{"catalogRevision":"24028ffcfc2b295fa1b08ee6caa84b765f0731b321496bf4f548c49ad2177028","contextIds":["ctrl:aiuc-1:A003","ctrl:aiuc-1:A004","ctrl:aiuc-1:A005","ctrl:aiuc-1:B001","ctrl:aiuc-1:B007","ctrl:aiuc-1:C002","ctrl:aiuc-1:C008","ctrl:aiuc-1:C010","ctrl:aiuc-1:C011","ctrl:aiuc-1:C012","ctrl:aiuc-1:D002","ctrl:aiuc-1:D004","ctrl:aiuc-1:E009","ctrl:aiuc-1:E015","ctrl:cobit-2019:DSS02","ctrl:cobit-2019:DSS03","ctrl:cobit-2019:DSS05","ctrl:coso-ic:P7","ctrl:dora:DORA-Art17-23","ctrl:dora:DORA-Art24-27","ctrl:eu-ai-act:AIA-Art12","ctrl:eu-ai-act:AIA-Art19","ctrl:eu-ai-act:AIA-Art72","ctrl:gdpr:GDPR-Art32","ctrl:gdpr:GDPR-Art33","ctrl:gdpr:GDPR-Art44-49","ctrl:hipaa:HIPAA-164.312(a)","ctrl:hipaa:HIPAA-164.312(b)","ctrl:iso-27001:A.5.15","ctrl:iso-27001:A.5.16","ctrl:iso-27001:A.5.17","ctrl:iso-27001:A.5.18","ctrl:iso-27001:A.5.25","ctrl:iso-27001:A.5.26","ctrl:iso-27001:A.5.28","ctrl:iso-27001:A.5.7","ctrl:iso-27001:A.5.8","ctrl:iso-27001:A.6.3","ctrl:iso-27001:A.6.8","ctrl:iso-27001:A.8.12"],"directIds":[],"kind":"bundle","metadata":"/assets/agent_metadata.5c7612c9c5b0b455.json","name":"Logging, Monitoring & Detection","next":"/assets/agent_topics-logging-monitoring-detection-2.3bbce908bfd485df.json","page":1,"pageSize":40,"records":[{"attributes":{"category":"technical","framework":"aiuc-1","type":"preventive"},"canonicalUrl":"https://controlsmap.com/frameworks/aiuc-1/","description":"Limit AI agent data access","details":{"automation":"automated","control_category":"technical","control_id":"A003","control_type":"preventive","domains":["AI Governance","Data Protection & Privacy"],"framework":"aiuc-1","group":"Data & Privacy","key_control":false,"requirement_frequency":"Every 12 months","requirement_status":"mandatory","risk_count":7,"source_pages":null,"source_url":"https://www.aiuc-1.com/data-and-privacy/implement-contextual-data-safeguards"},"direct":false,"htmlUrl":"/agents/records/ctrl-aiuc-1-a003-bea61fd9.html","id":"ctrl:aiuc-1:A003","mapUrl":"https://controlsmap.com/?v=1&node=ctrl%3Aaiuc-1%3AA003","sourceIds":["aiuc-1"],"sourceUrl":"https://www.aiuc-1.com/data-and-privacy/implement-contextual-data-safeguards","title":"A003 — Limit AI agent data access","type":"control","url":"/assets/agent_record-ctrl-aiuc-1-a003-bea61fd9.af585433fb30a112.json"},{"attributes":{"category":"technical","framework":"aiuc-1","type":"preventive"},"canonicalUrl":"https://controlsmap.com/frameworks/aiuc-1/","description":"Protect IP & trade secrets","details":{"automation":"hybrid","control_category":"technical","control_id":"A004","control_type":"preventive","domains":["AI Governance","Data Protection & Privacy"],"framework":"aiuc-1","group":"Data & Privacy","key_control":false,"requirement_frequency":"Every 12 months","requirement_status":"mandatory","risk_count":5,"source_pages":null,"source_url":"https://www.aiuc-1.com/data-and-privacy/protect-ip-trade-secrets"},"direct":false,"htmlUrl":"/agents/records/ctrl-aiuc-1-a004-0955d43a.html","id":"ctrl:aiuc-1:A004","mapUrl":"https://controlsmap.com/?v=1&node=ctrl%3Aaiuc-1%3AA004","sourceIds":["aiuc-1"],"sourceUrl":"https://www.aiuc-1.com/data-and-privacy/protect-ip-trade-secrets","title":"A004 — Protect IP & trade secrets","type":"control","url":"/assets/agent_record-ctrl-aiuc-1-a004-0955d43a.1017c974af4b43d0.json"},{"attributes":{"category":"technical","framework":"aiuc-1","type":"preventive"},"canonicalUrl":"https://controlsmap.com/frameworks/aiuc-1/","description":"Prevent cross-customer data exposure","details":{"automation":"automated","control_category":"technical","control_id":"A005","control_type":"preventive","domains":["AI Governance","Data Protection & Privacy"],"framework":"aiuc-1","group":"Data & Privacy","key_control":false,"requirement_frequency":"Every 12 months","requirement_status":"mandatory","risk_count":5,"source_pages":null,"source_url":"https://www.aiuc-1.com/data-and-privacy/prevent-cross-customer-data-exposure"},"direct":false,"htmlUrl":"/agents/records/ctrl-aiuc-1-a005-12903764.html","id":"ctrl:aiuc-1:A005","mapUrl":"https://controlsmap.com/?v=1&node=ctrl%3Aaiuc-1%3AA005","sourceIds":["aiuc-1"],"sourceUrl":"https://www.aiuc-1.com/data-and-privacy/prevent-cross-customer-data-exposure","title":"A005 — Prevent cross-customer data exposure","type":"control","url":"/assets/agent_record-ctrl-aiuc-1-a005-12903764.f738ac844492303a.json"},{"attributes":{"category":"administrative","framework":"aiuc-1","type":"preventive"},"canonicalUrl":"https://controlsmap.com/frameworks/aiuc-1/","description":"Third-party testing of adversarial robustness","details":{"automation":"manual","control_category":"administrative","control_id":"B001","control_type":"preventive","domains":["AI Governance","Access Control & Identity Management","Secure Development (SDLC) & Application Security"],"framework":"aiuc-1","group":"Security","key_control":true,"requirement_frequency":"Every 3 months","requirement_status":"mandatory","risk_count":5,"source_pages":null,"source_url":"https://www.aiuc-1.com/security/test-adversarial-robustness"},"direct":false,"htmlUrl":"/agents/records/ctrl-aiuc-1-b001-19a54ee3.html","id":"ctrl:aiuc-1:B001","mapUrl":"https://controlsmap.com/?v=1&node=ctrl%3Aaiuc-1%3AB001","sourceIds":["aiuc-1"],"sourceUrl":"https://www.aiuc-1.com/security/test-adversarial-robustness","title":"B001 — Third-party testing of adversarial robustness","type":"control","url":"/assets/agent_record-ctrl-aiuc-1-b001-19a54ee3.f6951418c6c04285.json"},{"attributes":{"category":"technical","framework":"aiuc-1","type":"preventive"},"canonicalUrl":"https://controlsmap.com/frameworks/aiuc-1/","description":"Enforce user access privileges to AI systems","details":{"automation":"hybrid","control_category":"technical","control_id":"B007","control_type":"preventive","domains":["AI Governance","Access Control & Identity Management","Secure Development (SDLC) & Application Security"],"framework":"aiuc-1","group":"Security","key_control":true,"requirement_frequency":"Every 3 months","requirement_status":"mandatory","risk_count":4,"source_pages":null,"source_url":"https://www.aiuc-1.com/security/enforce-ai-access-privileges"},"direct":false,"htmlUrl":"/agents/records/ctrl-aiuc-1-b007-151dfcd3.html","id":"ctrl:aiuc-1:B007","mapUrl":"https://controlsmap.com/?v=1&node=ctrl%3Aaiuc-1%3AB007","sourceIds":["aiuc-1"],"sourceUrl":"https://www.aiuc-1.com/security/enforce-ai-access-privileges","title":"B007 — Enforce user access privileges to AI systems","type":"control","url":"/assets/agent_record-ctrl-aiuc-1-b007-151dfcd3.a8fe995563ac9d9f.json"},{"attributes":{"category":"administrative","framework":"aiuc-1","type":"preventive"},"canonicalUrl":"https://controlsmap.com/frameworks/aiuc-1/","description":"Conduct pre-deployment testing","details":{"automation":"hybrid","control_category":"administrative","control_id":"C002","control_type":"preventive","domains":["AI Governance"],"framework":"aiuc-1","group":"Safety","key_control":false,"requirement_frequency":"Every 12 months","requirement_status":"mandatory","risk_count":6,"source_pages":null,"source_url":"https://www.aiuc-1.com/safety/conduct-pre-deployment-testing"},"direct":false,"htmlUrl":"/agents/records/ctrl-aiuc-1-c002-6c739dcb.html","id":"ctrl:aiuc-1:C002","mapUrl":"https://controlsmap.com/?v=1&node=ctrl%3Aaiuc-1%3AC002","sourceIds":["aiuc-1"],"sourceUrl":"https://www.aiuc-1.com/safety/conduct-pre-deployment-testing","title":"C002 — Conduct pre-deployment testing","type":"control","url":"/assets/agent_record-ctrl-aiuc-1-c002-6c739dcb.9f8944ee1bc83c9e.json"},{"attributes":{"category":"technical","framework":"aiuc-1","type":"detective"},"canonicalUrl":"https://controlsmap.com/frameworks/aiuc-1/","description":"Monitor AI risk categories","details":{"automation":"automated","control_category":"technical","control_id":"C008","control_type":"detective","domains":["AI Governance"],"framework":"aiuc-1","group":"Safety","key_control":false,"requirement_frequency":"Every 12 months","requirement_status":"optional","risk_count":6,"source_pages":null,"source_url":"https://www.aiuc-1.com/safety/monitor-ai-risk-categories"},"direct":false,"htmlUrl":"/agents/records/ctrl-aiuc-1-c008-94bd64f2.html","id":"ctrl:aiuc-1:C008","mapUrl":"https://controlsmap.com/?v=1&node=ctrl%3Aaiuc-1%3AC008","sourceIds":["aiuc-1"],"sourceUrl":"https://www.aiuc-1.com/safety/monitor-ai-risk-categories","title":"C008 — Monitor AI risk categories","type":"control","url":"/assets/agent_record-ctrl-aiuc-1-c008-94bd64f2.762375d4fb6f0a93.json"},{"attributes":{"category":"administrative","framework":"aiuc-1","type":"preventive"},"canonicalUrl":"https://controlsmap.com/frameworks/aiuc-1/","description":"Third-party testing for harmful outputs","details":{"automation":"manual","control_category":"administrative","control_id":"C010","control_type":"preventive","domains":["AI Governance"],"framework":"aiuc-1","group":"Safety","key_control":true,"requirement_frequency":"Every 3 months","requirement_status":"mandatory","risk_count":5,"source_pages":null,"source_url":"https://www.aiuc-1.com/safety/3rd-party-testing-for-harmful-outputs"},"direct":false,"htmlUrl":"/agents/records/ctrl-aiuc-1-c010-b0a758b4.html","id":"ctrl:aiuc-1:C010","mapUrl":"https://controlsmap.com/?v=1&node=ctrl%3Aaiuc-1%3AC010","sourceIds":["aiuc-1"],"sourceUrl":"https://www.aiuc-1.com/safety/3rd-party-testing-for-harmful-outputs","title":"C010 — Third-party testing for harmful outputs","type":"control","url":"/assets/agent_record-ctrl-aiuc-1-c010-b0a758b4.1c43b9be128d3524.json"},{"attributes":{"category":"administrative","framework":"aiuc-1","type":"preventive"},"canonicalUrl":"https://controlsmap.com/frameworks/aiuc-1/","description":"Third-party testing for out-of-scope outputs","details":{"automation":"manual","control_category":"administrative","control_id":"C011","control_type":"preventive","domains":["AI Governance"],"framework":"aiuc-1","group":"Safety","key_control":true,"requirement_frequency":"Every 3 months","requirement_status":"mandatory","risk_count":5,"source_pages":null,"source_url":"https://www.aiuc-1.com/safety/3rd-party-testing-for-out-of-scope-outputs"},"direct":false,"htmlUrl":"/agents/records/ctrl-aiuc-1-c011-7889db41.html","id":"ctrl:aiuc-1:C011","mapUrl":"https://controlsmap.com/?v=1&node=ctrl%3Aaiuc-1%3AC011","sourceIds":["aiuc-1"],"sourceUrl":"https://www.aiuc-1.com/safety/3rd-party-testing-for-out-of-scope-outputs","title":"C011 — Third-party testing for out-of-scope outputs","type":"control","url":"/assets/agent_record-ctrl-aiuc-1-c011-7889db41.be400fb756f735e6.json"},{"attributes":{"category":"administrative","framework":"aiuc-1","type":"preventive"},"canonicalUrl":"https://controlsmap.com/frameworks/aiuc-1/","description":"Third-party testing for customer-defined risk","details":{"automation":"manual","control_category":"administrative","control_id":"C012","control_type":"preventive","domains":["AI Governance"],"framework":"aiuc-1","group":"Safety","key_control":true,"requirement_frequency":"Every 3 months","requirement_status":"mandatory","risk_count":5,"source_pages":null,"source_url":"https://www.aiuc-1.com/safety/3rd-party-testing-for-other-risk"},"direct":false,"htmlUrl":"/agents/records/ctrl-aiuc-1-c012-783c55df.html","id":"ctrl:aiuc-1:C012","mapUrl":"https://controlsmap.com/?v=1&node=ctrl%3Aaiuc-1%3AC012","sourceIds":["aiuc-1"],"sourceUrl":"https://www.aiuc-1.com/safety/3rd-party-testing-for-other-risk","title":"C012 — Third-party testing for customer-defined risk","type":"control","url":"/assets/agent_record-ctrl-aiuc-1-c012-783c55df.90373a20c285e27f.json"},{"attributes":{"category":"administrative","framework":"aiuc-1","type":"preventive"},"canonicalUrl":"https://controlsmap.com/frameworks/aiuc-1/","description":"Third-party testing for hallucinations","details":{"automation":"manual","control_category":"administrative","control_id":"D002","control_type":"preventive","domains":["AI Governance"],"framework":"aiuc-1","group":"Reliability","key_control":true,"requirement_frequency":"Every 3 months","requirement_status":"mandatory","risk_count":5,"source_pages":null,"source_url":"https://www.aiuc-1.com/reliability/3rd-party-testing-for-hallucinations"},"direct":false,"htmlUrl":"/agents/records/ctrl-aiuc-1-d002-34554b38.html","id":"ctrl:aiuc-1:D002","mapUrl":"https://controlsmap.com/?v=1&node=ctrl%3Aaiuc-1%3AD002","sourceIds":["aiuc-1"],"sourceUrl":"https://www.aiuc-1.com/reliability/3rd-party-testing-for-hallucinations","title":"D002 — Third-party testing for hallucinations","type":"control","url":"/assets/agent_record-ctrl-aiuc-1-d002-34554b38.cd845fda29af2076.json"},{"attributes":{"category":"administrative","framework":"aiuc-1","type":"preventive"},"canonicalUrl":"https://controlsmap.com/frameworks/aiuc-1/","description":"Third-party testing of tool calls","details":{"automation":"manual","control_category":"administrative","control_id":"D004","control_type":"preventive","domains":["AI Governance"],"framework":"aiuc-1","group":"Reliability","key_control":true,"requirement_frequency":"Every 3 