AS9100D - Aerospace Quality Management System 8.1: Operational Planning and Control

What else in your programme already covers this

This control maps to 285 controls across 128 other frameworks. If you already hold one of them, the evidence you collected for it is the starting point here rather than new work.

NIST SP 800-53 Rev 5 · 6 controls

NIST800-CM-4 Impact analyses
NIST800-CM-9 Configuration management plan
NIST800-SA-10 Developer configuration management
NIST800-SR-11 Component authenticity
NIST800-SR-3 Supply chain controls and processes
NIST800-SR-8 Notification agreements

ISO/IEC 27557:2022 - Organisational Privacy Risk Management · 5 controls

27557-1 Scope
27557-3 Terms and definitions
27557-6.4 Privacy risk treatment
27557-6.6 Recording and reporting
27557-7.3 Risk-based privacy program implementation

FFIEC IT Examination Handbook · 4 controls

FFIEC-03 Risk appetite and tolerance for IT risk
FFIEC-10 Secure configuration standards
FFIEC-18 Ongoing monitoring and assessment
FFIEC-20 Exit strategy and transition planning

NIST Cybersecurity Framework 2.0 · 4 controls

NIST-CSF-GV.RM-03 Cybersecurity risk management activities and outcomes are included in enterprise risk management processes
NIST-CSF-GV.RM-04 Strategic direction that describes appropriate risk response options is established and communicated
NIST-CSF-GV.SC-01 A cybersecurity supply chain risk management program, strategy, objectives, policies, and processes are established and agreed to by organizational stakeholders
NIST-CSF-PR.PS-01 Configuration management practices are established and applied

NIST SP 800-171A Rev 3 - Assessing CUI Security Requirements · 4 controls

3.16 System and Services Acquisition
3.17 Supply Chain Risk Management
FEDRAMP-CM-1 Configuration Management Policy
FEDRAMP-CM-2 Baseline Configuration

PCI P2PE · 4 controls

PCI-P2PE-10 Secure configuration standards
PCI-P2PE-16 Due diligence and onboarding
PCI-P2PE-18 Ongoing monitoring and assessment
PCI-P2PE-19 Concentration risk management

PCI PIN Security · 4 controls

PCI-PIN-10 Secure configuration standards
PCI-PIN-16 Due diligence and onboarding
PCI-PIN-18 Ongoing monitoring and assessment
PCI-PIN-19 Concentration risk management

PCI SSF · 4 controls

PCI-SSF-03 Risk appetite and tolerance for IT risk
PCI-SSF-10 Secure configuration standards
PCI-SSF-16 Due diligence and onboarding
PCI-SSF-17 Contractual security requirements

SASB Standards · 4 controls

SASB-3 Leadership and Governance (LG)
SASB-LG-2 Systemic Risk Management
SASB-LG-3 Critical Incident Risk Management
SASB-LG-5 Systemic Risk Management

API 1164 · 3 controls

API1164-14 Physical Security
API1164-21 TSA Pipeline Security Directive Alignment
API1164-22 Configuration management for OT systems

APRA CPS 230 Operational Risk Management · 3 controls

CPS230-16 Internal Audit Review of the Business Continuity Plan
CPS230-37 Service Provider Management Policy
CPS230-46 Ongoing Risk Management of Each Material Arrangement

ASD Strategies to Mitigate Cyber Security Incidents · 3 controls

ASD37-04 User application hardening (Essential)
ASD37-10 Server application hardening (Very Good)
ASD37-11 Operating system hardening (Very Good)

BSI IT-Grundschutz · 3 controls

BSI-23 Baseline configuration establishment
BSI-24 Configuration change control
BSI-26 System component inventory

Belgium CyberFundamentals · 3 controls

BE-CF-23 Baseline configuration establishment
BE-CF-25 Security impact analysis
BE-CF-26 System component inventory

EASA Part-IS - Information Security in Aviation · 3 controls

IS.D.OR.210 Information Security Risk Treatment
IS.I.OR.210 Information Security Risk Treatment
IS.I.OR.220 Information Security Risk Management

