Meet an obligation
Which framework or law do you answer to?
Name your obligation, follow the mappings to the documents that support it, and assemble the evidence an audit will ask for. The mappings support gap analysis and audit preparation; they do not certify compliance.
Instruments, 27
The standards, laws, frameworks, and programmes
One row per crosswalk instrument, generated from the alignment matrices, the canonical citations register, and the taxonomy at build time. A row opens the instrument's crosswalk page; the count beside it is the library documents the matrices map to it or whose framework alignment names it in a form the site's alias map recognizes, so a document naming it only in another form is not counted. The crosswalk shows 19 of them as one table, domain by domain, and lists COBIT 2019, PIPEDA, Quebec Law 25, ISO/IEC 27002:2022, ISO 31000:2018, ISO/IEC 27701:2025, LGPD, and PIPL under Also in the corpus.
- ISO/IEC 27001:2022312 documentsStandards and management systems
- ISO/IEC 42001:202389 documentsStandards and management systems
- NIST CSF 2.0286 documentsFrameworks and control catalogues
- NIST SP 800-53 Rev. 565 documentsFrameworks and control catalogues
- NIST AI RMF 1.067 documentsFrameworks and control catalogues
- CSA CCM v4.1306 documentsFrameworks and control catalogues
- CSA AICM v1.180 documentsFrameworks and control catalogues
- OWASP LLM Top 10 (2026)20 documentsFrameworks and control catalogues
- MITRE ATLAS v2026.076 documentsFrameworks and control catalogues
- EU AI Act54 documentsLaws and regulations
- GDPR60 documentsLaws and regulations
- DORA33 documentsLaws and regulations
- NIS 241 documentsLaws and regulations
- CTPAT (2020)65 documentsSector and trade programmes
- PIP92 documentsSector and trade programmes
- BASC (V6-2022)111 documentsSector and trade programmes
- WCO SAFE (2025 edition)72 documentsSector and trade programmes
- AEO/AEO-S115 documentsSector and trade programmes
- AICPA TSC0 documentsAudit and attestation. No document counts toward it yet; its crosswalk column is being populated domain by domain.
- COBIT 201978 documentsAlso in the corpus
- PIPEDA9 documentsAlso in the corpus
- Quebec Law 256 documentsAlso in the corpus
- ISO/IEC 27002:202232 documentsAlso in the corpus
- ISO 31000:201813 documentsAlso in the corpus
- ISO/IEC 27701:202517 documentsAlso in the corpus
- LGPD15 documentsAlso in the corpus
- PIPL16 documentsAlso in the corpus
Not listed
Answering to something not listed here?
The corpus mappings live in the matrix documents, 6 in the corpus, on one page. For how coverage of regulatory obligations is evidenced, read the outcome map How leadership can know, with evidence, whether the organization's legal and regulatory obligations are identified and met. Every standard, law, framework, and programme in the canonical citations register, mapped here or not, is listed with its current edition on the Standards & frameworks page, generated from that register. If none of these covers your obligation, the corpus likely does not map it yet.
Known coverage gaps are declared in the Coverage Gap Analysis Register, never hidden. Where the corpus does not map your obligation, it says so, and what an assurer ultimately tests is whether your controls are well designed and actually operate, not only whether the paper exists.
Method
Work backwards from the obligation
If your framework has a column in the compliance alignment matrix or the cross-framework alignment matrix, read off which corpus documents align to its requirements. To work backwards from a control you already hold, the reverse framework-control crosswalk names which library documents address it. Check editions against the canonical citations register so your programme names the edition your auditor will. Then adopt the supporting documents plus the annex overlays, 66 in the corpus, including jurisdiction and sector overlays, and keep the registers that carry the evidence, 39 in the corpus.