Annex 11 to EU GMP - Computerised Systems
General Requirements (Annex 11)

Annex 11 to EU GMP - Computerised Systems Clause 1: Risk management

Risk assessment should be performed throughout the lifecycle to determine the level of validation and data integrity controls.

Maintained by Gerard BlokdykVerified against the published standard Control text last updated

What else in your programme already covers this

This control maps to 370 controls across 175 other frameworks. If you already hold one of them, the evidence you collected for it is the starting point here rather than new work.

ISO/IEC 27557:2022 - Organisational Privacy Risk Management · 7 controls

  • 27557-1 Scope
  • 27557-3 Terms and definitions
  • 27557-4.3 Individual impact consideration
  • 27557-6.3 Privacy risk assessment
  • 27557-6.4 Privacy risk treatment
  • 27557-6.6 Recording and reporting
  • 27557-7.3 Risk-based privacy program implementation

NIST SP 800-53 Rev 5 · 7 controls

ISO/IEC 23894:2023 · 6 controls

  • ISO23894-5.1 Leadership and Commitment
  • ISO23894-5.2 AI Risk Management Integration
  • ISO23894-5.5 Framework Evaluation
  • ISO23894-6.3 AI Risk Assessment
  • ISO23894-6.3.1 AI Risk Identification
  • ISO23894-6.3.3 AI Risk Evaluation

NIST SP 800-30 · 6 controls

  • NISTSP30-1 Risk Management Strategy and Risk Assessment Programme Establishment
  • NISTSP30-2 Three-Tier Risk Assessment Scoping (Organisation, Mission/Business, Information System)
  • NISTSP30-3 Threat Source and Threat Event Identification
  • NISTSP30-4 Vulnerability and Predisposing Condition Identification
  • NISTSP30-6 Risk Determination, Uncertainty, and Sensitivity Analysis
  • NISTSP30-8 Risk Assessment Maintenance, Continuous Monitoring, and Integration with the RMF

EASA Part-IS - Information Security in Aviation · 5 controls

  • IS.D.OR.205 Information Security Risk Assessment
  • IS.D.OR.210 Information Security Risk Treatment
  • IS.I.OR.205 Information Security Risk Assessment
  • IS.I.OR.210 Information Security Risk Treatment
  • IS.I.OR.220 Information Security Risk Management

NIST Cybersecurity Framework 2.0 · 5 controls

  • NIST-CSF-GV.RM-03 Cybersecurity risk management activities and outcomes are included in enterprise risk management processes
  • NIST-CSF-GV.RM-04 Strategic direction that describes appropriate risk response options is established and communicated
  • NIST-CSF-GV.RM-07 Strategic opportunities (i.e., positive risks) are characterized and are included in organizational cybersecurity risk discussions
  • NIST-CSF-GV.SC-01 A cybersecurity supply chain risk management program, strategy, objectives, policies, and processes are established and agreed to by organizational stakeholders
  • NIST-CSF-ID.RA-09 The authenticity and integrity of hardware and software are assessed prior to acquisition and use

APRA CPS 230 Operational Risk Management · 4 controls

  • CPS230-11 Identification, Assessment and Management of Operational Risk
  • CPS230-16 Internal Audit Review of the Business Continuity Plan
  • CPS230-37 Service Provider Management Policy
  • CPS230-46 Ongoing Risk Management of Each Material Arrangement

FTC GLBA Safeguards Rule (16 CFR Part 314) · 4 controls

  • FTC-Safeguards-EffectiveDate-Small-Institution Effective Date, Small Institution Exemption and Sectoral Coordination (16 CFR 314.5, 314.6)
  • FTC-Safeguards-IR-Plan-BoardReporting-FTC-Notification Written Incident Response Plan + Board Reporting + FTC Breach Notification (16 CFR 314.4(h), (i), (j))
  • FTC-Safeguards-Risk-Assessment Written Risk Assessment (16 CFR 314.4(b))
  • FTC-Safeguards-ServiceProvider-Evaluation Service Provider Oversight + Program Evaluation + Personnel Training (16 CFR 314.4(d-g))

Japan AI Guidelines · 4 controls

  • JP-AIG-Continuous-Monitoring-Lifecycle-Model-Evaluation-Performance-Drift-Post-Deployment Japan AI Guidelines Continuous Monitoring + AI System Lifecycle Management + Model Evaluation + Performance Drift + Concept Drift + Post-Deployment + Retraining Triggers + Safe Update + Decommissioning + Model Card Versioning
  • JP-AIG-Fairness-Bias-Detection-Mitigation-Inclusive-AI-Discrimination-Prevention-10-Principles-2019-Heritage Japan AI Guidelines Fairness + Bias Detection + Mitigation + Inclusive AI + Discrimination Prevention + 10 Principles 2019 Heritage + Protected Attributes + Disparate Impact + Statistical Parity + Counterfactual Fairness
  • JP-AIG-Safety-Validation-Testing-Robustness-AISI-AI-Safety-Institute-Pre-Deployment-Evaluation-Red-Teaming Japan AI Guidelines Safety + Validation + Testing + Robustness + AISI AI Safety Institute (14 Feb 2024) + Pre-Deployment Evaluation + Red Teaming + Capability Evaluations + AI Incident Database + Safe Deployment + AI Safety Reports
  • JP-AIG-Scope-METI-MIC-AI-Guidelines-Business-v1.0-April2024-Society-5.0-Cabinet-Office-AI-Strategy-Council Japan AI Guidelines Scope + METI/MIC AI Guidelines for Business v1.0 (April 2024) + Society 5.0 + Cabinet Office AI Strategy Council + 10 Principles 2019 Heritage + Education + Literacy + Fair Competition + Innovation Principles

