IAIS Insurance Core Principles (ICPs)

International (IAIS)

v2019 (updated)

22 domains

47 controls

The International Association of Insurance Supervisors (IAIS) Insurance Core Principles (ICPs) provide a globally accepted framework for the supervision of the insurance sector. The 26 ICPs cover licensing, governance, risk management, conduct of business, group supervision, and cross-border cooperation. They serve as the benchmark for insurance regulation globally and are assessed by the IMF and World Bank as part of Financial Sector Assessment Programs (FSAPs).

Unverified

Framework summaries on this platform are AI-assisted interpretations for educational and compliance planning purposes. They do not reproduce or replace the official standards. Refer to the authoritative source for the definitive text. Framework names and trademarks belong to their respective organisations.

Framework Domains (22)

Authorization

2 controls

Controls in the Authorization domain of IAIS Insurance Core Principles (ICPs) — 2 controls
Code	Title	Description
ICP4	Licensing	Insurers are required to be licensed before underwriting business with fit and proper criteria for owners and key person...
ICP6	Changes in Control and Portfolio Transfers	Supervisory approval is required for changes in control, mergers and portfolio transfers including assessment of acquire...

Conduct

2 controls

Controls in the Conduct domain of IAIS Insurance Core Principles (ICPs) — 2 controls
Code	Title	Description
ICP18	Intermediaries	Insurance intermediaries are subject to licensing, conduct rules and oversight including remuneration disclosure.
ICP19	Conduct of Business	Insurers and intermediaries treat customers fairly throughout the product lifecycle with suitability and disclosure obli...

Cooperation

1 controls

Controls in the Cooperation domain of IAIS Insurance Core Principles (ICPs) — 1 controls
Code	Title	Description
ICP3	Information Exchange and Confidentiality	Information sharing arrangements protect confidentiality while enabling effective supervision and cross border cooperati...

Corporate Governance and Risk Management

3 controls

Controls in the Corporate Governance and Risk Management domain of IAIS Insurance Core Principles (ICPs) — 3 controls
Code	Title	Description
ICP-7	Corporate Governance	The supervisor requires insurers to establish and implement a corporate governance framework providing for sound and pru...
ICP-8	Risk Management and Internal Controls	The supervisor requires an insurer to have effective systems of risk management and internal controls, including effecti...
ICP-9	Supervisory Review and Reporting	The supervisor takes a risk-based approach to supervision using both off-site monitoring and on-site inspections to exam...

Disclosure

1 controls

Controls in the Disclosure domain of IAIS Insurance Core Principles (ICPs) — 1 controls
Code	Title	Description
ICP20	Public Disclosure	Insurers disclose relevant and comparable information on financial position, performance and risk profile.

Enforcement

1 controls

Controls in the Enforcement domain of IAIS Insurance Core Principles (ICPs) — 1 controls
Code	Title	Description
ICP10	Preventive Measures, Corrective Measures and Sanctions	The supervisor has a range of preventive, corrective and enforcement powers proportionate to issues identified.

Financial

3 controls

Controls in the Financial domain of IAIS Insurance Core Principles (ICPs) — 3 controls
Code	Title	Description
ICP14	Valuation	Insurers value assets and liabilities for solvency purposes on an economic and consistent basis.
ICP15	Investments	Insurers establish investment policies including prudent person principles, asset liability matching and concentration l...
ICP17	Capital Adequacy	Insurers maintain capital adequate to cover risks with regulatory solvency control levels and intervention ladders.

Financial Crime

2 controls

Controls in the Financial Crime domain of IAIS Insurance Core Principles (ICPs) — 2 controls
Code	Title	Description
ICP21	Countering Fraud in Insurance	Insurers and supervisors deter, prevent, detect, report and remedy fraud in insurance.
ICP22	Anti Money Laundering and Combating the Financing of Terrorism	Insurers implement AML CFT controls including customer due diligence, monitoring, reporting and training.

