Back to Frameworks

Voluntary Principles on Security and Human Rights (VPs)

Self-Assess
International (Voluntary Principles Initiative)
vVoluntary Principles on Security and Human Rights (2000); VPI Governance Rules adopted December 2024
4 domains
35 controls

The Voluntary Principles on Security and Human Rights (2000): voluntary principles guiding extractive and energy companies on security and human rights risk assessment and on relations with public and private security, with the Voluntary Principles Initiative's participation, reporting and verification expectations for members (Governance Rules, December 2024). 35 leaves read against the principles text and Governance Rules.

Verified

Voluntary Principles on Security and Human Rights (VPs) is a compliance framework from International (Voluntary Principles Initiative) with 4 domains and 35 controls that map to 108 other frameworks. The largest domains are Part II: Interactions between companies and public security – Voluntary Principles on Security and Human Rights (VPs) (14 controls), Part III: Interactions between companies and private security – Voluntary Principles on Security and Human Rights (VPs) (13 controls), Part I: Risk assessment – Voluntary Principles on Security and Human Rights (VPs) (6 controls). Every control below carries what it requires and what an assessor expects to see.

Maintained by Gerard BlokdykVerified against the published standard Control text last updated

Framework summaries on this platform are interpretations grounded in the published source, for educational and compliance planning purposes. They do not reproduce or replace the official standards. Refer to the authoritative source for the definitive text. Framework names and trademarks belong to their respective organisations.

Framework Domains (4)

Part I: Risk assessment – Voluntary Principles on Security and Human Rights (VPs)

6 controls
Controls in the Part I: Risk assessment – Voluntary Principles on Security and Human Rights (VPs) domain of Voluntary Principles on Security and Human Rights (VPs): 6 controls
CodeTitle
voluntary-principles-on-security-and-human-rights-vps::RA-1Identification of security risks
voluntary-principles-on-security-and-human-rights-vps::RA-2Potential for violence
voluntary-principles-on-security-and-human-rights-vps::RA-3Human rights records of security actors
voluntary-principles-on-security-and-human-rights-vps::RA-4Rule of law
voluntary-principles-on-security-and-human-rights-vps::RA-5Conflict analysis
voluntary-principles-on-security-and-human-rights-vps::RA-6Equipment transfers

Part II: Interactions between companies and public security – Voluntary Principles on Security and Human Rights (VPs)

14 controls
Controls in the Part II: Interactions between companies and public security – Voluntary Principles on Security and Human Rights (VPs) domain of Voluntary Principles on Security and Human Rights (VPs): 14 controls
CodeTitle
voluntary-principles-on-security-and-human-rights-vps::PUB-1Consult on the impact of security arrangements
voluntary-principles-on-security-and-human-rights-vps::PUB-10Support human rights training and accountability
voluntary-principles-on-security-and-human-rights-vps::PUB-11Record and report allegations
voluntary-principles-on-security-and-human-rights-vps::PUB-12Monitor investigations
voluntary-principles-on-security-and-human-rights-vps::PUB-13Monitor use of company-provided equipment
voluntary-principles-on-security-and-human-rights-vps::PUB-14Credible information and source protection
voluntary-principles-on-security-and-human-rights-vps::PUB-2Communicate company policies to public security
voluntary-principles-on-security-and-human-rights-vps::PUB-3Transparency of security arrangements
voluntary-principles-on-security-and-human-rights-vps::PUB-4Role and proportionate deployment of public security
voluntary-principles-on-security-and-human-rights-vps::PUB-5Equipment provided to public security
voluntary-principles-on-security-and-human-rights-vps::PUB-6Promote vetting, proportionate force and workers' rights
voluntary-principles-on-security-and-human-rights-vps::PUB-7Reporting use of force and medical aid
voluntary-principles-on-security-and-human-rights-vps::PUB-8Structured meetings and collective engagement
voluntary-principles-on-security-and-human-rights-vps::PUB-9Promote international law enforcement principles

Part III: Interactions between companies and private security – Voluntary Principles on Security and Human Rights (VPs)

13 controls
Controls in the Part III: Interactions between companies and private security – Voluntary Principles on Security and Human Rights (VPs) domain of Voluntary Principles on Security and Human Rights (VPs): 13 controls
CodeTitle
voluntary-principles-on-security-and-human-rights-vps::PRI-1Observe company policy, law and standards
voluntary-principles-on-security-and-human-rights-vps::PRI-10Contract provisions and training
voluntary-principles-on-security-and-human-rights-vps::PRI-11Consult and monitor providers; local representation
voluntary-principles-on-security-and-human-rights-vps::PRI-12Background review of providers
voluntary-principles-on-security-and-human-rights-vps::PRI-13Share experience with others
voluntary-principles-on-security-and-human-rights-vps::PRI-2Technical and professional proficiency
voluntary-principles-on-security-and-human-rights-vps::PRI-3Lawful conduct and restraint
voluntary-principles-on-security-and-human-rights-vps::PRI-4Conduct policies and monitoring
voluntary-principles-on-security-and-human-rights-vps::PRI-5Record and investigate allegations
voluntary-principles-on-security-and-human-rights-vps::PRI-6Preventive and defensive services only
voluntary-principles-on-security-and-human-rights-vps::PRI-7Vetting, proportionate force and freedom of association
voluntary-principles-on-security-and-human-rights-vps::PRI-8Investigate use of force and medical aid
voluntary-principles-on-security-and-human-rights-vps::PRI-9Confidentiality of information