NIST SP 800-37 · 4 controls

  • NISTSP37-1 RMF Prepare Step: Organisation-Level and System-Level Preparation
  • NISTSP37-2 RMF Categorize Step: Information and System Categorisation
  • NISTSP37-3 RMF Select Step: Security and Privacy Control Selection
  • NISTSP37-7 RMF Monitor Step: Continuous Monitoring and Ongoing Authorisation

SASB Standards · 4 controls

  • SASB-3 Leadership and Governance (LG)
  • SASB-LG-2 Systemic Risk Management
  • SASB-LG-3 Critical Incident Risk Management
  • SASB-LG-5 Systemic Risk Management

SOC for Cybersecurity - Cybersecurity Risk Management Examination · 4 controls

  • SOC-CY-DC1 Nature of Business and Operations
  • SOC-CY-DC3 Cybersecurity Risk Management Objectives
  • SOC-CY-DC4 Governance Structure
  • SOC-CY-DC5 Risk Assessment Process

SSAE 18 - Attestation Standards (SOC Reporting) · 4 controls

  • SSAE18-CC3.1 CC3.1 - COSO Principle 6: Risk Identification
  • SSAE18-CC3.2 CC3.2 - COSO Principle 7: Risk Analysis
  • SSAE18-CC9.2 CC9.2 - Vendor and Business Partner Risk Management
  • SSAE18-SOC1-02 Risk Assessment

Security of Critical Infrastructure Act 2018 (SOCI) · 4 controls

  • SOCI-S30AC Obligation to adopt a CIRMP
  • SOCI-S30AD Compliance with CIRMP
  • SOCI-S30AE Annual review of CIRMP
  • SOCI-S30CU Vulnerability assessments

API 1164 · 3 controls

  • API1164-07 Remote Access
  • API1164-21 TSA Pipeline Security Directive Alignment
  • API1164-24 Vulnerability assessment for critical systems

BSI IT-Grundschutz · 3 controls

  • BSI-13 Risk assessment procedures
  • BSI-15 Security categorization
  • BSI-17 Continuous monitoring strategy

FFIEC IT Examination Handbook · 3 controls

  • FFIEC-03 Risk appetite and tolerance for IT risk
  • FFIEC-18 Ongoing monitoring and assessment
  • FFIEC-20 Exit strategy and transition planning

FISMA · 3 controls

  • FISMA-3554-Agency-Responsibilities Federal Agency Responsibilities (44 USC 3554) - CIO + CISO + Program + Reporting
  • FISMA-CIRCIA-ZTA-EO14028 CIRCIA, Zero Trust Architecture, EO 14028 + 14110 + OMB Memoranda
  • FISMA-NIST-800-53-RMF-800-171-FIPS Operationalisation via NIST 800-53 + 800-37 RMF + 800-171 + FIPS 199 + FIPS 200

IEC 60601-1 - Medical Electrical Equipment Safety · 3 controls

  • 60601-1.4.1 General requirements
  • 60601-1.4.2 Risk management process
  • 60601-1.5.1 General requirements for testing

IEC 62304:2015 Medical Device Software Lifecycle Processes · 3 controls

  • IEC62304-4.1 Quality Management System
  • IEC62304-5.1 Software Development Planning
  • IEC62304-7.4 Risk Management of Software Changes

IEC 62443 · 3 controls

  • IEC62443-07 Personnel risk assessment
  • IEC62443-21 Supply chain risk management for critical components
  • IEC62443-24 Vulnerability assessment for critical systems

IEEE 1686 · 3 controls

  • IEEE1686-IR-Recovery-Reporting-Exercises-Drills-RECOV IEEE 1686 - Incident Response + Recovery from Failed Update + Reporting to Authorities + Coordination with Sector-Specific Agencies + Exercises and Drills
  • IEEE1686-Section5.1-AccessControl-Accounts-Roles-Password-Session-Remote IEEE 1686 Section 5.1 - Electronic Access Account Management + Roles + Password + Failed Login + Session + Remote Access + Personnel
  • IEEE1686-SupplyChain-Documentation-Procurement-ComplianceTable-Physical IEEE 1686 Section 6 IED Security Documentation + Supply Chain + Procurement Specification + Appendix A Compliance Table + Physical and Tamper

