Crosswalk
CSA CCM v4.1
Where the corpus maps to CSA CCM v4.1: Cloud Controls Matrix.
Canonical citation
- Standard ID
- CSA CCM
- Current version
- v4.1
- Publication date
- 2026-01
- Topic
- Cloud Controls Matrix
- Upstream check location
- https://
cloudsecurityalliance.org/ research/ cloud-controls-matrix (opens in a new tab) - Last verified (UTC)
- 2026-06-30
Mapped control areas, 14
Control areas from the reverse crosswalk
From the Reverse Framework Control Crosswalk Matrix, which answers: given a control identifier or family, which documents address it.
Coverage, 12 domains
Coverage by domain
From the GRC Library Compliance Alignment Matrix; the main crosswalk table's document counts land here.
Governance, 22 documents
- Governance Library CharterGRC-01, GRC-02
- Exception and Risk Acceptance Management PolicyGRC-04
- Records Retention and Destruction StandardDSP-16, DSP-02
- Emergency Authority StandardCCC-08, CCC-09, IAM-05, IAM-10, SEF-03, SEF-07, SEF-09, BCR-09
- Semantic Continuity in Migration and Retirement StandardCCC-03, DSP-16
- Delegation-of-Authority StandardIAM-04, IAM-05, IAM-07, IAM-08
- Document Index and Classification RegisterGRC-01
- Continuous Assurance and Improvement FrameworkA&A-01, A&A-05, A&A-02
- Document Architecture and Interrelationship FrameworkGRC-01, GRC-03
- Governance Performance and Improvement FrameworkGRC-06, GRC-03
- Human Capital and Ethical Conduct FrameworkHRS-09, HRS-11, HRS-13
- Metrics, Monitoring and Performance Reporting FrameworkGRC-02, LOG-03
- Sustainability and Responsible Technology FrameworkSTA-01
- Minimum Viable Governance Structure GuidelineGRC-01, GRC-06
- Digital Twin and Simulation Governance PolicyGRC-01, DSP-05, IAM-01, LOG-01
- Continuous Improvement Register ProcedureA&A-06, GRC-02
- GRC Programme Management and Annual Review ProcedureGRC-01, GRC-03, A&A-05
- Whistleblower and Incident Reporting ProcedureSEF-01, SEF-03, SEF-08
- Data Retention ScheduleDSP-16, DSP-02
- Digital Trust and Assurance Metrics RegisterA&A-02, GRC-02
- Role Authority RegisterGRC-06, HRS-09, IAM-04
- AI Security Tooling Landscape RegisterTVM-04, TVM-01
Risk, 15 documents
- Enterprise Governance and Risk Management PolicyGRC-01, GRC-02
- Enterprise Risk Management StandardGRC-02
- Third-Party and Supply Chain Risk StandardSTA-01
- Risk Assessment Methodology ProcedureGRC-02
- Risk Register ProcedureGRC-02
- Risk Acceptance ProcedureGRC-02, GRC-04
- Assurance Map RegisterA&A-02, A&A-03, GRC-02
- Key Risk Indicator CatalogueGRC-02
- Scenario Risk CatalogueGRC-02, BCR-02
- Quantitative Risk Analysis GuidelineGRC-02
- Enterprise Risk Register TemplateGRC-02, GRC-04
- Operational Risk Register TemplateGRC-02, GRC-04
- Risk Appetite Statement TemplateGRC-02
- Board Risk Report TemplateGRC-02, GRC-06
- AI-Specific Risk Methodology AnnexGRC-02, AIS-01