FFIEC Cybersecurity Assessment Tool (CAT) · 3 controls

CAT-D1-2 Risk management
CAT-D3-3 Corrective controls
CAT-ML-2 Evolving

IEC 60601-1 - Medical Electrical Equipment Safety · 3 controls

60601-1.4.1 General requirements
60601-1.4.2 Risk management process
60601-1.5.1 General requirements for testing

IEC 62304:2015 Medical Device Software Lifecycle Processes · 3 controls

IEC62304-4.1 Quality Management System
IEC62304-5.1 Software Development Planning
IEC62304-7.4 Risk Management of Software Changes

IEC 62443 · 3 controls

IEC62443-14 System security hardening
IEC62443-21 Supply chain risk management for critical components
IEC62443-22 Configuration management for OT systems

ISO 27005 · 3 controls

ISO27005-01 Risk management policy and scope
ISO27005-05 Risk management integration
ISO27005-18 Risk register maintenance

ISO 27019 · 3 controls

ISO27019-14 System security hardening
ISO27019-21 Supply chain risk management for critical components
ISO27019-22 Configuration management for OT systems

ISO 31000 · 3 controls

ISO31000-01 Risk management policy and scope
ISO31000-05 Risk management integration
ISO31000-18 Risk register maintenance

ISO/IEC 23894:2023 · 3 controls

ISO23894-5.1 Leadership and Commitment
ISO23894-5.2 AI Risk Management Integration
ISO23894-5.5 Framework Evaluation

Japan AI Guidelines · 3 controls

JP-AIG-Continuous-Monitoring-Lifecycle-Model-Evaluation-Performance-Drift-Post-Deployment Japan AI Guidelines Continuous Monitoring + AI System Lifecycle Management + Model Evaluation + Performance Drift + Concept Drift + Post-Deployment + Retraining Triggers + Safe Update + Decommissioning + Model Card Versioning
JP-AIG-Fairness-Bias-Detection-Mitigation-Inclusive-AI-Discrimination-Prevention-10-Principles-2019-Heritage Japan AI Guidelines Fairness + Bias Detection + Mitigation + Inclusive AI + Discrimination Prevention + 10 Principles 2019 Heritage + Protected Attributes + Disparate Impact + Statistical Parity + Counterfactual Fairness
JP-AIG-Safety-Validation-Testing-Robustness-AISI-AI-Safety-Institute-Pre-Deployment-Evaluation-Red-Teaming Japan AI Guidelines Safety + Validation + Testing + Robustness + AISI AI Safety Institute (14 Feb 2024) + Pre-Deployment Evaluation + Red Teaming + Capability Evaluations + AI Incident Database + Safe Deployment + AI Safety Reports

NIST Privacy Framework · 3 controls

NISTPF-1 Identify-P - Business Environment, Data Processing Inventory, Ecosystem, and Risk Assessment
NISTPF-2 Govern-P - Governance Policies, Risk Management Strategy, Awareness Training, and Monitoring
NISTPF-8 Protect-P Information Protection Processes (PR.PO-P)

NIST SP 1800-32 · 3 controls

NIST1800-32-14 System security hardening
NIST1800-32-21 Supply chain risk management for critical components
NIST1800-32-22 Configuration management for OT systems

NIST SP 800-30 · 3 controls

NISTSP30-1 Risk Management Strategy and Risk Assessment Programme Establishment
NISTSP30-2 Three-Tier Risk Assessment Scoping (Organisation, Mission/Business, Information System)
NISTSP30-8 Risk Assessment Maintenance, Continuous Monitoring, and Integration with the RMF

OSFI B-13 · 3 controls

OSFIB13-1 Governance, Risk Management, and Three Lines of Defense
OSFIB13-3 Cyber Security: Identification, Protection, Detection, Response, Recovery
OSFIB13-4 Third-Party Risk Management and Cloud