ISO/IEC 27003:2017 · 3 controls

  • ISO27003-6.1 Actions to address risks and opportunities
  • ISO27003-8.2 Information security risk assessment
  • ISO27003-8.3 Information security risk treatment

ISO/IEC 27019:2024 · 3 controls

  • ISO27019-07 Personnel risk assessment
  • ISO27019-21 Supply chain risk management for critical components
  • ISO27019-24 Vulnerability assessment for critical systems

ISO/IEC 29134:2023 · 3 controls

  • 29134-1 Scope
  • 29134-3 Terms and definitions
  • 29134-9.1 PIA report structure

NIST Privacy Framework · 3 controls

  • NISTPF-1 Identify-P - Business Environment, Data Processing Inventory, Ecosystem, and Risk Assessment
  • NISTPF-2 Govern-P - Governance Policies, Risk Management Strategy, Awareness Training, and Monitoring
  • NISTPF-8 Protect-P Information Protection Processes (PR.PO-P)

NIST SP 1800-32 · 3 controls

NIST SP 800-39 · 3 controls

  • NISTSP39-3 Risk Assessing: Organisation, Mission, and System Level Assessments
  • NISTSP39-4 Risk Responding: Identify, Evaluate, Decide, Implement
  • NISTSP39-5 Risk Monitoring: Effectiveness, Changes, Compliance, and Reassessment Triggers

Nevada Gaming Control Board Cybersecurity Requirements · 3 controls

  • NGCB-1 Regulation 5.260 Scope, Applicability, and Licensee Categories
  • NGCB-5 Technical Security Controls - Access + Network + Encryption + Vulnerability + Logging
  • NGCB-8 Annual Independent Cybersecurity Assessment + Reporting + Board Oversight

PCI P2PE · 3 controls

  • PCI-P2PE-16 Due diligence and onboarding
  • PCI-P2PE-18 Ongoing monitoring and assessment
  • PCI-P2PE-19 Concentration risk management

PCI PIN Security · 3 controls

  • PCI-PIN-16 Due diligence and onboarding
  • PCI-PIN-18 Ongoing monitoring and assessment
  • PCI-PIN-19 Concentration risk management

PCI SSF · 3 controls

  • PCI-SSF-03 Risk appetite and tolerance for IT risk
  • PCI-SSF-16 Due diligence and onboarding
  • PCI-SSF-17 Contractual security requirements

Responsible Minerals Initiative (RMI) - Responsible Minerals Assurance Process · 3 controls

  • RMI-DD-2 Supply Chain Information Collection
  • RMI-SEG-2 Environmental Standards
  • RMI-SEG-3 OHS and Governance

Solvency II · 3 controls

  • SII-P2-11 Remuneration Policy
  • SII-P2-12 Written Policies
  • SII-P3-06 SFCR Section B: System of Governance

UAE Virtual Asset Regulatory Authority (VARA) Regulations · 3 controls

  • CRM-1 AML/CFT Compliance
  • CRM-3 Risk Management Framework
  • CRM-4 Business Risk Assessment

AML/CTF Act 2006 (Australia) · 2 controls

  • AMLCTF-82 Part A Compliance
  • AMLCTF-PartA-RiskAssess ML/TF Risk Assessment

APRA CPS 234 · 2 controls

  • CPS234-16 Assessment of Related Party and Third Party Capability
  • CPS234-20 Information Asset Classification

APRA SPS 220 Risk Management (Superannuation) · 2 controls

  • SPS220-22 Framework Enabling Strategies, Policies, Procedures and Controls
  • SPS220-28 Annual Board Risk Management Declaration

Authorised Economic Operator (AEO) Programmes - Global Standards · 2 controls

  • P1-S1 Advance Electronic Information
  • P1-S2 Risk-Management Systems

BS 65000:2014 - Guidance on Organizational Resilience · 2 controls

  • BS65000-RM-01 Resilience Journey
  • BS65000-RM-02 Integrated Approach

FBI CJIS Security Policy · 2 controls

  • CJIS-17 Risk Assessment
  • CJIS-19 Supply Chain Risk Management

FFIEC Cybersecurity Assessment Tool (CAT) · 2 controls

  • CAT-D1-2 Risk management
  • CAT-ML-2 Evolving

FedRAMP High · 2 controls

  • IR-2 Incident Response Training
  • RA-1 Policy and Procedures

FedRAMP Moderate · 2 controls

  • IR-2 Incident Response Training
  • RA-1 Policy and Procedures

FedRAMP Rev 5 · 2 controls

  • FedRAMP-Boundary Authorization Boundary, SSP, SAR, POA&M documentation
  • FedRAMP-SupplyChain-SBOM FedRAMP supply chain risk management + SBOM (per EO 14028 + NIST 800-218 SSDF)