Compliance, 37 documents
- Compliance, Audit, and CAPA Management PolicyGRC-06, GRC-07, A&A-05
- Global Regulatory Applicability RegisterGRC-01, GRC-07
- BASC IT and Information Security ResponsibilitiesGRC-01, GRC-02
- BASC IT Compliance Monitoring and KPIsA&A-04, GRC-07
- UK AEO-S IT and Cybersecurity RequirementsIAM-01, SEF-01, DSP-01
- Legal and Regulatory Compliance PolicyGRC-01, GRC-06, GRC-07
- Internal Audit StandardA&A-01, A&A-02, A&A-03
- Audit Planning ProcedureA&A-01, A&A-02
- Corrective and Preventive Action (CAPA) ProcedureA&A-06
- Control Testing ProcedureA&A-02, A&A-05
- Mergers and Acquisitions Due Diligence ProcedureGRC-02, GRC-07, A&A-03
- Sanctions and Export-Control Screening StandardGRC-07, STA-13, IAM-04
- Compliance Obligations Register TemplateGRC-01, GRC-06, GRC-07
- Audit Evidence Package TemplateA&A-01, A&A-02, GRC-06
- Regulator Interaction TemplatesGRC-06, SEF-08
- NIS 2 Implementation AnnexGRC-06, STA-01, SEF-01
- DORA Implementation AnnexGRC-02, STA-01, BCR-02, SEF-03
- MiCA Implementation AnnexGRC-07, GRC-02
- Financial Services Sector GRC Requirements AnnexGRC-01, GRC-07, STA-01, SEF-03, BCR-02
- SOX IT General Controls AnnexIAM-06, IAM-08, CCC-01, BCR-08, A&A-05
- Energy and Utilities Sector Requirements AnnexGRC-07, STA-01, SEF-03, DCS-01
- Healthcare Sector GRC Requirements AnnexDSP-17, GRC-07, SEF-08
- United States HIPAA Sector Requirements AnnexGRC-07, DSP-17, SEF-08
- HIPAA Operational Compliance ProcedureDSP-11, DSP-16, SEF-08, STA-11
- FedRAMP Sector Requirements AnnexGRC-07, IAM-01, A&A-02, STA-01
- Public Sector GRC Requirements AnnexGRC-07, DSP-16, A&A-01
- eIDAS Sector Requirements AnnexGRC-07, IAM-13, DSP-12
- Canada Public Sector GRC Requirements AnnexGRC-07
- Telecommunications Sector Requirements AnnexGRC-07, I&S-03, SEF-01, STA-01
- BASC Programme Overview AnnexGRC-01, GRC-07
- Logistics Sector GRC Requirements AnnexGRC-01, GRC-07, STA-01
- BASC Information Security PolicyIAM-01, GRC-01, TVM-01, LOG-01
- UK AEO IT Self-Assessment ProcedureA&A-04, GRC-07, A&A-02
- US CTPAT IT and Cybersecurity Compliance Controls RegisterIAM-01, TVM-01, SEF-01, LOG-01
- US CTPAT Minimum Security Criteria Controls RegisterDCS-01, IAM-01, HRS-01, STA-01
- Canada PIP IT and Cybersecurity Compliance Controls RegisterIAM-01, DSP-01, TVM-01, SEF-01
- Trade Compliance Programme Gap Assessment TemplateA&A-04, GRC-07
Security, 36 documents
- Information Security PolicyGRC-01, IAM-01, SEF-01
- Identity and Access Management PolicyIAM-01, IAM-02, IAM-03, IAM-04
- Acceptable Use PolicyHRS-02
- Encryption and Key Management PolicyCEK-01, CEK-02, CEK-03, CEK-04
- Logging and Monitoring StandardLOG-01, LOG-02, LOG-03, LOG-04
- Monitoring Integrity and Coverage StandardLOG-03, LOG-14, I&S-02, SEF-06, SEF-07
