domains":["Compliance, Audit & Assurance","Governance, Policy & Oversight"],"framework":"iia-2024","group":"Domain III — Governing the Internal Audit Function","key_control":false,"requirement_frequency":null,"requirement_status":null,"risk_count":2,"source_pages":null,"source_url":null},"direct":false,"htmlUrl":"/agents/records/ctrl-iia-2024-std-8-3-9200230e.html","id":"ctrl:iia-2024:Std 8.3","mapUrl":"https://controlsmap.com/?v=1&node=ctrl%3Aiia-2024%3AStd+8.3","sourceIds":["iia-2024"],"sourceUrl":null,"title":"Std 8.3 — Quality","type":"control","url":"/assets/agent_record-ctrl-iia-2024-std-8-3-9200230e.ee4a68440e116e1e.json"},{"attributes":{"category":"administrative","framework":"iia-pos-2026-erm","type":"preventive"},"canonicalUrl":"https://controlsmap.com/frameworks/iia-pos-2026-erm/","description":"Expanded internal-audit ERM responsibility requires documented allocation, board approval, separation, disclosure, independent assurance, cooling-off, periodic review, and transition where temporary.","details":{"automation":"manual","control_category":"administrative","control_id":"IIA-POS-ERM-03","control_type":"preventive","domains":[],"framework":"iia-pos-2026-erm","group":"Enterprise Risk Management Role Integrity","key_control":false,"requirement_frequency":null,"requirement_status":null,"risk_count":4,"source_pages":"ERM pp. 12–13, 15–20","source_url":null,"statement":"Expanded internal-audit ERM responsibility requires documented allocation, board approval, separation, disclosure, independent assurance, cooling-off, periodic review, and transition where temporary."},"direct":false,"htmlUrl":"/agents/records/ctrl-iia-pos-2026-erm-iia-pos-erm-03-2ed09a44.html","id":"ctrl:iia-pos-2026-erm:IIA-POS-ERM-03","mapUrl":"https://controlsmap.com/?v=1&node=ctrl%3Aiia-pos-2026-erm%3AIIA-POS-ERM-03","sourceIds":["iia-pos-2026-erm"],"sourceUrl":null,"title":"IIA-POS-ERM-03 — Safeguards for Expanded ERM Responsibility","type":"control","url":"/assets/agent_record-ctrl-iia-pos-2026-erm-iia-pos-erm-03-2ed09a44.8f5208a0589ea451.json"},{"attributes":{"category":"administrative","framework":"iia-pos-2026-three-lines","type":"preventive"},"canonicalUrl":"https://controlsmap.com/frameworks/iia-pos-2026-three-lines/","description":"Independence requires structural safeguards, board-approved expanded remit, protection against self-review, and at least 12 months between operational responsibility and assurance.","details":{"automation":"manual","control_category":"administrative","control_id":"IIA-POS-TLM-02","control_type":"preventive","domains":[],"framework":"iia-pos-2026-three-lines","group":"Three Lines Role Integrity","key_control":false,"requirement_frequency":null,"requirement_status":null,"risk_count":4,"source_pages":"Three Lines pp. 9–11, 20–22","source_url":null,"statement":"Independence requires structural safeguards, board-approved expanded remit, protection against self-review, and at least 12 months between operational responsibility and assurance."},"direct":false,"htmlUrl":"/agents/records/ctrl-iia-pos-2026-three-lines-iia-pos-tlm-02-c2f0d9a7.html","id":"ctrl:iia-pos-2026-three-lines:IIA-POS-TLM-02","mapUrl":"https://controlsmap.com/?v=1&node=ctrl%3Aiia-pos-2026-three-lines%3AIIA-POS-TLM-02","sourceIds":["iia-pos-2026-three-lines"],"sourceUrl":null,"title":"IIA-POS-TLM-02 — Independence and Self-Review Safeguards","type":"control","url":"/assets/agent_record-ctrl-iia-pos-2026-three-lines-iia-pos-tlm-02-c2f0d9a7.873cc5fc729e256b.json"},{"attributes":{"category":"administrative","framework":"iso-27001","type":"preventive"},"canonicalUrl":"https://controlsmap.com/frameworks/iso-27001/","description":"Access control","details":{"automation":"hybrid","control_category":"administrative","control_id":"A.5.15","control_type":"preventive","domains":["Access Control & Identity Management"],"framework":"iso-27001","group":"Organizational controls","key_control":true,"requirement_frequency":null,"requirement_status":null,"risk_count":7,"source_pages":null,"source_url":null},"direct":false,"htmlUrl":"/agents/records/ctrl-iso-27001-a-5-15-b8587804.html","id":"ctrl:iso-27001:A.5.15","mapUrl":"https://controlsmap.com/?v=1&node=ctrl%3Aiso-27001%3AA.5.15","sourceIds":["iso-27001"],"sourceUrl":null,"title":"A.5.15 — Access control","type":"control","url":"/assets/agent_record-ctrl-iso-27001-a-5-15-b8587804.790e4f214625d89e.json"},{"attributes":{"category":"administrative","framework":"iso-27001","type":"preventive"},"canonicalUrl":"https://controlsmap.com/frameworks/iso-27001/","description":"Addressing information security within supplier agreements","details":{"automation":"manual","control_category":"administrative","control_id":"A.5.20","control_type":"preventive","domains":["Human Resources / Personnel Security","Third-Party / Supply-Chain Risk"],"framework":"iso-27001","group":"Organizational controls","key_control":false,"requirement_frequency":null,"requirement_status":null,"risk_count":2,"source_pages":null,"source_url":null},"direct":false,"htmlUrl":"/agents/records/ctrl-iso-27001-a-5-20-fcee3b34.html","id":"ctrl:iso-27001:A.5.20","mapUrl":"https://controlsmap.com/?v=1&node=ctrl%3Aiso-27001%3AA.5.20","sourceIds":["iso-27001"],"sourceUrl":null,"title":"A.5.20 — Addressing information security within supplier agreements","type":"control","url":"/assets/agent_record-ctrl-iso-27001-a-5-20-fcee3b34.076c27118b287da4.json"},{"attributes":{"category":"administrative","framework":"iso-27001","type":"preventive"},"canonicalUrl":"https://controlsmap.com/frameworks/iso-27001/","description":"Management responsibilities","details":{"automation":"manual","control_category":"administrative","control_id":"A.5.4","control_type":"preventive","domains":["Awareness & Training","Governance, Policy & Oversight"],"framework":"iso-27001","group":"Organizational controls","key_control":false,"requirement_frequency":null,"requirement_status":null,"risk_count":3,"source_pages":null,"source_url":null},"direct":false,"htmlUrl":"/agents/records/ctrl-iso-27001-a-5-4-779338c6.html","id":"ctrl:iso-27001:A.5.4","mapUrl":"https://controlsmap.com/?v=1&node=ctrl%3Aiso-27001%3AA.5.4","sourceIds":["iso-27001"],"sourceUrl":null,"title":"A.5.4 — Management responsibilities","type":"control","url":"/assets/agent_record-ctrl-iso-27001-a-5-4-779338c6.c8c329d40cfa88d5.json"},{"attributes":{"category":"administrative","framework":"iso-27001","type":"preventive"},"canonicalUrl":"https://controlsmap.com/frameworks/iso-27001/","description":"Screening","details":{"automation":"manual","control_category":"administrative","control_id":"A.6.1","control_type":"preventive","domains":["Human Resources / Personnel Security"],"framework":"iso-27001","group":"People controls","key_control":false,"requirement_frequency":null,"requirement_status":null,"risk_count":2,"source_pages":null,"source_url":null},"direct":false,"htmlUrl":"/agents/records/ctrl-iso-27001-a-6-1-048c51f3.html","id":"ctrl:iso-27001:A.6.1","mapUrl":"https://controlsmap.com/?v=1&node=ctrl%3Aiso-27001%3AA.6.1","sourceIds":["iso-27001"],"sourceUrl":null,"title":"A.6.1 — Screening","type":"control","url":"/assets/agent_record-ctrl-iso-27001-a-6-1-048c51f3.2ae67f1f08f40a3a.json"},{"attributes":{"category":"administrative","framework":"iso-27001","type":"preventive"},"canonicalUrl":"https://controlsmap.com/frameworks/iso-27001/","description":"Terms and conditions of employment","details":{"automation":"manual","control_category":"administrative","control_id":"A.6.2","control_type":"preventive","domains":["Human Resources / Personnel Security"],"framework":"iso-27001","group":"People controls","key_control":false,"requirement_frequency":null,"requirement_status":null,"risk_count":2,"source_pages":null,"source_url":null},"direct":false,"htmlUrl":"/agents/records/ctrl-iso-27001-a-6-2-89c7f287.html","id":"ctrl:iso-27001:A.6.2","mapUrl":"https://controlsmap.com/?v=1&node=ctrl%3Aiso-27001%3AA.6.2","sourceIds":["iso-27001"],"sourceUrl":null,"title":"A.6.2 — Terms and conditions of employment","type":"control","url":"/assets/agent_record-ctrl-iso-27001-a-6-2-89c7f287.c263e2a154ab9869.json"}],"relationships":[{"expectedCatalogRevision":"24028ffcfc2b295fa1b08ee6caa84b765f0731b321496bf4f548c49ad2177028","id":"rel:071946c7f47bc974a5dad8a15a71bae0ed4c9fa115558049369b03248c1b5562","properties":{"control_id":"HIPAA-164.314","coverage":"partial","delta":"group health plan document requirements (164.314(b)) fall outside vendor/BA contracting","framework":"hipaa","provenance":{"defaultConfidence":"medium","defaultStatus":"active","direction":"canonical_to_source","mapper":"coworkcanvas-compliance-graph","note":"Each member is a documented relationship claim from the canonical unified control to a source control or guidance proposition. relationship: equal|superset_of (full) / intersects_with|subset_of (partial) / informs (guidance). confidence 'medium' = single-mapper, documented, not