US SEC Digital Assets and Crypto Regulatory Framework
Securities Classification of Digital Assets

US SEC Digital Assets and Crypto Regulatory Framework US-SEC-DA-SC-01: Howey Test Application

Investment contract analysis for digital assets. Investment of money. Common enterprise. Expectation of profits. Derived from efforts of others. Economic reality analysis. Sufficiently decentralised test.

Maintained by Gerard BlokdykVerified against the published standard Control text last updated

What else in your programme already covers this

This control maps to 199 controls across 92 other frameworks. If you already hold one of them, the evidence you collected for it is the starting point here rather than new work.

ISO 15189:2022 - Medical Laboratories Requirements for Quality and Competence · 5 controls

ISO/IEC 27557:2022 - Organisational Privacy Risk Management · 4 controls

Annex 11 to EU GMP - Computerised Systems · 3 controls

BRCGS Global Standard for Food Safety Issue 9 · 3 controls

  • 1.2 Operating System Privileged Account Control
  • 1.3 Virtualisation Platform Protection
  • 3.3 Configure Data Access Control Lists

DAMA-DMBOK2 - Data Management Body of Knowledge (2nd Edition) · 3 controls

  • DA-1 Enterprise Data Architecture
  • DIQ-2 Data Quality Management
  • RMD-1 Reference Data Management

IEC 62304:2015 Medical Device Software Lifecycle Processes · 3 controls

ISO 19650 - Organisation and Digitisation of Information about Buildings and Civil Engineering Works (BIM) · 3 controls

ISO 22320:2018 · 3 controls

ISO 22739:2024 - Blockchain and Distributed Ledger Technologies Vocabulary · 3 controls

ISO 37000:2021 - Governance of Organizations · 3 controls

ISO/IEC 23837 - Security Requirements for Quantum Key Distribution · 3 controls

ISO/IEC 23894:2023 · 3 controls

ISO/IEC 27004:2016 · 3 controls

ISO/IEC 27011:2024 · 3 controls

ISO/IEC 27014:2020 · 3 controls

ISO/IEC 27400:2022 · 3 controls

ISO/IEC 29100:2024 · 3 controls

ISO/IEC 29134:2023 · 3 controls

ISO/IEC 29147:2018 · 3 controls

ISO/IEC 30111:2019 · 3 controls

ISO/IEC 38500:2024 - Governance of IT · 3 controls

Illinois Biometric Information Privacy Act (BIPA) · 3 controls

NIST SP 800-124 Revision 2 - Guidelines for Managing the Security of Mobile Devices · 3 controls

NIST SP 800-171A Rev 3 - Assessing CUI Security Requirements · 3 controls

NRC 10 CFR 73.54 - Nuclear Facility Cybersecurity · 3 controls

21 CFR Part 58 - Good Laboratory Practice (GLP) · 2 controls

AICPA Privacy Management Framework (PMF) · 2 controls

Albania Law on Protection of Personal Data (Law No. 9887, 2008, amended 2014) · 2 controls

Austria Data Protection Act (Datenschutzgesetz, DSG, amended 2018) · 2 controls

  • AT-DSG-2 Section 2 - Scope and application
  • AT-DSG-8 Section 22 - Functions and powers of the DPA

Automotive SPICE (ASPICE) v4.0 - Process Assessment Model · 2 controls

  • MLE.1 Machine Learning Requirements Analysis
  • MLE.3 Machine Learning Training

IEC 60601-1 - Medical Electrical Equipment Safety · 2 controls

ISO 19011 · 2 controls

  • 6.5 Preparing and Distributing Audit Report
  • 6.7 Conducting Audit Follow-up

ISO 20400:2017 - Sustainable Procurement · 2 controls

ISO 41001:2018 - Facility Management Systems · 2 controls

ISO 56002 · 2 controls

ISO 8000 - Data Quality · 2 controls

ISO/IEC 17025:2017 - General Requirements for Testing and Calibration · 2 controls

ISO/IEC 25012:2008 - Data Quality Model · 2 controls

NIST Cybersecurity Framework 2.0 · 2 controls

  • NIST-CSF-DE.AE-08 Incidents are declared when adverse events meet the defined incident criteria
  • NIST-CSF-PR.AA-05 Access permissions, entitlements, and authorizations are defined in a policy, managed, enforced, and reviewed, and incorporate the principles of least privilege and separation of duties

Nebraska Data Privacy Act · 2 controls

  • NDPA-2 Consumer Rights - Access, Correct, Delete, Portability, Appeal
  • NDPA-5 Privacy Notice, Data Minimisation, and Purpose Limitation

