Frameworks / German Supply Chain Due Diligence Act (LkSG) / LkSG-Sec4-RiskMgmt-Sec5-RiskAnalysis German Supply Chain Due Diligence Act (LkSG)
LkSG: Section 4 Risk Management System + Section 5 Annual Risk Analysis
German Supply Chain Due Diligence Act (LkSG) LkSG-Sec4-RiskMgmt-Sec5-RiskAnalysis: Section 4 Risk Management System + Section 5 Annual Risk Analysis LkSG Sections 4-5 - risk management system + risk analysis. SECTION 4 RISK MANAGEMENT SYSTEM: companies must establish an APPROPRIATE + EFFECTIVE risk management system to identify + prevent + mitigate + remediate human rights and environmental risks arising from own business operations + direct suppliers + (where substantiated knowledge) indirect suppliers; the system must be PROPORTIONATE + COMMENSURATE WITH the company's specific risk profile + size + sector + geographies. IN-HOUSE RESPONSIBILITY (Section 4(3)): companies must designate a HUMAN RIGHTS OFFICER or equivalent position with DIRECT REPORTING to senior management + adequate resources + independence + cross-functional authority. SECTION 5 RISK ANALYSIS (Annual + Ad-hoc): (a) ANNUAL risk analysis covering own business + direct suppliers; (b) AD-HOC analysis whenever new product + new business activity + new geography + substantial change + substantiated knowledge of risks; (c) WHEN: priority on high-risk geographies + sectors + commodities; (d) METHODOLOGY: identify + assess likelihood + severity + irreversibility + own contribution to risk; (e) RESULTS feed into POLICY STATEMENT (Sec.6) + PREVENTIVE MEASURES (Sec.6) + REMEDIAL ACTION (Sec.8) + COMPLAINTS PROCEDURE (Sec.9) + REPORTING (Sec.10). DATA SOURCES: industry intelligence + NGO reports + supplier surveys + audits + grievance data + government reports.
Maintained by Gerard Blokdyk · Verified against the published standard 31 May 2026 · Control text last updated 21 May 2026 What else in your programme already covers this This control maps to 187 controls across 93 other frameworks. If you already hold one of them, the evidence you collected for it is the starting point here rather than new work.
27557-1 Scope 27557-3 Terms and definitions 27557-4.3 Individual impact consideration 27557-6.3 Privacy risk assessment 27557-6.4 Privacy risk treatment 27557-6.6 Recording and reporting 27557-7.3 Risk-based privacy program implementation ISO23894-5.1 Leadership and Commitment ISO23894-5.2 AI Risk Management Integration ISO23894-5.5 Framework Evaluation ISO23894-6.3 AI Risk Assessment ISO23894-6.3.1 AI Risk Identification ISO23894-6.3.3 AI Risk Evaluation IS.D.OR.205 Information Security Risk Assessment IS.D.OR.210 Information Security Risk Treatment IS.I.OR.205 Information Security Risk Assessment IS.I.OR.210 Information Security Risk Treatment IS.I.OR.220 Information Security Risk Management CPS230-11 Identification, Assessment and Management of Operational Risk CPS230-16 Internal Audit Review of the Business Continuity Plan CPS230-37 Service Provider Management Policy CPS230-46 Ongoing Risk Management of Each Material Arrangement JP-AIG-Continuous-Monitoring-Lifecycle-Model-Evaluation-Performance-Drift-Post-Deployment Japan AI Guidelines Continuous Monitoring + AI System Lifecycle Management + Model Evaluation + Performance Drift + Concept Drift + Post-Deployment + Retraining Triggers + Safe Update + Decommissioning + Model Card Versioning JP-AIG-Fairness-Bias-Detection-Mitigation-Inclusive-AI-Discrimination-Prevention-10-Principles-2019-Heritage Japan AI Guidelines Fairness + Bias Detection + Mitigation + Inclusive AI + Discrimination Prevention + 10 Principles 2019 