APRA CPS 220 Risk Management CPS220-P36: Monitoring of Policy Review Dates and Ownership

What else in your programme already covers this

This control maps to 15 controls across 10 other frameworks. If you already hold one of them, the evidence you collected for it is the starting point here rather than new work.

Cloud Security Alliance Cloud Controls Matrix (CCM) v4.0.1 · 3 controls

CCM-GRC-01 Governance Program Policy and Procedures
CCM-GRC-03 Organizational Policy Reviews
CCM-GRC-06 Governance Responsibility Model

C5 (Germany) · 2 controls

C5-SP-01 Documentation, communication and provision of policies and instructions
C5-SP-02 Review and Approval of Policies and Instructions

HIPAA Security Rule · 2 controls

164.316(a) Policies and Procedures (Standard)
164.316(b)(2)(iii) Updates (Documentation)

NIST SP 800-53 Rev 5 · 2 controls

NIST800-PL-1 PL-1 Policy and Procedures
NIST800-RA-1 RA-1 Policy and Procedures

FedRAMP High · 1 control

AC-1 Policy and Procedures

FedRAMP Moderate · 1 control

AC-1 Policy and Procedures

NIST Cybersecurity Framework 2.0 · 1 control

NIST-CSF-GV.PO-02 Policy for managing cybersecurity risks is reviewed, updated, communicated, and enforced to reflect changes in requirements, threats, technology, and organizational mission

NIST SP 800-161 Rev 1 · 1 control

161R1-SR-1 Policy and Procedures

NIST SP 800-66 Rev 2 · 1 control

164.316(a) Policies and Procedures (Standard)

SOC 2 · 1 control

SOC2-CC5.3 CC5.3 Deploying controls through policies and procedures (COSO principle 12)

Every mapping shown was judged rather than inferred from wording similarity, and the ones that failed review are published too. See the coverage reports and what was rejected.