French Sapin II Law (Law No. 2016-1691) · 2 controls

  • Sapin2-Pillar3-Risk-Mapping Pillar 3 - Corruption Risk Mapping (Cartographie des Risques)
  • Sapin2-Pillar4-ThirdParty-DueDiligence Pillar 4 - Third-Party Due Diligence (Clients, Suppliers, Intermediaries, M&A)

German Supply Chain Due Diligence Act (LkSG) · 2 controls

Ghana Cybersecurity Act · 2 controls

  • GhCSA-CII-Designation-Plan-Audit-Risk CII Designation, Registration, Cybersecurity Plan, Audit and Risk Assessment
  • GhCSA-Implementation-Roadmap Implementation Roadmap - Organizational Roles, Tooling and Metrics

IAIS Insurance Core Principles (ICPs) · 2 controls

  • ICP-16 Enterprise Risk Management for Solvency Purposes
  • ICP-8 Risk Management and Internal Controls

IATF 16949:2016 - Quality Management System for Automotive Production · 2 controls

  • IATF16949-Clause6-Planning-Risk-Contingency-Objectives-Change IATF 16949 Clause 6 - Planning + Risks and Opportunities + Contingency Plans + Quality Objectives + Change
  • IATF16949-Clause8-Operation-APQP-Design-Production-ControlPlan-SpecialChars IATF 16949 Clause 8 - Operation Planning + APQP + Design + Special Characteristics + Production + Control Plan + Set-Up Verification

ICAO Annex 17 - Aviation Security (AVSEC) · 2 controls

  • ICAO-ANX17-Chap2-ThreatAssessment-RiskManagement-Cyber-GASeP ICAO Annex 17 Chapter 2 - Threat Assessment + Risk Management + Cyber Threats to Critical Aviation Systems (Amendment 17/18)
  • ICAO-ANX17-Chap4-Cargo-Mail-Catering-Stores-Supplies-RegulatedAgent-KnownConsignor ICAO Annex 17 Chapter 4 - Cargo + Mail + Catering + Stores + Supplies Security + Regulated Agent + Known Consignor + Supply Chain

IEEE 7000 · 2 controls

  • IEEE7000-EthicalRisk-Identification-Analysis-Treatment-ValidationOutcomes IEEE 7000 Clauses 8 + 8.1 + 8.2 - Ethical Risk Identification + Analysis + Treatment + Validation of Ethical Outcomes + AI Safety + Robustness + Adversarial Protection
  • IEEE7000-Values-Elicitation-Prioritisation-IEEE7000Family-Bias-Privacy-Transparency IEEE 7000 Clauses 6 + 6.1 - Ethical Values Elicitation + Prioritisation + IEEE 7000 Family Integration (Bias + Privacy + Transparency + Wellbeing)

IRM/AIRMIC/ALARM A Risk Management Standard (2002) · 2 controls

  • IRM-Process-Identification-Analysis-Evaluation-Treatment-Monitoring-Review-ISO31000-Aligned IRM Risk Management Process - 5-Stage Cycle + Identification + Analysis (Inherent/Residual) + Evaluation + Treatment (4Ts Tolerate/Treat/Transfer/Terminate) + Monitoring + Review + Communication + Risk Register
  • IRM-RiskCategories-Strategic-Financial-Operational-Knowledge-FOIL-External-Internal-DownsideUpside IRM Four Risk Categories - Strategic + Financial + Operational + Knowledge + FOIL Typology + External vs Internal + Downside Threats and Upside Opportunities + Risk Universe

Lloyd's of London Cyber Insurance Requirements and Underwriting Standards · 2 controls

  • LLOYDS-CI-Risk-Selection-Cyber-Hygiene-Underwriting-Criteria-Pre-Bind-Risk-Engineering-MFA-Backup-EDR Lloyds Cyber Insurance Risk Selection + Hygiene + Pre-Bind Engineering
  • LLOYDS-CI-Systemic-Cyber-Risk-Aggregation-Cyber-Catastrophe-Modelling-Vendor-Use-RDS-Scenario-Testing Lloyds Cyber Insurance Systemic Aggregation + Catastrophe Modelling + RDS

NAIC Insurance Data Security Model Law (MDL-668) · 2 controls

  • NAIC-1 NAIC Model Law Adoption, Scope, and Licensee Definitions
  • NAIC-2 Information Security Program (ISP) - Section 4

NERC CIP · 2 controls

  • NERCCIP-5 System Security Management + Configuration Change Management and Vulnerability Assessments (CIP-007 + CIP-010)
  • NERCCIP-8 Supply Chain Risk Management (CIP-013)

NIST SP 800-82 Revision 3: Guide to Industrial Control Systems (ICS) Security · 2 controls

  • NISTSP82-1 OT Security Program Governance, Policy, Roles, and Safety-Security Integration
  • NISTSP82-2 OT Risk Assessment and Threat/Vulnerability Identification

NRF Cybersecurity and Data Privacy Framework (National Retail Federation) · 2 controls