yet externally corroborated. source_version is the member framework's edition from the standard version register.","reviewDate":"2026-09-07"},"relationship":"intersects_with","source_version":"45 CFR Parts 160/164 (Security, Privacy, Breach Notification)"},"sourceDetailPath":"/data/v1/records/uc-uc-tprm-03-c9edcf93.json","sourceId":"uc:UC-TPRM-03","targetDetailPath":"/data/v1/records/ctrl-hipaa-hipaa-164-314-0b44ffa8.json","targetId":"ctrl:hipaa:HIPAA-164.314","type":"maps_to"},{"expectedCatalogRevision":"24028ffcfc2b295fa1b08ee6caa84b765f0731b321496bf4f548c49ad2177028","id":"rel:08901f92f139567733352fa9c46f6b8381406d516a043727a779bb251a871be5","properties":{},"sourceDetailPath":"/data/v1/records/ctrl-coso-ic-p5-7f62f522.json","sourceId":"ctrl:coso-ic:P5","targetDetailPath":"/data/v1/records/std-coso-ic-3f80f565.json","targetId":"std:coso-ic","type":"belongs_to"},{"expectedCatalogRevision":"24028ffcfc2b295fa1b08ee6caa84b765f0731b321496bf4f548c49ad2177028","id":"rel:0d46be746c1f09cd9aa592f74a9c5676560a0be62dce9471bf6ca38af741e84e","properties":{"control_id":"Std 1.2","coverage":"full","delta":null,"framework":"iia-2024","provenance":{"defaultConfidence":"medium","defaultStatus":"active","direction":"canonical_to_source","mapper":"coworkcanvas-compliance-graph","note":"Each member is a documented relationship claim from the canonical unified control to a source control or guidance proposition. relationship: equal|superset_of (full) / intersects_with|subset_of (partial) / informs (guidance). confidence 'medium' = single-mapper, documented, not yet externally corroborated. source_version is the member framework's edition from the standard version register.","reviewDate":"2026-09-07"},"relationship":"superset_of","source_version":"2024 edition"},"sourceDetailPath":"/data/v1/records/uc-uc-audit-04-c880e18f.json","sourceId":"uc:UC-AUDIT-04","targetDetailPath":"/data/v1/records/ctrl-iia-2024-std-1-2-da892b84.json","targetId":"ctrl:iia-2024:Std 1.2","type":"maps_to"},{"expectedCatalogRevision":"24028ffcfc2b295fa1b08ee6caa84b765f0731b321496bf4f548c49ad2177028","id":"rel:136507dff54ef0af3b27852a8536c3f3de34c304c0f271557c3d0a9835e36313","properties":{},"sourceDetailPath":"/data/v1/records/ctrl-iia-2024-principle-1-97822cbc.json","sourceId":"ctrl:iia-2024:Principle 1","targetDetailPath":"/data/v1/records/std-iia-2024-1687734b.json","targetId":"std:iia-2024","type":"belongs_to"},{"expectedCatalogRevision":"24028ffcfc2b295fa1b08ee6caa84b765f0731b321496bf4f548c49ad2177028","id":"rel:180ce223861b332e1e1d5ad983fb57d87f852dbf326eb0e493dd27e918386be6","properties":{},"sourceDetailPath":"/data/v1/records/ctrl-coso-erm-e5-9038c819.json","sourceId":"ctrl:coso-erm:E5","targetDetailPath":"/data/v1/records/std-coso-erm-7265cc54.json","targetId":"std:coso-erm","type":"belongs_to"},{"expectedCatalogRevision":"24028ffcfc2b295fa1b08ee6caa84b765f0731b321496bf4f548c49ad2177028","id":"rel:1cbe84b3d02248a688536c82e7822f036836bb524da8e6cbd17b9c0c80bf40af","properties":{},"sourceDetailPath":"/data/v1/records/ctrl-aiuc-1-c001-6bc6c173.json","sourceId":"ctrl:aiuc-1:C001","targetDetailPath":"/data/v1/records/std-aiuc-1-d2a8b650.json","targetId":"std:aiuc-1","type":"belongs_to"},{"expectedCatalogRevision":"24028ffcfc2b295fa1b08ee6caa84b765f0731b321496bf4f548c49ad2177028","id":"rel:1d432230ecd3d2a598a5a0d08362e5568163137ad9ad1a09b7f538785887a862","properties":{},"sourceDetailPath":"/data/v1/records/ctrl-iia-2024-std-11-2-36c386cb.json","sourceId":"ctrl:iia-2024:Std 11.2","targetDetailPath":"/data/v1/records/std-iia-2024-1687734b.json","targetId":"std:iia-2024","type":"belongs_to"},{"expectedCatalogRevision":"24028ffcfc2b295fa1b08ee6caa84b765f0731b321496bf4f548c49ad2177028","id":"rel:1e1e41b81cfaa99a6c07c8879250c2bf86a8ce054be57cf89dc659bd1c1d76e9","properties":{},"sourceDetailPath":"/data/v1/records/ctrl-iia-2024-principle-12-ef0f1834.json","sourceId":"ctrl:iia-2024:Principle 12","targetDetailPath":"/data/v1/records/std-iia-2024-1687734b.json","targetId":"std:iia-2024","type":"belongs_to"},{"expectedCatalogRevision":"24028ffcfc2b295fa1b08ee6caa84b765f0731b321496bf4f548c49ad2177028","id":"rel:24fac1046b37ebc9bdc5375cd7c40130fdd31d0f4733479e05795a6b2589d023","properties":{"control_id":"A.5.4","coverage":"full","delta":null,"framework":"iso-27001","provenance":{"defaultConfidence":"medium","defaultStatus":"active","direction":"canonical_to_source","mapper":"coworkcanvas-compliance-graph","note":"Each member is a documented relationship claim from the canonical unified control to a source control or guidance proposition. relationship: equal|superset_of (full) / intersects_with|subset_of (partial) / informs (guidance). confidence 'medium' = single-mapper, documented, not yet externally corroborated. source_version is the member framework's edition from the standard version register.","reviewDate":"2026-09-07"},"relationship":"superset_of","source_version":"2022"},"sourceDetailPath":"/data/v1/records/uc-uc-gov-07-2a8998f7.json","sourceId":"uc:UC-GOV-07","targetDetailPath":"/data/v1/records/ctrl-iso-27001-a-5-4-779338c6.json","targetId":"ctrl:iso-27001:A.5.4","type":"maps_to"},{"expectedCatalogRevision":"24028ffcfc2b295fa1b08ee6caa84b765f0731b321496bf4f548c49ad2177028","id":"rel:28274a8c3f9ad8a2d885158f58bafbdd313754cb0dbeeb773d63bcdd96809e76","properties":{"control_id":"Std 11.2","coverage":"partial","delta":"Requires communications be accurate, objective, clear, concise, constructive, complete, and timely","framework":"iia-2024","provenance":{"defaultConfidence":"medium","defaultStatus":"active","direction":"canonical_to_source","mapper":"coworkcanvas-compliance-graph","note":"Each member is a documented relationship claim from the canonical unified control to a source control or guidance proposition. relationship: equal|superset_of (full) / intersects_with|subset_of (partial) / informs (guidance). confidence 'medium' = single-mapper, documented, not yet externally corroborated. source_version is the member framework's edition from the standard version register.","reviewDate":"2026-09-07"},"relationship":"intersects_with","source_version":"2024 edition"},"sourceDetailPath":"/data/v1/records/uc-uc-audit-18-7ab55995.json","sourceId":"uc:UC-AUDIT-18","targetDetailPath":"/data/v1/records/ctrl-iia-2024-std-11-2-36c386cb.json","targetId":"ctrl:iia-2024:Std 11.2","type":"maps_to"},{"expectedCatalogRevision":"24028ffcfc2b295fa1b08ee6caa84b765f0731b321496bf4f548c49ad2177028","id":"rel:2e1a500f18d0e2b83e81106ed2f4fbf92860977b1a8e6661d8bc8b375f5e1366","properties":{},"sourceDetailPath":"/data/v1/records/ctrl-ccpa-ccpa-1798-140-775f9cfa.json","sourceId":"ctrl:ccpa:CCPA-1798.140","targetDetailPath":"/data/v1/records/std-ccpa-55f3fd20.json","targetId":"std:ccpa","type":"belongs_to"},{"expectedCatalogRevision":"24028ffcfc2b295fa1b08ee6caa84b765f0731b321496bf4f548c49ad2177028","id":"rel:2f313f616bc55cce7ba558e4371bea44fc259e5d0cdec292b9752ca5cff6f867","properties":{},"sourceDetailPath":"/data/v1/records/ctrl-hipaa-hipaa-164-308-d26b6932.json","sourceId":"ctrl:hipaa:HIPAA-164.308","targetDetailPath":"/data/v1/records/std-hipaa-a825d271.json","targetId":"std:hipaa","type":"belongs_to"},{"expectedCatalogRevision":"24028ffcfc2b295fa1b08ee6caa84b765f0731b321496bf4f548c49ad2177028","id":"rel:3127e258f3fa443104b7c62468d64e1ea2001d2af6471e8af98154a5eca75379","properties":{},"sourceDetailPath":"/data/v1/records/ctrl-iia-2024-std-2-2-521156a0.json","sourceId":"ctrl:iia-2024:Std 2.2","targetDetailPath":"/data/v1/records/std-iia-2024-1687734b.json","targetId":"std:iia-2024","type":"belongs_to"},{"expectedCatalogRevision":"24028ffcfc2b295fa1b08ee6caa84b765f0731b321496bf4f548c49ad2177028","id":"rel:31aad85a41264a2f288f88465dff2361c9eedafac885731f96494a7a3e3b78d4","properties":{},"sourceDetailPath":"/data/v1/records/ctrl-iia-pos-2026-erm-iia-pos-erm-03-2ed09a44.json","sourceId":"ctrl:iia-pos-2026-erm:IIA-POS-ERM-03","targetDetailPath":"/data/v1/records/std-iia-pos-2026-erm-d24e4aa8.json","targetId":"std:iia-pos-2026-erm","type":"belongs_to"},{"expectedCatalogRevision":"24028ffcfc2b295fa1b08ee6caa84b765f0731b321496bf4f548c49ad2177028","id":"rel:3270acd877664b49d9afe4306dd9b608118e56b620865bbdca0676d9bca84a26","properties":{"control_id":"E5","coverage":"full","delta":null,"framework":"coso-erm","provenance":{"defaultConfidence":"medium","defaultStatus":"active","direction":"canonical_to_source","mapper":"coworkcanvas-compliance-graph","note":"Each member is a documented relationship claim from the canonical unified control to a source control or guidance proposition. relationship: equal|superset_of (full) / intersects_with|subset_of (partial) / informs (guidance). confidence 'medium' = single-mapper, documented, not yet externally corroborated. source_version is the member framework's edition from the standard version