French Sapin II Law (Law No. 2016-1691)
Sapin II: Pillars 3+4 - Corruption Risk Mapping and Third-Party Due Diligence

French Sapin II Law (Law No. 2016-1691) Pillar3-Risk-Mapping: Pillar 3 - Corruption Risk Mapping (Cartographie des Risques)

Sapin II Pillar 3 - Corruption Risk Mapping (Cartographie des risques de corruption). REQUIREMENTS: a documented + risk-based + regularly-updated MAPPING of corruption risks across the organization. METHODOLOGY: (a) IDENTIFICATION of corruption risks per business activity + geography + counterparty + transaction type + product/service line; (b) ASSESSMENT of likelihood + impact (typically 4-tier scale very-low / low / medium / high + 4-tier impact financial / legal / reputational / operational); (c) RISK SCORING + heat map; (d) MITIGATION measures per risk; (e) RESIDUAL risk tracking; (f) ANNUAL REVIEW + after major events. AFA-PREFERRED FEATURES: workshop-based with cross-functional teams (business + legal + audit + finance); per-third-party scoring incorporating Transparency International Corruption Perception Index; integration with risk-based due diligence (Pillar 4); board reporting + audit committee oversight. INTEGRATION: with the company-wide ERM (Enterprise Risk Management) framework + COSO + ISO 31000.

Maintained by Gerard BlokdykVerified against the published standard Control text last updated

What else in your programme already covers this

This control maps to 207 controls across 133 other frameworks. If you already hold one of them, the evidence you collected for it is the starting point here rather than new work.

FTC GLBA Safeguards Rule (16 CFR Part 314) · 4 controls

BSI IT-Grundschutz · 3 controls

  • BSI-13 Risk assessment procedures
  • BSI-15 Security categorization
  • BSI-17 Continuous monitoring strategy

ISO 27005 · 3 controls

ISO 31000 · 3 controls

ISO/IEC 23894:2023 · 3 controls

ISO/IEC 29134:2023 · 3 controls

NIST SP 800-30 · 3 controls

  • NISTSP30-3 Threat Source and Threat Event Identification
  • NISTSP30-4 Vulnerability and Predisposing Condition Identification
  • NISTSP30-6 Risk Determination, Uncertainty, and Sensitivity Analysis

NIST SP 800-53 Rev 5 · 3 controls

Nevada Gaming Control Board Cybersecurity Requirements · 3 controls

  • NGCB-1 Regulation 5.260 Scope, Applicability, and Licensee Categories
  • NGCB-5 Technical Security Controls - Access + Network + Encryption + Vulnerability + Logging
  • NGCB-8 Annual Independent Cybersecurity Assessment + Reporting + Board Oversight

Responsible Minerals Initiative (RMI) - Responsible Minerals Assurance Process · 3 controls

API 1164 · 2 controls

EASA Part-IS - Information Security in Aviation · 2 controls

German Supply Chain Due Diligence Act (LkSG) · 2 controls

Ghana Cybersecurity Act · 2 controls

IATF 16949:2016 - Quality Management System for Automotive Production · 2 controls

ICAO Annex 17 - Aviation Security (AVSEC) · 2 controls

IEC 62443 · 2 controls

IEEE 1686 · 2 controls

IRM Enterprise Risk Management Framework (Institute of Risk Management) · 2 controls

ISO 27019 · 2 controls

ISO/IEC 27003:2017 · 2 controls

ISO/IEC 27014:2020 · 2 controls

ISO/IEC 27557:2022 - Organisational Privacy Risk Management · 2 controls

Lloyd's of London Cyber Insurance Requirements and Underwriting Standards · 2 controls

NAIC Insurance Data Security Model Law (MDL-668) · 2 controls

  • NAIC-1 NAIC Model Law Adoption, Scope, and Licensee Definitions
  • NAIC-2 Information Security Program (ISP) - Section 4

NIST Cybersecurity Framework 2.0 · 2 controls

  • NIST-CSF-GV.RM-07 Strategic opportunities (i.e., positive risks) are characterized and are included in organizational cybersecurity risk discussions
  • NIST-CSF-ID.RA-09 The authenticity and integrity of hardware and software are assessed prior to acquisition and use

NIST Privacy Framework · 2 controls

  • NISTPF-1 Identify-P - Business Environment, Data Processing Inventory, Ecosystem, and Risk Assessment
  • NISTPF-8 Protect-P Information Protection Processes (PR.PO-P)

NIST SP 1800-32 · 2 controls

NIST SP 800-37 · 2 controls

  • NISTSP37-2 RMF Categorize Step: Information and System Categorisation
  • NISTSP37-3 RMF Select Step: Security and Privacy Control Selection

Nebraska Data Privacy Act · 2 controls

  • NDPA-1 Applicability, Scope, and Carve-Outs
  • NDPA-7 Data Protection Assessments and Processor Contracts

New Zealand Information Security Manual (NZISM) · 2 controls

  • NZISM-1 NZISM Governance, Documentation, and Classification System
  • NZISM-3 Personnel Security, Physical Security, and Cryptography