months","requirement_status":"mandatory","risk_count":5,"source_pages":null,"source_url":"https://www.aiuc-1.com/reliability/3rd-party-testing-of-tool-calls"},"direct":false,"htmlUrl":"/agents/records/ctrl-aiuc-1-d004-21d4eeb4.html","id":"ctrl:aiuc-1:D004","mapUrl":"https://controlsmap.com/?v=1&node=ctrl%3Aaiuc-1%3AD004","sourceIds":["aiuc-1"],"sourceUrl":"https://www.aiuc-1.com/reliability/3rd-party-testing-of-tool-calls","title":"D004 — Third-party testing of tool calls","type":"control","url":"/assets/agent_record-ctrl-aiuc-1-d004-21d4eeb4.7a3954e8387e3f1c.json"},{"attributes":{"category":"technical","framework":"aiuc-1","type":"preventive"},"canonicalUrl":"https://controlsmap.com/frameworks/aiuc-1/","description":"Monitor third-party access","details":{"automation":"automated","control_category":"technical","control_id":"E009","control_type":"preventive","domains":["AI Governance","Governance, Policy & Oversight"],"framework":"aiuc-1","group":"Accountability","key_control":false,"requirement_frequency":"Every 12 months","requirement_status":"mandatory","risk_count":4,"source_pages":null,"source_url":"https://www.aiuc-1.com/accountability/monitor-3rd-party-access"},"direct":false,"htmlUrl":"/agents/records/ctrl-aiuc-1-e009-5269a385.html","id":"ctrl:aiuc-1:E009","mapUrl":"https://controlsmap.com/?v=1&node=ctrl%3Aaiuc-1%3AE009","sourceIds":["aiuc-1"],"sourceUrl":"https://www.aiuc-1.com/accountability/monitor-3rd-party-access","title":"E009 — Monitor third-party access","type":"control","url":"/assets/agent_record-ctrl-aiuc-1-e009-5269a385.5dc6cd79a240576a.json"},{"attributes":{"category":"technical","framework":"aiuc-1","type":"detective"},"canonicalUrl":"https://controlsmap.com/frameworks/aiuc-1/","description":"Log AI system activity","details":{"automation":"automated","control_category":"technical","control_id":"E015","control_type":"detective","domains":["AI Governance","Governance, Policy & Oversight"],"framework":"aiuc-1","group":"Accountability","key_control":false,"requirement_frequency":"Every 12 months","requirement_status":"mandatory","risk_count":6,"source_pages":null,"source_url":"https://www.aiuc-1.com/accountability/log-model-activity"},"direct":false,"htmlUrl":"/agents/records/ctrl-aiuc-1-e015-94a0c8ea.html","id":"ctrl:aiuc-1:E015","mapUrl":"https://controlsmap.com/?v=1&node=ctrl%3Aaiuc-1%3AE015","sourceIds":["aiuc-1"],"sourceUrl":"https://www.aiuc-1.com/accountability/log-model-activity","title":"E015 — Log AI system activity","type":"control","url":"/assets/agent_record-ctrl-aiuc-1-e015-94a0c8ea.656c173a4dbefe3f.json"},{"attributes":{"category":"administrative","framework":"cobit-2019","type":"corrective"},"canonicalUrl":"https://controlsmap.com/frameworks/cobit-2019/","description":"Managed Service Requests and Incidents","details":{"automation":"hybrid","control_category":"administrative","control_id":"DSS02","control_type":"corrective","domains":["Business Continuity & Disaster Recovery","Incident Management & Response","Logging, Monitoring & Detection","Governance, Policy & Oversight"],"framework":"cobit-2019","group":"Deliver, Service and Support","key_control":false,"requirement_frequency":null,"requirement_status":null,"risk_count":5,"source_pages":null,"source_url":null},"direct":false,"htmlUrl":"/agents/records/ctrl-cobit-2019-dss02-af5bca5d.html","id":"ctrl:cobit-2019:DSS02","mapUrl":"https://controlsmap.com/?v=1&node=ctrl%3Acobit-2019%3ADSS02","sourceIds":["cobit-2019"],"sourceUrl":null,"title":"DSS02 — Managed Service Requests and Incidents","type":"control","url":"/assets/agent_record-ctrl-cobit-2019-dss02-af5bca5d.d9fabf94aa20dc7d.json"},{"attributes":{"category":"administrative","framework":"cobit-2019","type":"corrective"},"canonicalUrl":"https://controlsmap.com/frameworks/cobit-2019/","description":"Managed Problems","details":{"automation":"manual","control_category":"administrative","control_id":"DSS03","control_type":"corrective","domains":["Business Continuity & Disaster Recovery","Incident Management & Response","Logging, Monitoring & Detection","Governance, Policy & Oversight"],"framework":"cobit-2019","group":"Deliver, Service and Support","key_control":false,"requirement_frequency":null,"requirement_status":null,"risk_count":5,"source_pages":null,"source_url":null},"direct":false,"htmlUrl":"/agents/records/ctrl-cobit-2019-dss03-2540740f.html","id":"ctrl:cobit-2019:DSS03","mapUrl":"https://controlsmap.com/?v=1&node=ctrl%3Acobit-2019%3ADSS03","sourceIds":["cobit-2019"],"sourceUrl":null,"title":"DSS03 — Managed Problems","type":"control","url":"/assets/agent_record-ctrl-cobit-2019-dss03-2540740f.0983703d1904b1c5.json"},{"attributes":{"category":"technical","framework":"cobit-2019","type":"preventive"},"canonicalUrl":"https://controlsmap.com/frameworks/cobit-2019/","description":"Managed Security Services","details":{"automation":"hybrid","control_category":"technical","control_id":"DSS05","control_type":"preventive","domains":["Business Continuity & Disaster Recovery","Incident Management & Response","Logging, Monitoring & Detection","Governance, Policy & Oversight"],"framework":"cobit-2019","group":"Deliver, Service and Support","key_control":true,"requirement_frequency":null,"requirement_status":null,"risk_count":5,"source_pages":null,"source_url":null},"direct":false,"htmlUrl":"/agents/records/ctrl-cobit-2019-dss05-80cfe6d8.html","id":"ctrl:cobit-2019:DSS05","mapUrl":"https://controlsmap.com/?v=1&node=ctrl%3Acobit-2019%3ADSS05","sourceIds":["cobit-2019"],"sourceUrl":null,"title":"DSS05 — Managed Security Services","type":"control","url":"/assets/agent_record-ctrl-cobit-2019-dss05-80cfe6d8.40f5cc048ce33ab4.json"},{"attributes":{"category":"administrative","framework":"coso-ic","type":"preventive"},"canonicalUrl":"https://controlsmap.com/frameworks/coso-ic/","description":"The organization identifies risks to the achievement of its objectives across the entity and analyzes risks as a basis for determining how the risks should be managed.","details":{"automation":"manual","control_category":"administrative","control_id":"P7","control_type":"preventive","domains":["AI Governance","Risk Assessment & Management","Third-Party / Supply-Chain Risk"],"framework":"coso-ic","group":"Risk Assessment","key_control":false,"requirement_frequency":null,"requirement_status":null,"risk_count":3,"source_pages":null,"source_url":null},"direct":false,"htmlUrl":"/agents/records/ctrl-coso-ic-p7-a272f700.html","id":"ctrl:coso-ic:P7","mapUrl":"https://controlsmap.com/?v=1&node=ctrl%3Acoso-ic%3AP7","sourceIds":["coso-ic"],"sourceUrl":null,"title":"P7 — The organization identifies risks to the achievement of its objectives across the entity and analyzes risks as a basis for determining how the risks should be managed.","type":"control","url":"/assets/agent_record-ctrl-coso-ic-p7-a272f700.857cd7fd11a55c0c.json"},{"attributes":{"category":"administrative","framework":"dora","type":"corrective"},"canonicalUrl":"https://controlsmap.com/frameworks/dora/","description":"ICT-related incident management, classification and reporting","details":{"automation":"hybrid","control_category":"administrative","control_id":"DORA-Art17-23","control_type":"corrective","domains":["Business Continuity & Disaster Recovery","Incident Management & Response","Third-Party / Supply-Chain Risk","Governance, Policy & Oversight","Risk Assessment & Management"],"framework":"dora","group":"EU DORA (Digital Operational Resilience Act)","key_control":true,"requirement_frequency":null,"requirement_status":null,"risk_count":5,"source_pages":null,"source_url":null},"direct":false,"htmlUrl":"/agents/records/ctrl-dora-dora-art17-23-9aa7977f.html","id":"ctrl:dora:DORA-Art17-23","mapUrl":"https://controlsmap.com/?v=1&node=ctrl%3Adora%3ADORA-Art17-23","sourceIds":["dora"],"sourceUrl":null,"title":"DORA-Art17-23 — ICT-related incident management, classification and reporting","type":"control","url":"/assets/agent_record-ctrl-dora-dora-art17-23-9aa7977f.313cf7638f5cfdb3.json"},{"attributes":{"category":"technical","framework":"dora","type":"detective"},"canonicalUrl":"https://controlsmap.com/frameworks/dora/","description":"Digital operational resilience testing (incl. threat-led penetration testing)","details":{"automation":"hybrid","control_category":"technical","control_id":"DORA-Art24-27","control_type":"detective","domains":["Business Continuity & Disaster Recovery","Incident Management & Response","Third-Party / Supply-Chain Risk","Governance, Policy & Oversight","Risk Assessment & Management"],"framework":"dora","group":"EU DORA (Digital Operational Resilience Act)","key_control":false,"requirement_frequency":null,"requirement_status":null,"risk_count":3,"source_pages":null,"source_url":null},"direct":false,"htmlUrl":"/agents/records/ctrl-dora-dora-art24-27-dc4b8836.html","id":"ctrl:dora:DORA-Art24-27","mapUrl":"https://controlsmap.com/?v=1&node=ctrl%3Adora%3ADORA-Art24-27","sourceIds":["dora"],"sourceUrl":null,"title":"DORA-Art24-27 — Digital operational resilience testing (incl. threat-led penetration testing)","type":"control","url":"/assets/agent_record-ctrl-dora-dora-art24-27-dc4b8836.10b427458b73121d.json"},{"attributes":{"category":"technical","framework":"eu-ai-act","type":"detective"},"canonicalUrl":"https://controlsmap.com/frameworks/eu-ai-act/","description":"Record-keeping / logging (high-risk)","details":{"automation":"automated","control_category":"technical","control_id":"AIA-Art12","control_type":"detective","domains":["AI Governance","Risk Assessment & Management","Governance, Policy & Oversight"],"framework":"eu-ai-act","group":"EU AI Act","key_control":true,"requirement_frequency":null,"requirement_status":null,"risk_count":6,"source_pages":null,"source_url":null},"direct":false,"htmlUrl":"/agents/records/ctrl-eu-ai-act-aia-art12-3714b8af.html","id":"ctrl:eu-ai-act:AIA-Art12","mapUrl":"https://controlsmap.com/?v=1&node=ctrl%3Aeu-ai-act%3AAIA-Art12","sourceIds":["eu-ai-act"],"sourceUrl":null,"title":"AIA-Art12 — Record-keeping / logging (high-risk)","type":"control","url":"/assets/agent_record-ctrl-eu-ai-act-aia-art12-3714b8af.118bd0f6a3053147.json"},{"attributes":{"category":"technical","framework":"eu-ai-act","type":"detective"},"canonicalUrl":"https://controlsmap.com/frameworks/eu-ai-act/","description":"Automatically generated logs — provider retention of high-risk system logs (minimum six months)","details":{"automation":"automated","control_category":"technical","control_id":"AIA-Art19","control_type":"detective","domains":["AI Governance","Risk Assessment & Management","Governance, Policy & Oversight"],"framework":"eu-ai-act","group":"EU AI Act","key_control":false,"requirement_frequency":null,"requirement_status":null,"risk_count":6,"source_pages":null,"source_url":null},"direct":false,"htmlUrl":"/agents/records/ctrl-eu-ai-act-aia-art19-55451bfa.html","id":"ctrl:eu-ai-act:AIA-Art19","mapUrl":"https://controlsmap.com/?v=1&node=ctrl%3Aeu-ai-act%3AAIA-Art19","sourceIds":["eu-ai-act"],"sourceUrl":null,"title":"AIA-Art19 — Automatically generated logs — provider retention of high-risk system logs (minimum six months)","type":"control","url":"/assets/agent_record-ctrl-eu-ai-act-aia-art19-55451bfa.87a8da9d00d38c01.json"},{"attributes":{"category":"administrative","framework":"eu-ai-act","type":"detective"},"canonicalUrl":"https://controlsmap.com/frameworks/eu-ai-act/","description":"Post-market monitoring by providers of high-risk AI systems","details":{"automation":"hybrid","control_category":"administrative","control_id":"AIA-Art72","control_type":"detective","domains":["AI Governance","Risk Assessment & Management","Governance, Policy & Oversight"],"framework":"eu-ai-act","group":"EU AI Act","key_control":false,"requirement_frequency":null,"requirement_status":null,"risk_count":6,"source_pages":null,"source_url":null},"direct":false,"htmlUrl":"/agents/records/ctrl-eu-ai-act-aia-art72-2866ca15.html","id":"ctrl:eu-ai-act:AIA-Art72","mapUrl":"https://controlsmap.com/?v=1&node=ctrl%3Aeu-ai-act%3AAIA-Art72","sourceIds":["eu-ai-act"],"sourceUrl":null,"title":"AIA-Art72 — Post-market monitoring by providers of high-risk AI systems","type":"control","url":"/assets/agent_record-ctrl-eu-ai-act-aia-art72-2866ca15.6e8db1483b110a8e.json"},{"attributes":{"category":"technical","framework":"gdpr","type":"preventive"},"canonicalUrl":"https://controlsmap.com/frameworks/gdpr/","description":"Security of processing","details":{"automation":"hybrid","control_category":"technical","control_id":"GDPR-Art32","control_type":"preventive","domains":["Data Protection & Privacy","Governance, Policy & Oversight","Incident Management & Response","Third-Party / Supply-Chain Risk","Risk Assessment & Management"],"framework":"gdpr","group":"EU GDPR","key_control":true,"requirement_frequency":null,"requirement_status":null,"risk_count":4,"source_pages":null,"source_url":null},"direct":false,"htmlUrl":"/agents/records/ctrl-gdpr-gdpr-art32-63aa3290.html","id":"ctrl:gdpr:GDPR-Art32","mapUrl":"https://controlsmap.com/?v=1&node=ctrl%3Agdpr%3AGDPR-Art32","sourceIds":["gdpr"],"sourceUrl":null,"title":"GDPR-Art32 — Security of