Heritage + Protected Attributes + Disparate Impact + Statistical Parity + Counterfactual Fairness JP-AIG-Safety-Validation-Testing-Robustness-AISI-AI-Safety-Institute-Pre-Deployment-Evaluation-Red-Teaming Japan AI Guidelines Safety + Validation + Testing + Robustness + AISI AI Safety Institute (14 Feb 2024) + Pre-Deployment Evaluation + Red Teaming + Capability Evaluations + AI Incident Database + Safe Deployment + AI Safety Reports JP-AIG-Scope-METI-MIC-AI-Guidelines-Business-v1.0-April2024-Society-5.0-Cabinet-Office-AI-Strategy-Council Japan AI Guidelines Scope + METI/MIC AI Guidelines for Business v1.0 (April 2024) + Society 5.0 + Cabinet Office AI Strategy Council + 10 Principles 2019 Heritage + Education + Literacy + Fair Competition + Innovation Principles API1164-07 Remote Access API1164-21 TSA Pipeline Security Directive Alignment API1164-24 Vulnerability assessment for critical systems BSI-13 Risk assessment procedures BSI-15 Security categorization BSI-17 Continuous monitoring strategy FFIEC-03 Risk appetite and tolerance for IT risk FFIEC-18 Ongoing monitoring and assessment FFIEC-20 Exit strategy and transition planning 60601-1.4.1 General requirements 60601-1.4.2 Risk management process 60601-1.5.1 General requirements for testing IEC62304-4.1 Quality Management System IEC62304-5.1 Software Development Planning IEC62304-7.4 Risk Management of Software Changes IEC62443-07 Personnel risk assessment IEC62443-21 Supply chain risk management for critical components IEC62443-24 Vulnerability assessment for critical systems IEEE1686-IR-Recovery-Reporting-Exercises-Drills-RECOV IEEE 1686 - Incident Response + Recovery from Failed Update + Reporting to Authorities + Coordination with Sector-Specific Agencies + Exercises and Drills IEEE1686-Section5.1-AccessControl-Accounts-Roles-Password-Session-Remote IEEE 1686 Section 5.1 - Electronic Access Account Management + Roles + Password + Failed Login + Session + Remote Access + Personnel IEEE1686-SupplyChain-Documentation-Procurement-ComplianceTable-Physical IEEE 1686 Section 6 IED Security Documentation + Supply Chain + Procurement Specification + Appendix A Compliance Table + Physical and Tamper ISO-20400-4.2 Principles of sustainable procurement ISO-20400-4.3 Core subjects of sustainable procurement ISO-20400-4.5 Key considerations for sustainable procurement ISO-26000-6.3.1 Due diligence ISO-26000-6.3.2 Human rights risk situations ISO-26000-6.3.3 Avoidance of complicity ISO27003-6.1 Actions to address risks and opportunities ISO27003-8.2 Information security risk assessment ISO27003-8.3 Information security risk treatment ISO27019-07 Personnel risk assessment ISO27019-21 Supply chain risk management for critical components ISO27019-24 Vulnerability assessment for critical systems 29134-1 Scope 29134-3 Terms and definitions 29134-9.1 PIA report structure NGCB-1 Regulation 5.260 Scope, Applicability, and Licensee Categories NGCB-5 Technical Security Controls - Access + Network + Encryption + Vulnerability + Logging NGCB-8 Annual Independent Cybersecurity Assessment + Reporting + Board Oversight CRM-1 AML/CFT Compliance CRM-3 Risk Management Framework CRM-4 Business Risk Assessment AMLCTF-82 Part A Compliance AMLCTF-PartA-RiskAssess ML/TF Risk Assessment CPS234-16 Assessment of Related Party and Third Party Capability CPS234-20 Information Asset Classification BS65000-RM-01 Resilience Journey BS65000-RM-02 Integrated Approach CJIS-17 Risk Assessment CJIS-19 Supply Chain Risk Management CAT-D1-2 Risk management CAT-ML-2 Evolving Sapin2-Pillar3-Risk-Mapping Pillar 3 - Corruption Risk