PSD2 SCA · 3 controls

PSDTWO-1 Strong Customer Authentication (SCA) Core Requirements
PSDTWO-2 SCA Exemptions and Risk-Based Authentication
PSDTWO-3 Common and Secure Communication, API Access for AISPs and PISPs

SOC for Cybersecurity - Cybersecurity Risk Management Examination · 3 controls

SOC-CY-DC1 Nature of Business and Operations
SOC-CY-DC3 Cybersecurity Risk Management Objectives
SOC-CY-DC4 Governance Structure

Security of Critical Infrastructure Act 2018 (SOCI) · 3 controls

SOCI-S30AC Obligation to adopt a CIRMP
SOCI-S30AD Compliance with CIRMP
SOCI-S30AE Annual review of CIRMP

Solvency II · 3 controls

SII-P2-11 Remuneration Policy
SII-P2-12 Written Policies
SII-P3-06 SFCR Section B: System of Governance

APRA CPS 234 · 2 controls

CPS234-16 Assessment of Related Party and Third Party Capability
CPS234-20 Information Asset Classification

Annex 11 to EU GMP - Computerised Systems · 2 controls

Clause 1 Risk management
Clause 10 Change and configuration management

BS 65000:2014 - Guidance on Organizational Resilience · 2 controls

BS65000-RM-01 Resilience Journey
BS65000-RM-02 Integrated Approach

Bermuda Monetary Authority (BMA) Cyber Risk Management Code of Conduct · 2 controls

BMA-3 Operational Cyber Risk Management Programme
BMA-4 Chief Information Security Officer

FBI CJIS Security Policy · 2 controls

CJIS-19 Supply Chain Risk Management
CJIS-7 Configuration Management

FISMA · 2 controls

FISMA-3554-Agency-Responsibilities Federal Agency Responsibilities (44 USC 3554) - CIO + CISO + Program + Reporting
FISMA-NIST-800-53-RMF-800-171-FIPS Operationalisation via NIST 800-53 + 800-37 RMF + 800-171 + FIPS 199 + FIPS 200

FedRAMP Rev 5 · 2 controls

FedRAMP-Boundary Authorization Boundary, SSP, SAR, POA&M documentation
FedRAMP-SupplyChain-SBOM FedRAMP supply chain risk management + SBOM (per EO 14028 + NIST 800-218 SSDF)

HKMA Cyber Resilience Assessment Framework (C-RAF) · 2 controls

HKMA-CRAF-Domain1-2-Governance-Identification HKMA C-RAF Domain 1 (Governance) + Domain 2 (Identification) - Cyber Strategy, Risk Management, Asset Management, Threat Assessment
HKMA-CRAF-Domain3-4-Protection-Detection HKMA C-RAF Domain 3 (Protection) + Domain 4 (Detection) - Access, Data, Infrastructure, Application, Monitoring, Testing, Threat Intel

HKMA SPM · 2 controls

HKMA-SPM-OR-RR-SA-OperationalResilience HKMA SPM Operational Risk (OR-1), Operational Resilience (OR-2), Recovery Planning (RR-1), Outsourcing (SA-2)
HKMA-SPM-TM-Technology-TM-G-1-CRAF-Coord HKMA SPM Technology Management Modules (TM-G-1 to TM-G-4, TM-E-1) + Coordination with C-RAF

IAIS Insurance Core Principles (ICPs) · 2 controls

ICP-16 Enterprise Risk Management for Solvency Purposes
ICP-8 Risk Management and Internal Controls

ICAO Annex 17 - Aviation Security (AVSEC) · 2 controls

ICAO-ANX17-Chap2-ThreatAssessment-RiskManagement-Cyber-GASeP ICAO Annex 17 Chapter 2 - Threat Assessment + Risk Management + Cyber Threats to Critical Aviation Systems (Amendment 17/18)
ICAO-ANX17-Chap4-Cargo-Mail-Catering-Stores-Supplies-RegulatedAgent-KnownConsignor ICAO Annex 17 Chapter 4 - Cargo + Mail + Catering + Stores + Supplies Security + Regulated Agent + Known Consignor + Supply Chain