processing","type":"control","url":"/assets/agent_record-ctrl-gdpr-gdpr-art32-63aa3290.135b09987bf85085.json"},{"attributes":{"category":"administrative","framework":"gdpr","type":"corrective"},"canonicalUrl":"https://controlsmap.com/frameworks/gdpr/","description":"Notification of a personal data breach to the supervisory authority","details":{"automation":"manual","control_category":"administrative","control_id":"GDPR-Art33","control_type":"corrective","domains":["Data Protection & Privacy","Governance, Policy & Oversight","Incident Management & Response","Third-Party / Supply-Chain Risk","Risk Assessment & Management"],"framework":"gdpr","group":"EU GDPR","key_control":true,"requirement_frequency":null,"requirement_status":null,"risk_count":3,"source_pages":null,"source_url":null},"direct":false,"htmlUrl":"/agents/records/ctrl-gdpr-gdpr-art33-a2a440c2.html","id":"ctrl:gdpr:GDPR-Art33","mapUrl":"https://controlsmap.com/?v=1&node=ctrl%3Agdpr%3AGDPR-Art33","sourceIds":["gdpr"],"sourceUrl":null,"title":"GDPR-Art33 — Notification of a personal data breach to the supervisory authority","type":"control","url":"/assets/agent_record-ctrl-gdpr-gdpr-art33-a2a440c2.047194a4abc43d41.json"},{"attributes":{"category":"administrative","framework":"gdpr","type":"preventive"},"canonicalUrl":"https://controlsmap.com/frameworks/gdpr/","description":"International transfers of personal data","details":{"automation":"manual","control_category":"administrative","control_id":"GDPR-Art44-49","control_type":"preventive","domains":["Data Protection & Privacy","Governance, Policy & Oversight","Incident Management & Response","Third-Party / Supply-Chain Risk","Risk Assessment & Management"],"framework":"gdpr","group":"EU GDPR","key_control":false,"requirement_frequency":null,"requirement_status":null,"risk_count":5,"source_pages":null,"source_url":null},"direct":false,"htmlUrl":"/agents/records/ctrl-gdpr-gdpr-art44-49-8ad28202.html","id":"ctrl:gdpr:GDPR-Art44-49","mapUrl":"https://controlsmap.com/?v=1&node=ctrl%3Agdpr%3AGDPR-Art44-49","sourceIds":["gdpr"],"sourceUrl":null,"title":"GDPR-Art44-49 — International transfers of personal data","type":"control","url":"/assets/agent_record-ctrl-gdpr-gdpr-art44-49-8ad28202.5b6cd8ca6d1807c9.json"},{"attributes":{"category":"technical","framework":"hipaa","type":"preventive"},"canonicalUrl":"https://controlsmap.com/frameworks/hipaa/","description":"Technical access control for ePHI (unique user ID, emergency access, automatic logoff, encryption/decryption)","details":{"automation":"hybrid","control_category":"technical","control_id":"HIPAA-164.312(a)","control_type":"preventive","domains":["Governance, Policy & Oversight","Risk Assessment & Management","Access Control & Identity Management","Physical & Environmental Security","Logging, Monitoring & Detection","Business Continuity & Disaster Recovery","Third-Party / Supply-Chain Risk","Data Protection & Privacy"],"framework":"hipaa","group":"HIPAA Security Rule","key_control":false,"requirement_frequency":null,"requirement_status":null,"risk_count":4,"source_pages":null,"source_url":null},"direct":false,"htmlUrl":"/agents/records/ctrl-hipaa-hipaa-164-312-a-5c8bb707.html","id":"ctrl:hipaa:HIPAA-164.312(a)","mapUrl":"https://controlsmap.com/?v=1&node=ctrl%3Ahipaa%3AHIPAA-164.312%28a%29","sourceIds":["hipaa"],"sourceUrl":null,"title":"HIPAA-164.312(a) — Technical access control for ePHI (unique user ID, emergency access, automatic logoff, encryption/decryption)","type":"control","url":"/assets/agent_record-ctrl-hipaa-hipaa-164-312-a-5c8bb707.b17a8cd3c637ac4b.json"},{"attributes":{"category":"technical","framework":"hipaa","type":"detective"},"canonicalUrl":"https://controlsmap.com/frameworks/hipaa/","description":"Audit controls recording activity in systems with ePHI","details":{"automation":"automated","control_category":"technical","control_id":"HIPAA-164.312(b)","control_type":"detective","domains":["Governance, Policy & Oversight","Risk Assessment & Management","Access Control & Identity Management","Physical & Environmental Security","Logging, Monitoring & Detection","Business Continuity & Disaster Recovery","Third-Party / Supply-Chain Risk","Data Protection & Privacy"],"framework":"hipaa","group":"HIPAA Security Rule","key_control":false,"requirement_frequency":null,"requirement_status":null,"risk_count":4,"source_pages":null,"source_url":null},"direct":false,"htmlUrl":"/agents/records/ctrl-hipaa-hipaa-164-312-b-7272303c.html","id":"ctrl:hipaa:HIPAA-164.312(b)","mapUrl":"https://controlsmap.com/?v=1&node=ctrl%3Ahipaa%3AHIPAA-164.312%28b%29","sourceIds":["hipaa"],"sourceUrl":null,"title":"HIPAA-164.312(b) — Audit controls recording activity in systems with ePHI","type":"control","url":"/assets/agent_record-ctrl-hipaa-hipaa-164-312-b-7272303c.3f97e7dbfc1288c9.json"},{"attributes":{"category":"administrative","framework":"iso-27001","type":"preventive"},"canonicalUrl":"https://controlsmap.com/frameworks/iso-27001/","description":"Access control","details":{"automation":"hybrid","control_category":"administrative","control_id":"A.5.15","control_type":"preventive","domains":["Access Control & Identity Management"],"framework":"iso-27001","group":"Organizational controls","key_control":true,"requirement_frequency":null,"requirement_status":null,"risk_count":7,"source_pages":null,"source_url":null},"direct":false,"htmlUrl":"/agents/records/ctrl-iso-27001-a-5-15-b8587804.html","id":"ctrl:iso-27001:A.5.15","mapUrl":"https://controlsmap.com/?v=1&node=ctrl%3Aiso-27001%3AA.5.15","sourceIds":["iso-27001"],"sourceUrl":null,"title":"A.5.15 — Access control","type":"control","url":"/assets/agent_record-ctrl-iso-27001-a-5-15-b8587804.790e4f214625d89e.json"},{"attributes":{"category":"administrative","framework":"iso-27001","type":"preventive"},"canonicalUrl":"https://controlsmap.com/frameworks/iso-27001/","description":"Identity management","details":{"automation":"hybrid","control_category":"administrative","control_id":"A.5.16","control_type":"preventive","domains":["Access Control & Identity Management"],"framework":"iso-27001","group":"Organizational controls","key_control":true,"requirement_frequency":null,"requirement_status":null,"risk_count":3,"source_pages":null,"source_url":null},"direct":false,"htmlUrl":"/agents/records/ctrl-iso-27001-a-5-16-46fc8420.html","id":"ctrl:iso-27001:A.5.16","mapUrl":"https://controlsmap.com/?v=1&node=ctrl%3Aiso-27001%3AA.5.16","sourceIds":["iso-27001"],"sourceUrl":null,"title":"A.5.16 — Identity management","type":"control","url":"/assets/agent_record-ctrl-iso-27001-a-5-16-46fc8420.2675ac3eda4cd50e.json"},{"attributes":{"category":"administrative","framework":"iso-27001","type":"preventive"},"canonicalUrl":"https://controlsmap.com/frameworks/iso-27001/","description":"Authentication information","details":{"automation":"hybrid","control_category":"administrative","control_id":"A.5.17","control_type":"preventive","domains":["Access Control & Identity Management"],"framework":"iso-27001","group":"Organizational controls","key_control":true,"requirement_frequency":null,"requirement_status":null,"risk_count":4,"source_pages":null,"source_url":null},"direct":false,"htmlUrl":"/agents/records/ctrl-iso-27001-a-5-17-b45de021.html","id":"ctrl:iso-27001:A.5.17","mapUrl":"https://controlsmap.com/?v=1&node=ctrl%3Aiso-27001%3AA.5.17","sourceIds":["iso-27001"],"sourceUrl":null,"title":"A.5.17 — Authentication information","type":"control","url":"/assets/agent_record-ctrl-iso-27001-a-5-17-b45de021.883dd52c9a8ad6ee.json"},{"attributes":{"category":"administrative","framework":"iso-27001","type":"preventive"},"canonicalUrl":"https://controlsmap.com/frameworks/iso-27001/","description":"Access rights","details":{"automation":"hybrid","control_category":"administrative","control_id":"A.5.18","control_type":"preventive","domains":["Access Control & Identity Management"],"framework":"iso-27001","group":"Organizational controls","key_control":true,"requirement_frequency":null,"requirement_status":null,"risk_count":4,"source_pages":null,"source_url":null},"direct":false,"htmlUrl":"/agents/records/ctrl-iso-27001-a-5-18-472ef6f1.html","id":"ctrl:iso-27001:A.5.18","mapUrl":"https://controlsmap.com/?v=1&node=ctrl%3Aiso-27001%3AA.5.18","sourceIds":["iso-27001"],"sourceUrl":null,"title":"A.5.18 — Access rights","type":"control","url":"/assets/agent_record-ctrl-iso-27001-a-5-18-472ef6f1.c3aebc6053284559.json"},{"attributes":{"category":"administrative","framework":"iso-27001","type":"detective"},"canonicalUrl":"https://controlsmap.com/frameworks/iso-27001/","description":"Assessment and decision on information security events","details":{"automation":"manual","control_category":"administrative","control_id":"A.5.25","control_type":"detective","domains":["Incident Management & Response"],"framework":"iso-27001","group":"Organizational controls","key_control":false,"requirement_frequency":null,"requirement_status":null,"risk_count":3,"source_pages":null,"source_url":null},"direct":false,"htmlUrl":"/agents/records/ctrl-iso-27001-a-5-25-7dc7a20c.html","id":"ctrl:iso-27001:A.5.25","mapUrl":"https://controlsmap.com/?v=1&node=ctrl%3Aiso-27001%3AA.5.25","sourceIds":["iso-27001"],"sourceUrl":null,"title":"A.5.25 — Assessment and decision on information security events","type":"control","url":"/assets/agent_record-ctrl-iso-27001-a-5-25-7dc7a20c.52bc6e2b0f1530dc.json"},{"attributes":{"category":"administrative","framework":"iso-27001","type":"corrective"},"canonicalUrl":"https://controlsmap.com/frameworks/iso-27001/","description":"Response to information security incidents","details":{"automation":"manual","control_category":"administrative","control_id":"A.5.26","control_type":"corrective","domains":["Incident Management & Response"],"framework":"iso-27001","group":"Organizational controls","key_control":false,"requirement_frequency":null,"requirement_status":null,"risk_count":3,"source_pages":null,"source_url":null},"direct":false,"htmlUrl":"/agents/records/ctrl-iso-27001-a-5-26-863e832e.html","id":"ctrl:iso-27001:A.5.26","mapUrl":"https://controlsmap.com/?v=1&node=ctrl%3Aiso-27001%3AA.5.26","sourceIds":["iso-27001"],"sourceUrl":null,"title":"A.5.26 — Response to information security incidents","type":"control","url":"/assets/agent_record-ctrl-iso-27001-a-5-26-863e832e.4d7659d97c4996db.json"},{"attributes":{"category":"administrative","framework":"iso-27001","type":"corrective"},"canonicalUrl":"https://controlsmap.com/frameworks/iso-27001/","description":"Collection of evidence","details":{"automation":"manual","control_category":"administrative","control_id":"A.5.28","control_type":"corrective","domains":["Incident Management & Response"],"framework":"iso-27001","group":"Organizational controls","key_control":false,"requirement_frequency":null,"requirement_status":null,"risk_count":2,"source_pages":null,"source_url":null},"direct":false,"htmlUrl":"/agents/records/ctrl-iso-27001-a-5-28-e9d04483.html","id":"ctrl:iso-27001:A.5.28","mapUrl":"https://controlsmap.com/?v=1&node=ctrl%3Aiso-27001%3AA.5.28","sourceIds":["iso-27001"],"sourceUrl":null,"title":"A.5.28 — Collection of evidence","type":"control","url":"/assets/agent_record-ctrl-iso-27001-a-5-28-e9d04483.1cdfd3369d01b3d2.json"},{"attributes":{"category":"administrative","framework":"iso-27001","type":"detective"},"canonicalUrl":"https://controlsmap.com/frameworks/iso-27001/","description":"Threat intelligence","details":{"automation":"hybrid","control_category":"administrative","control_id":"A.5.7","control_type":"detective","domains":["Risk Assessment & Management"],"framework":"iso-27001","group":"Organizational controls","key_control":false,"requirement_frequency":null,"requirement_status":null,"risk_count":2,"source_pages":null,"source_url":null},"direct":false,"htmlUrl":"/agents/records/ctrl-iso-27001-a-5-7-0328fe6b.html","id":"ctrl:iso-27001:A.5.7","mapUrl":"https://controlsmap.com/?v=1&node=ctrl%3Aiso-27001%3AA.5.7","sourceIds":["iso-27001"],"sourceUrl":null,"title":"A.5.7 — Threat intelligence","type":"control","url":"/assets/agent_record-ctrl-iso-27001-a-5-7-0328fe6b.e1d8614948702701.json"},{"attributes":{"category":"administrative","framework":"iso-27001","type":"preventive"},"canonicalUrl":"https://controlsmap.com/frameworks/iso-27001/","description":"Information security in project management","details":{"automation":"manual","control_category":"administrative","control_id":"A.5.8","control_type":"preventive","domains":["Risk Assessment & Management"],"framework":"iso-27001","group":"Organizational controls","key_control":false,"requirement_frequency":null,"requirement_status":null,"risk_count":3,"source_pages":null,"source_url":null},"direct":false,"htmlUrl":"/agents/records/ctrl-iso-27001-a-5-8-bf8c2add.html","id":"ctrl:iso-27001:A.5.8","mapUrl":"https://controlsmap.com/?v=1&node=ctrl%3Aiso-27001%3AA.5.8","sourceIds":["iso-27001"],"sourceUrl":null,"title":"A.5.8 — Information security in project management","type":"control","url":"/assets/agent_record-ctrl-iso-27001-a-5-8-bf8c2add.a085d08362f33570.json"},{"attributes":{"category":"administrative","framework":"iso-27001","type":"preventive"},"canonicalUrl":"https://controlsmap.com/frameworks/iso-27001/","description":"Information