  • NRFCS-1 Retail Cybersecurity Governance, Policy, and Regulatory Change Management
  • NRFCS-2 Risk Assessment, Customer Data Inventory, Classification, and Retail Threat Model

Nebraska Data Privacy Act · 2 controls

  • NDPA-1 Applicability, Scope, and Carve-Outs
  • NDPA-7 Data Protection Assessments and Processor Contracts

New Zealand Information Security Manual (NZISM) · 2 controls

  • NZISM-1 NZISM Governance, Documentation, and Classification System
  • NZISM-3 Personnel Security, Physical Security, and Cryptography

Nigeria Data Protection Act 2023 (NDPA) · 2 controls

  • NG-NDPA-1 Scope, Applicability, and Establishment of Nigeria Data Protection Commission
  • NG-NDPA-7 Cross-Border Data Transfers and International Cooperation

OCC Heightened Standards (12 CFR Part 30, Appendix D) · 2 controls

  • OCCHS-3 Risk Appetite Statement, Risk Limits, Concentration Risk, and Limit Breach Protocols
  • OCCHS-7 Risk Data Aggregation, Reporting, Talent, Compensation, and Strategic Planning

OECD AI Principles · 2 controls

  • OECDAI-3 Robustness, Security, Safety, and Adversarial Attack Protection
  • OECDAI-5 Data Governance, Training Data Quality, Privacy, and Bias Mitigation

OSFI B-13 · 2 controls

  • OSFIB13-1 Governance, Risk Management, and Three Lines of Defense
  • OSFIB13-4 Third-Party Risk Management and Cloud

Own Risk and Solvency Assessment (ORSA) - NAIC Model Act · 2 controls

  • ORSA-S1 Guidance Manual Section 1: Description of the insurer's risk management framework
  • ORSA-S2 Guidance Manual Section 2: Insurer's assessment of risk exposures

PSD2 SCA · 2 controls

  • PSDTWO-1 Strong Customer Authentication (SCA) Core Requirements
  • PSDTWO-3 Common and Secure Communication, API Access for AISPs and PISPs

SQF Code Edition 9 - Safe Quality Food · 2 controls

  • 2.4.4 Hazard Analysis and Risk Assessment
  • 2.7.2 Food Fraud Plan

Singapore Government Instruction Manual on ICT&SS Management (IM8) · 2 controls

  • IM8-SEC.4 Vulnerability Management
  • IM8-TPM.4 Supply Chain Risk Management

South Korea ISMS-P · 2 controls

  • ISMSP-MS-02 Risk Management
  • ISMSP-SYS-04 Vulnerability Management

Switzerland New Federal Act on Data Protection (nFADP/nDSG, 2023) · 2 controls

  • CH-FADP-21 Data protection impact assessments
  • FADP-7 Data Protection Impact Assessment (Articles 9-10)

TISAX - Trusted Information Security Assessment Exchange · 2 controls

UNESCO Recommendation on the Ethics of AI · 2 controls

  • UNESCO-AI-PA1 Ethical Impact Assessment
  • UNESCOAI-1 Principles 1-3: Proportionality, Safety, Fairness

AICPA Privacy Management Framework (PMF) · 1 control

AS9100D - Aerospace Quality Management System · 1 control

  • AS9100D-8.1 Operational Planning and Control

ASIS SPC.1-2009 - Organizational Resilience Standard · 1 control

  • 4.3.1 Risk Assessment and Impact Analysis

AWWA Cybersecurity Guidance for the Water Sector (American Water Works Association) · 1 control

  • AWWA-1.2 Risk Assessment

Aged Care Quality Standards 2019 (repealed edition) · 1 control

  • ACQS-8-4 Risk Management

Bahrain PDPL · 1 control

Barbados Data Protection Act 2019 · 1 control

  • BB-DPA-20 Sections 50-60 - Registration and Responsibilities

Ecuador Ley Orgánica de Protección de Datos Personales (LOPDP) · 1 control

  • LOPDP-EC-Governance-DPO-ROPA-DPIA-Privacy-by-Design-Training-Articles-46-58-Compliance-Monitoring Ecuador LOPDP Governance + DPO + ROPA + DPIA + Privacy by Design + Training

FATF Recommendation 16 - Payment Transparency (Travel Rule) · 1 control

  • R.16-VATR.Unhosted Unhosted (self-hosted / non-custodial) wallet transfers - 2024 Targeted Update

FDA 21 CFR Part 11 · 1 control

  • Part11.CSV Computer system validation + risk-based approach (21 CFR §11.10(a) + 2003 FDA Scope and Application Guidance + 2023 CSA draft)

FSSC 22000 - Food Safety System Certification · 1 control

  • FSSC-Additional-Requirements-v6 FSSC 22000 Additional Requirements v6 (Food Defense + Food Fraud + Allergen + Environmental + Culture)