Nigeria Data Protection Act 2023 (NDPA) · 2 controls

  • NG-NDPA-1 Scope, Applicability, and Establishment of Nigeria Data Protection Commission
  • NG-NDPA-7 Cross-Border Data Transfers and International Cooperation

Own Risk and Solvency Assessment (ORSA) - NAIC Model Act · 2 controls

  • ORSA-S1 ORSA Manual Section 1: Description of Insurer's Risk Management Framework
  • ORSA-S2 ORSA Manual Section 2: Insurer's Assessment of Risk Exposure

PCAOB AS 2201 - Audit of Internal Control Over Financial Reporting (ICFR) · 2 controls

  • ASTWO-1 Audit Planning, Scaling, Risk Assessment, and Integration
  • ASTWO-3 Entity-Level Controls and Period-End Financial Reporting Process

SQF Code Edition 9 - Safe Quality Food · 2 controls

  • 2.4.4 Hazard Analysis and Risk Assessment
  • 2.7.2 Food Fraud Plan

South Korea ISMS-P · 2 controls

Switzerland New Federal Act on Data Protection (nFADP/nDSG, 2023) · 2 controls

  • CH-FADP-21 Data protection impact assessments
  • FADP-7 Data Protection Impact Assessment (Articles 9-10)

UAE Virtual Asset Regulatory Authority (VARA) Regulations · 2 controls

  • CRM-1 AML/CFT Compliance
  • CRM-4 Business Risk Assessment

US Gramm-Leach-Bliley Act (GLBA) - Higher Education Safeguards Rule · 2 controls

AICPA Privacy Management Framework (PMF) · 1 control

AML/CTF Act 2006 (Australia) · 1 control

APRA CPS 230 Operational Risk Management · 1 control

  • CPS230-11 Identification, Assessment and Management of Operational Risk

ASIS SPC.1-2009 - Organizational Resilience Standard · 1 control

  • 4.3.1 Risk Assessment and Impact Analysis

AWWA Cybersecurity Guidance for the Water Sector (American Water Works Association) · 1 control

Annex 11 to EU GMP - Computerised Systems · 1 control

Authorised Economic Operator (AEO) Programmes - Global Standards · 1 control

  • P1-S1 Advance Electronic Information

Bahrain PDPL · 1 control

Barbados Data Protection Act 2019 · 1 control

  • BB-DPA-20 Sections 50-60 - Registration and Responsibilities

FBI CJIS Security Policy · 1 control

FSSC 22000 - Food Safety System Certification · 1 control

FedRAMP High · 1 control

  • RA-1 Policy and Procedures

FedRAMP Moderate · 1 control

  • RA-1 Policy and Procedures

Federal Decree-Law No. 45 of 2021 on the Protection of Personal Data (UAE PDPL) · 1 control

GDPR · 1 control

GLOBALG.A.P. Integrated Farm Assurance (IFA) Standard v6 · 1 control

HKMA Cyber Resilience Assessment Framework (C-RAF) · 1 control

IACS Unified Requirements E26/E27 - Cyber Resilience of Ships and On-Board Systems · 1 control

IAEA Nuclear Security Series - Computer Security at Nuclear Facilities (NSS-17-T Rev 1) · 1 control

IEEE 7000 · 1 control

IMO Maritime Cybersecurity Guidelines (MSC-FAL.1/Circ.3/Rev.2) · 1 control

ISMAP (Japan) · 1 control

ISO 13485 · 1 control

  • ISO13485-06 Security management process and risk analysis

ISO 22000 · 1 control

ISO 22313:2020 - Guidance on Business Continuity Management Systems · 1 control

ISO 26262:2018 - Functional Safety for Road Vehicles · 1 control

ISO 27017 · 1 control

ISO 27018 · 1 control

ISO 27799 · 1 control

  • ISO27799-06 Security management process and risk analysis

ISO 45001 · 1 control

ISO/IEC 27031:2011 · 1 control

ISO/IEC 29147:2018 · 1 control

  • 29147-5.11 Researcher Safe Harbour and Legal Posture

Iceland Data Protection and Processing of Personal Data Act (Act No. 90/2018) · 1 control

India CERT-In Cyber Security Directions 2022 · 1 control

India DPDP Act · 1 control

Indiana Consumer Data Protection Act · 1 control

Indonesia PDP Law · 1 control

Iowa Consumer Data Protection Act · 1 control

Jamaica Data Protection Act 2020 · 1 control

Japan AI Guidelines · 1 control

Kentucky Consumer Data Protection Act · 1 control

Kuwait National Cybersecurity Framework · 1 control

LGPD · 1 control

Law No. 172-13 on the Protection of Personal Data · 1 control

Ley Orgánica de Protección de Datos Personales (LOPDP) · 1 control

Liechtenstein DPA · 1 control

MARS-E · 1 control

MDS2 (Medical Device) · 1 control

MTCS (Singapore) · 1 control

Malaysia PDPA 2010 · 1 control

Maryland Online Data Privacy Act of 2024 · 1 control

Mauritius DPA · 1 control

Mexico LFPDPPP · 1 control

Minnesota Consumer Data Privacy Act · 1 control

Montana Consumer Data Privacy Act · 1 control

NERC CIP · 1 control

  • NERCCIP-5 System Security Management + Configuration Change Management and Vulnerability Assessments (CIP-007 + CIP-010)