security awareness, education and training","details":{"automation":"manual","control_category":"administrative","control_id":"A.6.3","control_type":"preventive","domains":["Awareness & Training"],"framework":"iso-27001","group":"People controls","key_control":false,"requirement_frequency":null,"requirement_status":null,"risk_count":5,"source_pages":null,"source_url":null},"direct":false,"htmlUrl":"/agents/records/ctrl-iso-27001-a-6-3-b9bb8fbd.html","id":"ctrl:iso-27001:A.6.3","mapUrl":"https://controlsmap.com/?v=1&node=ctrl%3Aiso-27001%3AA.6.3","sourceIds":["iso-27001"],"sourceUrl":null,"title":"A.6.3 — Information security awareness, education and training","type":"control","url":"/assets/agent_record-ctrl-iso-27001-a-6-3-b9bb8fbd.365b3922b77de0c9.json"},{"attributes":{"category":"administrative","framework":"iso-27001","type":"detective"},"canonicalUrl":"https://controlsmap.com/frameworks/iso-27001/","description":"Information security event reporting","details":{"automation":"manual","control_category":"administrative","control_id":"A.6.8","control_type":"detective","domains":["Incident Management & Response"],"framework":"iso-27001","group":"People controls","key_control":false,"requirement_frequency":null,"requirement_status":null,"risk_count":3,"source_pages":null,"source_url":null},"direct":false,"htmlUrl":"/agents/records/ctrl-iso-27001-a-6-8-87f56c6a.html","id":"ctrl:iso-27001:A.6.8","mapUrl":"https://controlsmap.com/?v=1&node=ctrl%3Aiso-27001%3AA.6.8","sourceIds":["iso-27001"],"sourceUrl":null,"title":"A.6.8 — Information security event reporting","type":"control","url":"/assets/agent_record-ctrl-iso-27001-a-6-8-87f56c6a.9e050c5a3627b344.json"},{"attributes":{"category":"technical","framework":"iso-27001","type":"preventive"},"canonicalUrl":"https://controlsmap.com/frameworks/iso-27001/","description":"Data leakage prevention","details":{"automation":"automated","control_category":"technical","control_id":"A.8.12","control_type":"preventive","domains":["Data Protection & Privacy"],"framework":"iso-27001","group":"Technological controls","key_control":false,"requirement_frequency":null,"requirement_status":null,"risk_count":5,"source_pages":null,"source_url":null},"direct":false,"htmlUrl":"/agents/records/ctrl-iso-27001-a-8-12-8310e795.html","id":"ctrl:iso-27001:A.8.12","mapUrl":"https://controlsmap.com/?v=1&node=ctrl%3Aiso-27001%3AA.8.12","sourceIds":["iso-27001"],"sourceUrl":null,"title":"A.8.12 — Data leakage prevention","type":"control","url":"/assets/agent_record-ctrl-iso-27001-a-8-12-8310e795.cb4eafa1d3e16902.json"}],"relationships":[{"expectedCatalogRevision":"24028ffcfc2b295fa1b08ee6caa84b765f0731b321496bf4f548c49ad2177028","id":"rel:0143972f536ed73420cfad9018dabcad73590f295f5a8a7d609d0277e9c474bf","properties":{"control_id":"B007","coverage":"partial","delta":"quarterly review of user access privileges to AI systems, including administrative, configuration, and training-data access","framework":"aiuc-1","provenance":{"defaultConfidence":"medium","defaultStatus":"active","direction":"canonical_to_source","mapper":"coworkcanvas-compliance-graph","note":"Each member is a documented relationship claim from the canonical unified control to a source control or guidance proposition. relationship: equal|superset_of (full) / intersects_with|subset_of (partial) / informs (guidance). confidence 'medium' = single-mapper, documented, not yet externally corroborated. source_version is the member framework's edition from the standard version register.","reviewDate":"2026-09-07"},"relationship":"intersects_with","source_version":"July 15, 2026 release (quarterly update cadence)"},"sourceDetailPath":"/data/v1/records/uc-uc-access-05-9b7f3e34.json","sourceId":"uc:UC-ACCESS-05","targetDetailPath":"/data/v1/records/ctrl-aiuc-1-b007-151dfcd3.json","targetId":"ctrl:aiuc-1:B007","type":"maps_to"},{"expectedCatalogRevision":"24028ffcfc2b295fa1b08ee6caa84b765f0731b321496bf4f548c49ad2177028","id":"rel:064c13ba66090a675f3ddc5ec32d06e7ad9429416e49de63db68a7cbc43d4f65","properties":{},"sourceDetailPath":"/data/v1/records/ctrl-cobit-2019-dss05-80cfe6d8.json","sourceId":"ctrl:cobit-2019:DSS05","targetDetailPath":"/data/v1/records/std-cobit-2019-2181ce0c.json","targetId":"std:cobit-2019","type":"belongs_to"},{"expectedCatalogRevision":"24028ffcfc2b295fa1b08ee6caa84b765f0731b321496bf4f548c49ad2177028","id":"rel:076722c10b06e43d9f84521802be10ef1863a351ae38466b1fca083ff7a9fda1","properties":{},"sourceDetailPath":"/data/v1/records/ctrl-aiuc-1-c008-94bd64f2.json","sourceId":"ctrl:aiuc-1:C008","targetDetailPath":"/data/v1/records/std-aiuc-1-d2a8b650.json","targetId":"std:aiuc-1","type":"belongs_to"},{"expectedCatalogRevision":"24028ffcfc2b295fa1b08ee6caa84b765f0731b321496bf4f548c49ad2177028","id":"rel:0d4c62ecaae2f7303c04611942d2d3c0be48b1dbbbdc87b1c12837d9d00505c0","properties":{"control_id":"A.5.16","coverage":"full","delta":null,"framework":"iso-27001","provenance":{"defaultConfidence":"medium","defaultStatus":"active","direction":"canonical_to_source","mapper":"coworkcanvas-compliance-graph","note":"Each member is a documented relationship claim from the canonical unified control to a source control or guidance proposition. relationship: equal|superset_of (full) / intersects_with|subset_of (partial) / informs (guidance). confidence 'medium' = single-mapper, documented, not yet externally corroborated. source_version is the member framework's edition from the standard version register.","reviewDate":"2026-09-07"},"relationship":"superset_of","source_version":"2022"},"sourceDetailPath":"/data/v1/records/uc-uc-access-06-623f356c.json","sourceId":"uc:UC-ACCESS-06","targetDetailPath":"/data/v1/records/ctrl-iso-27001-a-5-16-46fc8420.json","targetId":"ctrl:iso-27001:A.5.16","type":"maps_to"},{"expectedCatalogRevision":"24028ffcfc2b295fa1b08ee6caa84b765f0731b321496bf4f548c49ad2177028","id":"rel:1034a1bf8aadb88c03724051eb8a21ece1a44c8b14c592c16dc9039e08476a12","properties":{},"sourceDetailPath":"/data/v1/records/ctrl-gdpr-gdpr-art44-49-8ad28202.json","sourceId":"ctrl:gdpr:GDPR-Art44-49","targetDetailPath":"/data/v1/records/std-gdpr-17d65d0b.json","targetId":"std:gdpr","type":"belongs_to"},{"expectedCatalogRevision":"24028ffcfc2b295fa1b08ee6caa84b765f0731b321496bf4f548c49ad2177028","id":"rel:125837fa57ffac78b2e9e962c9d8e11ca5fc8d0bffd212767c6b8ede1c62b007","properties":{},"sourceDetailPath":"/data/v1/records/ctrl-iso-27001-a-5-18-472ef6f1.json","sourceId":"ctrl:iso-27001:A.5.18","targetDetailPath":"/data/v1/records/std-iso-27001-656201bd.json","targetId":"std:iso-27001","type":"belongs_to"},{"expectedCatalogRevision":"24028ffcfc2b295fa1b08ee6caa84b765f0731b321496bf4f548c49ad2177028","id":"rel:151c6358382dbbca56287fa96b5e2f91eda2817b774910275f3b508306cd9bfe","properties":{},"sourceDetailPath":"/data/v1/records/ctrl-aiuc-1-a005-12903764.json","sourceId":"ctrl:aiuc-1:A005","targetDetailPath":"/data/v1/records/std-aiuc-1-d2a8b650.json","targetId":"std:aiuc-1","type":"belongs_to"},{"expectedCatalogRevision":"24028ffcfc2b295fa1b08ee6caa84b765f0731b321496bf4f548c49ad2177028","id":"rel:176888462abb754dc37b3a4a12b0775af91b62a797ccf757969e2c9fc7078651","properties":{},"sourceDetailPath":"/data/v1/records/ctrl-aiuc-1-e015-94a0c8ea.json","sourceId":"ctrl:aiuc-1:E015","targetDetailPath":"/data/v1/records/std-aiuc-1-d2a8b650.json","targetId":"std:aiuc-1","type":"belongs_to"},{"expectedCatalogRevision":"24028ffcfc2b295fa1b08ee6caa84b765f0731b321496bf4f548c49ad2177028","id":"rel:196ceefc0745c6ddc8a3f0db75c1ea4386ea6dd54352a7744060fe898f7b82cc","properties":{"control_id":"GDPR-Art32","coverage":"partial","delta":"also requires encryption, resilience, and effectiveness testing addressed in other domains","framework":"gdpr","provenance":{"defaultConfidence":"medium","defaultStatus":"active","direction":"canonical_to_source","mapper":"coworkcanvas-compliance-graph","note":"Each member is a documented relationship claim from the canonical unified control to a source control or guidance proposition. relationship: equal|superset_of (full) / intersects_with|subset_of (partial) / informs (guidance). confidence 'medium' = single-mapper, documented, not yet externally corroborated. source_version is the member framework's edition from the standard version register.","reviewDate":"2026-09-07"},"relationship":"intersects_with","source_version":"Regulation (EU) 2016/679"},"sourceDetailPath":"/data/v1/records/uc-uc-access-05-9b7f3e34.json","sourceId":"uc:UC-ACCESS-05","targetDetailPath":"/data/v1/records/ctrl-gdpr-gdpr-art32-63aa3290.json","targetId":"ctrl:gdpr:GDPR-Art32","type":"maps_to"},{"expectedCatalogRevision":"24028ffcfc2b295fa1b08ee6caa84b765f0731b321496bf4f548c49ad2177028","id":"rel:199e523235255b49f7b7f37170eadd985d243e5d71a80080efd22243a1989120","properties":{},"sourceDetailPath":"/data/v1/records/ctrl-gdpr-gdpr-art32-63aa3290.json","sourceId":"ctrl:gdpr:GDPR-Art32","targetDetailPath":"/data/v1/records/std-gdpr-17d65d0b.json","targetId":"std:gdpr","type":"belongs_to"},{"expectedCatalogRevision":"24028ffcfc2b295fa1b08ee6caa84b765f0731b321496bf4f548c49ad2177028","id":"rel:1b1ee959cc26f4a87a9386efa482ae23a1501dc8f85d4ce4a62122317e320641","properties":{"control_id":"AIA-Art72","coverage":"partial","delta":"a documented post-market monitoring plan, proportionate to the system's risk, that actively collects and analyses lifetime performance data including interaction with other AI systems","framework":"eu-ai-act","provenance":{"defaultConfidence":"medium","defaultStatus":"active","direction":"canonical_to_source","mapper":"coworkcanvas-compliance-graph","note":"Each member is a documented relationship claim from the canonical unified control to a source control or guidance proposition. relationship: equal|superset_of (full) / intersects_with|subset_of (partial) / informs (guidance). confidence 'medium' = single-mapper, documented, not yet externally corroborated. source_version is the member framework's edition from the standard version register.","reviewDate":"2026-09-07"},"relationship":"intersects_with","source_version":"Regulation (EU) 2024/1689"},"sourceDetailPath":"/data/v1/records/uc-uc-ai-08-fada68b7.json","sourceId":"uc:UC-AI-08","targetDetailPath":"/data/v1/records/ctrl-eu-ai-act-aia-art72-2866ca15.json","targetId":"ctrl:eu-ai-act:AIA-Art72","type":"maps_to"},{"expectedCatalogRevision":"24028ffcfc2b295fa1b08ee6caa84b765f0731b321496bf4f548c49ad2177028","id":"rel:1bb99a7220444665b11dad31e587befeb9ef3f26c3fb61bf4ac73c2b49cf1faa","properties":{"control_id":"C002","coverage":"full","delta":null,"framework":"aiuc-1","provenance":{"defaultConfidence":"medium","defaultStatus":"active","direction":"canonical_to_source","mapper":"coworkcanvas-compliance-graph","note":"Each member is a documented relationship claim from the canonical unified control to a source control or guidance proposition. relationship: equal|superset_of (full) / intersects_with|subset_of (partial) / informs (guidance). confidence 'medium' = single-mapper, documented, not yet externally corroborated. source_version is the member framework's edition from the standard version register.","reviewDate":"2026-09-07"},"relationship":"superset_of","source_version":"July 15, 2026 release (quarterly update cadence)"},"sourceDetailPath":"/data/v1/records/uc-uc-ai-07-9c5c9573.json","sourceId":"uc:UC-AI-07","targetDetailPath":"/data/v1/records/ctrl-aiuc-1-c002-6c739dcb.json","targetId":"ctrl:aiuc-1:C002","type":"maps_to"},{"expectedCatalogRevision":"24028ffcfc2b295fa1b08ee6caa84b765f0731b321496bf4f548c49ad2177028","id":"rel:1df7d03ef432f33e2aa5d7ac1451629578a6aa10389545ab9db5a521f3bbf50a","properties":{"control_id":"C010","coverage":"full","delta":null,"framework":"aiuc-1","provenance":{"defaultConfidence":"medium","defaultStatus":"active","direction":"canonical_to_source","mapper":"coworkcanvas-compliance-graph","note":"Each member is a documented relationship claim from the canonical unified control to a source control or guidance proposition. relationship: equal|superset_of (full) / intersects_with|subset_of (partial) / informs (guidance). confidence 'medium' = single-mapper, documented, not yet externally corroborated. source_version is the member framework's edition from the standard version register.","reviewDate":"2026-09-07"},"relationship":"superset_of","source_version":"July 15, 2026 release (quarterly update cadence)"},"sourceDetailPath":"/data/v1/records/uc-uc-ai-21-8afd47db.json","sourceId":"uc:UC-AI-21","targetDetailPath":"/data/v1/records/ctrl-aiuc-1-c010-b0a758b4.json","targetId":"ctrl:aiuc-1:C010","type":"maps_to"},{"expectedCatalogRevision":"24028ffcfc2b295fa1b08ee6caa84b765f0731b321496bf4f548c49ad2177028","id":"rel:20e4b2a31e5517b32fa223ea9b1b8fd79f1f9756c4fd2ee3519a688b1e5e002f","properties":{"control_id":"DSS02","coverage":"full","delta":null,"framework":"cobit-2019","provenance":{"defaultConfidence":"medium","defaultStatus":"active","direction":"canonical_to_source","mapper":"coworkcanvas-compliance-graph","note":"Each member is a documented relationship claim from the canonical unified control to a source control or guidance proposition. relationship: equal|superset_of (full) / intersects_with|subset_of (partial) / informs (guidance). confidence 'medium' = single-mapper, documented, not yet externally corroborated. source_version is the member framework's edition from the standard version register.","reviewDate":"2026-09-07"},"relationship":"superset_of","source_version":"2019"},"sourceDetailPath":"/data/v1/records/uc-uc-bcdr-06-c505e5bd.json","sourceId":"uc:UC-BCDR-06","targetDetailPath":"/data/v1/records/ctrl-cobit-2019-dss02-af5bca5d.json","targetId":"ctrl:cobit-2019:DSS02","type":"maps_to"},{"expectedCatalogRevision":"24028ffcfc2b295fa1b08ee6caa84b765f0731b321496bf4f548c49ad2177028","id":"rel:241e3ed1ff8130607909052d7a1a4961af0c9fa568fdacf408d7b8d9d359cb20","properties":{"control_id":"A.6.8","coverage":"full","delta":null,"framework":"iso-27001","provenance":{"defaultConfidence":"medium","defaultStatus":"active","direction":"canonical_to_source","mapper":"coworkcanvas-compliance-graph","note":"Each member is a documented relationship claim from the canonical unified control to a source control or guidance proposition. relationship: equal|superset_of (full) / intersects_with|subset_of (partial) / informs (guidance). confidence 'medium' = single-mapper, documented, not yet externally corroborated. source_version is the member framework's edition from the standard version register.","reviewDate":"2026-09-07"},"relationship":"superset_of","source_version":"2022"},"sourceDetailPath":"/data/v1/records/uc-uc-ir-03-477c1ef0.json","sourceId":"uc:UC-IR-03","targetDetailPath":"/data/v1/records/ctrl-iso-27001-a-6-8-87f56c6a.json","targetId":"ctrl:iso-27001:A.6.8","type":"maps_to"},{"expectedCatalogRevision":"24028ffcfc2b295fa1b08ee6caa84b765f0731b321496bf4f548c49ad2177028","id":"rel:2fa9ee745188901dc9cf334d826e8e52a294a06c63ae786f99df85acdb98780d","properties":{},"sourceDetailPath":"/data/v1/records/ctrl-cobit-2019-dss02-af5bca5d.json","sourceId":"ctrl:cobit-2019:DSS02","targetDetailPath":"/data/v1/records/std-cobit-2019-2181ce0c.json","targetId":"std:cobit-2019","type":"belongs_to"},{"expectedCatalogRevision":"24028ffcfc2b295fa1b08ee6caa84b765f0731b321496bf4f548c49ad2177028","id":"rel:3169f2abc7f4fe1d152757d80f0cb5ad870bd962db2898bc84fe7d135ea5f6f1","properties":{"control_id":"GDPR-Art33","coverage":"full","delta":null,"framework":"gdpr","provenance":{"defaultConfidence":"medium","defaultStatus":"active","direction":"canonical_to_source","mapper":"coworkcanvas-compliance-graph","note":"Each member is a documented relationship claim from the canonical unified control to a source control or guidance proposition. relationship: equal|superset_of (full) / intersects_with|subset_of (partial) / informs (guidance). confidence 'medium' = single-mapper, documented, not yet externally corroborated. source_version is the member framework's edition from the standard version register.","reviewDate":"2026-09-07"},"relationship":"superset_of","source_version":"Regulation (EU) 2016/679"},"sourceDetailPath":"/data/v1/records/uc-uc-log-06-735bbc3e.json","sourceId":"uc:UC-LOG-06","targetDetailPath":"/data/v1/records/ctrl-gdpr-gdpr-art33-a2a440c2.json","targetId":"ctrl:gdpr:GDPR-Art33","type":"maps_to"},{"expectedCatalogRevision":"24028ffcfc2b295fa1b08ee6caa84b765f0731b321496bf4f548c49ad2177028","id":"rel:32bf6421f2b8d665a50dabd9afe913d3db465ae6fd73f6978e767f8a3e387d37","properties":{},"sourceDetailPath":"/data/v1/records/ctrl-hipaa-hipaa-164-312-a-5c8bb707.json","sourceId":"ctrl:hipaa:HIPAA-164.312(a)","targetDetailPath":"/data/v1/records/std-hipaa-a825d271.json","targetId":"std:hipaa","type":"belongs_to"},{"expectedCatalogRevision":"24028ffcfc2b295fa1b08ee6caa84b765f0731b321496bf4f548c49ad2177028","id":"rel:3725ab082d6da8f966bc8172699871ad9290c976ed4a2cb8b98b5400c81d7929","properties":{"control_id":"C012","coverage":"full","delta":null,"framework":"aiuc-1","provenance":{"defaultConfidence":"medium","defaultStatus":"active","direction":"canonical_to_source","mapper":"coworkcanvas-compliance-graph","note":"Each member is a documented relationship claim from the canonical unified control to a source control or guidance proposition. relationship: equal|superset_of (full) / intersects_with|subset_of (partial) / informs (guidance). confidence 'medium' = single-mapper, documented, not yet externally corroborated. source_version is the member framework's edition from the standard version register.","reviewDate":"2026-09-07"},"relationship":"superset_of","source_version":"July 15, 2026 release (quarterly update cadence)"},"sourceDetailPath":"/data/v1/records/uc-uc-ai-21-8afd47db.json","sourceId":"uc:UC-AI-21","targetDetailPath":"/data/v1/records/ctrl-aiuc-1-c012-783c55df.json","targetId":"ctrl:aiuc-1:C012","type":"maps_to"},{"expectedCatalogRevision":"24028ffcfc2b295fa1b08ee6caa84b765f0731b321496bf4f548c49ad2177028","id":"rel:39ba831adcb789e31ed1c2a108d886bd4232ca89968b0be5c4a70945c663fa9b","properties":{},"sourceDetailPath":"/data/v1/records/ctrl-iso-27001-a-8-12-8310e795.json","sourceId":"ctrl:iso-27001:A.8.12","targetDetailPath":"/data/v1/records/std-iso-27001-656201bd.json","targetId":"std:iso-27001","type":"belongs_to"},{"expectedCatalogRevision":"24028ffcfc2b295fa1b08ee6caa84b765f0731b321496bf4f548c49ad2177028","id":"rel:3c511ac1363b3cf7707cbe89a44ceff9ac1a631ccce30cd2f437a7b52ab0cf44","properties":{},"sourceDetailPath":"/data/v1/records/ctrl-eu-ai-act-aia-art72-2866ca15.json","sourceId":"ctrl:eu-ai-act:AIA-Art72","targetDetailPath":"/data/v1/records/std-eu-ai-act-54986689.json","targetId":"std:eu-ai-act","type":"belongs_to"},{"expectedCatalogRevision":"24028ffcfc2b295fa1b08ee6caa84b765f0731b321496bf4f548c49ad2177028","id":"rel:42509eb5656a89b1a92a9c36f3a2a4cdefa1a038aa8cc37f1f6b3d0b23eeb1fe","properties":{},"sourceDetailPath":"/data/v1/records/ctrl-aiuc-1-c012-783c55df.json","sourceId":"ctrl:aiuc-1:C012","targetDetailPath":"/data/v1/records/std-aiuc-1-d2a8b650.json","targetId":"std:aiuc-1","type":"belongs_to"},{"expectedCatalogRevision":"24028ffcfc2b295fa1b08ee6caa84b765f0731b321496bf4f548c49ad2177028","id":"rel:45a1e5145b0928b28d18bf5921388ea0c0962d3cd43c1e225eae980c86022c05","properties":{},"sourceDetailPath":"/data/v1/records/ctrl-aiuc-1-a003-bea61fd9.json","sourceId":"ctrl:aiuc-1:A003","targetDetailPath":"/data/v1/records/std-aiuc-1-d2a8b650.json","targetId":"std:aiuc-1","type":"belongs_to"},{"expectedCatalogRevision":"24028ffcfc2b295fa1b08ee6caa84b765f0731b321496bf4f548c49ad2177028","id":"rel:46649b5491420104088389b6488bcc81c25e0f04301e1b993c9c416d4ab952b2","properties":{"control_id":"GDPR-Art44-49","coverage":"full","delta":null,"framework":"gdpr","provenance":{"defaultConfidence":"medium","defaultStatus":"active","direction":"canonical_to_source","mapper":"coworkcanvas-compliance-graph","note":"Each member is a documented relationship claim from the canonical unified control to a source control or guidance proposition. relationship: equal|superset_of (full) / intersects_with|subset_of (partial) / informs (guidance). confidence 'medium' = single-mapper, documented, not yet externally corroborated. source_version is the member framework's edition from the standard version register.","reviewDate":"2026-09-07"},"relationship":"superset_of","source_version":"Regulation (EU) 2016/679"},"sourceDetailPath":"/data/v1/records/uc-uc-data-11-baf71fe4.json","sourceId":"uc:UC-DATA-11","targetDetailPath":"/data/v1/records/ctrl-gdpr-gdpr-art44-49-8ad28202.json","targetId":"ctrl:gdpr:GDPR-Art44-49","type":"maps_to"},{"expectedCatalogRevision":"24028ffcfc2b295fa1b08ee6caa84b765f0731b321496bf4f548c49ad2177028","id":"rel:46aa39a4ea46095a7cf37e080fc784c4480c2b0ec372694e0227c4b9c014074a","properties":{"control_id":"P7","coverage":"full","delta":null,"framework":"coso-ic","provenance":{"defaultConfidence":"medium","defaultStatus":"active","direction":"canonical_to_source","mapper":"coworkcanvas-compliance-graph","note":"Each member is a documented relationship claim from the canonical unified control to a source control or guidance proposition. relationship: equal|superset_of (full) / intersects_with|subset_of (partial) / informs (guidance). confidence 'medium' = single-mapper, documented, not yet externally corroborated. source_version is the member framework's edition from the standard version register.","reviewDate":"2026-09-07"},"relationship":"superset_of","source_version":"2013"},"sourceDetailPath":"/data/v1/records/uc-uc-risk-06-e9599494.json","sourceId":"uc:UC-RISK-06","targetDetailPath":"/data/v1/records/ctrl-coso-ic-p7-a272f700.json","targetId":"ctrl:coso-ic:P7","type":"maps_to"},{"expectedCatalogRevision":"24028ffcfc2b295fa1b08ee6caa84b765f0731b321496bf4f548c49ad2177028","id":"rel:47472f6f81d5e60212915d60644980d00c90385e35c468c9335aebda80a424de","properties":{"control_id":"HIPAA-164.312(a)","coverage":"partial","delta":"automatic logoff and encryption/decryption of ePHI are satisfied by the session-lock (UC-ACCESS-12) and cryptographic (UC-CRYPTO-01) companion controls; emergency-access is an availability arm","framework":"hipaa","provenance":{"defaultConfidence":"medium","defaultStatus":"active","direction":"canonical_to_source","mapper":"coworkcanvas-compliance-graph","note":"Each member is a documented relationship claim from the canonical unified control to a source control or guidance proposition. relationship: equal|superset_of (full) / intersects_with|subset_of (partial) / informs (guidance). confidence 'medium' = single-mapper, documented, not yet externally corroborated. source_version is the member framework's edition from the standard version register.","reviewDate":"2026-09-07"},"relationship":"intersects_with","source_version":"45 CFR Parts 160/164 (Security, Privacy, Breach Notification)"},"sourceDetailPath":"/data/v1/records/uc-uc-access-05-9b7f3e34.json","sourceId":"uc:UC-ACCESS-05","targetDetailPath":"/data/v1/records/ctrl-hipaa-hipaa-164-312-a-5c8bb707.json","targetId":"ctrl:hipaa:HIPAA-164.312(a)","type":"maps_to"},{"expectedCatalogRevision":"24028ffcfc2b295fa1b08ee6caa84b765f0731b321496bf4f548c49ad2177028","id":"rel:47bc91a357dabf951399db5e73d90410a16ea531245923ce66ba8d2c4e5a6628","properties":{},"sourceDetailPath":"/data/v1/records/ctrl-eu-ai-act-aia-art12-3714b8af.json","sourceId":"ctrl:eu-ai-act:AIA-Art12","targetDetailPath":"/data/v1/records/std-eu-ai-act-54986689.json","targetId":"std:eu-ai-act","type":"belongs_to"},{"expectedCatalogRevision":"24028ffcfc2b295fa1b08ee6caa84b765f0731b321496bf4f548c49ad2177028","id":"rel:4f4bfb919d761c9352da8a35038bb54e93595b16f4e9d3163a8df47218198b62","properties":{},"sourceDetailPath":"/data/v1/records/ctrl-aiuc-1-c002-6c739dcb.json","sourceId":"ctrl:aiuc-1:C002","targetDetailPath":"/data/v1/records/std-aiuc-1-d2a8b650.json","targetId":"std:aiuc-1","type":"belongs_to"},{"expectedCatalogRevision":"24028ffcfc2b295fa1b08ee6caa84b765f0731b321496bf4f548c49ad2177028","id":"rel:4fb51c383bd08d7e4cb798d652a83c0b888d8fd0853a69efefe852a66ecbb53a","properties":{},"sourceDetailPath":"/data/v1/records/ctrl-hipaa-hipaa-164-312-b-7272303c.json","sourceId":"ctrl:hipaa:HIPAA-164.312(b)","targetDetailPath":"/data/v1/records/std-hipaa-a825d271.json","targetId":"std:hipaa","type":"belongs_to"},{"expectedCatalogRevision":"24028ffcfc2b295fa1b08ee6caa84b765f0731b321496bf4f548c49ad2177028","id":"rel:512ba21439e87bc291748f791f63165c51c302598232ea229c29542a3578a201","properties":{},"sourceDetailPath":"/data/v1/records/ctrl-cobit-2019-dss03-2540740f.json","sourceId":"ctrl:cobit-2019:DSS03","targetDetailPath":"/data/v1/records/std-cobit-2019-2181ce0c.json","targetId":"std:cobit-2019","type":"belongs_to"},{"expectedCatalogRevision":"24028ffcfc2b295fa1b08ee6caa84b765f0731b321496bf4f548c49ad2177028","id":"rel:54a5127b09fa0df51fdec8c2d52d749eb8f7b18dcdc92569ca6cf4f78c2bd536","properties":{},"sourceDetailPath":"/data/v1/records/ctrl-aiuc-1-b001-19a54ee3.json","sourceId":"ctrl:aiuc-1:B001","targetDetailPath":"/data/v1/records/std-aiuc-1-d2a8b650.json","targetId":"std:aiuc-1","type":"belongs_to"},{"expectedCatalogRevision":"24028ffcfc2b295fa1b08ee6caa84b765f0731b321496bf4f548c49ad2177028","id":"rel:60f2083b85eec41e5629c01567e3bc03ebc043b72a575f38df3d7bd42caa9029","properties":{"control_id":"A.5.26","coverage":"full","delta":null,"framework":"iso-27001","provenance":{"defaultConfidence":"medium","defaultStatus":"active","direction":"canonical_to_source","mapper":"coworkcanvas-compliance-graph","note":"Each member is a documented relationship claim from the canonical unified control to a source control or guidance proposition. relationship: equal|superset_of (full) / intersects_with|subset_of (partial) / informs (guidance). confidence 'medium' = single-mapper, documented, not yet externally corroborated. source_version is the member framework's edition from the standard version register.","reviewDate":"2026-09-07"},"relationship":"superset_of","source_version":"2022"},"sourceDetailPath":"/data/v1/records/uc-uc-ir-06-0b166c2a.json","sourceId":"uc:UC-IR-06","targetDetailPath":"/data/v1/records/ctrl-iso-27001-a-5-26-863e832e.json","targetId":"ctrl:iso-27001:A.5.26","type":"maps_to"},{"expectedCatalogRevision":"24028ffcfc2b295fa1b08ee6caa84b765f0731b321496bf4f548c49ad2177028","id":"rel:639af74f867207985c0d330720da0b18bcbac5a07f9e93504c9405e222505aca","properties":{"control_id":"A005","coverage":"partial","delta":"tenant