- Data Classification and Handling StandardDSP-01, DSP-02, DSP-04
- Privileged Access Management StandardIAM-05, IAM-06, IAM-07, IAM-10
- Authentication and Password Management StandardIAM-02, IAM-13, IAM-14
- Security Incident Response ProcedureSEF-01, SEF-03, SEF-05, SEF-06, SEF-07, SEF-09
- Vulnerability Management ProcedureTVM-01, TVM-03, TVM-08
- Cryptographic Key Lifecycle Management FrameworkCEK-01, CEK-10, CEK-12, CEK-14
- Cryptographic Key Operations ProcedureCEK-10, CEK-12, CEK-13, CEK-14
- Key Escrow and Recovery ProcedureCEK-19, CEK-20, CEK-21
- Post-Quantum Cryptography Readiness RoadmapCEK-04, CEK-05, CEK-07
- Access Control ProcedureIAM-05, IAM-06, IAM-07, IAM-08
- Identity Management ProcedureIAM-01, IAM-03, IAM-12, IAM-13
- IT Onboarding and Offboarding ProcedureIAM-06, IAM-07, HRS-05, HRS-06
- Zero Trust Architecture FrameworkIAM-05, IAM-13, I&S-03
- Bring Your Own Device (BYOD) PolicyUEM-01, UEM-03, UEM-13, IAM-13
- Network Communications Security PolicyI&S-03, I&S-09
- Endpoint Hardening StandardUEM-05, UEM-07, UEM-08, UEM-09
- Email Security StandardDSP-10, TVM-02, SEF-01
- Data Loss Prevention StandardUEM-11, DSP-04, DSP-17
- SaaS Security Posture Management StandardSTA-01, STA-13, IAM-01
- Remote Working Security StandardHRS-04, UEM-01, IAM-13
- Incident Escalation MatrixSEF-07, SEF-03, SEF-08
- Security Ticket Reporting SchemeSEF-09, SEF-01
- Security Operations Centre Operating Model StandardLOG-03, SEF-01, TVM-02
- Penetration Testing and Red Team StandardTVM-07, TVM-08, A&A-02
- Threat Modelling StandardTVM-04, AIS-04
- Security Disciplinary Process ProcedureHRS-13, HRS-09
- Personnel Security Screening StandardHRS-01, IAM-06
- Security Awareness and Training StandardHRS-11, HRS-12
- Insider Risk Programme FrameworkHRS-01, IAM-05, LOG-03, SEF-07
- Acceptance Into Service PolicyCCC-01, CCC-02, CCC-04
Operations, 27 documents
- Production Security RequirementsCCC-01, CCC-02, TVM-01
- Network Security and Segmentation StandardI&S-03, I&S-08, I&S-09
- Cloud Security Configuration BaselineCCC-01, CCC-02, CEK-01, IAM-01
- Physical Security of IT Infrastructure StandardDCS-01, DCS-04
- Certificate Authority Management StandardCEK-01, CEK-04, IAM-10
- Change Management and Configuration Control ProcedureCCC-01, CCC-02, CCC-03, CCC-04
- Endpoint Management and Device Compliance ProcedureUEM-01, UEM-02
- Media Handling and Transport ProcedureDSP-04, DCS-05, DSP-02
- Security Monitoring and Alert Management ProcedureLOG-02, LOG-03, SEF-06
- Threat Intelligence and SIEM Operations ProcedureLOG-03, LOG-05, SEF-06
- IT Service Management FrameworkSEF-02, SEF-01, CCC-01
- Service Level Management StandardSEF-02, STA-11
- Site Reliability Engineering StandardSEF-03, CCC-01
- Patch Management ProcedureTVM-08, TVM-01, CCC-01
- Release Management ProcedureCCC-01, CCC-02, CCC-09