register.","reviewDate":"2026-09-07"},"relationship":"superset_of","source_version":"2017"},"sourceDetailPath":"/data/v1/records/uc-uc-gov-10-016614d1.json","sourceId":"uc:UC-GOV-10","targetDetailPath":"/data/v1/records/ctrl-coso-erm-e5-9038c819.json","targetId":"ctrl:coso-erm:E5","type":"maps_to"},{"expectedCatalogRevision":"24028ffcfc2b295fa1b08ee6caa84b765f0731b321496bf4f548c49ad2177028","id":"rel:34b195b7f7d5b0b72283e64b6687d8f3319af857205f58041ee596a0b56eba98","properties":{},"sourceDetailPath":"/data/v1/records/ctrl-cobit-2019-apo13-b83b9404.json","sourceId":"ctrl:cobit-2019:APO13","targetDetailPath":"/data/v1/records/std-cobit-2019-2181ce0c.json","targetId":"std:cobit-2019","type":"belongs_to"},{"expectedCatalogRevision":"24028ffcfc2b295fa1b08ee6caa84b765f0731b321496bf4f548c49ad2177028","id":"rel:3b9ed6f05fd9d237f6102e13c13ce5fc7df7836d69f775bccdc377d4039dfeed","properties":{},"sourceDetailPath":"/data/v1/records/ctrl-eu-ai-act-aia-art6-7-cd7435c0.json","sourceId":"ctrl:eu-ai-act:AIA-Art6-7","targetDetailPath":"/data/v1/records/std-eu-ai-act-54986689.json","targetId":"std:eu-ai-act","type":"belongs_to"},{"expectedCatalogRevision":"24028ffcfc2b295fa1b08ee6caa84b765f0731b321496bf4f548c49ad2177028","id":"rel:3f1b9ea154938221b1defc204c43a177d21cac451064cf698d3df8848fb47b3f","properties":{"control_id":"A.5.20","coverage":"partial","delta":"broader supplier security terms addressed under third-party risk domain","framework":"iso-27001","provenance":{"defaultConfidence":"medium","defaultStatus":"active","direction":"canonical_to_source","mapper":"coworkcanvas-compliance-graph","note":"Each member is a documented relationship claim from the canonical unified control to a source control or guidance proposition. relationship: equal|superset_of (full) / intersects_with|subset_of (partial) / informs (guidance). confidence 'medium' = single-mapper, documented, not yet externally corroborated. source_version is the member framework's edition from the standard version register.","reviewDate":"2026-09-07"},"relationship":"intersects_with","source_version":"2022"},"sourceDetailPath":"/data/v1/records/uc-uc-hr-05-4049a32e.json","sourceId":"uc:UC-HR-05","targetDetailPath":"/data/v1/records/ctrl-iso-27001-a-5-20-fcee3b34.json","targetId":"ctrl:iso-27001:A.5.20","type":"maps_to"},{"expectedCatalogRevision":"24028ffcfc2b295fa1b08ee6caa84b765f0731b321496bf4f548c49ad2177028","id":"rel:400f70c551f11263d174c3150339cb30cd22c365dcf230821bec670279b89c6e","properties":{},"sourceDetailPath":"/data/v1/records/ctrl-coso-ic-p15-04537dd0.json","sourceId":"ctrl:coso-ic:P15","targetDetailPath":"/data/v1/records/std-coso-ic-3f80f565.json","targetId":"std:coso-ic","type":"belongs_to"},{"expectedCatalogRevision":"24028ffcfc2b295fa1b08ee6caa84b765f0731b321496bf4f548c49ad2177028","id":"rel:45a1e5145b0928b28d18bf5921388ea0c0962d3cd43c1e225eae980c86022c05","properties":{},"sourceDetailPath":"/data/v1/records/ctrl-aiuc-1-a003-bea61fd9.json","sourceId":"ctrl:aiuc-1:A003","targetDetailPath":"/data/v1/records/std-aiuc-1-d2a8b650.json","targetId":"std:aiuc-1","type":"belongs_to"},{"expectedCatalogRevision":"24028ffcfc2b295fa1b08ee6caa84b765f0731b321496bf4f548c49ad2177028","id":"rel:466a020d9155bf095f26f8dfdceec468959b77f8f152099748d1ae2efcd0adf4","properties":{"control_id":"A.6.2","coverage":"full","delta":null,"framework":"iso-27001","provenance":{"defaultConfidence":"medium","defaultStatus":"active","direction":"canonical_to_source","mapper":"coworkcanvas-compliance-graph","note":"Each member is a documented relationship claim from the canonical unified control to a source control or guidance proposition. relationship: equal|superset_of (full) / intersects_with|subset_of (partial) / informs (guidance). confidence 'medium' = single-mapper, documented, not yet externally corroborated. source_version is the member framework's edition from the standard version register.","reviewDate":"2026-09-07"},"relationship":"superset_of","source_version":"2022"},"sourceDetailPath":"/data/v1/records/uc-uc-hr-02-a54c8912.json","sourceId":"uc:UC-HR-02","targetDetailPath":"/data/v1/records/ctrl-iso-27001-a-6-2-89c7f287.json","targetId":"ctrl:iso-27001:A.6.2","type":"maps_to"},{"expectedCatalogRevision":"24028ffcfc2b295fa1b08ee6caa84b765f0731b321496bf4f548c49ad2177028","id":"rel:49158a853491a17b8c0cf4df8cfd3ee6736d411aca4002ded09826f63b7e58ae","properties":{},"sourceDetailPath":"/data/v1/records/ctrl-iia-2024-std-12-2-9e51df17.json","sourceId":"ctrl:iia-2024:Std 12.2","targetDetailPath":"/data/v1/records/std-iia-2024-1687734b.json","targetId":"std:iia-2024","type":"belongs_to"},{"expectedCatalogRevision":"24028ffcfc2b295fa1b08ee6caa84b765f0731b321496bf4f548c49ad2177028","id":"rel:4a56783ad6dcc794d803ee7fe980c8690886e0375e32405c74497491ed4b0b70","properties":{"control_id":"APO07","coverage":"partial","delta":"workforce capacity/utilization planning and contract-staff management, beyond attracting, developing, and retaining competent personnel","framework":"cobit-2019","provenance":{"defaultConfidence":"medium","defaultStatus":"active","direction":"canonical_to_source","mapper":"coworkcanvas-compliance-graph","note":"Each member is a documented relationship claim from the canonical unified control to a source control or guidance proposition. relationship: equal|superset_of (full) / intersects_with|subset_of (partial) / informs (guidance). confidence 'medium' = single-mapper, documented, not yet externally corroborated. source_version is the member framework's edition from the standard version register.","reviewDate":"2026-09-07"},"relationship":"intersects_with","source_version":"2019"},"sourceDetailPath":"/data/v1/records/uc-uc-gov-10-016614d1.json","sourceId":"uc:UC-GOV-10","targetDetailPath":"/data/v1/records/ctrl-cobit-2019-apo07-20c9bdf0.json","targetId":"ctrl:cobit-2019:APO07","type":"maps_to"},{"expectedCatalogRevision":"24028ffcfc2b295fa1b08ee6caa84b765f0731b321496bf4f548c49ad2177028","id":"rel:4bd552c6a065a73e52f443df3cb6de91adcc22ab6d830654bb7a55b4508b5e29","properties":{},"sourceDetailPath":"/data/v1/records/ctrl-iia-2024-std-8-3-9200230e.json","sourceId":"ctrl:iia-2024:Std 8.3","targetDetailPath":"/data/v1/records/std-iia-2024-1687734b.json","targetId":"std:iia-2024","type":"belongs_to"},{"expectedCatalogRevision":"24028ffcfc2b295fa1b08ee6caa84b765f0731b321496bf4f548c49ad2177028","id":"rel:4c0658b16e591d3a8cb34969be86f430c6b8cecf6ce29130505d8475938e81cf","properties":{},"sourceDetailPath":"/data/v1/records/ctrl-iia-2024-principle-2-88ab9637.json","sourceId":"ctrl:iia-2024:Principle 2","targetDetailPath":"/data/v1/records/std-iia-2024-1687734b.json","targetId":"std:iia-2024","type":"belongs_to"},{"expectedCatalogRevision":"24028ffcfc2b295fa1b08ee6caa84b765f0731b321496bf4f548c49ad2177028","id":"rel:522d28aed24ab32fe41449ac950acc152ef604cf0a9e3b0e0aee1ab0b91027e2","properties":{"control_id":"P5","coverage":"full","delta":null,"framework":"coso-ic","provenance":{"defaultConfidence":"medium","defaultStatus":"active","direction":"canonical_to_source","mapper":"coworkcanvas-compliance-graph","note":"Each member is a documented relationship claim from the canonical unified control to a source control or guidance proposition. relationship: equal|superset_of (full) / intersects_with|subset_of (partial) / informs (guidance). confidence 'medium' = single-mapper, documented, not yet externally corroborated. source_version is the member framework's edition from the standard version register.","reviewDate":"2026-09-07"},"relationship":"superset_of","source_version":"2013"},"sourceDetailPath":"/data/v1/records/uc-uc-gov-07-2a8998f7.json","sourceId":"uc:UC-GOV-07","targetDetailPath":"/data/v1/records/ctrl-coso-ic-p5-7f62f522.json","targetId":"ctrl:coso-ic:P5","type":"maps_to"},{"expectedCatalogRevision":"24028ffcfc2b295fa1b08ee6caa84b765f0731b321496bf4f548c49ad2177028","id":"rel:567ac53a09b3d61c3e4c298d3d34b79b550ea4cfa02e32c845375c30744f2be7","properties":{"control_id":"Std 8.1","coverage":"full","delta":null,"framework":"iia-2024","provenance":{"defaultConfidence":"medium","defaultStatus":"active","direction":"canonical_to_source","mapper":"coworkcanvas-compliance-graph","note":"Each member is a documented relationship claim from the canonical unified control to a source control or guidance proposition. relationship: equal|superset_of (full) / intersects_with|subset_of (partial) / informs (guidance). confidence 'medium' = single-mapper, documented, not yet externally corroborated. source_version is the member framework's edition from the standard version register.","reviewDate":"2026-09-07"},"relationship":"superset_of","source_version":"2024 edition"},"sourceDetailPath":"/data/v1/records/uc-uc-audit-03-927ae903.json","sourceId":"uc:UC-AUDIT-03","targetDetailPath":"/data/v1/records/ctrl-iia-2024-std-8-1-fcaabb3b.json","targetId":"ctrl:iia-2024:Std 8.1","type":"maps_to"},{"expectedCatalogRevision":"24028ffcfc2b295fa1b08ee6caa84b765f0731b321496bf4f548c49ad2177028","id":"rel:5809c10d79dbe0dab9da26811957d1943c0288a7eb8249ba7af1c187dcba466a","properties":{},"sourceDetailPath":"/data/v1/records/ctrl-iia-2024-std-11-1-ae43870c.json","sourceId":"ctrl:iia-2024:Std 