IEEE 1686 · 2 controls

IEEE1686-Section5.5-5.6-5.7-5.8-Firmware-ConfigSW-TimeSync-DataAtRest IEEE 1686 Section 5.5-5.8 - Firmware Quality + Configuration Software Security + Time Synchronisation + Data Protection at Rest + Patch + Malware + Hardening + Vulnerability
IEEE1686-SupplyChain-Documentation-Procurement-ComplianceTable-Physical IEEE 1686 Section 6 IED Security Documentation + Supply Chain + Procurement Specification + Appendix A Compliance Table + Physical and Tamper

IEEE 7000 · 2 controls

IEEE7000-EthicalRisk-Identification-Analysis-Treatment-ValidationOutcomes IEEE 7000 Clauses 8 + 8.1 + 8.2 - Ethical Risk Identification + Analysis + Treatment + Validation of Ethical Outcomes + AI Safety + Robustness + Adversarial Protection
IEEE7000-Values-Elicitation-Prioritisation-IEEE7000Family-Bias-Privacy-Transparency IEEE 7000 Clauses 6 + 6.1 - Ethical Values Elicitation + Prioritisation + IEEE 7000 Family Integration (Bias + Privacy + Transparency + Wellbeing)

ISO 27017 · 2 controls

ISO27017-19 Image and template hardening
ISO27017-20 Cloud configuration management

ISO 27018 · 2 controls

ISO27018-19 Image and template hardening
ISO27018-20 Cloud configuration management

ISO 37000:2021 - Governance of Organizations · 2 controls

ISO-37000-14.1 Risk governance
ISO-37000-14.2 Risk appetite and tolerance

ISO/IEC 23837 - Security Requirements for Quantum Key Distribution · 2 controls

27557-1 Scope
27557-3 Terms and definitions

ISO/IEC 27003:2017 · 2 controls

ISO27003-6.1 Actions to Address Risks and Opportunities
ISO27003-8.3 Information Security Risk Treatment

MTCS (Singapore) · 2 controls

MTCS-Governance-ISMS-Risk-HR-Lifecycle-Compliance-Cloud-Strategy-Roles-Responsibilities MTCS Governance + ISMS + Risk Management + HR Security + Cloud Service Lifecycle + Compliance + Roles
MTCS-Logging-Monitoring-Compliance-Audit-SLA-Configuration-SIEM-SOAR-Cloud-Monitoring-CSPM MTCS Logging + Monitoring + Compliance + Audit + SLA + Configuration + SIEM + SOAR + CSPM

Monetary Authority of Singapore Technology Risk Management Guidelines · 2 controls

MAS-TRM-Access-Cryptography-Network-Security-Chapters-9-10-MFA-PKI-Encryption-Network-Segmentation MAS TRM Access Control + Cryptography + Network + Chapters 9-10 + MFA + PKI + Encryption + Network Segmentation
MAS-TRM-Third-Party-IT-Audit-Chapters-14-15-Outsourcing-Notice-658-Concentration-Risk-Exit-Strategy MAS TRM Third Party + IT Audit + Chapters 14-15 + Outsourcing + Notice 658 + Concentration Risk + Exit Strategy

NERC CIP · 2 controls

NERCCIP-5 System Security Management + Configuration Change Management and Vulnerability Assessments (CIP-007 + CIP-010)
NERCCIP-8 Supply Chain Risk Management (CIP-013)

NIST SP 800-145 · 2 controls

NISTSP145-7 Cloud Procurement Standards Aligned to NIST SP 800-145 Definition
NISTSP145-8 Governance, Reporting, and Stakeholder Education on Cloud Definition

NIST SP 800-190 · 2 controls

NIST190-19 Image and template hardening
NIST190-20 Cloud configuration management

NIST SP 800-37 · 2 controls

NISTSP37-1 RMF Prepare Step: Organisation-Level and System-Level Preparation
NISTSP37-7 RMF Monitor Step: Continuous Monitoring and Ongoing Authorisation