Family Educational Rights and Privacy Act (FERPA) · 1 control

  • FERPA-Safeguards-PTAC Data Security Safeguards for PII in Education Records (PTAC Best Practices, SPPO Guidance)

Federal Decree-Law No. 45 of 2021 on the Protection of Personal Data (UAE PDPL) · 1 control

  • UAE-PDPL-Art.18_19_20_21 Security measures, controller/processor relationship, DPIA (UAE PDPL Articles 18-21)

Florida Digital Bill of Rights (FDBR) · 1 control

  • FDBR-ControllerObligations-DPA-Notice Controller + Processor Obligations + Data Protection Assessments (Fla. Stat. 501.707, 501.708, 501.71, 501.711)

GDPR · 1 control

GLBA · 1 control

  • GLBA-Subordinate-Rules-Operationalisation GLBA Operationalisation through FTC Safeguards Rule, Privacy Rule, SEC Reg S-P and Banking-Agency Guidelines

GLI-33 - Gaming Laboratories International Event Wagering Systems · 1 control

  • GLI33-EventWagering-System-Architecture GLI-33 Event Wagering System Architecture, Wager Engine, Odds Engine and Risk Management

GLOBALG.A.P. Integrated Farm Assurance (IFA) Standard v6 · 1 control

  • GGAP-IFA-AllFarmBase-Mgmt-Workers-Env-Trace GLOBALG.A.P. IFA v6 All Farm Base (AF): Management, Workers, Environment, Traceability and Food Safety

HKMA SPM · 1 control

  • HKMA-SPM-OR-RR-SA-OperationalResilience HKMA SPM Operational Risk (OR-1), Operational Resilience (OR-2), Recovery Planning (RR-1), Outsourcing (SA-2)

IACS Unified Requirements E26/E27 - Cyber Resilience of Ships and On-Board Systems · 1 control

  • IACS-UR-E26-Identify-Plan-Risk-Survey-Documentation IACS UR E26 Identify Goal - Ship Cyber Resilience Plan + CBS Risk Assessment + Survey + Documentation

IAEA Nuclear Security Series - Computer Security at Nuclear Facilities (NSS-17-T Rev 1) · 1 control

ICH E6(R3) - Good Clinical Practice · 1 control

ICH Q10 - Pharmaceutical Quality System · 1 control

ICMM Mining Principles (2024 Update) · 1 control

  • ICMM-MP-P3-P4-HumanRights-RiskMgmt-UNGP-DueDiligence ICMM Mining Principles 3 + 4 - Human Rights (UNGPs Alignment) + Risk Management + Due Diligence

IMO Maritime Cybersecurity Guidelines (MSC-FAL.1/Circ.3/Rev.4) · 1 control

  • IMO-MSC-FAL-Identify-AssetInventory-ThreatsVulnerabilities-CyberRiskAssessment-RolesResponsibilities IMO MSC-FAL Identify Function - OT/IT Asset Inventory + Threats + Vulnerabilities + Cyber Risk Assessment + Roles and Responsibilities + Crew + CSO + DPA

ISMAP (Japan) · 1 control

ISO 15189:2022 - Medical Laboratories Requirements for Quality and Competence · 1 control

  • ISO-15189-5.6 Risk management

ISO 20400:2017 - Sustainable Procurement · 1 control

  • ISO-20400-4.5 Key considerations for sustainable procurement

ISO 22313:2020 - Guidance on Business Continuity Management Systems · 1 control

  • ISO-22313-8.2 Business impact analysis and risk assessment

ISO 22320:2018 · 1 control

  • ISO-22320-4.3 Risk-based approach

ISO 26262:2018 - Functional Safety for Road Vehicles · 1 control

  • ISO-26262-3-7 Hazard analysis and risk assessment (HARA)

ISO 27799:2025 · 1 control

  • ISO27799-06 Security management process and risk analysis

ISO 28001:2007 Supply Chain Security Management · 1 control

  • ISO28001-SA-04 Security Risk Treatment Planning

ISO/IEC 27031:2011 · 1 control

  • 27031-7.2 Resource Requirements

ISO/IEC 29147:2018 · 1 control

  • 29147-5.11 Researcher Safe Harbour and Legal Posture

Iceland Data Protection and Processing of Personal Data Act (Act No. 90/2018) · 1 control

India CERT-In Cyber Security Directions 2022 · 1 control

India DPDP Act · 1 control

Indiana Consumer Data Protection Act · 1 control

  • INCDPA-SensitiveData-Children-Consent-COPPA-DataProtectionAssessment-DPIA Indiana CDPA Sensitive Data + Consent for Sensitive Categories + Children Under 13 + COPPA Coordination + Data Protection Assessment (DPA) + High-Risk Processing

Indonesia PDP Law · 1 control

Iowa Consumer Data Protection Act · 1 control

Jamaica Data Protection Act 2020 · 1 control

Kentucky Consumer Data Protection Act · 1 control

Kuwait National Cybersecurity Framework · 1 control

LGPD · 1 control

  • LGPD-BR-Governance-Encarregado-DPO-ROPA-DPIA-Privacy-by-Design-Article-46-50-Codes-of-Conduct Brazil LGPD Governance + Encarregado (DPO) + ROPA + DPIA + Articles 46-50

