SIG risk domain L, Compliance Management. The third party's governance and compliance functions identify the legal, regulatory, industry and contractual requirements that apply to the service, run compliance programs with reporting and escalation to management or the board, maintain a code of conduct or ethics program, and obtain external audits or certifications where the service, sector or regulation calls for them. Renamed from Compliance in 2023 when ESG content moved out.
The graph holds this control, the 0 it maps to, and the evidence behind each claim, over MCP and REST.