Mapping (Cartographie des Risques) Sapin2-Pillar4-ThirdParty-DueDiligence Pillar 4 - Third-Party Due Diligence (Clients, Suppliers, Intermediaries, M&A) GhCSA-CII-Designation-Plan-Audit-Risk CII Designation, Registration, Cybersecurity Plan, Audit and Risk Assessment GhCSA-Implementation-Roadmap Implementation Roadmap - Organizational Roles, Tooling and Metrics HKMA-CRAF-Domain1-2-Governance-Identification HKMA C-RAF Domain 1 (Governance) + Domain 2 (Identification) - Cyber Strategy, Risk Management, Asset Management, Threat Assessment HKMA-CRAF-Domain3-4-Protection-Detection HKMA C-RAF Domain 3 (Protection) + Domain 4 (Detection) - Access, Data, Infrastructure, Application, Monitoring, Testing, Threat Intel ICP-16 Enterprise Risk Management for Solvency Purposes ICP-8 Risk Management and Internal Controls IATF16949-Clause6-Planning-Risk-Contingency-Objectives-Change IATF 16949 Clause 6 - Planning + Risks and Opportunities + Contingency Plans + Quality Objectives + Change IATF16949-Clause8-Operation-APQP-Design-Production-ControlPlan-SpecialChars IATF 16949 Clause 8 - Operation Planning + APQP + Design + Special Characteristics + Production + Control Plan + Set-Up Verification IEEE7000-EthicalRisk-Identification-Analysis-Treatment-ValidationOutcomes IEEE 7000 Clauses 8 + 8.1 + 8.2 - Ethical Risk Identification + Analysis + Treatment + Validation of Ethical Outcomes + AI Safety + Robustness + Adversarial Protection IEEE7000-Values-Elicitation-Prioritisation-IEEE7000Family-Bias-Privacy-Transparency IEEE 7000 Clauses 6 + 6.1 - Ethical Values Elicitation + Prioritisation + IEEE 7000 Family Integration (Bias + Privacy + Transparency + Wellbeing) IRM-Process-Identification-Analysis-Evaluation-Treatment-Monitoring-Review-ISO31000-Aligned IRM Risk Management Process - 5-Stage Cycle + Identification + Analysis (Inherent/Residual) + Evaluation + Treatment (4Ts Tolerate/Treat/Transfer/Terminate) + Monitoring + Review + Communication + Risk Register IRM-RiskCategories-Strategic-Financial-Operational-Knowledge-FOIL-External-Internal-DownsideUpside IRM Four Risk Categories - Strategic + Financial + Operational + Knowledge + FOIL Typology + External vs Internal + Downside Threats and Upside Opportunities + Risk Universe LLOYDS-CI-Risk-Selection-Cyber-Hygiene-Underwriting-Criteria-Pre-Bind-Risk-Engineering-MFA-Backup-EDR Lloyds Cyber Insurance Risk Selection + Hygiene + Pre-Bind Engineering LLOYDS-CI-Systemic-Cyber-Risk-Aggregation-Cyber-Catastrophe-Modelling-Vendor-Use-RDS-Scenario-Testing Lloyds Cyber Insurance Systemic Aggregation + Catastrophe Modelling + RDS NISTPF-1 Identify-P - Business Environment, Data Processing Inventory, Ecosystem, and Risk Assessment NISTPF-2 Govern-P - Governance Policies, Risk Management Strategy, Awareness Training, and Monitoring OCCHS-3 Risk Appetite Statement, Risk Limits, Concentration Risk, and Limit Breach Protocols OCCHS-7 Risk Data Aggregation, Reporting, Talent, Compensation, and Strategic Planning ASTWO-1 Audit Planning, Scaling, Risk Assessment, and Integration ASTWO-3 Entity-Level Controls and Period-End Financial Reporting Process 2.4.4 Hazard Analysis and Risk Assessment 2.7.2 Food Fraud Plan IM8-SEC.4 Vulnerability Management IM8-TPM.4 Supply Chain Risk Management ISMSP-MS-02 Risk Management ISMSP-SYS-04 Vulnerability Management CH-FADP-21 Data protection impact assessments FADP-7 Data Protection Impact Assessment (Articles 9-10) AS9100D-8.1 Operational Planning and Control 4.3.1 Risk Assessment and Impact Analysis BB-DPA-20 Sections 50-60 - Registration and Responsibilities