Law No. 172-13 on the Protection of Personal Data · 1 control

  • DOM172-Supervisory-Authority-Cooperation-Sanctions-Penalties-Articles-77-79-Awareness-Training-Retention-DPO-Designation Dominican Republic Law 172-13 Supervisory Authority + Sanctions + Articles 77-79 + DPO + Awareness

Liechtenstein DPA · 1 control

MARS-E · 1 control

MDS2 (Medical Device) · 1 control

  • MDS2-Audit-Logging-AUDT-Integrity-IGAU-Cybersecurity-Risk-CYBR-Monitoring MDS2 Audit Controls + AUDT + Integrity + IGAU + Cybersecurity Risk + CYBR + Continuous Monitoring

MTCS (Singapore) · 1 control

  • MTCS-Governance-ISMS-Risk-HR-Lifecycle-Compliance-Cloud-Strategy-Roles-Responsibilities MTCS Governance + ISMS + Risk Management + HR Security + Cloud Service Lifecycle + Compliance + Roles

Malaysia PDPA 2010 · 1 control

  • MY-PDPA-DPO-Designation-Class-Data-User-Registration-DPIA-Code-Practice-Section-43A-2024-Amendment Malaysia PDPA Governance + DPO Section 43A + Class of Data User Registration + DPIA + Code of Practice

Maryland Online Data Privacy Act of 2024 · 1 control

Mauritius DPA · 1 control

  • MU-DPA-Cross-Border-Transfer-Section-36-Adequacy-SCC-BCR-Mauritius-Global-Business-IBC-Financial-Services Mauritius DPA Cross-Border + Section 36 + Adequacy + SCC + BCR + Mauritius Global Business + Financial Services

Mexico LFPDPPP · 1 control

  • MX-LFPDPPP-Cross-Border-Transfer-Articles-36-37-Reglamento-66-68-Domestic-International-APEC-CBPR-USMCA Mexico LFPDPPP Cross-Border + Articles 36-37 + Reglamento 66 + 68 + Domestic + International + APEC CBPR + USMCA

Minnesota Consumer Data Privacy Act · 1 control

  • MN-CDPA-Data-Privacy-Assessment-DPIA-Section-325O-07-Sensitive-Targeted-Sale-Profiling-AI-Consumer-Health Minnesota CDPA DPIA + Section 325O.07 + Sensitive + Targeted + Sale + Profiling + AI + Consumer Health

Monetary Authority of Singapore Technology Risk Management Guidelines · 1 control

  • MAS-TRM-Third-Party-IT-Audit-Chapters-14-15-Outsourcing-Notice-658-Concentration-Risk-Exit-Strategy MAS TRM Third Party + IT Audit + Chapters 14-15 + Outsourcing + Notice 658 + Concentration Risk + Exit Strategy

Montana Consumer Data Privacy Act · 1 control

  • MT-CDPA-Data-Protection-Assessment-MCA-30-14-2815-Sensitive-Targeted-Sale-Profiling-AG-Inspection Montana CDPA Data Protection Assessment + MCA 30-14-2815 + Sensitive + Targeted + Sale + Profiling + AG Inspection

NFPA 1600 - Standard on Continuity, Emergency, and Crisis Management · 1 control

  • NFPA1600-5.1 Risk Assessment

NIST SP 800-122 · 1 control

  • NISTSP122-8 Continuous Monitoring, Training, and Privacy Programme Governance

NIST SP 800-144 · 1 control

  • NISTSP144-1 Cloud Governance, Risk Assessment, and Provider Trust Evaluation

NIST SP 800-145 · 1 control

  • NISTSP145-7 Cloud Procurement Standards Aligned to NIST SP 800-145 Definition

NIST SP 800-146 · 1 control

  • NISTSP146-1 Cloud Adoption Strategy, Workload Suitability, and Decision Framework

NIST SP 800-190 · 1 control

NIST SP 800-66 · 1 control

  • NISTSP66-1 Security Management Process: Risk Analysis and Risk Management for ePHI

New Hampshire Data Privacy Act · 1 control

  • NHPA-7 Data Protection Assessments and Processor Contracts

New Jersey Data Privacy Act · 1 control

  • NJDPA-7 Data Protection Assessments and Processor Contracts

Nigeria Data Protection Regulation (NDPR) · 1 control

  • NGNDPR-5 Security of Personal Data, Breach Notification, and DPIA under NDPR Section 2.6-Security

Nigeria Open Banking Regulatory Framework (CBN, 2023) · 1 control

  • NGOB-1 Open Banking Registry Participation, Tiered Categorisation, and KYP

O-RAN WG11 Security Specification · 1 control

  • ORANWG11-1 O-RAN Threat Model, Risk Management, and Security Architecture

OECD Guidelines for Multinational Enterprises on Responsible Business Conduct (2023 Update) · 1 control