Financial Integrity and Group Supervision

5 controls

Controls in the Financial Integrity and Group Supervision domain of IAIS Insurance Core Principles (ICPs) — 5 controls
Code	Title	Description
ICP-21	Countering Fraud in Insurance	The supervisor requires that insurers and intermediaries take effective measures to deter, prevent, detect, report and r...
ICP-22	Anti-Money Laundering and Combating the Financing of Terrorism	The supervisor requires insurers and intermediaries to take effective measures to combat money laundering and the financ...
ICP-23	Group-wide Supervision	The supervisor has a framework and adequate powers for group-wide supervision of insurers and where appropriate imposes...
ICP-24	Macroprudential Surveillance and Insurance Supervision	The supervisor identifies, monitors, and analyses market and financial developments and other environmental factors that...
ICP-25	Supervisory Cooperation and Coordination	The supervisor cooperates and coordinates with other relevant supervisors and authorities for effective supervision of i...

Financial Soundness

5 controls

Controls in the Financial Soundness domain of IAIS Insurance Core Principles (ICPs) — 5 controls
Code	Title	Description
ICP-13	Reinsurance and Other Forms of Risk Transfer	The supervisor sets standards on the use of reinsurance and other forms of risk transfer to ensure that insurers adequat...
ICP-14	Valuation	The supervisor establishes requirements for the valuation of assets, liabilities, and insurance contracts, for solvency...
ICP-15	Investment	The supervisor establishes requirements for solvency purposes on the investment activities of insurers to address the ri...
ICP-16	Enterprise Risk Management for Solvency Purposes	The supervisor establishes enterprise risk management requirements for solvency purposes that require insurers to addres...
ICP-17	Capital Adequacy	The supervisor establishes capital adequacy requirements for solvency purposes so that insurers can absorb significant u...

Governance

2 controls

Controls in the Governance domain of IAIS Insurance Core Principles (ICPs) — 2 controls
Code	Title	Description
ICP5	Suitability of Persons	Significant owners, board members, senior management and key control function holders meet fitness and propriety standar...
ICP7	Corporate Governance	Insurers establish corporate governance frameworks with effective oversight, defined roles and risk culture.

Group Supervision

1 controls

Controls in the Group Supervision domain of IAIS Insurance Core Principles (ICPs) — 1 controls
Code	Title	Description
ICP23	Group Wide Supervision	Insurance groups are supervised on a group wide basis with a group wide supervisor and coordinated approach.

Licensing and Suitability

3 controls

Controls in the Licensing and Suitability domain of IAIS Insurance Core Principles (ICPs) — 3 controls
Code	Title	Description
ICP-4	Licensing	An insurer must be licensed before it can operate within a jurisdiction and the requirements and procedures for licensin...
ICP-5	Suitability of Persons	The supervisor requires Board Members, Senior Management, Key Persons in Control Functions and Significant Owners to be...
ICP-6	Changes in Control and Portfolio Transfers	Supervisory approval is required for proposals to acquire significant ownership or an interest in an insurer and for por...

Market Conduct and Consumer Protection

3 controls

Controls in the Market Conduct and Consumer Protection domain of IAIS Insurance Core Principles (ICPs) — 3 controls
Code	Title	Description
ICP-18	Intermediaries	The supervisor sets and enforces requirements for the conduct of insurance intermediaries to ensure that they conduct bu...
ICP-19	Conduct of Business	The supervisor sets requirements for the conduct of the business of insurance to ensure that customers are treated fairl...
ICP-20	Public Disclosure	The supervisor requires insurers to disclose relevant, comprehensive and adequate information on a timely basis in order...

Preventive and Corrective Measures

2 controls

Controls in the Preventive and Corrective Measures domain of IAIS Insurance Core Principles (ICPs) — 2 controls
Code	Title	Description
ICP-10	Preventive Measures, Corrective Measures and Sanctions	The supervisor takes preventive and corrective measures that are timely, suitable and necessary to achieve the objective...
ICP-12	Exit from the Market and Resolution	The legislation provides for requirements addressing the exit of insurance legal entities from the market for reasons of...

Resolution

1 controls

Controls in the Resolution domain of IAIS Insurance Core Principles (ICPs) — 1 controls
Code	Title	Description
ICP12	Exit from the Market and Resolution	A resolution regime exists with powers to ensure orderly resolution of insurers with policyholder protection.