- Capacity and Performance Management StandardI&S-02, BCR-03
- Observability and Telemetry StandardLOG-01, LOG-03, LOG-07
- IT Financial Management StandardGRC-01, GRC-02
- Asset Inventory RegisterDCS-06, DCS-07, UEM-04
- IT Operations Key Performance Indicators RegisterGRC-02, SEF-05
- IT Security Operations RegisterSEF-01, LOG-03
- OT/ICS Security StandardI&S-03, IAM-13, TVM-01, DCS-01, LOG-03, BCR-08
- Operational Technology Security Overview AnnexI&S-03, I&S-01
- Building Management Systems (BMS) Overlay AnnexDCS-01, I&S-03, DSP-03, STA-01
- OT Change Management ProcedureCCC-01, CCC-02, CCC-04, CCC-06
- OT Incident Response ProcedureSEF-01, SEF-03, SEF-06, SEF-07, SEF-08
- OT Asset Inventory and Lifecycle RegisterDCS-06, DCS-07, UEM-04, TVM-03, STA-08
Supply chain, 18 documents
- Supplier and Cloud Governance FrameworkSTA-01, STA-02, STA-03, STA-05
- Supplier Security and Privacy Assurance StandardSTA-01, STA-02, STA-03
- Supplier Resilience Monitoring StandardSTA-10, STA-13, BCR-01
- Cloud Exit and Data Portability StandardIPY-01, IPY-03, IPY-04, STA-13
- Supplier Due Diligence ProcedureSTA-01
- Supplier Onboarding Security Review ProcedureSTA-01, STA-02, STA-12, IAM-06
- Supplier Ongoing Monitoring ProcedureSTA-13, STA-14, GRC-07
- Supplier Audit ProcedureSTA-16, GRC-07
- Supplier Exit and Data Return ProcedureSTA-14, DSP-16, IAM-07
- Fourth-Party and Nth-Party Risk ProcedureSTA-01, STA-08, STA-09
- Third-Party AI Due Diligence ProcedureSTA-01, STA-02, STA-06, STA-13
- Concentration Risk RegisterSTA-10, BCR-02, GRC-02
- Software Bill of Materials RegisterSTA-09, TVM-06, TVM-08, TVM-03
- Subprocessor Register TemplateDSP-14, STA-13, DSP-10, DSP-19
- Supplier Risk Register TemplateSTA-01, STA-02, STA-14, GRC-02
- Supplier Offboarding Evidence TemplateIPY-04, DSP-02, STA-12
- Supplier Security QuestionnaireA&A-04, STA-13, STA-16
- Trade and Supply-Chain Continuity Controls AnnexSTA-01, STA-08, BCR-02, BCR-04
Resilience, 21 documents
- Business Continuity and Disaster Recovery PolicyBCR-01, BCR-02
- Business Continuity and Disaster Recovery StandardBCR-01, BCR-02, BCR-03, BCR-04, BCR-05
- Backup and Recovery ProcedureBCR-08, BCR-09, BCR-10
- Business Continuity and Resilience FrameworkBCR-01, BCR-02, BCR-03, BCR-04, BCR-06, BCR-07
- Business Continuity and Crisis Management PlanBCR-04, BCR-07, BCR-09, SEF-03
- IT Disaster Recovery PlanBCR-08, BCR-09, BCR-11
- Pandemic Continuity PlanBCR-01, BCR-02, BCR-04
- Physical Site Continuity PlanBCR-01, BCR-04, BCR-09
- Crisis Communication PlanBCR-07, SEF-08
- Business Impact Analysis ProcedureBCR-02, BCR-03
- Continuity and Recovery Testing ProcedureBCR-06, BCR-10
- Crisis Management and Emergency Operations Activation ProcedureBCR-07, BCR-09
- Cross-Domain Incident Coordination ProcedureSEF-07, SEF-08, SEF-09