11.1","targetDetailPath":"/data/v1/records/std-iia-2024-1687734b.json","targetId":"std:iia-2024","type":"belongs_to"},{"expectedCatalogRevision":"24028ffcfc2b295fa1b08ee6caa84b765f0731b321496bf4f548c49ad2177028","id":"rel:58bd3d267681fb8a22f1c1faf4dbce17ca775e16854f8db06a4ad0ff7a22bb18","properties":{},"sourceDetailPath":"/data/v1/records/ctrl-iia-2024-std-8-2-6259e7c5.json","sourceId":"ctrl:iia-2024:Std 8.2","targetDetailPath":"/data/v1/records/std-iia-2024-1687734b.json","targetId":"std:iia-2024","type":"belongs_to"},{"expectedCatalogRevision":"24028ffcfc2b295fa1b08ee6caa84b765f0731b321496bf4f548c49ad2177028","id":"rel:5fa2ccc6de3ab9094d6e51b67af95c17549f6904217e30f200e30cadaa06a411","properties":{"control_id":"Std 12.2","coverage":"full","delta":null,"framework":"iia-2024","provenance":{"defaultConfidence":"medium","defaultStatus":"active","direction":"canonical_to_source","mapper":"coworkcanvas-compliance-graph","note":"Each member is a documented relationship claim from the canonical unified control to a source control or guidance proposition. relationship: equal|superset_of (full) / intersects_with|subset_of (partial) / informs (guidance). confidence 'medium' = single-mapper, documented, not yet externally corroborated. source_version is the member framework's edition from the standard version register.","reviewDate":"2026-09-07"},"relationship":"superset_of","source_version":"2024 edition"},"sourceDetailPath":"/data/v1/records/uc-uc-audit-19-a0f61a19.json","sourceId":"uc:UC-AUDIT-19","targetDetailPath":"/data/v1/records/ctrl-iia-2024-std-12-2-9e51df17.json","targetId":"ctrl:iia-2024:Std 12.2","type":"maps_to"},{"expectedCatalogRevision":"24028ffcfc2b295fa1b08ee6caa84b765f0731b321496bf4f548c49ad2177028","id":"rel:6a6ee7bb71598007c95021c955a96b2c1acda401441d403b7218ab5f3411adcb","properties":{"control_id":"A.6.1","coverage":"full","delta":null,"framework":"iso-27001","provenance":{"defaultConfidence":"medium","defaultStatus":"active","direction":"canonical_to_source","mapper":"coworkcanvas-compliance-graph","note":"Each member is a documented relationship claim from the canonical unified control to a source control or guidance proposition. relationship: equal|superset_of (full) / intersects_with|subset_of (partial) / informs (guidance). confidence 'medium' = single-mapper, documented, not yet externally corroborated. source_version is the member framework's edition from the standard version register.","reviewDate":"2026-09-07"},"relationship":"superset_of","source_version":"2022"},"sourceDetailPath":"/data/v1/records/uc-uc-hr-01-c7e14dc5.json","sourceId":"uc:UC-HR-01","targetDetailPath":"/data/v1/records/ctrl-iso-27001-a-6-1-048c51f3.json","targetId":"ctrl:iso-27001:A.6.1","type":"maps_to"},{"expectedCatalogRevision":"24028ffcfc2b295fa1b08ee6caa84b765f0731b321496bf4f548c49ad2177028","id":"rel:6af6976069665b10d4b3552ac957d6046868428cb13f6aad904d27fc4a1976ab","properties":{"control_id":"APO13","coverage":"full","delta":null,"framework":"cobit-2019","provenance":{"defaultConfidence":"medium","defaultStatus":"active","direction":"canonical_to_source","mapper":"coworkcanvas-compliance-graph","note":"Each member is a documented relationship claim from the canonical unified control to a source control or guidance proposition. relationship: equal|superset_of (full) / intersects_with|subset_of (partial) / informs (guidance). confidence 'medium' = single-mapper, documented, not yet externally corroborated. source_version is the member framework's edition from the standard version register.","reviewDate":"2026-09-07"},"relationship":"superset_of","source_version":"2019"},"sourceDetailPath":"/data/v1/records/uc-uc-gov-15-828b3eec.json","sourceId":"uc:UC-GOV-15","targetDetailPath":"/data/v1/records/ctrl-cobit-2019-apo13-b83b9404.json","targetId":"ctrl:cobit-2019:APO13","type":"maps_to"},{"expectedCatalogRevision":"24028ffcfc2b295fa1b08ee6caa84b765f0731b321496bf4f548c49ad2177028","id":"rel:6e062e768ccd5a27ae74097131b061d024e4d8c49db22e35bd13c427c83f108e","properties":{},"sourceDetailPath":"/data/v1/records/ctrl-iia-2024-std-1-2-da892b84.json","sourceId":"ctrl:iia-2024:Std 1.2","targetDetailPath":"/data/v1/records/std-iia-2024-1687734b.json","targetId":"std:iia-2024","type":"belongs_to"},{"expectedCatalogRevision":"24028ffcfc2b295fa1b08ee6caa84b765f0731b321496bf4f548c49ad2177028","id":"rel:6e78e0481feaa67b20a386a2793b8dd288b60bbe92bf3303d2f27e141417dca7","properties":{},"sourceDetailPath":"/data/v1/records/ctrl-iso-27001-a-6-1-048c51f3.json","sourceId":"ctrl:iso-27001:A.6.1","targetDetailPath":"/data/v1/records/std-iso-27001-656201bd.json","targetId":"std:iso-27001","type":"belongs_to"},{"expectedCatalogRevision":"24028ffcfc2b295fa1b08ee6caa84b765f0731b321496bf4f548c49ad2177028","id":"rel:71ea591a30bb2547450d55fa30b3545b6eee9d654e32b64a78e867a353061f38","properties":{"control_id":"Std 2.1","coverage":"full","delta":null,"framework":"iia-2024","provenance":{"defaultConfidence":"medium","defaultStatus":"active","direction":"canonical_to_source","mapper":"coworkcanvas-compliance-graph","note":"Each member is a documented relationship claim from the canonical unified control to a source control or guidance proposition. relationship: equal|superset_of (full) / intersects_with|subset_of (partial) / informs (guidance). confidence 'medium' = single-mapper, documented, not yet externally corroborated. source_version is the member framework's edition from the standard version register.","reviewDate":"2026-09-07"},"relationship":"superset_of","source_version":"2024 edition"},"sourceDetailPath":"/data/v1/records/uc-uc-audit-05-3332a81f.json","sourceId":"uc:UC-AUDIT-05","targetDetailPath":"/data/v1/records/ctrl-iia-2024-std-2-1-bd937208.json","targetId":"ctrl:iia-2024:Std 2.1","type":"maps_to"},{"expectedCatalogRevision":"24028ffcfc2b295fa1b08ee6caa84b765f0731b321496bf4f548c49ad2177028","id":"rel:74bc65e8e9aa1bfb54f93555a389e7974ee95deaf69f27e0c445b8aa95797baf","properties":{},"sourceDetailPath":"/data/v1/records/ctrl-eu-ai-act-aia-art27-7b550500.json","sourceId":"ctrl:eu-ai-act:AIA-Art27","targetDetailPath":"/data/v1/records/std-eu-ai-act-54986689.json","targetId":"std:eu-ai-act","type":"belongs_to"},{"expectedCatalogRevision":"24028ffcfc2b295fa1b08ee6caa84b765f0731b321496bf4f548c49ad2177028","id":"rel:769743561dc289ced57b9ded66609f78483c955be227f5149e999a43b6eb56dd","properties":{"control_id":"Std 2.3","coverage":"full","delta":null,"framework":"iia-2024","provenance":{"defaultConfidence":"medium","defaultStatus":"active","direction":"canonical_to_source","mapper":"coworkcanvas-compliance-graph","note":"Each member is a documented relationship claim from the canonical unified control to a source control or guidance proposition. relationship: equal|superset_of (full) / intersects_with|subset_of (partial) / informs (guidance). confidence 'medium' = single-mapper, documented, not yet externally corroborated. source_version is the member framework's edition from the standard version register.","reviewDate":"2026-09-07"},"relationship":"superset_of","source_version":"2024 edition"},"sourceDetailPath":"/data/v1/records/uc-uc-audit-05-3332a81f.json","sourceId":"uc:UC-AUDIT-05","targetDetailPath":"/data/v1/records/ctrl-iia-2024-std-2-3-44f8f5b2.json","targetId":"ctrl:iia-2024:Std 2.3","type":"maps_to"},{"expectedCatalogRevision":"24028ffcfc2b295fa1b08ee6caa84b765f0731b321496bf4f548c49ad2177028","id":"rel:76f616cc9d689545baa7759562f2c82713d99f16be87637a3b8abeb1523b4053","properties":{"control_id":"Std 1.1","coverage":"full","delta":null,"framework":"iia-2024","provenance":{"defaultConfidence":"medium","defaultStatus":"active","direction":"canonical_to_source","mapper":"coworkcanvas-compliance-graph","note":"Each member is a documented relationship claim from the canonical unified control to a source control or guidance proposition. relationship: equal|superset_of (full) / intersects_with|subset_of (partial) / informs (guidance). confidence 'medium' = single-mapper, documented, not yet externally corroborated. source_version is the member framework's edition from the standard version register.","reviewDate":"2026-09-07"},"relationship":"superset_of","source_version":"2024 edition"},"sourceDetailPath":"/data/v1/records/uc-uc-audit-04-c880e18f.json","sourceId":"uc:UC-AUDIT-04","targetDetailPath":"/data/v1/records/ctrl-iia-2024-std-1-1-e8b262ce.json","targetId":"ctrl:iia-2024:Std 1.1","type":"maps_to"},{"expectedCatalogRevision":"24028ffcfc2b295fa1b08ee6caa84b765f0731b321496bf4f548c49ad2177028","id":"rel:7844c6b31cbd1d768f2a3e54adc373869a072b6ecb9c2ae94226209800315bfe","properties":{"control_id":"Principle 11","coverage":"partial","delta":"Principle 11 also spans communication quality, results reporting, errors, risk-acceptance