Risk Management

2 controls

Controls in the Risk Management domain of IAIS Insurance Core Principles (ICPs) — 2 controls
Code	Title	Description
ICP16	Enterprise Risk Management and ORSA	Insurers conduct an Own Risk and Solvency Assessment integrating risk management and capital adequacy.
ICP8	Risk Management and Internal Controls	Insurers maintain effective risk management, internal control, internal audit, actuarial and compliance functions.

Risk Transfer

1 controls

Controls in the Risk Transfer domain of IAIS Insurance Core Principles (ICPs) — 1 controls
Code	Title	Description
ICP13	Reinsurance and Other Forms of Risk Transfer	Insurers manage reinsurance and risk transfer arrangements with appropriate counterparty risk controls.

Supervision

1 controls

Controls in the Supervision domain of IAIS Insurance Core Principles (ICPs) — 1 controls
Code	Title	Description
ICP9	Supervisory Review and Reporting	The supervisor uses a risk based approach with on site and off site monitoring and regular reporting from insurers.

Supervisory Authority

2 controls

Controls in the Supervisory Authority domain of IAIS Insurance Core Principles (ICPs) — 2 controls
Code	Title	Description
ICP1	Objectives, Powers and Responsibilities of the Supervisor	The supervisor has clearly defined objectives, powers and responsibilities for the regulation of insurers.
ICP2	Supervisor Independence and Resources	The supervisor is operationally independent, accountable and adequately resourced with legal protection for staff.

Supervisory Framework

3 controls

Controls in the Supervisory Framework domain of IAIS Insurance Core Principles (ICPs) — 3 controls
Code	Title	Description
ICP-1	Objectives, Powers and Responsibilities of the Supervisor	The authority responsible for insurance supervision and the objectives of insurance supervision are clearly defined.
ICP-2	Supervisor	The supervisor, in the exercise of its functions and powers, is operationally independent, accountable, transparent, and...
ICP-3	Information Sharing and Confidentiality Requirements	The supervisor exchanges information with other relevant supervisors and authorities subject to confidentiality, purpose...

Systemic Risk

1 controls

Controls in the Systemic Risk domain of IAIS Insurance Core Principles (ICPs) — 1 controls
Code	Title	Description
ICP24	Macroprudential Supervision	Supervisors identify and address systemic risks in the insurance sector including data collection and tools.

Your Compliance Coverage

If you comply with IAIS Insurance Core Principles (ICPs), you already cover:

MTCS (Singapore)

11%

5 controls mapped

Compare →

Authorised Economic Operator (AEO) Programmes - Global Standards

11%

5 controls mapped

Compare →

NIST SP 800-82 Revision 3: Guide to Industrial Control Systems (ICS) Security

4 controls mapped

Compare →

+ 222 more: NIS2 Directive (9%), New Zealand Information Security Manual (NZISM) (9%)

See all 225 mapped frameworks ↓

Maps to 225 other frameworks

47 total controls

MTCS (Singapore)

5 source controls mapped|3 target controls covered

11%

Authorised Economic Operator (AEO) Programmes - Global Standards

5 source controls mapped|3 target controls covered

11%

NIST SP 800-82 Revision 3: Guide to Industrial Control Systems (ICS) Security

4 source controls mapped|3 target controls covered

NIS2 Directive

4 source controls mapped|3 target controls covered

New Zealand Information Security Manual (NZISM)

4 source controls mapped|3 target controls covered

NERC CIP

4 source controls mapped|3 target controls covered

IMO Maritime Cybersecurity Guidelines (MSC-FAL.1/Circ.3/Rev.2)

4 source controls mapped|2 target controls covered

IEEE 1686

4 source controls mapped|3 target controls covered

NIST SP 800-171A Rev 3 - Assessing CUI Security Requirements

4 source controls mapped|6 target controls covered

API 1164

4 source controls mapped|3 target controls covered

IEC 62443

4 source controls mapped|3 target controls covered

ISO 28001:2007 Supply Chain Security Management

4 source controls mapped|3 target controls covered

NIST SP 1800-32

4 source controls mapped|3 target controls covered

NIST SP 800-53 Rev 5

4 source controls mapped|5 target controls covered

ISO 27019

4 source controls mapped|3 target controls covered

NIST Cybersecurity Framework 2.0

4 source controls mapped|6 target controls covered

Own Risk and Solvency Assessment (ORSA) - NAIC Model Act

4 source controls mapped|2 target controls covered

NIST AI Risk Management Framework (AI RMF 1.0)