isolation inside AI systems: retrieval indexes, memory, fine-tuning data, and caches segregated so one customer's data cannot surface in another customer's outputs","framework":"aiuc-1","provenance":{"defaultConfidence":"medium","defaultStatus":"active","direction":"canonical_to_source","mapper":"coworkcanvas-compliance-graph","note":"Each member is a documented relationship claim from the canonical unified control to a source control or guidance proposition. relationship: equal|superset_of (full) / intersects_with|subset_of (partial) / informs (guidance). confidence 'medium' = single-mapper, documented, not yet externally corroborated. source_version is the member framework's edition from the standard version register.","reviewDate":"2026-09-07"},"relationship":"intersects_with","source_version":"July 15, 2026 release (quarterly update cadence)"},"sourceDetailPath":"/data/v1/records/uc-uc-data-11-baf71fe4.json","sourceId":"uc:UC-DATA-11","targetDetailPath":"/data/v1/records/ctrl-aiuc-1-a005-12903764.json","targetId":"ctrl:aiuc-1:A005","type":"maps_to"},{"expectedCatalogRevision":"24028ffcfc2b295fa1b08ee6caa84b765f0731b321496bf4f548c49ad2177028","id":"rel:6c1846fb9812d3a66dd47cb08fabc59bc2947d21d3b9398e0ec8166b1e2f5445","properties":{},"sourceDetailPath":"/data/v1/records/ctrl-aiuc-1-a004-0955d43a.json","sourceId":"ctrl:aiuc-1:A004","targetDetailPath":"/data/v1/records/std-aiuc-1-d2a8b650.json","targetId":"std:aiuc-1","type":"belongs_to"},{"expectedCatalogRevision":"24028ffcfc2b295fa1b08ee6caa84b765f0731b321496bf4f548c49ad2177028","id":"rel:711a1e90cc08e74c4fa39e7c5ba0baed9abb795e999c10d2a47d3e0db122c51f","properties":{"control_id":"AIA-Art12","coverage":"full","delta":null,"framework":"eu-ai-act","provenance":{"defaultConfidence":"medium","defaultStatus":"active","direction":"canonical_to_source","mapper":"coworkcanvas-compliance-graph","note":"Each member is a documented relationship claim from the canonical unified control to a source control or guidance proposition. relationship: equal|superset_of (full) / intersects_with|subset_of (partial) / informs (guidance). confidence 'medium' = single-mapper, documented, not yet externally corroborated. source_version is the member framework's edition from the standard version register.","reviewDate":"2026-09-07"},"relationship":"superset_of","source_version":"Regulation (EU) 2024/1689"},"sourceDetailPath":"/data/v1/records/uc-uc-ai-08-fada68b7.json","sourceId":"uc:UC-AI-08","targetDetailPath":"/data/v1/records/ctrl-eu-ai-act-aia-art12-3714b8af.json","targetId":"ctrl:eu-ai-act:AIA-Art12","type":"maps_to"},{"expectedCatalogRevision":"24028ffcfc2b295fa1b08ee6caa84b765f0731b321496bf4f548c49ad2177028","id":"rel:7135470f5a63fc7121113c02de833d6fde647eb75c6bb98fd804caa7badca929","properties":{},"sourceDetailPath":"/data/v1/records/ctrl-iso-27001-a-5-7-0328fe6b.json","sourceId":"ctrl:iso-27001:A.5.7","targetDetailPath":"/data/v1/records/std-iso-27001-656201bd.json","targetId":"std:iso-27001","type":"belongs_to"},{"expectedCatalogRevision":"24028ffcfc2b295fa1b08ee6caa84b765f0731b321496bf4f548c49ad2177028","id":"rel:72b94ed91e964541cc87bf386c4b6994337ba2ac851d16d3f3454cfd9b8d8eb3","properties":{"control_id":"D002","coverage":"full","delta":null,"framework":"aiuc-1","provenance":{"defaultConfidence":"medium","defaultStatus":"active","direction":"canonical_to_source","mapper":"coworkcanvas-compliance-graph","note":"Each member is a documented relationship claim from the canonical unified control to a source control or guidance proposition. relationship: equal|superset_of (full) / intersects_with|subset_of (partial) / informs (guidance). confidence 'medium' = single-mapper, documented, not yet externally corroborated. source_version is the member framework's edition from the standard version register.","reviewDate":"2026-09-07"},"relationship":"superset_of","source_version":"July 15, 2026 release (quarterly update cadence)"},"sourceDetailPath":"/data/v1/records/uc-uc-ai-21-8afd47db.json","sourceId":"uc:UC-AI-21","targetDetailPath":"/data/v1/records/ctrl-aiuc-1-d002-34554b38.json","targetId":"ctrl:aiuc-1:D002","type":"maps_to"},{"expectedCatalogRevision":"24028ffcfc2b295fa1b08ee6caa84b765f0731b321496bf4f548c49ad2177028","id":"rel:7373d57591824458194e96497f8a2b6c6ae3fe9bd3cf3df2640217f46ee2c232","properties":{},"sourceDetailPath":"/data/v1/records/ctrl-iso-27001-a-5-8-bf8c2add.json","sourceId":"ctrl:iso-27001:A.5.8","targetDetailPath":"/data/v1/records/std-iso-27001-656201bd.json","targetId":"std:iso-27001","type":"belongs_to"},{"expectedCatalogRevision":"24028ffcfc2b295fa1b08ee6caa84b765f0731b321496bf4f548c49ad2177028","id":"rel:7378e9eab62be8ba3d1a1ed5bd35f653d390c7165684821983a39c6e739cf851","properties":{"control_id":"C011","coverage":"full","delta":null,"framework":"aiuc-1","provenance":{"defaultConfidence":"medium","defaultStatus":"active","direction":"canonical_to_source","mapper":"coworkcanvas-compliance-graph","note":"Each member is a documented relationship claim from the canonical unified control to a source control or guidance proposition. relationship: equal|superset_of (full) / intersects_with|subset_of (partial) / informs (guidance). confidence 'medium' = single-mapper, documented, not yet externally corroborated. source_version is the member framework's edition from the standard version register.","reviewDate":"2026-09-07"},"relationship":"superset_of","source_version":"July 15, 2026 release (quarterly update cadence)"},"sourceDetailPath":"/data/v1/records/uc-uc-ai-21-8afd47db.json","sourceId":"uc:UC-AI-21","targetDetailPath":"/data/v1/records/ctrl-aiuc-1-c011-7889db41.json","targetId":"ctrl:aiuc-1:C011","type":"maps_to"},{"expectedCatalogRevision":"24028ffcfc2b295fa1b08ee6caa84b765f0731b321496bf4f548c49ad2177028","id":"rel:7566c86da6687604708ae8825c0fd65a28909fb3e0c43ea698aedff05673ebe4","properties":{"control_id":"A.5.25","coverage":"full","delta":null,"framework":"iso-27001","provenance":{"defaultConfidence":"medium","defaultStatus":"active","direction":"canonical_to_source","mapper":"coworkcanvas-compliance-graph","note":"Each member is a documented relationship claim from the canonical unified control to a source control or guidance proposition. relationship: equal|superset_of (full) / intersects_with|subset_of (partial) / informs (guidance). confidence 'medium' = single-mapper, documented, not yet externally corroborated. source_version is the member framework's edition from the standard version register.","reviewDate":"2026-09-07"},"relationship":"superset_of","source_version":"2022"},"sourceDetailPath":"/data/v1/records/uc-uc-ir-04-6067c069.json","sourceId":"uc:UC-IR-04","targetDetailPath":"/data/v1/records/ctrl-iso-27001-a-5-25-7dc7a20c.json","targetId":"ctrl:iso-27001:A.5.25","type":"maps_to"},{"expectedCatalogRevision":"24028ffcfc2b295fa1b08ee6caa84b765f0731b321496bf4f548c49ad2177028","id":"rel:771fe71b653da797589e3eeb3d84a995ac2416455b1e8170bcd03ca056f8d16e","properties":{},"sourceDetailPath":"/data/v1/records/ctrl-aiuc-1-d004-21d4eeb4.json","sourceId":"ctrl:aiuc-1:D004","targetDetailPath":"/data/v1/records/std-aiuc-1-d2a8b650.json","targetId":"std:aiuc-1","type":"belongs_to"},{"expectedCatalogRevision":"24028ffcfc2b295fa1b08ee6caa84b765f0731b321496bf4f548c49ad2177028","id":"rel:7fe14f045eb5b989ed2b172e29123795c887a077790aec281603ac0cb5b7b76a","properties":{},"sourceDetailPath":"/data/v1/records/ctrl-aiuc-1-c010-b0a758b4.json","sourceId":"ctrl:aiuc-1:C010","targetDetailPath":"/data/v1/records/std-aiuc-1-d2a8b650.json","targetId":"std:aiuc-1","type":"belongs_to"},{"expectedCatalogRevision":"24028ffcfc2b295fa1b08ee6caa84b765f0731b321496bf4f548c49ad2177028","id":"rel:831bb87ed52b4b8496a2df0763736f691983d642227954b2a9794574ad122e52","properties":{},"sourceDetailPath":"/data/v1/records/ctrl-iso-27001-a-5-15-b8587804.json","sourceId":"ctrl:iso-27001:A.5.15","targetDetailPath":"/data/v1/records/std-iso-27001-656201bd.json","targetId":"std:iso-27001","type":"belongs_to"},{"expectedCatalogRevision":"24028ffcfc2b295fa1b08ee6caa84b765f0731b321496bf4f548c49ad2177028","id":"rel:89206e47cbd4bf028123c0d6072f24d0408b695ea872f1bf5bc128ad8cd1c09c","properties":{},"sourceDetailPath":"/data/v1/records/ctrl-iso-27001-a-5-17-b45de021.json","sourceId":"ctrl:iso-27001:A.5.17","targetDetailPath":"/data/v1/records/std-iso-27001-656201bd.json","targetId":"std:iso-27001","type":"belongs_to"},{"expectedCatalogRevision":"24028ffcfc2b295fa1b08ee6caa84b765f0731b321496bf4f548c49ad2177028","id":"rel:8ad43eeb9707d403a42533306a14908e951226d382dfc555c22e8baefaf7633b","properties":{"control_id":"A.5.17","coverage":"partial","delta":"advising personnel on proper handling and protection of authentication information","framework":"iso-27001","provenance":{"defaultConfidence":"medium","defaultStatus":"active","direction":"canonical_to_source","mapper":"coworkcanvas-compliance-graph","note":"Each member is a documented relationship claim from the canonical unified control to a source control or guidance proposition. relationship: equal|superset_of (full) / intersects_with|subset_of (partial) / informs (guidance). confidence 'medium' = single-mapper, documented, not yet externally corroborated. source_version is the member framework's edition from the standard version register.","reviewDate":"2026-09-07"},"relationship":"intersects_with","source_version":"2022"},"sourceDetailPath":"/data/v1/records/uc-uc-access-08-7c9dc13e.json","sourceId":"uc:UC-ACCESS-08","targetDetailPath":"/data/v1/records/ctrl-iso-27001-a-5-17-b45de021.json","targetId":"ctrl:iso-27001:A.5.17","type":"maps_to"},{"expectedCatalogRevision":"24028ffcfc2b295fa1b08ee6caa84b765f0731b321496bf4f548c49ad2177028","id":"rel:8b9de4df2b9b11f4758d16caba3a14418486d52562080438d56995febeaf4511","properties":{"control_id":"DORA-Art17-23","coverage":"partial","delta":"major-incident report clocks: initial 24h, intermediate 72h, final 1 month","framework":"dora","provenance":{"defaultConfidence":"medium","defaultStatus":"active","direction":"canonical_to_source","mapper":"coworkcanvas-compliance-graph","note":"Each member is a documented relationship claim from the canonical unified control to a source control or guidance proposition. relationship: equal|superset_of (full) / intersects_with|subset_of (partial) / informs (guidance). confidence 'medium' = single-mapper, documented, not yet externally corroborated. source_version is the member framework's edition from the standard version register.","reviewDate":"2026-09-07"},"relationship":"intersects_with","source_version":"Regulation (EU) 2022/2554"},"sourceDetailPath":"/data/v1/records/uc-uc-bcdr-06-c505e5bd.json","sourceId":"uc:UC-BCDR-06","targetDetailPath":"/data/v1/records/ctrl-dora-dora-art17-23-9aa7977f.json","targetId":"ctrl:dora:DORA-Art17-23","type":"maps_to"},{"expectedCatalogRevision":"24028ffcfc2b295fa1b08ee6caa84b765f0731b321496bf4f548c49ad2177028","id":"rel:8ba1fcd2dce54d62b11512c22b5f9ff1de51a9fb9f041e24912fc85eded145cd","properties":{"control_id":"A.8.12","coverage":"full","delta":null,"framework":"iso-27001","provenance":{"defaultConfidence":"medium","defaultStatus":"active","direction":"canonical_to_source","mapper":"coworkcanvas-compliance-graph","note":"Each member is a documented relationship claim from the canonical unified control to a source control or guidance proposition. relationship: equal|superset_of (full) / intersects_with|subset_of (partial) / informs (guidance). confidence 'medium' = single-mapper, documented, not yet externally corroborated. source_version is the member framework's edition from the standard version register.","reviewDate":"2026-09-07"},"relationship":"superset_of","source_version":"2022"},"sourceDetailPath":"/data/v1/records/uc-uc-data-11-baf71fe4.json","sourceId":"uc:UC-DATA-11","targetDetailPath":"/data/v1/records/ctrl-iso-27001-a-8-12-8310e795.json","targetId":"ctrl:iso-27001:A.8.12","type":"maps_to"},{"expectedCatalogRevision":"24028ffcfc2b295fa1b08ee6caa84b765f0731b321496bf4f548c49ad2177028","id":"rel:8cf6a557412855d991f5fbe276861808067d53cad6d0a3017419b255fa47e568","properties":{"control_id":"A.5.15","coverage":"partial","delta":"also requires rules controlling physical access to information and assets","framework":"iso-27001","provenance":{"defaultConfidence":"medium","defaultStatus":"active","direction":"canonical_to_source","mapper":"coworkcanvas-compliance-graph","note":"Each member is a documented relationship claim from the canonical unified control to a source control or guidance proposition. relationship: equal|superset_of (full) / intersects_with|subset_of (partial) / informs (guidance). confidence 'medium' = single-mapper, documented, not yet externally corroborated. source_version is the member framework's edition from the standard version