escalation (11.2-11.5)","framework":"iia-2024","provenance":{"defaultConfidence":"medium","defaultStatus":"active","direction":"canonical_to_source","mapper":"coworkcanvas-compliance-graph","note":"Each member is a documented relationship claim from the canonical unified control to a source control or guidance proposition. relationship: equal|superset_of (full) / intersects_with|subset_of (partial) / informs (guidance). confidence 'medium' = single-mapper, documented, not yet externally corroborated. source_version is the member framework's edition from the standard version register.","reviewDate":"2026-09-07"},"relationship":"intersects_with","source_version":"2024 edition"},"sourceDetailPath":"/data/v1/records/uc-uc-audit-18-7ab55995.json","sourceId":"uc:UC-AUDIT-18","targetDetailPath":"/data/v1/records/ctrl-iia-2024-principle-11-9a00dcd8.json","targetId":"ctrl:iia-2024:Principle 11","type":"maps_to"},{"expectedCatalogRevision":"24028ffcfc2b295fa1b08ee6caa84b765f0731b321496bf4f548c49ad2177028","id":"rel:7d34e04ad1579e310269ee941e2a5c6a7cac485064e493b51c90fee6778eed55","properties":{},"sourceDetailPath":"/data/v1/records/ctrl-iia-2024-principle-11-9a00dcd8.json","sourceId":"ctrl:iia-2024:Principle 11","targetDetailPath":"/data/v1/records/std-iia-2024-1687734b.json","targetId":"std:iia-2024","type":"belongs_to"},{"expectedCatalogRevision":"24028ffcfc2b295fa1b08ee6caa84b765f0731b321496bf4f548c49ad2177028","id":"rel:7d7f47e94e080166ff4b43be28d637d82c7939b51d35c1a61664ce6a8d58db45","properties":{"control_id":"Principle 1","coverage":"full","delta":null,"framework":"iia-2024","provenance":{"defaultConfidence":"medium","defaultStatus":"active","direction":"canonical_to_source","mapper":"coworkcanvas-compliance-graph","note":"Each member is a documented relationship claim from the canonical unified control to a source control or guidance proposition. relationship: equal|superset_of (full) / intersects_with|subset_of (partial) / informs (guidance). confidence 'medium' = single-mapper, documented, not yet externally corroborated. source_version is the member framework's edition from the standard version register.","reviewDate":"2026-09-07"},"relationship":"superset_of","source_version":"2024 edition"},"sourceDetailPath":"/data/v1/records/uc-uc-audit-04-c880e18f.json","sourceId":"uc:UC-AUDIT-04","targetDetailPath":"/data/v1/records/ctrl-iia-2024-principle-1-97822cbc.json","targetId":"ctrl:iia-2024:Principle 1","type":"maps_to"},{"expectedCatalogRevision":"24028ffcfc2b295fa1b08ee6caa84b765f0731b321496bf4f548c49ad2177028","id":"rel:831bb87ed52b4b8496a2df0763736f691983d642227954b2a9794574ad122e52","properties":{},"sourceDetailPath":"/data/v1/records/ctrl-iso-27001-a-5-15-b8587804.json","sourceId":"ctrl:iso-27001:A.5.15","targetDetailPath":"/data/v1/records/std-iso-27001-656201bd.json","targetId":"std:iso-27001","type":"belongs_to"},{"expectedCatalogRevision":"24028ffcfc2b295fa1b08ee6caa84b765f0731b321496bf4f548c49ad2177028","id":"rel:856ae582614767a74c07a1041173d99810fa33db053c90655845d698a9a11860","properties":{"control_id":"Std 2.2","coverage":"full","delta":null,"framework":"iia-2024","provenance":{"defaultConfidence":"medium","defaultStatus":"active","direction":"canonical_to_source","mapper":"coworkcanvas-compliance-graph","note":"Each member is a documented relationship claim from the canonical unified control to a source control or guidance proposition. relationship: equal|superset_of (full) / intersects_with|subset_of (partial) / informs (guidance). confidence 'medium' = single-mapper, documented, not yet externally corroborated. source_version is the member framework's edition from the standard version register.","reviewDate":"2026-09-07"},"relationship":"superset_of","source_version":"2024 edition"},"sourceDetailPath":"/data/v1/records/uc-uc-audit-05-3332a81f.json","sourceId":"uc:UC-AUDIT-05","targetDetailPath":"/data/v1/records/ctrl-iia-2024-std-2-2-521156a0.json","targetId":"ctrl:iia-2024:Std 2.2","type":"maps_to"},{"expectedCatalogRevision":"24028ffcfc2b295fa1b08ee6caa84b765f0731b321496bf4f548c49ad2177028","id":"rel:8611a5306bb73746d58e0da84faa0355ff47c68a535062018d0da7f0a4f8a487","properties":{"control_id":"Std 8.2","coverage":"full","delta":null,"framework":"iia-2024","provenance":{"defaultConfidence":"medium","defaultStatus":"active","direction":"canonical_to_source","mapper":"coworkcanvas-compliance-graph","note":"Each member is a documented relationship claim from the canonical unified control to a source control or guidance proposition. relationship: equal|superset_of (full) / intersects_with|subset_of (partial) / informs (guidance). confidence 'medium' = single-mapper, documented, not yet externally corroborated. source_version is the member framework's edition from the standard version register.","reviewDate":"2026-09-07"},"relationship":"superset_of","source_version":"2024 edition"},"sourceDetailPath":"/data/v1/records/uc-uc-audit-03-927ae903.json","sourceId":"uc:UC-AUDIT-03","targetDetailPath":"/data/v1/records/ctrl-iia-2024-std-8-2-6259e7c5.json","targetId":"ctrl:iia-2024:Std 8.2","type":"maps_to"},{"expectedCatalogRevision":"24028ffcfc2b295fa1b08ee6caa84b765f0731b321496bf4f548c49ad2177028","id":"rel:864b97133dc86c0f2253703e0c993cca4244168aca39b91663776379305caf25","properties":{},"sourceDetailPath":"/data/v1/records/ctrl-iso-27001-a-6-2-89c7f287.json","sourceId":"ctrl:iso-27001:A.6.2","targetDetailPath":"/data/v1/records/std-iso-27001-656201bd.json","targetId":"std:iso-27001","type":"belongs_to"},{"expectedCatalogRevision":"24028ffcfc2b295fa1b08ee6caa84b765f0731b321496bf4f548c49ad2177028","id":"rel:8971794847ccd5035c53cd286df2473e21d22b664f87028844a75bd655b59b86","properties":{},"sourceDetailPath":"/data/v1/records/ctrl-gdpr-gdpr-art28-e21fee94.json","sourceId":"ctrl:gdpr:GDPR-Art28","targetDetailPath":"/data/v1/records/std-gdpr-17d65d0b.json","targetId":"std:gdpr","type":"belongs_to"},{"expectedCatalogRevision":"24028ffcfc2b295fa1b08ee6caa84b765f0731b321496bf4f548c49ad2177028","id":"rel:89a8daad09cbe7d2d73e348c5f242203fcf030baf4354c979f89107eab43fc1a","properties":{},"sourceDetailPath":"/data/v1/records/ctrl-coso-ic-p4-8da1f64c.json","sourceId":"ctrl:coso-ic:P4","targetDetailPath":"/data/v1/records/std-coso-ic-3f80f565.json","targetId":"std:coso-ic","type":"belongs_to"},{"expectedCatalogRevision":"24028ffcfc2b295fa1b08ee6caa84b765f0731b321496bf4f548c49ad2177028","id":"rel:8cf6a557412855d991f5fbe276861808067d53cad6d0a3017419b255fa47e568","properties":{"control_id":"A.5.15","coverage":"partial","delta":"also requires rules controlling physical access to information and assets","framework":"iso-27001","provenance":{"defaultConfidence":"medium","defaultStatus":"active","direction":"canonical_to_source","mapper":"coworkcanvas-compliance-graph","note":"Each member is a documented relationship claim from the canonical unified control to a source control or guidance proposition. relationship: equal|superset_of (full) / intersects_with|subset_of (partial) / informs (guidance). confidence 'medium' = single-mapper, documented, not yet externally corroborated. source_version is the member framework's edition from the standard version register.","reviewDate":"2026-09-07"},"relationship":"intersects_with","source_version":"2022"},"sourceDetailPath":"/data/v1/records/uc-uc-access-03-43eeb212.json","sourceId":"uc:UC-ACCESS-03","targetDetailPath":"/data/v1/records/ctrl-iso-27001-a-5-15-b8587804.json","targetId":"ctrl:iso-27001:A.5.15","type":"maps_to"},{"expectedCatalogRevision":"24028ffcfc2b295fa1b08ee6caa84b765f0731b321496bf4f548c49ad2177028","id":"rel:92097a2b41cd94612b542b8d426d8375439369b2c336077c6144ee961c0e0e58","properties":{},"sourceDetailPath":"/data/v1/records/ctrl-iia-2024-std-8-1-fcaabb3b.json","sourceId":"ctrl:iia-2024:Std 8.1","targetDetailPath":"/data/v1/records/std-iia-2024-1687734b.json","targetId":"std:iia-2024","type":"belongs_to"},{"expectedCatalogRevision":"24028ffcfc2b295fa1b08ee6caa84b765f0731b321496bf4f548c49ad2177028","id":"rel:9932a4f02e142b017c507e3b409efd0cb48f21bb451588f489f5337f3cfa0c24","properties":{},"sourceDetailPath":"/data/v1/records/ctrl-iia-2024-std-1-3-d38479a0.json","sourceId":"ctrl:iia-2024:Std 1.3","targetDetailPath":"/data/v1/records/std-iia-2024-1687734b.json","targetId":"std:iia-2024","type":"belongs_to"},{"expectedCatalogRevision":"24028ffcfc2b295fa1b08ee6caa84b765f0731b321496bf4f548c49ad2177028","id":"rel:9a1ac393b5ffa6c111074f18af41181d192062e7ee4f735c450051e58b8df60c","properties":{},"sourceDetailPath":"/data/v1/records/ctrl-iso-27001-a-5-4-779338c6.json","sourceId":"ctrl:iso-27001:A.5.4","targetDetailPath":"/data/v1/records/std-iso-27001-656201bd.json","targetId":"std:iso-27001","type":"belongs_to"},{"expectedCatalogRevision":"24028ffcfc2b295fa1b08ee6caa84b765f0731b321496bf4f548c49ad2177028","id":"rel:9d6b9b606b485c90a839a57bafe230a44e306f127a95e429e71bf0c9216880aa","properties":{"control_id":"P15","coverage":"partial","delta":"entity-wide