4 source controls mapped|4 target controls covered

FFIEC Cybersecurity Assessment Tool (CAT)

3 source controls mapped|3 target controls covered

Albania Law on Protection of Personal Data (Law No. 9887, 2008, amended 2014)

3 source controls mapped|4 target controls covered

Barbados Data Protection Act 2019

3 source controls mapped|3 target controls covered

German Supply Chain Due Diligence Act (LkSG)

3 source controls mapped|2 target controls covered

IFRS 17 - Insurance Contracts

3 source controls mapped|1 target controls covered

PSD2 SCA

3 source controls mapped|2 target controls covered

PIC/S Guide to Good Manufacturing Practice for Medicinal Products

3 source controls mapped|4 target controls covered

OSFI B-13

3 source controls mapped|2 target controls covered

Open Banking Security

3 source controls mapped|2 target controls covered

O-RAN WG11 Security Specification

3 source controls mapped|4 target controls covered

Monetary Authority of Singapore Technology Risk Management Guidelines

3 source controls mapped|2 target controls covered

ICH Q10 - Pharmaceutical Quality System

3 source controls mapped|3 target controls covered

IEC 60601-1 - Medical Electrical Equipment Safety

3 source controls mapped|4 target controls covered

ISO/IEC 27557:2022 - Organisational Privacy Risk Management

3 source controls mapped|7 target controls covered

FFIEC IT Examination Handbook

3 source controls mapped|4 target controls covered

ISO/IEC 23837 - Security Requirements for Quantum Key Distribution

3 source controls mapped|3 target controls covered

APRA CPS 234

3 source controls mapped|4 target controls covered

Annex 11 to EU GMP - Computerised Systems

3 source controls mapped|4 target controls covered

ISO/IEC 38500:2024 - Governance of IT

3 source controls mapped|4 target controls covered

AS9100D:2016 - Quality Management Systems for Aviation, Space, and Defence

3 source controls mapped|3 target controls covered

AS9100D - Aerospace Quality Management System

3 source controls mapped|4 target controls covered

ISO/IEC 27003:2017

3 source controls mapped|4 target controls covered

ISO 15189:2022 - Medical Laboratories Requirements for Quality and Competence

3 source controls mapped|7 target controls covered

ISO 37000:2021 - Governance of Organizations

3 source controls mapped|4 target controls covered

PCI PIN Security

3 source controls mapped|4 target controls covered

ISO 20400:2017 - Sustainable Procurement

3 source controls mapped|3 target controls covered

PCI SSF

3 source controls mapped|4 target controls covered

ISO/IEC 23894:2023

3 source controls mapped|6 target controls covered

SSAE 18 - Attestation Standards (SOC Reporting)

3 source controls mapped|3 target controls covered

IEC 62304:2015 Medical Device Software Lifecycle Processes

3 source controls mapped|6 target controls covered

PCI P2PE

3 source controls mapped|4 target controls covered

ISO 22320:2018

3 source controls mapped|4 target controls covered

NIST SP 800-146

2 source controls mapped|2 target controls covered

NIST SP 800-145

2 source controls mapped|2 target controls covered

NIST SP 800-144

2 source controls mapped|2 target controls covered

ISMAP (Japan)

2 source controls mapped|2 target controls covered

IAEA Nuclear Security Series - Computer Security at Nuclear Facilities (NSS-17-T Rev 1)

2 source controls mapped|4 target controls covered

Florida Digital Bill of Rights (FDBR)

2 source controls mapped|2 target controls covered

ISO/IEC 27400:2022

2 source controls mapped|4 target controls covered

Azure Security Benchmark

2 source controls mapped|2 target controls covered

ISO/IEC 27006:2024

2 source controls mapped|4 target controls covered

AWS Well-Architected Security Pillar

2 source controls mapped|2 target controls covered

Austria Data Protection Act (Datenschutzgesetz, DSG, amended 2018)