LOPDP-EC-Governance-DPO-ROPA-DPIA-Privacy-by-Design-Training-Articles-46-58-Compliance-Monitoring Ecuador LOPDP Governance + DPO + ROPA + DPIA + Privacy by Design + Training UAE-PDPL-Art.18_19_20_21 Security measures, controller/processor relationship, DPIA (UAE PDPL Articles 18-21) GLBA-Subordinate-Rules-Operationalisation GLBA Operationalisation through FTC Safeguards Rule, Privacy Rule, SEC Reg S-P and Banking-Agency Guidelines GLI33-EventWagering-System-Architecture GLI-33 Event Wagering System Architecture, Wager Engine, Odds Engine and Risk Management GGAP-IFA-AllFarmBase-Mgmt-Workers-Env-Trace GLOBALG.A.P. IFA v6 All Farm Base (AF): Management, Workers, Environment, Traceability and Food Safety CBPR-9-APEC-Privacy-Principles Global CBPR Forum: 9 APEC Privacy Principles (Notice + Collection + Uses + Choice + Integrity + Security + Access + Accountability + Preventing Harm) HKMA-SPM-OR-RR-SA-OperationalResilience HKMA SPM Operational Risk (OR-1), Operational Resilience (OR-2), Recovery Planning (RR-1), Outsourcing (SA-2) IACS-UR-E26-Identify-Plan-Risk-Survey-Documentation IACS UR E26 Identify Goal - Ship Cyber Resilience Plan + CBS Risk Assessment + Survey + Documentation ICMM-MP-P3-P4-HumanRights-RiskMgmt-UNGP-DueDiligence ICMM Mining Principles 3 + 4 - Human Rights (UNGPs Alignment) + Risk Management + Due Diligence IMO-MSC-FAL-Identify-AssetInventory-ThreatsVulnerabilities-CyberRiskAssessment-RolesResponsibilities IMO MSC-FAL Identify Function - OT/IT Asset Inventory + Threats + Vulnerabilities + Cyber Risk Assessment + Roles and Responsibilities + Crew + CSO + DPA ISO-15189-5.6 Risk management ISO-22313-8.2 Business impact analysis and risk assessment ISO-22320-4.3 Risk-based approach ISO-26262-3-7 Hazard analysis and risk assessment (HARA) ISO27799-06 Security management process and risk analysis ISO28001-SA-04 Security Risk Treatment Planning 27031-7.2 Resource Requirements 29147-5.11 Researcher Safe Harbour and Legal Posture INCDPA-SensitiveData-Children-Consent-COPPA-DataProtectionAssessment-DPIA Indiana CDPA Sensitive Data + Consent for Sensitive Categories + Children Under 13 + COPPA Coordination + Data Protection Assessment (DPA) + High-Risk Processing LGPD-BR-Governance-Encarregado-DPO-ROPA-DPIA-Privacy-by-Design-Article-46-50-Codes-of-Conduct Brazil LGPD Governance + Encarregado (DPO) + ROPA + DPIA + Articles 46-50 DOM172-Supervisory-Authority-Cooperation-Sanctions-Penalties-Articles-77-79-Awareness-Training-Retention-DPO-Designation Dominican Republic Law 172-13 Supervisory Authority + Sanctions + Articles 77-79 + DPO + Awareness OECDMNE-1 Concepts and General Policies, Risk-Based Due Diligence Framework AUPRV-6 Sensitive Information, PIA, Privacy by Design, Children PSPF24-1 Security Culture, Governance, Risk Management AIGF-1.1 Risk Management and Internal Controls PIPA-CPO-DPO-Privacy-Officer-PIA-Personal-Information-Impact-Assessment-Articles-31-33 Korea PIPA CPO + DPO + Privacy Officer + PIA + Personal Information Impact Assessment + Articles 31-33 TURKEYKVKK-3 Special Categories and Sensitive Data UNGPBHR-2 Pillar II: Corporate Responsibility to Respect Human Rights CPSC-RA.3 Lifecycle Risk Assessment VERMONTAICDA-4 Vermont AG Enforcement and Cure VIETNAMCYBER-4 Incident Reporting and Cooperation VPSHR-3 Implementation Guidance and Reporting Every mapping shown was judged rather than inferred from wording similarity, and the ones that failed review are published too. See the coverage reports and what was rejected .
Query this from an agent The graph holds this control, the 187 it maps to, and the evidence behind each claim, over MCP and REST.