- Security Incident Reporting and Escalation ProcedureSEF-01, SEF-06, SEF-08
- Emergency Response and Protective Actions GuidelineBCR-09, SEF-01
- Emergency Operations Contact Directory RegisterBCR-07, SEF-10
- Resilience Metrics and Testing Log RegisterBCR-06, BCR-10
- Departmental Continuity Plan TemplateBCR-02, BCR-03, BCR-04
- Lessons Learned TemplateBCR-06
- Recovery Runbook TemplateBCR-09, BCR-10
- Tabletop Exercise TemplateBCR-06, BCR-10
Privacy, 52 documents
- Privacy and Data Governance PolicyDSP-01, DSP-02, DSP-04
- Privacy Impact and Cross-Border Transfer ProcedureDSP-09, DSP-10
- Privacy Management Programme CharterGRC-01, DSP-01, GRC-06
- Children's Data FrameworkDSP-17, DSP-07, DSP-04
- Consent Management FrameworkDSP-12, DSP-01, GRC-01
- Privacy by Design FrameworkDSP-07, DSP-08, DSP-01
- Pseudonymization and Anonymization StandardDSP-07, DSP-17, DSP-16
- Automated Decision-Making and Profiling RegisterDSP-03, GRC-02, DSP-12
- Cookie and Tracker RegisterDSP-03, DSP-12, DSP-01
- Cross-Border Data Flow RegisterDSP-10, DSP-19, DSP-03
- Transfer Impact Assessment (TIA) TemplateDSP-10, DSP-19, GRC-02
- Privacy Jurisdiction IndexGRC-01, GRC-07
- Data Protection and Privacy Breach Response ProcedureSEF-08, SEF-03, SEF-06
- Breach Notification Regulator Register TemplateSEF-08, GRC-07
- Data Subject Rights Management ProcedureDSP-11, DSP-01
- DPIA (Data Protection Impact Assessment) TemplateDSP-07, DSP-08, DSP-01
- Legitimate Interest Assessment (LIA) TemplateDSP-12, DSP-01, GRC-02
- Data Subject Access Request Workflow TemplateDSP-11, DSP-01, DSP-06
- Joint Controller Arrangement TemplateGRC-06, DSP-06, DSP-01
- Privacy Notice TemplateDSP-01, DSP-08, DSP-05
- Record of Processing Activities TemplateDSP-03, DSP-05, DSP-06
- Data Processing Agreement Template (GDPR Article 28)DSP-13, DSP-14, DSP-16, DSP-01
- Australia Privacy Regulatory RequirementsDSP-01, DSP-10, DSP-17
- Brazil Privacy Regulatory RequirementsDSP-01, DSP-10, DSP-17
- Chile Privacy Regulatory RequirementsDSP-01, DSP-10, DSP-17
- Peru Privacy Regulatory RequirementsDSP-01, DSP-10, DSP-17
- Colombia Privacy Regulatory RequirementsDSP-01, DSP-10, DSP-17
- Ecuador Privacy Regulatory RequirementsDSP-01, DSP-10, DSP-17
- Canada Privacy Regulatory RequirementsDSP-01, DSP-10, DSP-17
- China Privacy Regulatory RequirementsDSP-01, DSP-10, DSP-17
- European Union Privacy Regulatory RequirementsDSP-01, DSP-10, DSP-17
- India Privacy Regulatory RequirementsDSP-01, DSP-10, DSP-17
- Indonesia Privacy Regulatory RequirementsDSP-01, DSP-10, DSP-17
- Japan Privacy Regulatory RequirementsDSP-01, DSP-10, DSP-17
- Kenya Privacy Regulatory RequirementsDSP-01, DSP-10, DSP-17
- Latin America Privacy Regulatory RequirementsDSP-01, DSP-10, DSP-17
- Malaysia Privacy Regulatory RequirementsDSP-01, DSP-10, DSP-17