register.","reviewDate":"2026-09-07"},"relationship":"intersects_with","source_version":"2022"},"sourceDetailPath":"/data/v1/records/uc-uc-access-03-43eeb212.json","sourceId":"uc:UC-ACCESS-03","targetDetailPath":"/data/v1/records/ctrl-iso-27001-a-5-15-b8587804.json","targetId":"ctrl:iso-27001:A.5.15","type":"maps_to"},{"expectedCatalogRevision":"24028ffcfc2b295fa1b08ee6caa84b765f0731b321496bf4f548c49ad2177028","id":"rel:8f00b3af18bd976ece45fa4f771f6deb906c8ac51a41df201a46be8c80fdd8ca","properties":{},"sourceDetailPath":"/data/v1/records/ctrl-coso-ic-p7-a272f700.json","sourceId":"ctrl:coso-ic:P7","targetDetailPath":"/data/v1/records/std-coso-ic-3f80f565.json","targetId":"std:coso-ic","type":"belongs_to"},{"expectedCatalogRevision":"24028ffcfc2b295fa1b08ee6caa84b765f0731b321496bf4f548c49ad2177028","id":"rel:8ff93d7e4e334d9453ecbad99b8cd3527f3de070de51c8adc3daad60b069d2b6","properties":{"control_id":"A.6.3","coverage":"full","delta":null,"framework":"iso-27001","provenance":{"defaultConfidence":"medium","defaultStatus":"active","direction":"canonical_to_source","mapper":"coworkcanvas-compliance-graph","note":"Each member is a documented relationship claim from the canonical unified control to a source control or guidance proposition. relationship: equal|superset_of (full) / intersects_with|subset_of (partial) / informs (guidance). confidence 'medium' = single-mapper, documented, not yet externally corroborated. source_version is the member framework's edition from the standard version register.","reviewDate":"2026-09-07"},"relationship":"superset_of","source_version":"2022"},"sourceDetailPath":"/data/v1/records/uc-uc-train-01-5f513831.json","sourceId":"uc:UC-TRAIN-01","targetDetailPath":"/data/v1/records/ctrl-iso-27001-a-6-3-b9bb8fbd.json","targetId":"ctrl:iso-27001:A.6.3","type":"maps_to"},{"expectedCatalogRevision":"24028ffcfc2b295fa1b08ee6caa84b765f0731b321496bf4f548c49ad2177028","id":"rel:98e288190a80f4b9684f719b462f304e3ad2604643cf30159ec607b9f18aa498","properties":{"control_id":"A004","coverage":"partial","delta":"leakage of intellectual property and confidential information through AI system outputs, requiring model-output safeguards beyond network and channel flow controls","framework":"aiuc-1","provenance":{"defaultConfidence":"medium","defaultStatus":"active","direction":"canonical_to_source","mapper":"coworkcanvas-compliance-graph","note":"Each member is a documented relationship claim from the canonical unified control to a source control or guidance proposition. relationship: equal|superset_of (full) / intersects_with|subset_of (partial) / informs (guidance). confidence 'medium' = single-mapper, documented, not yet externally corroborated. source_version is the member framework's edition from the standard version register.","reviewDate":"2026-09-07"},"relationship":"intersects_with","source_version":"July 15, 2026 release (quarterly update cadence)"},"sourceDetailPath":"/data/v1/records/uc-uc-data-11-baf71fe4.json","sourceId":"uc:UC-DATA-11","targetDetailPath":"/data/v1/records/ctrl-aiuc-1-a004-0955d43a.json","targetId":"ctrl:aiuc-1:A004","type":"maps_to"},{"expectedCatalogRevision":"24028ffcfc2b295fa1b08ee6caa84b765f0731b321496bf4f548c49ad2177028","id":"rel:9f229e45003f2c7c825f7932294437466bf8be9e39c6c4ab0bcb25d8dc6b2192","properties":{},"sourceDetailPath":"/data/v1/records/ctrl-dora-dora-art17-23-9aa7977f.json","sourceId":"ctrl:dora:DORA-Art17-23","targetDetailPath":"/data/v1/records/std-dora-95cf939d.json","targetId":"std:dora","type":"belongs_to"},{"expectedCatalogRevision":"24028ffcfc2b295fa1b08ee6caa84b765f0731b321496bf4f548c49ad2177028","id":"rel:a09570a6185e464a33d447ed7e365813f9ec4e119b3b996bb917758789fe6d6c","properties":{"control_id":"A.5.8","coverage":"full","delta":null,"framework":"iso-27001","provenance":{"defaultConfidence":"medium","defaultStatus":"active","direction":"canonical_to_source","mapper":"coworkcanvas-compliance-graph","note":"Each member is a documented relationship claim from the canonical unified control to a source control or guidance proposition. relationship: equal|superset_of (full) / intersects_with|subset_of (partial) / informs (guidance). confidence 'medium' = single-mapper, documented, not yet externally corroborated. source_version is the member framework's edition from the standard version register.","reviewDate":"2026-09-07"},"relationship":"superset_of","source_version":"2022"},"sourceDetailPath":"/data/v1/records/uc-uc-risk-02-0f8519bb.json","sourceId":"uc:UC-RISK-02","targetDetailPath":"/data/v1/records/ctrl-iso-27001-a-5-8-bf8c2add.json","targetId":"ctrl:iso-27001:A.5.8","type":"maps_to"},{"expectedCatalogRevision":"24028ffcfc2b295fa1b08ee6caa84b765f0731b321496bf4f548c49ad2177028","id":"rel:a0c14c0293d1afba8a4199022904af26b4f4095f4319e0f53f6796d1a5facba9","properties":{},"sourceDetailPath":"/data/v1/records/ctrl-aiuc-1-b007-151dfcd3.json","sourceId":"ctrl:aiuc-1:B007","targetDetailPath":"/data/v1/records/std-aiuc-1-d2a8b650.json","targetId":"std:aiuc-1","type":"belongs_to"},{"expectedCatalogRevision":"24028ffcfc2b295fa1b08ee6caa84b765f0731b321496bf4f548c49ad2177028","id":"rel:a663d636ace716e1441d87cd25897840f98c0c489bea339a8e1d75115860ac39","properties":{},"sourceDetailPath":"/data/v1/records/ctrl-iso-27001-a-6-3-b9bb8fbd.json","sourceId":"ctrl:iso-27001:A.6.3","targetDetailPath":"/data/v1/records/std-iso-27001-656201bd.json","targetId":"std:iso-27001","type":"belongs_to"},{"expectedCatalogRevision":"24028ffcfc2b295fa1b08ee6caa84b765f0731b321496bf4f548c49ad2177028","id":"rel:a8cee9dde29a243b600f5ad0128cf7aa74a7d87d1be4519238792fcbf2469e27","properties":{"control_id":"DSS05","coverage":"partial","delta":"also identity/logical access, physical access, and sensitive-document/output-device controls","framework":"cobit-2019","provenance":{"defaultConfidence":"medium","defaultStatus":"active","direction":"canonical_to_source","mapper":"coworkcanvas-compliance-graph","note":"Each member is a documented relationship claim from the canonical unified control to a source control or guidance proposition. relationship: equal|superset_of (full) / intersects_with|subset_of (partial) / informs (guidance). confidence 'medium' = single-mapper, documented, not yet externally corroborated. source_version is the member framework's edition from the standard version register.","reviewDate":"2026-09-07"},"relationship":"intersects_with","source_version":"2019"},"sourceDetailPath":"/data/v1/records/uc-uc-bcdr-13-aa7feb8e.json","sourceId":"uc:UC-BCDR-13","targetDetailPath":"/data/v1/records/ctrl-cobit-2019-dss05-80cfe6d8.json","targetId":"ctrl:cobit-2019:DSS05","type":"maps_to"},{"expectedCatalogRevision":"24028ffcfc2b295fa1b08ee6caa84b765f0731b321496bf4f548c49ad2177028","id":"rel:aa2bb7ba717c5ce844028d7bbfbbb392a9b458f4a4f55e65abf03c53175313f7","properties":{},"sourceDetailPath":"/data/v1/records/ctrl-eu-ai-act-aia-art19-55451bfa.json","sourceId":"ctrl:eu-ai-act:AIA-Art19","targetDetailPath":"/data/v1/records/std-eu-ai-act-54986689.json","targetId":"std:eu-ai-act","type":"belongs_to"},{"expectedCatalogRevision":"24028ffcfc2b295fa1b08ee6caa84b765f0731b321496bf4f548c49ad2177028","id":"rel:b16d94a2172ca8f0cd1a12637021852d2064f9132dd64f4ad2453c881c7973b1","properties":{},"sourceDetailPath":"/data/v1/records/ctrl-iso-27001-a-5-26-863e832e.json","sourceId":"ctrl:iso-27001:A.5.26","targetDetailPath":"/data/v1/records/std-iso-27001-656201bd.json","targetId":"std:iso-27001","type":"belongs_to"},{"expectedCatalogRevision":"24028ffcfc2b295fa1b08ee6caa84b765f0731b321496bf4f548c49ad2177028","id":"rel:b49441ad04e7bb2572f9ca20f5e87f347a22f75d23a7969d40c00117e61d6d09","properties":{"control_id":"D004","coverage":"full","delta":null,"framework":"aiuc-1","provenance":{"defaultConfidence":"medium","defaultStatus":"active","direction":"canonical_to_source","mapper":"coworkcanvas-compliance-graph","note":"Each member is a documented relationship claim from the canonical unified control to a source control or guidance proposition. relationship: equal|superset_of (full) / intersects_with|subset_of (partial) / informs (guidance). confidence 'medium' = single-mapper, documented, not yet externally corroborated. source_version is the member framework's edition from the standard version register.","reviewDate":"2026-09-07"},"relationship":"superset_of","source_version":"July 15, 2026 release (quarterly update cadence)"},"sourceDetailPath":"/data/v1/records/uc-uc-ai-21-8afd47db.json","sourceId":"uc:UC-AI-21","targetDetailPath":"/data/v1/records/ctrl-aiuc-1-d004-21d4eeb4.json","targetId":"ctrl:aiuc-1:D004","type":"maps_to"},{"expectedCatalogRevision":"24028ffcfc2b295fa1b08ee6caa84b765f0731b321496bf4f548c49ad2177028","id":"rel:bb8674403229a0ce2c5ec8c9080da85bd8087859e0a852a85af0bac50d670a98","properties":{"control_id":"DORA-Art24-27","coverage":"partial","delta":"vulnerability assessments and the Art 25 security-testing catalogue satisfied by companion controls; TLPT regime specifics - three-yearly cadence, authority-approved scope, independent/certified testers (Arts 26-27), and tester independence (Art 24(4)) - require dedicated controls","framework":"dora","provenance":{"defaultConfidence":"medium","defaultStatus":"active","direction":"canonical_to_source","mapper":"coworkcanvas-compliance-graph","note":"Each member is a documented relationship claim from the canonical unified control to a source control or guidance proposition. relationship: equal|superset_of (full) / intersects_with|subset_of (partial) / informs (guidance). confidence 'medium' = single-mapper, documented, not yet externally corroborated. source_version is the member framework's edition from the standard version register.","reviewDate":"2026-09-07"},"relationship":"intersects_with","source_version":"Regulation (EU) 2022/2554"},"sourceDetailPath":"/data/v1/records/uc-uc-bcdr-10-602160e4.json","sourceId":"uc:UC-BCDR-10","targetDetailPath":"/data/v1/records/ctrl-dora-dora-art24-27-dc4b8836.json","targetId":"ctrl:dora:DORA-Art24-27","type":"maps_to"},{"expectedCatalogRevision":"24028ffcfc2b295fa1b08ee6caa84b765f0731b321496bf4f548c49ad2177028","id":"rel:bf5f7706b3e73a46db661616cf5be6eac2a75128746032843f715220ed4b0d51","properties":{"control_id":"HIPAA-164.312(b)","coverage":"full","delta":null,"framework":"hipaa","provenance":{"defaultConfidence":"medium","defaultStatus":"active","direction":"canonical_to_source","mapper":"coworkcanvas-compliance-graph","note":"Each member is a documented relationship claim from the canonical unified control to a source control or guidance proposition. relationship: equal|superset_of (full) / intersects_with|subset_of (partial) / informs (guidance). confidence 'medium' = single-mapper, documented, not yet externally corroborated. source_version is the member framework's edition from the standard version register.","reviewDate":"2026-09-07"},"relationship":"superset_of","source_version":"45 CFR Parts 160/164 (Security, Privacy, Breach Notification)"},"sourceDetailPath":"/data/v1/records/uc-uc-log-01-022e9745.json","sourceId":"uc:UC-LOG-01","targetDetailPath":"/data/v1/records/ctrl-hipaa-hipaa-164-312-b-7272303c.json","targetId":"ctrl:hipaa:HIPAA-164.312(b)","type":"maps_to"},{"expectedCatalogRevision":"24028ffcfc2b295fa1b08ee6caa84b765f0731b321496bf4f548c49ad2177028","id":"rel:bfb7de3a8015b3a23a00a22565f5ec4ed0ddcdd12489f4bb54574cd8ddbc7472","properties":{"control_id":"DSS03","coverage":"full","delta":null,"framework":"cobit-2019","provenance":{"defaultConfidence":"medium","defaultStatus":"active","direction":"canonical_to_source","mapper":"coworkcanvas-compliance-graph","note":"Each member is a documented relationship claim from the canonical unified control to a source control or guidance proposition. relationship: equal|superset_of (full) / intersects_with|subset_of (partial) / informs (guidance). confidence 'medium' = single-mapper, documented, not yet externally corroborated. source_version is the member framework's edition from the standard version register.","reviewDate":"2026-09-07"},"relationship":"superset_of","source_version":"2019"},"sourceDetailPath":"/data/v1/records/uc-uc-bcdr-06-c505e5bd.json","sourceId":"uc:UC-BCDR-06","targetDetailPath":"/data/v1/records/ctrl-cobit-2019-dss03-2540740f.json","targetId":"ctrl:cobit-2019:DSS03","type":"maps_to"},{"expectedCatalogRevision":"24028ffcfc2b295fa1b08ee6caa84b765f0731b321496bf4f548c49ad2177028","id":"rel:c004356ed83fe24ae6123dec85b7ce5b0a8df574641f5cf6abb86bf0567cdd12","properties":{"control_id":"E015","coverage":"full","delta":null,"framework":"aiuc-1","provenance":{"defaultConfidence":"medium","defaultStatus":"active","direction":"canonical_to_source","mapper":"coworkcanvas-compliance-graph","note":"Each member is a documented relationship claim from the canonical unified control to a source control or guidance proposition. relationship: equal|superset_of (full) / intersects_with|subset_of (partial) / informs (guidance). confidence 'medium' = single-mapper, documented, not yet externally corroborated. source_version is the member framework's edition from the standard version register.","reviewDate":"2026-09-07"},"relationship":"superset_of","source_version":"July 15, 2026 release (quarterly update