external channels (whistleblower, customers, suppliers) beyond assurance stakeholders","framework":"coso-ic","provenance":{"defaultConfidence":"medium","defaultStatus":"active","direction":"canonical_to_source","mapper":"coworkcanvas-compliance-graph","note":"Each member is a documented relationship claim from the canonical unified control to a source control or guidance proposition. relationship: equal|superset_of (full) / intersects_with|subset_of (partial) / informs (guidance). confidence 'medium' = single-mapper, documented, not yet externally corroborated. source_version is the member framework's edition from the standard version register.","reviewDate":"2026-09-07"},"relationship":"intersects_with","source_version":"2013"},"sourceDetailPath":"/data/v1/records/uc-uc-audit-18-7ab55995.json","sourceId":"uc:UC-AUDIT-18","targetDetailPath":"/data/v1/records/ctrl-coso-ic-p15-04537dd0.json","targetId":"ctrl:coso-ic:P15","type":"maps_to"},{"expectedCatalogRevision":"24028ffcfc2b295fa1b08ee6caa84b765f0731b321496bf4f548c49ad2177028","id":"rel:a0887b53aed259e28429576545e1992b4afb34046c08213b939b0636474f65ed","properties":{"control_id":"P4","coverage":"full","delta":null,"framework":"coso-ic","provenance":{"defaultConfidence":"medium","defaultStatus":"active","direction":"canonical_to_source","mapper":"coworkcanvas-compliance-graph","note":"Each member is a documented relationship claim from the canonical unified control to a source control or guidance proposition. relationship: equal|superset_of (full) / intersects_with|subset_of (partial) / informs (guidance). confidence 'medium' = single-mapper, documented, not yet externally corroborated. source_version is the member framework's edition from the standard version register.","reviewDate":"2026-09-07"},"relationship":"superset_of","source_version":"2013"},"sourceDetailPath":"/data/v1/records/uc-uc-gov-10-016614d1.json","sourceId":"uc:UC-GOV-10","targetDetailPath":"/data/v1/records/ctrl-coso-ic-p4-8da1f64c.json","targetId":"ctrl:coso-ic:P4","type":"maps_to"},{"expectedCatalogRevision":"24028ffcfc2b295fa1b08ee6caa84b765f0731b321496bf4f548c49ad2177028","id":"rel:a1bb1621ad1c51d063f6e33db96e516aadea16e66c6f3ad15bdb3abc0f0ba182","properties":{},"sourceDetailPath":"/data/v1/records/ctrl-hipaa-hipaa-164-314-0b44ffa8.json","sourceId":"ctrl:hipaa:HIPAA-164.314","targetDetailPath":"/data/v1/records/std-hipaa-a825d271.json","targetId":"std:hipaa","type":"belongs_to"},{"expectedCatalogRevision":"24028ffcfc2b295fa1b08ee6caa84b765f0731b321496bf4f548c49ad2177028","id":"rel:a1f433171b5aaf25af2d32fbfc47776014edc843e7c1f77d8dd25b39f4b867f4","properties":{"control_id":"IIA-POS-TLM-02","coverage":"guidance","delta":null,"framework":"iia-pos-2026-three-lines","provenance":{"defaultConfidence":"medium","defaultStatus":"active","direction":"canonical_to_source","mapper":"coworkcanvas-compliance-graph","note":"Each member is a documented relationship claim from the canonical unified control to a source control or guidance proposition. relationship: equal|superset_of (full) / intersects_with|subset_of (partial) / informs (guidance). confidence 'medium' = single-mapper, documented, not yet externally corroborated. source_version is the member framework's edition from the standard version register.","reviewDate":"2026-09-07"},"relationship":"informs","sourcePages":"Three Lines pp. 9–11, 20–22","source_version":"2026"},"sourceDetailPath":"/data/v1/records/uc-uc-audit-05-3332a81f.json","sourceId":"uc:UC-AUDIT-05","targetDetailPath":"/data/v1/records/ctrl-iia-pos-2026-three-lines-iia-pos-tlm-02-c2f0d9a7.json","targetId":"ctrl:iia-pos-2026-three-lines:IIA-POS-TLM-02","type":"informed_by"},{"expectedCatalogRevision":"24028ffcfc2b295fa1b08ee6caa84b765f0731b321496bf4f548c49ad2177028","id":"rel:b139e0e30e2a6e5562d1a215ab602aa680e60545c099bd97f213cc6e1c55c901","properties":{},"sourceDetailPath":"/data/v1/records/ctrl-iia-2024-std-2-1-bd937208.json","sourceId":"ctrl:iia-2024:Std 2.1","targetDetailPath":"/data/v1/records/std-iia-2024-1687734b.json","targetId":"std:iia-2024","type":"belongs_to"},{"expectedCatalogRevision":"24028ffcfc2b295fa1b08ee6caa84b765f0731b321496bf4f548c49ad2177028","id":"rel:b1ed9c27194ee1313187f33bdc2bd3453ff18132e9501be428ba167899a52497","properties":{"control_id":"Std 11.1","coverage":"full","delta":null,"framework":"iia-2024","provenance":{"defaultConfidence":"medium","defaultStatus":"active","direction":"canonical_to_source","mapper":"coworkcanvas-compliance-graph","note":"Each member is a documented relationship claim from the canonical unified control to a source control or guidance proposition. relationship: equal|superset_of (full) / intersects_with|subset_of (partial) / informs (guidance). confidence 'medium' = single-mapper, documented, not yet externally corroborated. source_version is the member framework's edition from the standard version register.","reviewDate":"2026-09-07"},"relationship":"superset_of","source_version":"2024 edition"},"sourceDetailPath":"/data/v1/records/uc-uc-audit-18-7ab55995.json","sourceId":"uc:UC-AUDIT-18","targetDetailPath":"/data/v1/records/ctrl-iia-2024-std-11-1-ae43870c.json","targetId":"ctrl:iia-2024:Std 11.1","type":"maps_to"},{"expectedCatalogRevision":"24028ffcfc2b295fa1b08ee6caa84b765f0731b321496bf4f548c49ad2177028","id":"rel:b8ac22db464c1e05c1286c62ad846d099b579a8246dde5212f64d48d01418e67","properties":{"control_id":"HIPAA-164.308","coverage":"partial","delta":"risk analysis, training, contingency, evaluation, and BAAs satisfied in other domains","framework":"hipaa","provenance":{"defaultConfidence":"medium","defaultStatus":"active","direction":"canonical_to_source","mapper":"coworkcanvas-compliance-graph","note":"Each member is a documented relationship claim from the canonical unified control to a source control or guidance proposition. relationship: equal|superset_of (full) / intersects_with|subset_of (partial) / informs (guidance). confidence 'medium' = single-mapper, documented, not yet externally corroborated. source_version is the member framework's edition from the standard version register.","reviewDate":"2026-09-07"},"relationship":"intersects_with","source_version":"45 CFR Parts 160/164 (Security, Privacy, Breach Notification)"},"sourceDetailPath":"/data/v1/records/uc-uc-hr-01-c7e14dc5.json","sourceId":"uc:UC-HR-01","targetDetailPath":"/data/v1/records/ctrl-hipaa-hipaa-164-308-d26b6932.json","targetId":"ctrl:hipaa:HIPAA-164.308","type":"maps_to"},{"expectedCatalogRevision":"24028ffcfc2b295fa1b08ee6caa84b765f0731b321496bf4f548c49ad2177028","id":"rel:b942e1c5dad608655084fe8b0a63671d65b2e2b08497f85ac6f1be23fd85e28a","properties":{"control_id":"GDPR-Art28","coverage":"full","delta":null,"framework":"gdpr","provenance":{"defaultConfidence":"medium","defaultStatus":"active","direction":"canonical_to_source","mapper":"coworkcanvas-compliance-graph","note":"Each member is a documented relationship claim from the canonical unified control to a source control or guidance proposition. relationship: equal|superset_of (full) / intersects_with|subset_of (partial) / informs (guidance). confidence 'medium' = single-mapper, documented, not yet externally corroborated. source_version is the member framework's edition from the standard version register.","reviewDate":"2026-09-07"},"relationship":"superset_of","source_version":"Regulation (EU) 2016/679"},"sourceDetailPath":"/data/v1/records/uc-uc-tprm-03-c9edcf93.json","sourceId":"uc:UC-TPRM-03","targetDetailPath":"/data/v1/records/ctrl-gdpr-gdpr-art28-e21fee94.json","targetId":"ctrl:gdpr:GDPR-Art28","type":"maps_to"},{"expectedCatalogRevision":"24028ffcfc2b295fa1b08ee6caa84b765f0731b321496bf4f548c49ad2177028","id":"rel:b9c1da724030ace2b96f6e03c2a9f7e47cc0d4f04d2de036abf1f48391c8f2c6","properties":{},"sourceDetailPath":"/data/v1/records/ctrl-iia-2024-std-2-3-44f8f5b2.json","sourceId":"ctrl:iia-2024:Std 2.3","targetDetailPath":"/data/v1/records/std-iia-2024-1687734b.json","targetId":"std:iia-2024","type":"belongs_to"},{"expectedCatalogRevision":"24028ffcfc2b295fa1b08ee6caa84b765f0731b321496bf4f548c49ad2177028","id":"rel:baa1cf29b74729ad0cedb9794b800c963f716d47933df0994e7ae2bbdd13db4d","properties":{"control_id":"Std 1.3","coverage":"full","delta":null,"framework":"iia-2024","provenance":{"defaultConfidence":"medium","defaultStatus":"active","direction":"canonical_to_source","mapper":"coworkcanvas-compliance-graph","note":"Each member is a documented relationship claim from the canonical unified control to a source control or guidance proposition. relationship: equal|superset_of (full) / intersects_with|subset_of (partial) / informs (guidance). confidence 'medium' = single-mapper, documented, not yet externally corroborated. source_version is the member framework's edition from the standard version register.","reviewDate":"2026-09-07"},"relationship":"superset_of","source_version":"2024 