SANS Incident Handler's Handbook and PICERL Methodology · 2 controls

SOC 2 · 2 controls

  • SOC2-CC4.2 COSO principle 17: Evaluates and communicates deficiencies in a timely manner
  • SOC2-CC7.4 Responds to identified security incidents through defined procedures

SSAE 18 - Attestation Standards (SOC Reporting) · 2 controls

Science Based Targets Initiative (SBTi) - Net-Zero Standard · 2 controls

  • C1 Organizational Boundary
  • C3 Scope 1 and 2 Coverage

UK Bribery Act 2010 · 2 controls

21 CFR Part 211 - Current Good Manufacturing Practice · 1 control

ASIS SPC.1-2009 - Organizational Resilience Standard · 1 control

  • 4.4.1 Resources, Roles, Responsibility, and Authority

AWWA Cybersecurity Guidance for the Water Sector (American Water Works Association) · 1 control

Azerbaijan Law on Personal Data (2010) · 1 control

Barbados Data Protection Act 2019 · 1 control

CISA Cross-Sector Cybersecurity Performance Goals (CPG) 2.0 · 1 control

  • CPG-6.B Supply Chain Incident Reporting

COBIT 2019 · 1 control

FFIEC IT Examination Handbook · 1 control

  • FFIEC-05 Roles and responsibilities definition

FedRAMP High · 1 control

  • CA-9 Internal System Connections

FedRAMP Moderate · 1 control

  • CA-9 Internal System Connections

Florida Digital Bill of Rights (FDBR) · 1 control

IAIS Insurance Core Principles (ICPs) · 1 control

  • ICP-1 Objectives, Powers and Responsibilities of the Supervisor

IEC 62351 - Power Systems Communication Security · 1 control

ISO 14064 - Greenhouse Gas Accounting and Verification (Parts 1-3) · 1 control

ISO 26262:2018 - Functional Safety for Road Vehicles · 1 control

ISO 27017 · 1 control

ISO 27018 · 1 control

ISO 27043 · 1 control

ISO 28001:2007 Supply Chain Security Management · 1 control

ISO 31000:2018 · 1 control

  • 6.7 Conducting Audit Follow-up

ISO/IEC 27003:2017 · 1 control

ISO/IEC 27007:2020 · 1 control

ISO/IEC 27031:2011 · 1 control

ISO/IEC 27050 - Electronic Discovery (Parts 1-4) · 1 control

ISO/IEC 29115:2023 - Entity Authentication Assurance Framework · 1 control

ISO/SAE 21434 · 1 control

Kuwait National Cybersecurity Framework · 1 control

NIST SP 800-190 · 1 control

NIST SP 800-53 Rev 5 LOW · 1 control

  • CA-9 Internal System Connections

NIST SP 800-53 Rev 5 MODERATE · 1 control

  • CA-9 Internal System Connections

NIST SP 800-53 Revision 5.1 HIGH · 1 control

  • CA-9 Internal System Connections

PCI DSS 4.0 · 1 control

  • 2.2.2 Vendor default accounts are managed as follows: • If the vendor default account(s) will be used, the default password is changed per Requirement 8.3.6. • If the vendor default account(s) will not be used,

PCI P2PE · 1 control

PCI PIN Security · 1 control

PCI SSF · 1 control

Rhode Island Data Transparency and Privacy Protection Act (RIDTPPA) · 1 control

Singapore Cybersecurity Act 2018 · 1 control

  • SCA-S2 Interpretation and Definitions

Singapore Government Instruction Manual on ICT&SS Management (IM8) · 1 control

South Korea ISMS-P · 1 control

South Korea Korea Internet Self-Governance Organisation (KISO) Code of Ethics · 1 control

Sweden Data Protection Act (Dataskyddslag, 2018:218) · 1 control

  • SWE-2 Relationship to GDPR

Switzerland New Federal Act on Data Protection (nFADP/nDSG, 2023) · 1 control

  • FADP-5 Definitions (Article 5)

UK Open Banking Standard · 1 control

UK Telecommunications (Security) Act 2021 · 1 control

US Foreign Corrupt Practices Act (FCPA) · 1 control

WCAG 2.2 · 1 control

WHO Global Strategy on Digital Health 2020-2025 · 1 control

  • SO2.2 Digital health architecture blueprint

Every mapping shown was judged rather than inferred from wording similarity, and the ones that failed review are published too. See the coverage reports and what was rejected.

Other controls in Securities Classification of Digital Assets

Query this from an agent

The graph holds this control, the 199 it maps to, and the evidence behind each claim, over MCP and REST.

MCP endpointAll US SEC Digital Assets and Crypto Regulatory Framework controls