- Mexico Privacy Regulatory RequirementsDSP-01, DSP-10, DSP-17
- New Zealand Privacy Regulatory RequirementsDSP-01, DSP-10, DSP-17
- Nigeria Privacy Regulatory RequirementsDSP-01, DSP-10, DSP-17
- Philippines Privacy Regulatory RequirementsDSP-01, DSP-10, DSP-17
- Saudi Arabia Privacy Regulatory RequirementsDSP-01, DSP-10, DSP-17
- Singapore Privacy Regulatory RequirementsDSP-01, DSP-10, DSP-17
- South Africa Privacy Regulatory RequirementsDSP-01, DSP-10, DSP-17
- South Korea Privacy Regulatory RequirementsDSP-01, DSP-10, DSP-17
- Switzerland Privacy Regulatory RequirementsDSP-01, DSP-10, DSP-17
- Thailand Privacy Regulatory RequirementsDSP-01, DSP-10, DSP-17
- Turkey Privacy Regulatory RequirementsDSP-01, DSP-10, DSP-17
- United Arab Emirates Privacy Regulatory RequirementsDSP-01, DSP-10, DSP-17
- United Kingdom Privacy Regulatory RequirementsDSP-01, DSP-10, DSP-17
- United States Privacy Regulatory RequirementsDSP-01, DSP-10, DSP-17
- Vietnam Privacy Regulatory RequirementsDSP-01, DSP-10, DSP-17
Architecture, 8 documents
- Enterprise Architecture FrameworkGRC-01, GRC-02
- Architecture Review ProcedureGRC-01, CCC-01, CCC-02
- API Design StandardAIS-01, AIS-02, AIS-04, IPY-01
- Architecture Decision Records StandardGRC-01
- Data Architecture StandardDSP-01, DSP-02, DSP-03, DSP-05, DSP-07
- Integration Architecture StandardAIS-04, IPY-01, I&S-03, DSP-04
- Reference Architecture StandardGRC-01
- Technology Radar StandardGRC-01, STA-01
Dev security, 16 documents
- Secure Development and Engineering PolicyAIS-04, AIS-05, AIS-06, CCC-01, TVM-06
- Secure Code Review ProcedureAIS-04, AIS-05, CCC-01, CCC-02, TVM-06
- Compliance Controls and Gap Register TemplateA&A-04, GRC-07, A&A-05, A&A-06, GRC-01
- API Security StandardAIS-08, AIS-05, IAM-15, IAM-13, LOG-03
- AWS Cloud Hardening Baseline StandardI&S-04, I&S-03, IAM-01, LOG-01, CEK-01
- Azure Cloud Hardening Baseline StandardI&S-04, I&S-03, IAM-01, LOG-01, CEK-01
- Google Cloud Platform Hardening Baseline StandardI&S-04, I&S-03, IAM-01, LOG-01, CEK-01
- Container and Image Security StandardI&S-04, AIS-06, TVM-03, STA-09, I&S-06
- Developer Security RequirementsAIS-02, AIS-05, CEK-01, IAM-13, TVM-04
- DevOps Security RequirementsCCC-01, CCC-04, I&S-05, I&S-04
- Mobile Application Security StandardUEM-01, AIS-05, CEK-03, IAM-13, AIS-04
- Quality Assurance and Testing StandardCCC-02, AIS-05, TVM-07, AIS-07
- Security Baseline and Standards ReferenceGRC-01, GRC-05, IAM-01, DSP-01, CEK-01, LOG-01
- Security Quick ReferenceIAM-01, CEK-03, DSP-01, TVM-01, CCC-01, AIS-05
- Software Composition Analysis StandardSTA-09, TVM-06, TVM-08, TVM-03
- Software Evaluation, Acceptance and Lifecycle Management StandardSTA-01, AIS-06, TVM-08, STA-13
AI, 45 documents
- AI Governance Council CharterGRC-01, GRC-06, A&A-02