NFPA 1600 - Standard on Continuity, Emergency, and Crisis Management · 1 control

NIST SP 800-122 · 1 control

  • NISTSP122-8 Continuous Monitoring, Training, and Privacy Programme Governance

NIST SP 800-144 · 1 control

  • NISTSP144-1 Cloud Governance, Risk Assessment, and Provider Trust Evaluation

NIST SP 800-145 · 1 control

  • NISTSP145-7 Cloud Procurement Standards Aligned to NIST SP 800-145 Definition

NIST SP 800-146 · 1 control

  • NISTSP146-1 Cloud Adoption Strategy, Workload Suitability, and Decision Framework

NIST SP 800-190 · 1 control

NIST SP 800-39 · 1 control

  • NISTSP39-3 Risk Assessing: Organisation, Mission, and System Level Assessments

NIST SP 800-53 Rev 5 LOW · 1 control

  • RA-1 Policy and Procedures

NIST SP 800-53 Rev 5 MODERATE · 1 control

  • RA-1 Policy and Procedures

NIST SP 800-53 Revision 5.1 HIGH · 1 control

  • RA-1 Policy and Procedures

NIST SP 800-66 · 1 control

  • NISTSP66-1 Security Management Process: Risk Analysis and Risk Management for ePHI

NIST SP 800-82 Revision 3: Guide to Industrial Control Systems (ICS) Security · 1 control

  • NISTSP82-2 OT Risk Assessment and Threat/Vulnerability Identification

NRF Cybersecurity and Data Privacy Framework (National Retail Federation) · 1 control

  • NRFCS-2 Risk Assessment, Customer Data Inventory, Classification, and Retail Threat Model

New Hampshire Data Privacy Act · 1 control

  • NHPA-7 Data Protection Assessments and Processor Contracts

New Jersey Data Privacy Act · 1 control

  • NJDPA-7 Data Protection Assessments and Processor Contracts

Nigeria Data Protection Regulation (NDPR) · 1 control

  • NGNDPR-5 Security of Personal Data, Breach Notification, and DPIA under NDPR Section 2.6-Security

Nigeria Open Banking Regulatory Framework (CBN, 2023) · 1 control

  • NGOB-1 Open Banking Registry Participation, Tiered Categorisation, and KYP

OECD AI Principles · 1 control

  • OECDAI-3 Robustness, Security, Safety, and Adversarial Attack Protection

OECD Guidelines for Multinational Enterprises on Responsible Business Conduct (2023 Update) · 1 control

  • OECDMNE-5 Environment, Climate, and Biodiversity

Oregon Consumer Privacy Act · 1 control

  • OREGONCPA-5 Data Protection Assessments, Privacy by Design, Security Practices

PDPA Singapore · 1 control

  • PDPASG-4 Children's Data, DPIA, and Privacy by Design

PDPA Thailand · 1 control

  • PDPATH-4 DPIA, Privacy by Design, Children's Data

POPIA · 1 control

  • POPIASA-4 Special Personal Information, Children, Information Quality, Documentation

Personal Data Act (personopplysningsloven) · 1 control

  • NORWAY-4 DPIA, Privacy by Design, Records of Processing

Privacy Act 1988 (Australia) · 1 control

  • AUPRV-6 Sensitive Information, PIA, Privacy by Design, Children

Privacy Act 2020 · 1 control

  • NZPRV-6 IPP 13 Unique Identifiers, Privacy Impact Assessment, Privacy by Design

Qatar DPL · 1 control

  • QATAR-7 DPO, Records, Retention, Marketing, Training

SANS Incident Handler's Handbook and PICERL Methodology · 1 control

Saudi Arabia PDPL · 1 control

Singapore Government Instruction Manual on ICT&SS Management (IM8) · 1 control

South Korea PIPA · 1 control

Turkey KVKK · 1 control

UK Defence Standard 05-138 - Cyber Security for Defence Suppliers · 1 control

UNICEF Policy Guidance on AI for Children (2021) · 1 control

  • UNICEFAI-4 Transparency, Explanation, Adult Capacity

US Consumer Product Safety Commission (CPSC) - Connected Product Safety · 1 control

Vermont Artificial Intelligence and Consumer Data Act (AICDA) · 1 control

Vietnam Law on Cybersecurity (No. 24/2018/QH14) · 1 control

Vietnam PDPD · 1 control

Every mapping shown was judged rather than inferred from wording similarity, and the ones that failed review are published too. See the coverage reports and what was rejected.

Other controls in Sapin II: Pillars 3+4 - Corruption Risk Mapping and Third-Party Due Diligence

Query this from an agent

The graph holds this control, the 207 it maps to, and the evidence behind each claim, over MCP and REST.

MCP endpointAll French Sapin II Law (Law No. 2016-1691) controls