2 source controls mapped|3 target controls covered

FedRAMP High

2 source controls mapped|3 target controls covered

NIST SP 800-53 Revision 5.1 HIGH

2 source controls mapped|3 target controls covered

FedRAMP Moderate

2 source controls mapped|3 target controls covered

NIST SP 800-53 Rev 5 MODERATE

2 source controls mapped|2 target controls covered

NIST SP 800-53 Rev 5 LOW

2 source controls mapped|2 target controls covered

ISO 27017

2 source controls mapped|2 target controls covered

NIST SP 800-190

2 source controls mapped|2 target controls covered

ISO 27018

2 source controls mapped|2 target controls covered

UK GDPR (UK General Data Protection Regulation)

2 source controls mapped|2 target controls covered

Regional Comprehensive Economic Partnership (RCEP) - E-Commerce Chapter

2 source controls mapped|2 target controls covered

Nigeria Data Protection Act 2023 (NDPA)

2 source controls mapped|4 target controls covered

Nebraska Data Privacy Act

2 source controls mapped|4 target controls covered

South Korea PIPA

2 source controls mapped|2 target controls covered

Israel Protection of Privacy Law (5741-1981)

2 source controls mapped|3 target controls covered

Azerbaijan Law on Personal Data (2010)

2 source controls mapped|2 target controls covered

AML/CTF Act 2006 (Australia)

2 source controls mapped|1 target controls covered

UK AI Regulation Framework

2 source controls mapped|1 target controls covered

SEC Climate Disclosure Rule

2 source controls mapped|1 target controls covered

SASB Standards

2 source controls mapped|1 target controls covered

OECD Recommendation on Artificial Intelligence (2024 Update)

2 source controls mapped|1 target controls covered

OECD AI Principles

2 source controls mapped|2 target controls covered

OCC Heightened Standards (12 CFR Part 30, Appendix D)

2 source controls mapped|2 target controls covered

NRF Cybersecurity and Data Privacy Framework (National Retail Federation)

2 source controls mapped|2 target controls covered

NIST SP 800-39

2 source controls mapped|2 target controls covered

NIST SP 800-37

2 source controls mapped|2 target controls covered

NIST SP 800-30

2 source controls mapped|3 target controls covered

NIST Privacy Framework

2 source controls mapped|3 target controls covered

NIS2 Directive Implementing Acts

2 source controls mapped|1 target controls covered

Lloyd's of London Cyber Insurance Requirements and Underwriting Standards

2 source controls mapped|1 target controls covered

Japan AI Guidelines

2 source controls mapped|3 target controls covered

IRM Enterprise Risk Management Framework (Institute of Risk Management)

2 source controls mapped|1 target controls covered

IEEE 7000

2 source controls mapped|2 target controls covered

ICAO Annex 17 - Aviation Security (AVSEC)

2 source controls mapped|2 target controls covered

BS 65000:2014 - Guidance on Organizational Resilience

2 source controls mapped|2 target controls covered

FBI CJIS Security Policy

2 source controls mapped|1 target controls covered

APRA CPS 230 Operational Risk Management

2 source controls mapped|3 target controls covered

Aged Care Quality Standards (Australia)

2 source controls mapped|1 target controls covered

ISO 31000

2 source controls mapped|3 target controls covered

APRA SPS 220 Risk Management (Superannuation)

2 source controls mapped|3 target controls covered

ISO 27005

2 source controls mapped|3 target controls covered

EASA Part-IS - Information Security in Aviation

2 source controls mapped|3 target controls covered

ITAR - International Traffic in Arms Regulations

2 source controls mapped|3 target controls covered

French Sapin II Law (Law No. 2016-1691)

2 source controls mapped|2 target controls covered

ISO/IEC 29147:2018

2 source controls mapped|4 target controls covered

NIST SP 800-171A - Assessing Security Requirements for Controlled Unclassified Information (CUI)