edition"},"sourceDetailPath":"/data/v1/records/uc-uc-audit-04-c880e18f.json","sourceId":"uc:UC-AUDIT-04","targetDetailPath":"/data/v1/records/ctrl-iia-2024-std-1-3-d38479a0.json","targetId":"ctrl:iia-2024:Std 1.3","type":"maps_to"},{"expectedCatalogRevision":"24028ffcfc2b295fa1b08ee6caa84b765f0731b321496bf4f548c49ad2177028","id":"rel:bb8674403229a0ce2c5ec8c9080da85bd8087859e0a852a85af0bac50d670a98","properties":{"control_id":"DORA-Art24-27","coverage":"partial","delta":"vulnerability assessments and the Art 25 security-testing catalogue satisfied by companion controls; TLPT regime specifics - three-yearly cadence, authority-approved scope, independent/certified testers (Arts 26-27), and tester independence (Art 24(4)) - require dedicated controls","framework":"dora","provenance":{"defaultConfidence":"medium","defaultStatus":"active","direction":"canonical_to_source","mapper":"coworkcanvas-compliance-graph","note":"Each member is a documented relationship claim from the canonical unified control to a source control or guidance proposition. relationship: equal|superset_of (full) / intersects_with|subset_of (partial) / informs (guidance). confidence 'medium' = single-mapper, documented, not yet externally corroborated. source_version is the member framework's edition from the standard version register.","reviewDate":"2026-09-07"},"relationship":"intersects_with","source_version":"Regulation (EU) 2022/2554"},"sourceDetailPath":"/data/v1/records/uc-uc-bcdr-10-602160e4.json","sourceId":"uc:UC-BCDR-10","targetDetailPath":"/data/v1/records/ctrl-dora-dora-art24-27-dc4b8836.json","targetId":"ctrl:dora:DORA-Art24-27","type":"maps_to"},{"expectedCatalogRevision":"24028ffcfc2b295fa1b08ee6caa84b765f0731b321496bf4f548c49ad2177028","id":"rel:c155012acf013e8a1e3c96c8c7765103fb5c190959a137a8a6cc41a1a4350970","properties":{"control_id":"CCPA-1798.140","coverage":"full","delta":null,"framework":"ccpa","provenance":{"defaultConfidence":"medium","defaultStatus":"active","direction":"canonical_to_source","mapper":"coworkcanvas-compliance-graph","note":"Each member is a documented relationship claim from the canonical unified control to a source control or guidance proposition. relationship: equal|superset_of (full) / intersects_with|subset_of (partial) / informs (guidance). confidence 'medium' = single-mapper, documented, not yet externally corroborated. source_version is the member framework's edition from the standard version register.","reviewDate":"2026-09-07"},"relationship":"superset_of","source_version":"CCPA (2018) as amended by CPRA (2020)"},"sourceDetailPath":"/data/v1/records/uc-uc-tprm-03-c9edcf93.json","sourceId":"uc:UC-TPRM-03","targetDetailPath":"/data/v1/records/ctrl-ccpa-ccpa-1798-140-775f9cfa.json","targetId":"ctrl:ccpa:CCPA-1798.140","type":"maps_to"},{"expectedCatalogRevision":"24028ffcfc2b295fa1b08ee6caa84b765f0731b321496bf4f548c49ad2177028","id":"rel:c3593c35718fb6895e0619e1721925c1cf835b3ceaa054ed46d8cb3be1d5e67d","properties":{},"sourceDetailPath":"/data/v1/records/ctrl-iia-2024-std-12-1-5f2fe558.json","sourceId":"ctrl:iia-2024:Std 12.1","targetDetailPath":"/data/v1/records/std-iia-2024-1687734b.json","targetId":"std:iia-2024","type":"belongs_to"},{"expectedCatalogRevision":"24028ffcfc2b295fa1b08ee6caa84b765f0731b321496bf4f548c49ad2177028","id":"rel:c35bda6f401c7e185f678db00808439de2948ae69fc0c5849eef9a052d198c43","properties":{},"sourceDetailPath":"/data/v1/records/ctrl-iia-2024-std-1-1-e8b262ce.json","sourceId":"ctrl:iia-2024:Std 1.1","targetDetailPath":"/data/v1/records/std-iia-2024-1687734b.json","targetId":"std:iia-2024","type":"belongs_to"},{"expectedCatalogRevision":"24028ffcfc2b295fa1b08ee6caa84b765f0731b321496bf4f548c49ad2177028","id":"rel:c3ba1662732119bdd03bfba1ff4eeab149d3d59112dfde8329ad4373221db519","properties":{"control_id":"Principle 2","coverage":"full","delta":null,"framework":"iia-2024","provenance":{"defaultConfidence":"medium","defaultStatus":"active","direction":"canonical_to_source","mapper":"coworkcanvas-compliance-graph","note":"Each member is a documented relationship claim from the canonical unified control to a source control or guidance proposition. relationship: equal|superset_of (full) / intersects_with|subset_of (partial) / informs (guidance). confidence 'medium' = single-mapper, documented, not yet externally corroborated. source_version is the member framework's edition from the standard version register.","reviewDate":"2026-09-07"},"relationship":"superset_of","source_version":"2024 edition"},"sourceDetailPath":"/data/v1/records/uc-uc-audit-05-3332a81f.json","sourceId":"uc:UC-AUDIT-05","targetDetailPath":"/data/v1/records/ctrl-iia-2024-principle-2-88ab9637.json","targetId":"ctrl:iia-2024:Principle 2","type":"maps_to"},{"expectedCatalogRevision":"24028ffcfc2b295fa1b08ee6caa84b765f0731b321496bf4f548c49ad2177028","id":"rel:cb17f75c567abf8ae870664ad17435d7a5829e5593acd8edf91d23f3b3e4fa5c","properties":{},"sourceDetailPath":"/data/v1/records/ctrl-iia-2024-principle-8-f2747c36.json","sourceId":"ctrl:iia-2024:Principle 8","targetDetailPath":"/data/v1/records/std-iia-2024-1687734b.json","targetId":"std:iia-2024","type":"belongs_to"},{"expectedCatalogRevision":"24028ffcfc2b295fa1b08ee6caa84b765f0731b321496bf4f548c49ad2177028","id":"rel:cff1193b4288fe551157bf960ab5acccac13ae290735955d5c5e704f34cab9db","properties":{},"sourceDetailPath":"/data/v1/records/ctrl-dora-dora-art24-27-dc4b8836.json","sourceId":"ctrl:dora:DORA-Art24-27","targetDetailPath":"/data/v1/records/std-dora-95cf939d.json","targetId":"std:dora","type":"belongs_to"},{"expectedCatalogRevision":"24028ffcfc2b295fa1b08ee6caa84b765f0731b321496bf4f548c49ad2177028","id":"rel:d23c16c0475ddff17cb84767adaa69eb11e7677c2c55a2aa5d8ac340b162dc89","properties":{"control_id":"C001","coverage":"partial","delta":"a system-specific AI risk taxonomy with severity tiers that drives output filtering, monitoring categories, and third-party test scope","framework":"aiuc-1","provenance":{"defaultConfidence":"medium","defaultStatus":"active","direction":"canonical_to_source","mapper":"coworkcanvas-compliance-graph","note":"Each member is a documented relationship claim from the canonical unified control to a source control or guidance proposition. relationship: equal|superset_of (full) / intersects_with|subset_of (partial) / informs (guidance). confidence 'medium' = single-mapper, documented, not yet externally corroborated. source_version is the member framework's edition from the standard version register.","reviewDate":"2026-09-07"},"relationship":"intersects_with","source_version":"July 15, 2026 release (quarterly update cadence)"},"sourceDetailPath":"/data/v1/records/uc-uc-ai-04-b35afd39.json","sourceId":"uc:UC-AI-04","targetDetailPath":"/data/v1/records/ctrl-aiuc-1-c001-6bc6c173.json","targetId":"ctrl:aiuc-1:C001","type":"maps_to"},{"expectedCatalogRevision":"24028ffcfc2b295fa1b08ee6caa84b765f0731b321496bf4f548c49ad2177028","id":"rel:d24407e00147961728306982a51e3cc72b1bb3edc653a3bde7863a093094d066","properties":{},"sourceDetailPath":"/data/v1/records/ctrl-iia-pos-2026-three-lines-iia-pos-tlm-02-c2f0d9a7.json","sourceId":"ctrl:iia-pos-2026-three-lines:IIA-POS-TLM-02","targetDetailPath":"/data/v1/records/std-iia-pos-2026-three-lines-1138e7ab.json","targetId":"std:iia-pos-2026-three-lines","type":"belongs_to"},{"expectedCatalogRevision":"24028ffcfc2b295fa1b08ee6caa84b765f0731b321496bf4f548c49ad2177028","id":"rel:d339e5a33703ddad17fd5c96450d2811a5fe1041841048ee938ee15e9f51f524","properties":{},"sourceDetailPath":"/data/v1/records/ctrl-iso-27001-a-5-20-fcee3b34.json","sourceId":"ctrl:iso-27001:A.5.20","targetDetailPath":"/data/v1/records/std-iso-27001-656201bd.json","targetId":"std:iso-27001","type":"belongs_to"},{"expectedCatalogRevision":"24028ffcfc2b295fa1b08ee6caa84b765f0731b321496bf4f548c49ad2177028","id":"rel:e28a72f4b0cd6f80510c81151daed71ede3c024dbdbf8b1557894ebece808997","properties":{"control_id":"Principle 12","coverage":"partial","delta":"engagement-level performance oversight and improvement (Std 12.3) satisfied by the documentation-and-supervision companion control","framework":"iia-2024","provenance":{"defaultConfidence":"medium","defaultStatus":"active","direction":"canonical_to_source","mapper":"coworkcanvas-compliance-graph","note":"Each member is a documented relationship claim from the canonical unified control to a source control or guidance proposition. relationship: equal|superset_of (full) / intersects_with|subset_of (partial) / informs (guidance). confidence 'medium' = single-mapper, documented, not yet externally corroborated. source_version is the member framework's edition from the standard version register.","reviewDate":"2026-09-07"},"relationship":"intersects_with","source_version":"2024 edition"},"sourceDetailPath":"/data/v1/records/uc-uc-audit-19-a0f61a19.json","sourceId":"uc:UC-AUDIT-19","targetDetailPath":"/data/v1/records/ctrl-iia-2024-principle-12-ef0f1834.json","targetId":"ctrl:iia-2024:Principle 