cadence)"},"sourceDetailPath":"/data/v1/records/uc-uc-ai-08-fada68b7.json","sourceId":"uc:UC-AI-08","targetDetailPath":"/data/v1/records/ctrl-aiuc-1-e015-94a0c8ea.json","targetId":"ctrl:aiuc-1:E015","type":"maps_to"},{"expectedCatalogRevision":"24028ffcfc2b295fa1b08ee6caa84b765f0731b321496bf4f548c49ad2177028","id":"rel:c530cc1fc512c2a65966b3618d10b34c3e8e6c8d48b0b90f66500505f8fac21e","properties":{},"sourceDetailPath":"/data/v1/records/ctrl-iso-27001-a-5-28-e9d04483.json","sourceId":"ctrl:iso-27001:A.5.28","targetDetailPath":"/data/v1/records/std-iso-27001-656201bd.json","targetId":"std:iso-27001","type":"belongs_to"},{"expectedCatalogRevision":"24028ffcfc2b295fa1b08ee6caa84b765f0731b321496bf4f548c49ad2177028","id":"rel:cef3659c19b299952916eb1c72046246e40f0deee302865659cc3f0729e3018d","properties":{"control_id":"A.5.18","coverage":"partial","delta":"provisioning, adjustment, and revocation satisfied by the account lifecycle control","framework":"iso-27001","provenance":{"defaultConfidence":"medium","defaultStatus":"active","direction":"canonical_to_source","mapper":"coworkcanvas-compliance-graph","note":"Each member is a documented relationship claim from the canonical unified control to a source control or guidance proposition. relationship: equal|superset_of (full) / intersects_with|subset_of (partial) / informs (guidance). confidence 'medium' = single-mapper, documented, not yet externally corroborated. source_version is the member framework's edition from the standard version register.","reviewDate":"2026-09-07"},"relationship":"intersects_with","source_version":"2022"},"sourceDetailPath":"/data/v1/records/uc-uc-access-02-0132e278.json","sourceId":"uc:UC-ACCESS-02","targetDetailPath":"/data/v1/records/ctrl-iso-27001-a-5-18-472ef6f1.json","targetId":"ctrl:iso-27001:A.5.18","type":"maps_to"},{"expectedCatalogRevision":"24028ffcfc2b295fa1b08ee6caa84b765f0731b321496bf4f548c49ad2177028","id":"rel:cff1193b4288fe551157bf960ab5acccac13ae290735955d5c5e704f34cab9db","properties":{},"sourceDetailPath":"/data/v1/records/ctrl-dora-dora-art24-27-dc4b8836.json","sourceId":"ctrl:dora:DORA-Art24-27","targetDetailPath":"/data/v1/records/std-dora-95cf939d.json","targetId":"std:dora","type":"belongs_to"},{"expectedCatalogRevision":"24028ffcfc2b295fa1b08ee6caa84b765f0731b321496bf4f548c49ad2177028","id":"rel:d16f10ed1a0c7529a9cb3f843113b2246df77c34d6c0e5cdc78c5c436dd87122","properties":{"control_id":"A.5.7","coverage":"full","delta":null,"framework":"iso-27001","provenance":{"defaultConfidence":"medium","defaultStatus":"active","direction":"canonical_to_source","mapper":"coworkcanvas-compliance-graph","note":"Each member is a documented relationship claim from the canonical unified control to a source control or guidance proposition. relationship: equal|superset_of (full) / intersects_with|subset_of (partial) / informs (guidance). confidence 'medium' = single-mapper, documented, not yet externally corroborated. source_version is the member framework's edition from the standard version register.","reviewDate":"2026-09-07"},"relationship":"superset_of","source_version":"2022"},"sourceDetailPath":"/data/v1/records/uc-uc-risk-17-4ea73b39.json","sourceId":"uc:UC-RISK-17","targetDetailPath":"/data/v1/records/ctrl-iso-27001-a-5-7-0328fe6b.json","targetId":"ctrl:iso-27001:A.5.7","type":"maps_to"},{"expectedCatalogRevision":"24028ffcfc2b295fa1b08ee6caa84b765f0731b321496bf4f548c49ad2177028","id":"rel:d5dca93df6c9f5e530850413d15cfae38b5b043a13806a8d64c2bcb79f49bcf8","properties":{},"sourceDetailPath":"/data/v1/records/ctrl-iso-27001-a-5-25-7dc7a20c.json","sourceId":"ctrl:iso-27001:A.5.25","targetDetailPath":"/data/v1/records/std-iso-27001-656201bd.json","targetId":"std:iso-27001","type":"belongs_to"},{"expectedCatalogRevision":"24028ffcfc2b295fa1b08ee6caa84b765f0731b321496bf4f548c49ad2177028","id":"rel:dbe656ec41a00e61bfd294b0ea18e81c7a16e4ddca41c534718e390300f999c0","properties":{},"sourceDetailPath":"/data/v1/records/ctrl-gdpr-gdpr-art33-a2a440c2.json","sourceId":"ctrl:gdpr:GDPR-Art33","targetDetailPath":"/data/v1/records/std-gdpr-17d65d0b.json","targetId":"std:gdpr","type":"belongs_to"},{"expectedCatalogRevision":"24028ffcfc2b295fa1b08ee6caa84b765f0731b321496bf4f548c49ad2177028","id":"rel:ddc52a3e4e143989b6eafea19376f24a04235bec1d452011589e6ebfc946cb37","properties":{},"sourceDetailPath":"/data/v1/records/ctrl-aiuc-1-d002-34554b38.json","sourceId":"ctrl:aiuc-1:D002","targetDetailPath":"/data/v1/records/std-aiuc-1-d2a8b650.json","targetId":"std:aiuc-1","type":"belongs_to"},{"expectedCatalogRevision":"24028ffcfc2b295fa1b08ee6caa84b765f0731b321496bf4f548c49ad2177028","id":"rel:e25af5768f22128e1055e10a2199c3d56161178d27b3c68001e5f625c5a67e54","properties":{},"sourceDetailPath":"/data/v1/records/ctrl-aiuc-1-e009-5269a385.json","sourceId":"ctrl:aiuc-1:E009","targetDetailPath":"/data/v1/records/std-aiuc-1-d2a8b650.json","targetId":"std:aiuc-1","type":"belongs_to"},{"expectedCatalogRevision":"24028ffcfc2b295fa1b08ee6caa84b765f0731b321496bf4f548c49ad2177028","id":"rel:e606dc337059883eca825fc58e55c1db8da105553e224d4723b18417ca8583ac","properties":{"control_id":"B001","coverage":"full","delta":null,"framework":"aiuc-1","provenance":{"defaultConfidence":"medium","defaultStatus":"active","direction":"canonical_to_source","mapper":"coworkcanvas-compliance-graph","note":"Each member is a documented relationship claim from the canonical unified control to a source control or guidance proposition. relationship: equal|superset_of (full) / intersects_with|subset_of (partial) / informs (guidance). confidence 'medium' = single-mapper, documented, not yet externally corroborated. source_version is the member framework's edition from the standard version register.","reviewDate":"2026-09-07"},"relationship":"superset_of","source_version":"July 15, 2026 release (quarterly update cadence)"},"sourceDetailPath":"/data/v1/records/uc-uc-ai-21-8afd47db.json","sourceId":"uc:UC-AI-21","targetDetailPath":"/data/v1/records/ctrl-aiuc-1-b001-19a54ee3.json","targetId":"ctrl:aiuc-1:B001","type":"maps_to"},{"expectedCatalogRevision":"24028ffcfc2b295fa1b08ee6caa84b765f0731b321496bf4f548c49ad2177028","id":"rel:eb0ed37196560f352a362b415b0bec4f7d604169244d4e8fe9f149661b959caf","properties":{},"sourceDetailPath":"/data/v1/records/ctrl-aiuc-1-c011-7889db41.json","sourceId":"ctrl:aiuc-1:C011","targetDetailPath":"/data/v1/records/std-aiuc-1-d2a8b650.json","targetId":"std:aiuc-1","type":"belongs_to"},{"expectedCatalogRevision":"24028ffcfc2b295fa1b08ee6caa84b765f0731b321496bf4f548c49ad2177028","id":"rel:f0c83635efeba62d090fe35f8b2986eb6385b02b17fd74179801aaf67ac7f465","properties":{"control_id":"A.5.28","coverage":"full","delta":null,"framework":"iso-27001","provenance":{"defaultConfidence":"medium","defaultStatus":"active","direction":"canonical_to_source","mapper":"coworkcanvas-compliance-graph","note":"Each member is a documented relationship claim from the canonical unified control to a source control or guidance proposition. relationship: equal|superset_of (full) / intersects_with|subset_of (partial) / informs (guidance). confidence 'medium' = single-mapper, documented, not yet externally corroborated. source_version is the member framework's edition from the standard version register.","reviewDate":"2026-09-07"},"relationship":"superset_of","source_version":"2022"},"sourceDetailPath":"/data/v1/records/uc-uc-ir-07-b4d61eff.json","sourceId":"uc:UC-IR-07","targetDetailPath":"/data/v1/records/ctrl-iso-27001-a-5-28-e9d04483.json","targetId":"ctrl:iso-27001:A.5.28","type":"maps_to"},{"expectedCatalogRevision":"24028ffcfc2b295fa1b08ee6caa84b765f0731b321496bf4f548c49ad2177028","id":"rel:f26464c19c5287e54a6d2bf630191ccc3b3196567844c1979896c115397f8603","properties":{"control_id":"C008","coverage":"partial","delta":"monitoring keyed to the AI risk taxonomy categories with per-category alert thresholds and response actions","framework":"aiuc-1","provenance":{"defaultConfidence":"medium","defaultStatus":"active","direction":"canonical_to_source","mapper":"coworkcanvas-compliance-graph","note":"Each member is a documented relationship claim from the canonical unified control to a source control or guidance proposition. relationship: equal|superset_of (full) / intersects_with|subset_of (partial) / informs (guidance). confidence 'medium' = single-mapper, documented, not yet externally corroborated. source_version is the member framework's edition from the standard version register.","reviewDate":"2026-09-07"},"relationship":"intersects_with","source_version":"July 15, 2026 release (quarterly update cadence)"},"sourceDetailPath":"/data/v1/records/uc-uc-ai-08-fada68b7.json","sourceId":"uc:UC-AI-08","targetDetailPath":"/data/v1/records/ctrl-aiuc-1-c008-94bd64f2.json","targetId":"ctrl:aiuc-1:C008","type":"maps_to"},{"expectedCatalogRevision":"24028ffcfc2b295fa1b08ee6caa84b765f0731b321496bf4f548c49ad2177028","id":"rel:f2dc4ec8b339793b1bff17301c96cd06c5e9a52ec5e53e22202d4a3ea2c5932c","properties":{},"sourceDetailPath":"/data/v1/records/ctrl-iso-27001-a-5-16-46fc8420.json","sourceId":"ctrl:iso-27001:A.5.16","targetDetailPath":"/data/v1/records/std-iso-27001-656201bd.json","targetId":"std:iso-27001","type":"belongs_to"},{"expectedCatalogRevision":"24028ffcfc2b295fa1b08ee6caa84b765f0731b321496bf4f548c49ad2177028","id":"rel:f88f1f5f58d8e1ec14714587c7e139ff273175c626d9948d5a60b0dd530f56fe","properties":{"control_id":"E009","coverage":"partial","delta":"monitoring of third-party API connections, integrations, and sessions into AI systems, including revocation of stale access","framework":"aiuc-1","provenance":{"defaultConfidence":"medium","defaultStatus":"active","direction":"canonical_to_source","mapper":"coworkcanvas-compliance-graph","note":"Each member is a documented relationship claim from the canonical unified control to a source control or guidance proposition. relationship: equal|superset_of (full) / intersects_with|subset_of (partial) / informs (guidance). confidence 'medium' = single-mapper, documented, not yet externally corroborated. source_version is the member framework's edition from the standard version register.","reviewDate":"2026-09-07"},"relationship":"intersects_with","source_version":"July 15, 2026 release (quarterly update cadence)"},"sourceDetailPath":"/data/v1/records/uc-uc-log-09-54136146.json","sourceId":"uc:UC-LOG-09","targetDetailPath":"/data/v1/records/ctrl-aiuc-1-e009-5269a385.json","targetId":"ctrl:aiuc-1:E009","type":"maps_to"},{"expectedCatalogRevision":"24028ffcfc2b295fa1b08ee6caa84b765f0731b321496bf4f548c49ad2177028","id":"rel:fa025a0315b5823b158620adb1e426d69f3be952af40edb9d2b815f9a31e2bc6","properties":{"control_id":"A003","coverage":"partial","delta":"agent-specific enforcement: data access scoped per task, user role, agent role, and context at inference time","framework":"aiuc-1","provenance":{"defaultConfidence":"medium","defaultStatus":"active","direction":"canonical_to_source","mapper":"coworkcanvas-compliance-graph","note":"Each member is a documented relationship claim from the canonical unified control to a source control or guidance proposition. relationship: equal|superset_of (full) / intersects_with|subset_of (partial) / informs (guidance). confidence 'medium' = single-mapper, documented, not yet externally corroborated. source_version is the member framework's edition from the standard version register.","reviewDate":"2026-09-07"},"relationship":"intersects_with","source_version":"July 15, 2026 release (quarterly update cadence)"},"sourceDetailPath":"/data/v1/records/uc-uc-access-03-43eeb212.json","sourceId":"uc:UC-ACCESS-03","targetDetailPath":"/data/v1/records/ctrl-aiuc-1-a003-bea61fd9.json","targetId":"ctrl:aiuc-1:A003","type":"maps_to"},{"expectedCatalogRevision":"24028ffcfc2b295fa1b08ee6caa84b765f0731b321496bf4f548c49ad2177028","id":"rel:fb1c8dd28ee831d63f9bbf5d171a0a088378fd7d5d6fc7e7be7195d57e5b27f1","properties":{"control_id":"AIA-Art19","coverage":"full","delta":null,"framework":"eu-ai-act","provenance":{"defaultConfidence":"medium","defaultStatus":"active","direction":"canonical_to_source","mapper":"coworkcanvas-compliance-graph","note":"Each member is a documented relationship claim from the canonical unified control to a source control or guidance proposition. relationship: equal|superset_of (full) / intersects_with|subset_of (partial) / informs (guidance). confidence 'medium' = single-mapper, documented, not yet externally corroborated. source_version is the member framework's edition from the standard version register.","reviewDate":"2026-09-07"},"relationship":"superset_of","source_version":"Regulation (EU) 2024/1689"},"sourceDetailPath":"/data/v1/records/uc-uc-ai-08-fada68b7.json","sourceId":"uc:UC-AI-08","targetDetailPath":"/data/v1/records/ctrl-eu-ai-act-aia-art19-55451bfa.json","targetId":"ctrl:eu-ai-act:AIA-Art19","type":"maps_to"},{"expectedCatalogRevision":"24028ffcfc2b295fa1b08ee6caa84b765f0731b321496bf4f548c49ad2177028","id":"rel:fbcc32d3308dfe1e2b2af67ca3fa556f7fabce7f55b7f1833e4b6cc79879460f","properties":{},"sourceDetailPath":"/data/v1/records/ctrl-iso-27001-a-6-8-87f56c6a.json","sourceId":"ctrl:iso-27001:A.6.8","targetDetailPath":"/data/v1/records/std-iso-27001-656201bd.json","targetId":"std:iso-27001","type":"belongs_to"}],"schemaVersion":1,"scope":"topics","total":377}