- AI Ethics Review Panel CharterGRC-06, A&A-02, GRC-01
- AI Algorithmic Compliance ChecklistGRC-02, A&A-02, AIS-05
- AI Governance and Risk FrameworkGRC-02, DSP-05, STA-01
- AI Model Documentation and Transparency FrameworkGRC-01, DSP-03, GRC-07
- AI Model Risk FrameworkGRC-02, DSP-05, TVM-01
- AI System Audit and Certification FrameworkA&A-01, A&A-02, A&A-05
- AI Adversarial Test ReferenceTVM-07, AIS-05, TVM-04
- AI Security Technical Implementation GuideLOG-03
- Adversarial Evaluation Suite Development GuidelineAIS-05, TVM-04, TVM-07
- Ethical AI Use GuidelineGRC-01, HRS-09, DSP-07
- AI Incident Response PlanSEF-03, SEF-07, SEF-06
- AI Compliance PolicyGRC-07, GRC-01, SEF-03
- AI Audit ProcedureA&A-01, A&A-05, A&A-02
- AI Evaluation ProcedureAIS-05, CCC-02, A&A-02
- AI Model Lifecycle Management ProcedureCCC-01, DSP-03, LOG-03
- AI Model Risk Assessment ProcedureGRC-02, TVM-04, DSP-05
- AI System Impact Assessment ProcedureDSP-09, GRC-02, DSP-05
- Foundation Model Lifecycle ProcedureSTA-01, STA-10, CCC-01
- Training Data Governance ProcedureDSP-03, DSP-05, DSP-16
- AI Risk RegisterGRC-02, A&A-02, GRC-01
- Model Context Protocol Server RegisterSTA-08, AIS-08, IAM-15
- Model RegistryDSP-03, GRC-02, STA-08
- AI Access and Agent Permissions StandardIAM-01, IAM-15, AIS-08
- AI and Agentic Development Security StandardAIS-05, TVM-04, STA-09
- AI Inference Cost Governance StandardGRC-02, LOG-03, STA-11, I&S-02
- AI Model Risk StandardGRC-02, TVM-04, A&A-02, DSP-03
- AI Security and Risk StandardGRC-05, IAM-01, TVM-04, STA-10
- AI Testing, Validation and Documentation StandardAIS-05, CCC-02, A&A-02, DSP-09
- AI Red Team Report TemplateTVM-07, AIS-05, TVM-04
- AI System Register TemplateDSP-03, GRC-02, GRC-07
- AI Vendor Security Questionnaire TemplateSTA-01, STA-10, STA-13, STA-16
- Dataset Datasheet TemplateDSP-03, DSP-06, DSP-05
- Model Card TemplateDSP-03, GRC-02, AIS-05
- System Card TemplateDSP-03, GRC-02, IAM-15
- Agentic Response State Model FrameworkSEF-03, IAM-15
- AI Human-Oversight StandardGRC-06
- AI Maturity Model FrameworkGRC-01, GRC-06
- AI Value and Decision-Governance FrameworkGRC-06
- AI Board Oversight GuideGRC-02, GRC-06
- AI Synthetic-Content Provenance GuidelineGRC-07
- Integrated AI and Privacy Assessment ProcedureDSP-09, GRC-07
- AI Data Quality and Readiness Validation StandardDSP-16, STA-11
- AI Model Succession and Identity Continuity StandardCCC-01, IAM-05
- AI Actor Role and Forum Standing CharterGRC-01, GRC-06
Crypto, 2 documents
- Crypto-Asset Governance FrameworkGRC-01, GRC-02, GRC-06, GRC-07
- Digital Asset Custody StandardCEK-01, CEK-20, CEK-21, IAM-04, LOG-10, SEF-07
Corpus citations, 87
Documents naming it in their framework alignment
Generated from each document's framework alignment list in the taxonomy, through the committed alias map.