1 source controls mapped|1 target controls covered

TSA Pipeline Cybersecurity Directives

1 source controls mapped|1 target controls covered

Oman National Cybersecurity Framework

1 source controls mapped|1 target controls covered

Japan FSA Cybersecurity Guidelines for Financial Institutions

1 source controls mapped|1 target controls covered

BSI IT-Grundschutz

1 source controls mapped|1 target controls covered

ASD Strategies to Mitigate Cyber Security Incidents

1 source controls mapped|2 target controls covered

ISO 27001:2022

1 source controls mapped|1 target controls covered

GDPR

1 source controls mapped|1 target controls covered

Virginia CDPA

1 source controls mapped|1 target controls covered

Vietnam PDPD

1 source controls mapped|1 target controls covered

Uruguay DPL

1 source controls mapped|1 target controls covered

Turkey KVKK

1 source controls mapped|1 target controls covered

Texas Data Privacy Act

1 source controls mapped|1 target controls covered

Taiwan PDPA

1 source controls mapped|1 target controls covered

Qatar DPL

1 source controls mapped|1 target controls covered

Privacy Act 2020

1 source controls mapped|1 target controls covered

POPIA

1 source controls mapped|1 target controls covered

Personal Data Act (personopplysningsloven)

1 source controls mapped|1 target controls covered

PDPA Thailand

1 source controls mapped|1 target controls covered

PDPA Singapore

1 source controls mapped|1 target controls covered

Oregon Consumer Privacy Act

1 source controls mapped|1 target controls covered

NIST SP 800-122

1 source controls mapped|1 target controls covered

Nigeria Data Protection Regulation (NDPR)

1 source controls mapped|1 target controls covered

New Jersey Data Privacy Act

1 source controls mapped|1 target controls covered

New Hampshire Data Privacy Act

1 source controls mapped|1 target controls covered

Montana Consumer Data Privacy Act

1 source controls mapped|1 target controls covered

Minnesota Consumer Data Privacy Act

1 source controls mapped|1 target controls covered

Mexico LFPDPPP

1 source controls mapped|1 target controls covered

Mauritius DPA

1 source controls mapped|1 target controls covered

Maryland Online Data Privacy Act of 2024

1 source controls mapped|1 target controls covered

Malaysia PDPA 2010

1 source controls mapped|1 target controls covered

Liechtenstein DPA

1 source controls mapped|1 target controls covered

LGPD

1 source controls mapped|1 target controls covered

Kentucky Consumer Data Protection Act

1 source controls mapped|1 target controls covered

Jamaica Data Protection Act 2020

1 source controls mapped|1 target controls covered

Indiana Consumer Data Protection Act

1 source controls mapped|1 target controls covered

Iceland Data Protection and Processing of Personal Data Act (Act No. 90/2018)

1 source controls mapped|1 target controls covered

Federal Decree-Law No. 45 of 2021 on the Protection of Personal Data (UAE PDPL)

1 source controls mapped|1 target controls covered

Australian Privacy Principles (APPs)

1 source controls mapped|1 target controls covered

Bahrain PDPL

1 source controls mapped|1 target controls covered

Armenia Law on Protection of Personal Data (2015)

1 source controls mapped|1 target controls covered

Voluntary Principles on Security and Human Rights (VPs)

1 source controls mapped|1 target controls covered

MiFID II / MiFIR

1 source controls mapped|1 target controls covered

Kids Online Safety Act (KOSA)

1 source controls mapped|1 target controls covered

ISO/IEC 30111:2019

1 source controls mapped|3 target controls covered

WCAG 2.2

1 source controls mapped|1 target controls covered

UK Gambling Commission - Cyber Resilience Requirements

1 source controls mapped|2 target controls covered

UK Bribery Act 2010

1 source controls mapped|1 target controls covered

Trinidad and Tobago Data Protection Act 2011

1 source controls mapped|3 target controls covered

Tanzania Personal Data Protection Act (Draft)

1 source controls mapped|2 target controls covered

SLSA

1 source controls mapped|1 target controls covered

SIG (Shared Assessments)

1 source controls mapped|1 target controls covered

PTES

1 source controls mapped|1 target controls covered

Philippines Cybercrime Prevention Act (RA 10175)