12","type":"maps_to"},{"expectedCatalogRevision":"24028ffcfc2b295fa1b08ee6caa84b765f0731b321496bf4f548c49ad2177028","id":"rel:e9ed37a16a9eea24ac6ab97a2867655eac5951640e5418829fc171db5167e1b6","properties":{"control_id":"Std 12.1","coverage":"full","delta":null,"framework":"iia-2024","provenance":{"defaultConfidence":"medium","defaultStatus":"active","direction":"canonical_to_source","mapper":"coworkcanvas-compliance-graph","note":"Each member is a documented relationship claim from the canonical unified control to a source control or guidance proposition. relationship: equal|superset_of (full) / intersects_with|subset_of (partial) / informs (guidance). confidence 'medium' = single-mapper, documented, not yet externally corroborated. source_version is the member framework's edition from the standard version register.","reviewDate":"2026-09-07"},"relationship":"superset_of","source_version":"2024 edition"},"sourceDetailPath":"/data/v1/records/uc-uc-audit-19-a0f61a19.json","sourceId":"uc:UC-AUDIT-19","targetDetailPath":"/data/v1/records/ctrl-iia-2024-std-12-1-5f2fe558.json","targetId":"ctrl:iia-2024:Std 12.1","type":"maps_to"},{"expectedCatalogRevision":"24028ffcfc2b295fa1b08ee6caa84b765f0731b321496bf4f548c49ad2177028","id":"rel:ec8bea9ce78a6a49049aa07087e07adc5bc84be5cd0d5fc0b7dac5a4fdcceab6","properties":{"control_id":"IIA-POS-ERM-03","coverage":"guidance","delta":null,"framework":"iia-pos-2026-erm","provenance":{"defaultConfidence":"medium","defaultStatus":"active","direction":"canonical_to_source","mapper":"coworkcanvas-compliance-graph","note":"Each member is a documented relationship claim from the canonical unified control to a source control or guidance proposition. relationship: equal|superset_of (full) / intersects_with|subset_of (partial) / informs (guidance). confidence 'medium' = single-mapper, documented, not yet externally corroborated. source_version is the member framework's edition from the standard version register.","reviewDate":"2026-09-07"},"relationship":"informs","sourcePages":"ERM pp. 12–13, 15–20","source_version":"2026"},"sourceDetailPath":"/data/v1/records/uc-uc-audit-05-3332a81f.json","sourceId":"uc:UC-AUDIT-05","targetDetailPath":"/data/v1/records/ctrl-iia-pos-2026-erm-iia-pos-erm-03-2ed09a44.json","targetId":"ctrl:iia-pos-2026-erm:IIA-POS-ERM-03","type":"informed_by"},{"expectedCatalogRevision":"24028ffcfc2b295fa1b08ee6caa84b765f0731b321496bf4f548c49ad2177028","id":"rel:edc524182fec3365afded04e66505533a46f61f318adf773398145e3a01d5efc","properties":{"control_id":"AIA-Art27","coverage":"full","delta":null,"framework":"eu-ai-act","provenance":{"defaultConfidence":"medium","defaultStatus":"active","direction":"canonical_to_source","mapper":"coworkcanvas-compliance-graph","note":"Each member is a documented relationship claim from the canonical unified control to a source control or guidance proposition. relationship: equal|superset_of (full) / intersects_with|subset_of (partial) / informs (guidance). confidence 'medium' = single-mapper, documented, not yet externally corroborated. source_version is the member framework's edition from the standard version register.","reviewDate":"2026-09-07"},"relationship":"superset_of","source_version":"Regulation (EU) 2024/1689"},"sourceDetailPath":"/data/v1/records/uc-uc-ai-04-b35afd39.json","sourceId":"uc:UC-AI-04","targetDetailPath":"/data/v1/records/ctrl-eu-ai-act-aia-art27-7b550500.json","targetId":"ctrl:eu-ai-act:AIA-Art27","type":"maps_to"},{"expectedCatalogRevision":"24028ffcfc2b295fa1b08ee6caa84b765f0731b321496bf4f548c49ad2177028","id":"rel:f08b3091da2f2ebef68bbc42112348fdd319a558f738645d33dbdb66a0e005e4","properties":{"control_id":"AIA-Art6-7","coverage":"full","delta":null,"framework":"eu-ai-act","provenance":{"defaultConfidence":"medium","defaultStatus":"active","direction":"canonical_to_source","mapper":"coworkcanvas-compliance-graph","note":"Each member is a documented relationship claim from the canonical unified control to a source control or guidance proposition. relationship: equal|superset_of (full) / intersects_with|subset_of (partial) / informs (guidance). confidence 'medium' = single-mapper, documented, not yet externally corroborated. source_version is the member framework's edition from the standard version register.","reviewDate":"2026-09-07"},"relationship":"superset_of","source_version":"Regulation (EU) 2024/1689"},"sourceDetailPath":"/data/v1/records/uc-uc-ai-04-b35afd39.json","sourceId":"uc:UC-AI-04","targetDetailPath":"/data/v1/records/ctrl-eu-ai-act-aia-art6-7-cd7435c0.json","targetId":"ctrl:eu-ai-act:AIA-Art6-7","type":"maps_to"},{"expectedCatalogRevision":"24028ffcfc2b295fa1b08ee6caa84b765f0731b321496bf4f548c49ad2177028","id":"rel:f18fda066acd49414a3ede545b79d3b75b88f80e0259d8198d31f59658b8c3c1","properties":{"control_id":"Principle 8","coverage":"partial","delta":"Principle 8 also includes board oversight of quality and external quality assessment (8.3-8.4)","framework":"iia-2024","provenance":{"defaultConfidence":"medium","defaultStatus":"active","direction":"canonical_to_source","mapper":"coworkcanvas-compliance-graph","note":"Each member is a documented relationship claim from the canonical unified control to a source control or guidance proposition. relationship: equal|superset_of (full) / intersects_with|subset_of (partial) / informs (guidance). confidence 'medium' = single-mapper, documented, not yet externally corroborated. source_version is the member framework's edition from the standard version register.","reviewDate":"2026-09-07"},"relationship":"intersects_with","source_version":"2024 edition"},"sourceDetailPath":"/data/v1/records/uc-uc-audit-03-927ae903.json","sourceId":"uc:UC-AUDIT-03","targetDetailPath":"/data/v1/records/ctrl-iia-2024-principle-8-f2747c36.json","targetId":"ctrl:iia-2024:Principle 8","type":"maps_to"},{"expectedCatalogRevision":"24028ffcfc2b295fa1b08ee6caa84b765f0731b321496bf4f548c49ad2177028","id":"rel:fa025a0315b5823b158620adb1e426d69f3be952af40edb9d2b815f9a31e2bc6","properties":{"control_id":"A003","coverage":"partial","delta":"agent-specific enforcement: data access scoped per task, user role, agent role, and context at inference time","framework":"aiuc-1","provenance":{"defaultConfidence":"medium","defaultStatus":"active","direction":"canonical_to_source","mapper":"coworkcanvas-compliance-graph","note":"Each member is a documented relationship claim from the canonical unified control to a source control or guidance proposition. relationship: equal|superset_of (full) / intersects_with|subset_of (partial) / informs (guidance). confidence 'medium' = single-mapper, documented, not yet externally corroborated. source_version is the member framework's edition from the standard version register.","reviewDate":"2026-09-07"},"relationship":"intersects_with","source_version":"July 15, 2026 release (quarterly update cadence)"},"sourceDetailPath":"/data/v1/records/uc-uc-access-03-43eeb212.json","sourceId":"uc:UC-ACCESS-03","targetDetailPath":"/data/v1/records/ctrl-aiuc-1-a003-bea61fd9.json","targetId":"ctrl:aiuc-1:A003","type":"maps_to"},{"expectedCatalogRevision":"24028ffcfc2b295fa1b08ee6caa84b765f0731b321496bf4f548c49ad2177028","id":"rel:fd5cc5846bbd4085805c3d24cd1befae5131799d97c039cee1e51044e90de1c6","properties":{},"sourceDetailPath":"/data/v1/records/ctrl-cobit-2019-apo07-20c9bdf0.json","sourceId":"ctrl:cobit-2019:APO07","targetDetailPath":"/data/v1/records/std-cobit-2019-2181ce0c.json","targetId":"std:cobit-2019","type":"belongs_to"},{"expectedCatalogRevision":"24028ffcfc2b295fa1b08ee6caa84b765f0731b321496bf4f548c49ad2177028","id":"rel:fee2d76255830c51428f8687147926228a54c979debbddb7b6760ffc16104523","properties":{"control_id":"Std 8.3","coverage":"partial","delta":"board's external-quality-assessment governance (ensuring periodic external assessments and discussing conformance) satisfied by the external-QA companion control (Std 8.4 home), beyond overseeing the internal QAIP","framework":"iia-2024","provenance":{"defaultConfidence":"medium","defaultStatus":"active","direction":"canonical_to_source","mapper":"coworkcanvas-compliance-graph","note":"Each member is a documented relationship claim from the canonical unified control to a source control or guidance proposition. relationship: equal|superset_of (full) / intersects_with|subset_of (partial) / informs (guidance). confidence 'medium' = single-mapper, documented, not yet externally corroborated. source_version is the member framework's edition from the standard version register.","reviewDate":"2026-09-07"},"relationship":"intersects_with","source_version":"2024 edition"},"sourceDetailPath":"/data/v1/records/uc-uc-audit-19-a0f61a19.json","sourceId":"uc:UC-AUDIT-19","targetDetailPath":"/data/v1/records/ctrl-iia-2024-std-8-3-9200230e.json","targetId":"ctrl:iia-2024:Std 8.3","type":"maps_to"}],"schemaVersion":1,"scope":"topics","total":197}