NIST SP 800-39 · 2 controls

NISTSP39-4 Risk Responding: Identify, Evaluate, Decide, Implement
NISTSP39-5 Risk Monitoring: Effectiveness, Changes, Compliance, and Reassessment Triggers

NIST SP 800-82 Revision 3: Guide to Industrial Control Systems (ICS) Security · 2 controls

NISTSP82-1 OT Security Program Governance, Policy, Roles, and Safety-Security Integration
NISTSP82-5 OT Configuration Management, Patching, Vulnerability Management, and Malware Protection

NRF Cybersecurity and Data Privacy Framework (National Retail Federation) · 2 controls

NRFCS-1 Retail Cybersecurity Governance, Policy, and Regulatory Change Management
NRFCS-2 Risk Assessment, Customer Data Inventory, Classification, and Retail Threat Model

OCC Heightened Standards (12 CFR Part 30, Appendix D) · 2 controls

OCCHS-3 Risk Appetite Statement, Risk Limits, Concentration Risk, and Limit Breach Protocols
OCCHS-7 Risk Data Aggregation, Reporting, Talent, Compensation, and Strategic Planning

OECD AI Principles · 2 controls

OECDAI-3 Robustness, Security, Safety, and Adversarial Attack Protection
OECDAI-5 Data Governance, Training Data Quality, Privacy, and Bias Mitigation

Open Banking Security · 2 controls

OPENBANK-3 Mutual TLS, Token Binding, Request Signing (JWS), Key Management
OPENBANK-4 Third Party Provider (TPP) Onboarding, Directory Integration, Due Diligence

South Korea ISMS-P · 2 controls

ISMSP-MS-02 Risk Management
ISMSP-SYS-01 System Hardening and Patch Management

TISAX - Trusted Information Security Assessment Exchange · 2 controls

TISAX-IS-03 Third-Party Risk Management
TISAX-ISM-02 Risk Management

AML/CTF Act 2006 (Australia) · 1 control

AMLCTF-82 Part A Compliance

APRA SPS 220 Risk Management (Superannuation) · 1 control

SPS220-28 Annual Board Risk Management Declaration

AWWA Cybersecurity Guidance for the Water Sector (American Water Works Association) · 1 control

AWWA-4.3 Configuration Management

Aged Care Quality Standards 2019 (repealed edition) · 1 control

ACQS-8-4 Risk Management

Authorised Economic Operator (AEO) Programmes - Global Standards · 1 control

P1-S2 Risk-Management Systems

Automotive SPICE (ASPICE) v4.0 - Process Assessment Model · 1 control

SUP.8 Configuration Management

Canada ITSG-33 - IT Security Risk Management · 1 control

CA-ITSG33-SC-01 Security Control Catalogue

GAMP 5 - Good Automated Manufacturing Practice · 1 control

GAMP5-Supplier-Operations-Change-Periodic Supplier Assessment, Operational Phase, Change Control and Periodic Review

GLBA · 1 control

GLBA-Subordinate-Rules-Operationalisation GLBA Operationalisation through FTC Safeguards Rule, Privacy Rule, SEC Reg S-P and Banking-Agency Guidelines

GLI-33 - Gaming Laboratories International Event Wagering Systems · 1 control

GLI33-EventWagering-System-Architecture GLI-33 Event Wagering System Architecture, Wager Engine, Odds Engine and Risk Management

German Supply Chain Due Diligence Act (LkSG) · 1 control

LkSG-Sec4-RiskMgmt-Sec5-RiskAnalysis Section 4 Risk Management System + Section 5 Annual Risk Analysis

Ghana Cybersecurity Act · 1 control

GhCSA-Implementation-Roadmap Implementation Roadmap - Organizational Roles, Tooling and Metrics

Global Cross-Border Privacy Rules (Global CBPR) Forum · 1 control

CBPR-9-APEC-Privacy-Principles Global CBPR Forum: 9 APEC Privacy Principles (Notice + Collection + Uses + Choice + Integrity + Security + Access + Accountability + Preventing Harm)