1 source controls mapped|1 target controls covered

OWASP SAMM

1 source controls mapped|1 target controls covered

OWASP MASVS

1 source controls mapped|1 target controls covered

OpenSSF Scorecard

1 source controls mapped|1 target controls covered

NRC 10 CFR 73.54 - Nuclear Facility Cybersecurity

1 source controls mapped|2 target controls covered

Notifiable Data Breaches Scheme (Australia)

1 source controls mapped|1 target controls covered

NIST SP 800-92

1 source controls mapped|1 target controls covered

NIST SP 800-88

1 source controls mapped|1 target controls covered

NIST SP 800-63-4

1 source controls mapped|1 target controls covered

NIST SP 800-61

1 source controls mapped|1 target controls covered

NIST SP 800-137

1 source controls mapped|1 target controls covered

NIST SP 800-123

1 source controls mapped|1 target controls covered

NIST SP 800-115 (Technical Guide to Information Security Testing and Assessment)

1 source controls mapped|1 target controls covered

NATO STANAG 4774 (Confidentiality Metadata Labels) and STANAG 4778 (Metadata Binding)

1 source controls mapped|2 target controls covered

MITRE ATT&CK

1 source controls mapped|1 target controls covered

ITU Radio Regulations and Space Security Standards

1 source controls mapped|1 target controls covered

IATA Operational Safety Audit (IOSA) Standards Manual

1 source controls mapped|1 target controls covered

FTC GLBA Safeguards Rule (16 CFR Part 314)

1 source controls mapped|1 target controls covered

FDA Quality Management System Regulation (QMSR)

1 source controls mapped|1 target controls covered

ISO/IEC 27050 - Electronic Discovery (Parts 1-4)

1 source controls mapped|1 target controls covered

21 CFR Part 58 - Good Laboratory Practice (GLP)

1 source controls mapped|2 target controls covered

BRCGS Global Standard for Food Safety Issue 9

1 source controls mapped|3 target controls covered

Illinois Biometric Information Privacy Act (BIPA)

1 source controls mapped|3 target controls covered

AWWA Cybersecurity Guidance for the Water Sector (American Water Works Association)

1 source controls mapped|1 target controls covered

ISO/IEC 29134:2023

1 source controls mapped|3 target controls covered

ISO/IEC 27014:2020

1 source controls mapped|3 target controls covered

ISO/IEC 27011:2024

1 source controls mapped|3 target controls covered

ISO/IEC 27004:2016

1 source controls mapped|3 target controls covered

DAMA-DMBOK2 - Data Management Body of Knowledge (2nd Edition)

1 source controls mapped|3 target controls covered

21 CFR Part 211 - Current Good Manufacturing Practice

1 source controls mapped|1 target controls covered

COBIT 2019

1 source controls mapped|1 target controls covered

ISO/IEC 29100:2024

1 source controls mapped|3 target controls covered

ISO/IEC 27031:2011

1 source controls mapped|1 target controls covered

ISO/IEC 27007:2020

1 source controls mapped|1 target controls covered

ISO 19011

1 source controls mapped|3 target controls covered

ISO 20000-1

1 source controls mapped|2 target controls covered

ISO 13485

1 source controls mapped|1 target controls covered

ISO 13485:2016

1 source controls mapped|1 target controls covered

ISO 9001:2015

1 source controls mapped|2 target controls covered

IEC 62351 - Power Systems Communication Security

1 source controls mapped|1 target controls covered

CISA Cross-Sector Cybersecurity Performance Goals (CPG) 2.0

1 source controls mapped|1 target controls covered

ASIS SPC.1-2009 - Organizational Resilience Standard

1 source controls mapped|1 target controls covered

ISO 14001

1 source controls mapped|1 target controls covered

ISO 45001:2018

1 source controls mapped|1 target controls covered

ISO/IEC 29115:2023 - Entity Authentication Assurance Framework

1 source controls mapped|1 target controls covered

ISO 31000:2018

1 source controls mapped|1 target controls covered

ISO 27043

1 source controls mapped|1 target controls covered

ISO 22739:2024 - Blockchain and Distributed Ledger Technologies Vocabulary

1 source controls mapped|3 target controls covered

NIST SP 800-124 Revision 2 - Guidelines for Managing the Security of Mobile Devices