  • OECDMNE-5 Environment, Climate, and Biodiversity

OECD Recommendation on Artificial Intelligence (2024 Update) · 1 control

  • OECDAI24-3 Frontier Model Risk Management, Capability Disclosure, and Independent Evaluation

Open Banking Security · 1 control

  • OPENBANK-4 Third Party Provider (TPP) Onboarding, Directory Integration, Due Diligence

Oregon Consumer Privacy Act · 1 control

  • OREGONCPA-5 Data Protection Assessments, Privacy by Design, Security Practices

PDPA Singapore · 1 control

  • PDPASG-4 Children's Data, DPIA, and Privacy by Design

PDPA Thailand · 1 control

  • PDPATH-4 DPIA, Privacy by Design, Children's Data

PIC/S Guide to Good Manufacturing Practice for Medicinal Products · 1 control

  • PICSGMP-1 Chapter 1: Pharmaceutical Quality System (PQS) and Quality Risk Management

POPIA · 1 control

  • POPIASA-4 Special Personal Information, Children, Information Quality, Documentation

Personal Data Act (personopplysningsloven) · 1 control

  • NORWAY-4 DPIA, Privacy by Design, Records of Processing

Privacy Act 2020 · 1 control

  • NZPRV-6 IPP 13 Unique Identifiers, Privacy Impact Assessment, Privacy by Design

Protective Security Policy Framework (PSPF) Release 2026 · 1 control

  • PSPF24-1 Security Culture, Governance, Risk Management

Qatar DPL · 1 control

  • QATAR-7 DPO, Records, Retention, Marketing, Training

SANS Incident Handler's Handbook and PICERL Methodology · 1 control

  • PICERL-P2 Risk Assessment

SEC Climate Disclosure Rule · 1 control

  • SECCLIM-2 Risk Management: Identification, Assessment, Integration

Saudi Arabia PDPL · 1 control

  • SA-PDPL-21 Data protection impact assessments

Singapore AI Governance Framework · 1 control

  • AIGF-1.1 Risk Management and Internal Controls

Singapore Cybersecurity Act 2018 · 1 control

  • SCA-S10 Annual Risk Assessment

South Korea PIPA · 1 control

  • PIPA-CPO-DPO-Privacy-Officer-PIA-Personal-Information-Impact-Assessment-Articles-31-33 Korea PIPA CPO + DPO + Privacy Officer + PIA + Personal Information Impact Assessment + Articles 31-33

TSA Pipeline Cybersecurity Directives · 1 control

  • TSAPIPE-1 Cybersecurity Implementation Plan and Coordinator

Taiwan PDPA · 1 control

  • TAIWAN-3 Data Subject Rights

Telecommunications Sector Security Reforms (TSSR) · 1 control

  • TSSR-SEC-3 National Security Risk Management

Texas Data Privacy and Security Act (TDPSA) · 1 control

  • TEXASTDPSA-3 Sensitive Data, Children, Sale Notice

Turkey KVKK · 1 control

  • TURKEYKVKK-3 Special Categories and Sensitive Data

UK AI Regulation Framework · 1 control

  • UKAI-1 Risk-Based Approach and Pro-Innovation Principles

UK Age Appropriate Design Code (Children's Code) · 1 control

  • Standard 2 Data Protection Impact Assessments

UK FCA/PRA Operational Resilience Framework · 1 control

  • UKOPRES-3 Self-Assessment and Board Engagement

UK GDPR (UK General Data Protection Regulation) · 1 control

  • UKGDPRREG-3 Controller and Processor (Articles 24-43)

UK Modern Slavery Act 2015 · 1 control

  • s.54(5) Statement Content Requirements

UK Security and Emergency Measures Direction (SEMD) - Water Industry · 1 control

  • SEMD-SP-2 Risk Identification and Assessment

UNICEF Policy Guidance on AI for Children (2021) · 1 control

  • UNICEFAI-4 Transparency, Explanation, Adult Capacity

US Consumer Product Safety Act (CPSC) Manufacturer and Importer Duties · 1 control

  • CPSC-RA.3 Lifecycle Risk Assessment

Uruguay DPL · 1 control

  • URUGUAY-5 Database Registration with AGESIC URCDP

Vietnam PDPD · 1 control

  • VIETNAMPDP-3 Data Subject Rights

Virginia CDPA · 1 control

  • VIRGINIAVCDPA-3 Sensitive Data Consent and Children

Every mapping shown was judged rather than inferred from wording similarity, and the ones that failed review are published too. See the coverage reports and what was rejected.

Other controls in General Requirements (Annex 11)

Query this from an agent

The graph holds this control, the 370 it maps to, and the evidence behind each claim, over MCP and REST.

MCP endpointAll Annex 11 to EU GMP - Computerised Systems controls