OCC Heightened Standards (12 CFR Part 30, Appendix D)
Risk Data, Talent, Compensation, Strategy

OCC Heightened Standards (12 CFR Part 30, Appendix D) OCCHS-7: Risk Data Aggregation, Reporting, Talent, Compensation, and Strategic Planning

Operate Risk Data Aggregation and Reporting + Talent Management + Compensation + Strategic Planning per 12 CFR Part 30 Appendix D Sections II.J + II.L + II.M + II.D. Risk Data Aggregation and Reporting per Section II.J must (a) provide the Board + senior management + Independent Risk Management with timely + accurate + comprehensive + consistent + relevant risk information across business lines + risk categories + with appropriate granularity, (b) align with BCBS 239 Principles for Effective Risk Data Aggregation and Risk Reporting as supervisory expectation for global systemically important banks, (c) integrate technology + data governance + data quality + reconciliation processes + capability to produce risk reports under stress conditions. Strategic Plan per Section II.D must (a) be a written multi-year strategy covering business objectives + risk objectives + capital + liquidity + earnings + growth + with consideration of macroeconomic + regulatory + competitive environment, (b) be aligned with Risk Appetite Statement + Risk Governance Framework, (c) be reviewed and approved annually by the Board. Talent Management per Section II.L must (a) attract + develop + retain personnel with the skills + experience + risk management capability + ethical standards required to operate the covered bank, (b) include succession planning for key roles + leadership development + diversity + inclusion considerations. Compensation and Performance Management per Section II.M must (a) align compensation + performance management with risk-taking decisions + risk outcomes + risk culture, (b) avoid excessive risk-taking incentives + balance short-term and long-term performance + integrate clawback + malus provisions + Board oversight of significant compensation arrangements.

What else in your programme already covers this

This control maps to 76 controls across 42 other frameworks. If you already hold one of them, the evidence you collected for it is the starting point here rather than new work.

ISO/IEC 27557:2022 - Organisational Privacy Risk Management · 5 controls

APRA CPS 230 Operational Risk Management · 3 controls

  • CPS230-16 Internal Audit Review of the Business Continuity Plan
  • CPS230-37 Service Provider Management Policy
  • CPS230-46 Ongoing Risk Management of Each Material Arrangement

FFIEC IT Examination Handbook · 3 controls

  • FFIEC-03 Risk appetite and tolerance for IT risk
  • FFIEC-18 Ongoing monitoring and assessment
  • FFIEC-20 Exit strategy and transition planning

IEC 60601-1 - Medical Electrical Equipment Safety · 3 controls

IEC 62304:2015 Medical Device Software Lifecycle Processes · 3 controls

Japan AI Guidelines · 3 controls

NIST Privacy Framework · 3 controls

  • NISTPF-1 Identify-P - Business Environment, Data Processing Inventory, Ecosystem, and Risk Assessment
  • NISTPF-2 Govern-P - Governance Policies, Risk Management Strategy, Awareness Training, and Monitoring
  • NISTPF-8 Protect-P Information Protection Processes (PR.PO-P)

NIST SP 800-30 · 3 controls

  • NISTSP30-1 Risk Management Strategy and Risk Assessment Programme Establishment
  • NISTSP30-2 Three-Tier Risk Assessment Scoping (Organisation, Mission/Business, Information System)
  • NISTSP30-8 Risk Assessment Maintenance, Continuous Monitoring, and Integration with the RMF

APRA CPS 234 · 2 controls

  • CPS234-16 Assessment of Related Party and Third Party Capability
  • CPS234-20 Information Asset Classification

BS 65000:2014 - Guidance on Organizational Resilience · 2 controls

FFIEC Cybersecurity Assessment Tool (CAT) · 2 controls

IAIS Insurance Core Principles (ICPs) · 2 controls

  • ICP-16 Enterprise Risk Management for Solvency Purposes
  • ICP-8 Risk Management and Internal Controls

ICAO Annex 17 - Aviation Security (AVSEC) · 2 controls

ISO/IEC 23837 - Security Requirements for Quantum Key Distribution · 2 controls

NIST SP 800-171A Rev 3 - Assessing CUI Security Requirements · 2 controls

  • 3.16 System and Services Acquisition
  • 3.17 Supply Chain Risk Management

NIST SP 800-37 · 2 controls

  • NISTSP37-1 RMF Prepare Step: Organisation-Level and System-Level Preparation
  • NISTSP37-7 RMF Monitor Step: Continuous Monitoring and Ongoing Authorisation

NIST SP 800-39 · 2 controls

  • NISTSP39-4 Risk Responding: Identify, Evaluate, Decide, Implement
  • NISTSP39-5 Risk Monitoring: Effectiveness, Changes, Compliance, and Reassessment Triggers

NRF Cybersecurity and Data Privacy Framework (National Retail Federation) · 2 controls

  • NRFCS-1 Retail Cybersecurity Governance, Policy, and Regulatory Change Management
  • NRFCS-2 Risk Assessment, Customer Data Inventory, Classification, and Retail Threat Model

AML/CTF Act 2006 (Australia) · 1 control

API 1164 · 1 control

  • API1164-21 TSA Pipeline Security Directive Alignment

AS9100D - Aerospace Quality Management System · 1 control

Aged Care Quality Standards 2019 (repealed edition) · 1 control

Annex 11 to EU GMP - Computerised Systems · 1 control

FBI CJIS Security Policy · 1 control

  • CJIS-19 Supply Chain Risk Management

German Supply Chain Due Diligence Act (LkSG) · 1 control

ICH Q10 - Pharmaceutical Quality System · 1 control

IEC 62443 · 1 control

  • IEC62443-21 Supply chain risk management for critical components

IMO Maritime Cybersecurity Guidelines (MSC-FAL.1/Circ.3/Rev.2) · 1 control

IRM Enterprise Risk Management Framework (Institute of Risk Management) · 1 control

ISO/IEC 38500:2024 - Governance of IT · 1 control

Lloyd's of London Cyber Insurance Requirements and Underwriting Standards · 1 control

MTCS (Singapore) · 1 control

Monetary Authority of Singapore Technology Risk Management Guidelines · 1 control

NERC CIP · 1 control

  • NERCCIP-8 Supply Chain Risk Management (CIP-013)

NIS2 Directive Implementing Acts · 1 control

  • NIS2I-2 Policy, Risk Management, and Roles + Responsibilities

NIST SP 800-82 Revision 3: Guide to Industrial Control Systems (ICS) Security · 1 control

  • NISTSP82-1 OT Security Program Governance, Policy, Roles, and Safety-Security Integration

New Zealand Information Security Manual (NZISM) · 1 control

  • NZISM-1 NZISM Governance, Documentation, and Classification System

O-RAN WG11 Security Specification · 1 control

  • ORANWG11-1 O-RAN Threat Model, Risk Management, and Security Architecture

Protective Security Policy Framework (PSPF) Release 2024 · 1 control

  • PSPF24-1 Security Culture, Governance, Risk Management

Singapore AI Governance Framework · 1 control

  • AIGF-1.1 Risk Management and Internal Controls

UAE Virtual Asset Regulatory Authority (VARA) Regulations · 1 control

  • CRM-3 Risk Management Framework

UK Defence Standard 05-138 - Cyber Security for Defence Suppliers · 1 control

Every mapping shown was judged rather than inferred from wording similarity, and the ones that failed review are published too. See the coverage reports and what was rejected.

Query this from an agent

The graph holds this control, the 76 it maps to, and the evidence behind each claim, over MCP and REST.

MCP endpointAll OCC Heightened Standards (12 CFR Part 30, Appendix D) controls