1 source controls mapped|3 target controls covered

ISO 14064 - Greenhouse Gas Accounting and Verification (Parts 1-3)

1 source controls mapped|1 target controls covered

ISO/IEC 17025:2017 - General Requirements for Testing and Calibration Laboratories

1 source controls mapped|3 target controls covered

SOC 2

1 source controls mapped|2 target controls covered

ISO 8000 - Data Quality

1 source controls mapped|2 target controls covered

SANS Incident Handler's Handbook and PICERL Methodology

1 source controls mapped|2 target controls covered

ISO/IEC 25012:2008 - Data Quality Model

1 source controls mapped|2 target controls covered

ISO/SAE 21434

1 source controls mapped|1 target controls covered

ISO 56002

1 source controls mapped|4 target controls covered

ISO 41001:2018 - Facility Management Systems

1 source controls mapped|3 target controls covered

ISO 39001:2012 - Road Traffic Safety Management

1 source controls mapped|3 target controls covered

ISO 37002:2021 - Whistleblowing Management Systems

1 source controls mapped|3 target controls covered

ISO 50001:2018 - Energy Management Systems

1 source controls mapped|3 target controls covered

ISO 22313:2020 - Guidance on Business Continuity Management Systems

1 source controls mapped|3 target controls covered

ISO 19650 - Organisation and Digitisation of Information about Buildings and Civil Engineering Works (BIM)

1 source controls mapped|3 target controls covered

AICPA Privacy Management Framework (PMF)

1 source controls mapped|2 target controls covered

Automotive SPICE (ASPICE) v4.0 - Process Assessment Model

1 source controls mapped|2 target controls covered

Rhode Island Data Transparency and Privacy Protection Act (RIDTPPA)

1 source controls mapped|1 target controls covered

ISO 26262:2018 - Functional Safety for Road Vehicles

1 source controls mapped|1 target controls covered

Compare IAIS Insurance Core Principles (ICPs) with MTCS (Singapore)

Frequently Asked Questions

What is IAIS Insurance Core Principles (ICPs)?

IAIS Insurance Core Principles (ICPs) is a compliance framework from International (IAIS) with 22 domains and 47 controls. The International Association of Insurance Supervisors (IAIS) Insurance Core Principles (ICPs) provide a globally accepted framework for the supervision of the insurance sector. The 26 ICPs cover licensing, governance, risk management, conduct of business, group supervision, and cross-border cooperation. They serve as the benchmark for insurance regulation globally and are assessed by the IMF and World Bank as part of Financial Sector Assessment Programs (FSAPs). It is used by organisations to establish and maintain compliance with industry standards and regulatory requirements.

How many controls does IAIS Insurance Core Principles (ICPs) have?

IAIS Insurance Core Principles (ICPs) has 47 controls organised across 22 domains. The largest domains are Financial Integrity and Group Supervision (5 controls), Financial Soundness (5 controls), Corporate Governance and Risk Management (3 controls). Each control defines specific requirements that organisations must implement to achieve compliance.

What frameworks does IAIS Insurance Core Principles (ICPs) map to?

IAIS Insurance Core Principles (ICPs) maps to 225 other compliance frameworks. The top mapping partners are MTCS (Singapore) (11% coverage), Authorised Economic Operator (AEO) Programmes - Global Standards (11% coverage), NIST SP 800-82 Revision 3: Guide to Industrial Control Systems (ICS) Security (9% coverage). Use our comparison tool to explore control-level mappings between frameworks.

How do I get started with IAIS Insurance Core Principles (ICPs) compliance?

Start your IAIS Insurance Core Principles (ICPs) compliance journey by running a self-assessment on our platform to identify your current compliance posture. Our AI advisory can answer specific questions about IAIS Insurance Core Principles (ICPs) requirements, and cross-framework mapping helps you leverage existing controls from other frameworks you may already comply with. Create a free account to access all 47 controls and track your progress.

Start Your Compliance Journey

Create a free account to run self-assessments, get AI advisory, and track your compliance progress across 700 frameworks.

Get Started Free →

Free forever — no credit card required