- Acceptable Use PolicySecurity
- Acceptance Into Service PolicySecurity
- Access Control ProcedureSecurity
- AI Access and Agent Permissions StandardAI
- AI Model Succession and Identity Continuity StandardAI
- API Security StandardDev security
- Asset Inventory RegisterOperations
- Authentication and Password Management StandardSecurity
- AWS Cloud Hardening Baseline StandardDev security
- Azure Cloud Hardening Baseline StandardDev security
- BASC Information Security PolicyCompliance
- Bring Your Own Device (BYOD) PolicySecurity
- Capability Is Not Authority PrincipleGovernance
- Certificate Authority Management StandardOperations
- Change Management and Configuration Control ProcedureOperations
- Cloud Exit and Data Portability StandardSupply chain
- Cloud Security Configuration BaselineOperations
- Continuous Assurance and Improvement FrameworkGovernance
- Control Testing ProcedureCompliance
- Corrective and Preventive Action (CAPA) ProcedureCompliance
- Cross-Domain Incident Coordination ProcedureResilience
- Cryptographic Key Lifecycle Management FrameworkSecurity
- Cryptographic Key Operations ProcedureSecurity
- Data Classification and Handling StandardSecurity
- Data Loss Prevention StandardSecurity
- Data Processing Agreement Template (GDPR Article 28)Privacy
- Data Protection and Privacy Breach Response ProcedurePrivacy
- Data Subject Rights Management ProcedurePrivacy
- Developer Security RequirementsDev security
- DevOps Security RequirementsDev security
- Digital Trust and Assurance Metrics RegisterGovernance
- Emergency Authority StandardGovernance
- Encryption and Key Management PolicySecurity
- Endpoint Hardening StandardSecurity
- Endpoint Management and Device Compliance ProcedureOperations
- Enterprise Governance and Risk Management PolicyRisk
- Enterprise Risk Management StandardRisk
- Google Cloud Platform Hardening Baseline StandardDev security
- Human Capital and Ethical Conduct FrameworkGovernance
- Identity and Access Management PolicySecurity
- Identity Management ProcedureSecurity
- Incident Escalation MatrixSecurity
- Information Security PolicySecurity
- Integrity and Trustworthiness PrincipleGovernance
- Internal Audit StandardCompliance
- IT Disaster Recovery PlanResilience
- IT Security Operations RegisterOperations
- IT Service Management FrameworkOperations
- Key Escrow and Recovery ProcedureSecurity
- Legal and Regulatory Compliance PolicyCompliance
- Legitimate Interest Assessment for Employment Monitoring AnnexPrivacy
- Logging and Monitoring StandardSecurity
- Media Handling and Transport ProcedureOperations
- Monitoring Integrity and Coverage StandardSecurity
- Network Communications Security PolicySecurity
- Network Security and Segmentation StandardOperations
- Network Telemetry and DPI Controls StandardPrivacy
- Patch Management ProcedureOperations
- Penetration Testing and Red Team StandardSecurity
- Personnel Security Screening StandardSecurity
- Physical Security of IT Infrastructure StandardOperations
- Presence Inference Limitations StandardPrivacy
- Privacy and Data Governance PolicyPrivacy
- Privacy Impact and Cross-Border Transfer ProcedurePrivacy
- Privacy Management Programme CharterPrivacy
- Privileged Access Management StandardSecurity
- Production Security RequirementsOperations
- Quality Assurance and Testing StandardDev security
- Records Retention and Destruction StandardGovernance
- Remote Working Security StandardSecurity
- Risk Assessment Methodology ProcedureRisk
- SaaS Security Posture Management StandardSecurity
- Secure Development and Engineering PolicyDev security
- Security Awareness and Training StandardSecurity
- Security Baseline and Standards ReferenceDev security
- Security Incident Response ProcedureSecurity
- Security Monitoring and Alert Management ProcedureOperations
- Semantic Continuity in Migration and Retirement StandardGovernance
- Software Evaluation, Acceptance and Lifecycle Management StandardDev security
- Supplier Offboarding Evidence TemplateSupply chain
- Supplier Security and Privacy Assurance StandardSupply chain
- Third-Party and Supply Chain Risk StandardRisk
- Threat Intelligence and SIEM Operations ProcedureOperations
- Threat Modelling StandardSecurity
- Vulnerability Management ProcedureSecurity
- Workforce Network Monitoring PolicySecurity
- Works Council and Employee Representative Consultation ProcedurePrivacy
Note
What this mapping is
From the GRC Library Compliance Alignment Matrix: citations are indicative, not exhaustive (the representative-citation convention), and no entry constitutes a certification, attestation, or legal opinion.
From the Reverse Framework Control Crosswalk Matrix: coverage is partial, and external control identifiers and clause numbers are referenced for navigation only; the library does not reproduce third-party control text.
From the Cross-Framework Alignment Matrix: the alignment is not an official mapping, certification claim, legal opinion, or reproduction of third-party framework content.
The standards, laws, frameworks, and programmes in the canonical citations register, mapped here or not, are listed with their current editions on the Standards & frameworks page, generated from that register.