IACS Unified Requirements E26/E27 - Cyber Resilience of Ships and On-Board Systems · 1 control

IACS-UR-E27-Equipment-Hardening-SecureConfig-Communications IACS UR E27 - Equipment Hardening + Secure Configuration + Secure Communications + Cryptography

IAEA Nuclear Security Series - Computer Security at Nuclear Facilities (NSS-17-T Rev 1) · 1 control

IAEA-NSS17-SystemIntegrity-Configuration-Change-Management IAEA NSS-17 - System Integrity + Configuration Management + Change Management + Baseline + Hardening

ICH E6(R3) - Good Clinical Practice · 1 control

ICH-E6-Scope-Principles-R3-2025-Risk-Based-DecentralisedClinical ICH E6 Good Clinical Practice - Scope + 13 Principles + R3 January 2025 + Risk-Based + Decentralised + Modernisation

ICH Q10 - Pharmaceutical Quality System · 1 control

ICH-Q10-Section1-Enablers-KnowledgeMgmt-QRM-FoundationICH-Q8-Q9 ICH Q10 Section 1 - PQS Enablers + Knowledge Management + Quality Risk Management (ICH Q9 Foundation)

ICMM Mining Principles (2024 Update) · 1 control

ICMM-MP-P3-P4-HumanRights-RiskMgmt-UNGP-DueDiligence ICMM Mining Principles 3 + 4 - Human Rights (UNGPs Alignment) + Risk Management + Due Diligence

IMO Maritime Cybersecurity Guidelines (MSC-FAL.1/Circ.3/Rev.2) · 1 control

IMO-MSC-FAL-Identify-AssetInventory-ThreatsVulnerabilities-CyberRiskAssessment-RolesResponsibilities IMO MSC-FAL Identify Function - OT/IT Asset Inventory + Threats + Vulnerabilities + Cyber Risk Assessment + Roles and Responsibilities + Crew + CSO + DPA

IRM Enterprise Risk Management Framework (Institute of Risk Management) · 1 control

IRM-Process-Identification-Analysis-Evaluation-Treatment-Monitoring-Review-ISO31000-Aligned IRM Risk Management Process - 5-Stage Cycle + Identification + Analysis (Inherent/Residual) + Evaluation + Treatment (4Ts Tolerate/Treat/Transfer/Terminate) + Monitoring + Review + Communication + Risk Register

ISMAP (Japan) · 1 control

ISMAP-CloudInfrastructure-NetworkSegmentation-Container-Serverless-WorkloadProtection-Hardening-ConfigManagement ISMAP Cloud Infrastructure - VPC Network Segmentation + Container/Serverless Security + Cloud Workload Protection (CWPP) + Image/Template Hardening + CIS Benchmarks + Configuration Management + IaC

ISO 14001:2015 · 1 control

8.1 Operational planning and control

ISO 14004:2016 · 1 control

8.1 Operational planning and control

ISO 15189:2022 - Medical Laboratories Requirements for Quality and Competence · 1 control

ISO-15189-5.6 Risk management

ISO 20000-1 · 1 control

ISO20000-10 Configuration management

ISO 20400:2017 - Sustainable Procurement · 1 control

ISO-20400-4.5 Key considerations for sustainable procurement

ISO 22000:2018 · 1 control

8.1 Operational planning and control

ISO 22301:2019 · 1 control

8.1 Operational planning and control

ISO 22320:2018 · 1 control

ISO-22320-4.3 Risk-based approach

ISO 26262:2018 - Functional Safety for Road Vehicles · 1 control

ISO-26262-8-7 Configuration management

ISO 27701:2019 · 1 control

5.6.1 Operational planning and control

ISO 28001:2007 Supply Chain Security Management · 1 control

ISO28001-SA-04 Security Risk Treatment Planning

ISO 37001:2016 · 1 control

8.1 Operational planning and control

ISO 37301:2021 · 1 control

8.1 Operational planning and control

ISO 45001:2018 · 1 control

8.1 Operational planning and control

ISO 50001:2018 - Energy Management Systems · 1 control

8.1 Operational planning and control

ISO 55001:2014 · 1 control

8.1 Operational planning and control

ISO 9001:2015 · 1 control

8.1 Operational planning and control

ISO/IEC 27400:2022 · 1 control

27400-6.4 Default Configuration Security

ISO/IEC 38500:2024 - Governance of IT · 1 control

38500-5.9 Risk governance

ISO/IEC 42001:2023 · 1 control

8.1 Operational planning and control

ITIL 4 · 1 control

ITIL4-10 Configuration management

Kuwait National Cybersecurity Framework · 1 control

KUWAIT-GOV-03 Risk Management Framework

Lloyd's of London Cyber Insurance Requirements and Underwriting Standards · 1 control

LLOYDS-CI-Risk-Selection-Cyber-Hygiene-Underwriting-Criteria-Pre-Bind-Risk-Engineering-MFA-Backup-EDR Lloyds Cyber Insurance Risk Selection + Hygiene + Pre-Bind Engineering

NIS2 Directive Implementing Acts · 1 control

NIS2I-2 Policy, Risk Management, and Roles + Responsibilities

NIST SP 800-144 · 1 control

NISTSP144-7 Cloud Workload Protection, Containers, Serverless, and Configuration

NIST SP 800-146 · 1 control

NISTSP146-4 IaaS Operational Recommendations and Workload Hardening

NRC 10 CFR 73.54 - Nuclear Facility Cybersecurity · 1 control

RG5.71-C.6 Configuration Management

New Zealand Information Security Manual (NZISM) · 1 control

NZISM-1 NZISM Governance, Documentation, and Classification System

O-RAN WG11 Security Specification · 1 control

ORANWG11-1 O-RAN Threat Model, Risk Management, and Security Architecture

OECD Recommendation on Artificial Intelligence (2024 Update) · 1 control

OECDAI24-3 Frontier Model Risk Management, Capability Disclosure, and Independent Evaluation

OWASP DevSecOps Maturity Model (DSOMM) · 1 control

DSOMM-3 Build, Deployment, Infrastructure Hardening, and Secrets Management

Oman National Cybersecurity Framework · 1 control

OMANCS-5 Network, Endpoint, System Development, and Configuration Security

Own Risk and Solvency Assessment (ORSA) - NAIC Model Act · 1 control

ORSA-S1 ORSA Manual Section 1: Description of Insurer's Risk Management Framework

PIC/S Guide to Good Manufacturing Practice for Medicinal Products · 1 control

PICSGMP-1 Chapter 1: Pharmaceutical Quality System (PQS) and Quality Risk Management

Protective Security Policy Framework (PSPF) Release 2024 · 1 control

PSPF24-1 Security Culture, Governance, Risk Management

SEC Climate Disclosure Rule · 1 control

SECCLIM-2 Risk Management: Identification, Assessment, Integration

SSAE 18 - Attestation Standards (SOC Reporting) · 1 control

SSAE18-CC9.2 CC9.2 - Vendor and Business Partner Risk Management

Secure by Design: A Guide for Manufacturers (CISA) · 1 control

CISABD-1 Take Ownership of Customer Security Outcomes

Singapore AI Governance Framework · 1 control

AIGF-1.1 Risk Management and Internal Controls

Singapore Government Instruction Manual on ICT&SS Management (IM8) · 1 control

IM8-TPM.4 Supply Chain Risk Management

Telecommunications Sector Security Reforms (TSSR) · 1 control

TSSR-SEC-3 National Security Risk Management

UAE Virtual Asset Regulatory Authority (VARA) Regulations · 1 control

CRM-3 Risk Management Framework

UK AI Regulation Framework · 1 control

UKAI-1 Risk-Based Approach and Pro-Innovation Principles

Every mapping shown was judged rather than inferred from wording similarity, and the ones that failed review are published too. See the coverage reports and what was rejected.