Voluntary Principles Initiative participation and reporting – Voluntary Principles on Security and Human Rights (VPs)

2 controls
Controls in the Voluntary Principles Initiative participation and reporting – Voluntary Principles on Security and Human Rights (VPs) domain of Voluntary Principles on Security and Human Rights (VPs): 2 controls
CodeTitle
voluntary-principles-on-security-and-human-rights-vps::VPI-PACParticipation and accountability criteria
voluntary-principles-on-security-and-human-rights-vps::VPI-REPCorporate annual reporting

Your Compliance Coverage

If you comply with Voluntary Principles on Security and Human Rights (VPs), you already cover:

Papua New Guinea National Cybersecurity Policy & Cybercrime Act (2016)

2%

1 controls mapped

Compare →

ISO 31000:2018

2%

1 controls mapped

Compare →

ISO/IEC 23894:2023

2%

1 controls mapped

Compare →

+ 105 more: Barbados Data Protection Act 2019 (2%), IEC 62443 (2%)

See all 108 mapped frameworks ↓

Maps to 108 other frameworks

59 total controls
Papua New Guinea National Cybersecurity Policy & Cybercrime Act (2016)
1 source controls mapped|1 target controls covered
2%
ISO 31000:2018
1 source controls mapped|1 target controls covered
2%
ISO/IEC 23894:2023
1 source controls mapped|1 target controls covered
2%
Barbados Data Protection Act 2019
1 source controls mapped|2 target controls covered
2%
IEC 62443
1 source controls mapped|4 target controls covered
2%
IAIS Insurance Core Principles (ICPs)
1 source controls mapped|1 target controls covered
2%
Kids Online Safety Act (KOSA)
1 source controls mapped|1 target controls covered
2%
MiFID II / MiFIR
1 source controls mapped|1 target controls covered
2%
DAMA-DMBOK2 - Data Management Body of Knowledge (2nd Edition)
1 source controls mapped|1 target controls covered
2%
SQF Code Edition 9 - Safe Quality Food
1 source controls mapped|1 target controls covered
2%
Aged Care Quality Standards 2019 (repealed edition)
1 source controls mapped|1 target controls covered
2%
ISO/IEC 27014:2020
1 source controls mapped|1 target controls covered
2%
AS9100D - Aerospace Quality Management System
1 source controls mapped|1 target controls covered
2%
IEC 62304:2015 Medical Device Software Lifecycle Processes
1 source controls mapped|2 target controls covered
2%
FDA Quality Management System Regulation (QMSR)
1 source controls mapped|2 target controls covered
2%
German Supply Chain Due Diligence Act (LkSG)
1 source controls mapped|4 target controls covered
2%
ICH Q10 - Pharmaceutical Quality System
1 source controls mapped|1 target controls covered
2%
ILO Declaration on Fundamental Principles and Rights at Work (Core Conventions)
1 source controls mapped|3 target controls covered
2%
IMO Maritime Cybersecurity Guidelines (MSC-FAL.1/Circ.3/Rev.4)
1 source controls mapped|1 target controls covered
2%
ITAR - International Traffic in Arms Regulations
1 source controls mapped|1 target controls covered
2%
NIST SP 800-30
1 source controls mapped|1 target controls covered
2%
NIST SP 800-37
1 source controls mapped|1 target controls covered
2%
NIST SP 800-39
1 source controls mapped|1 target controls covered
2%
PIC/S Guide to Good Manufacturing Practice for Medicinal Products
1 source controls mapped|1 target controls covered
2%
SA8000:2014 - Social Accountability Standard
1 source controls mapped|1 target controls covered
2%
TISAX - Trusted Information Security Assessment Exchange
1 source controls mapped|1 target controls covered
2%
UK FCA/PRA Operational Resilience Framework
1 source controls mapped|1 target controls covered
2%
BSI IT-Grundschutz
1 source controls mapped|3 target controls covered
2%
API 1164
1 source controls mapped|3 target controls covered
2%
ISO/IEC 30111:2019
1 source controls mapped|2 target controls covered
2%
US Maritime Transportation Security Act (MTSA) and USCG Cybersecurity Requirements
1 source controls mapped|1 target controls covered
2%
APPI
1 source controls mapped|2 target controls covered
2%
Bahrain PDPL
1 source controls mapped|2 target controls covered
2%
Switzerland New Federal Act on Data Protection (nFADP/nDSG, 2023)
1 source controls mapped|3 target controls covered
2%
FFIEC IT Examination Handbook
1 source controls mapped|3 target controls covered
2%
ASD Strategies to Mitigate Cyber Security Incidents
1 source controls mapped|2 target controls covered
2%
COSO Internal Control - Integrated Framework (2013)
1 source controls mapped|1 target controls covered
2%
Canada ITSG-33 - IT Security Risk Management
1 source controls mapped|1 target controls covered
2%
APRA CPS 230 Operational Risk Management
1 source controls mapped|1 target controls covered
2%
UK Defence Standard 05-138 - Cyber Security for Defence Suppliers
1 source controls mapped|2 target controls covered
2%
FFIEC Cybersecurity Assessment Tool (CAT)
1 source controls mapped|1 target controls covered
2%
APRA CPS 234
1 source controls mapped|2 target controls covered
2%
Annex 11 to EU GMP - Computerised Systems
1 source controls mapped|1 target controls covered
2%
ISO/IEC 27400:2022
1 source controls mapped|1 target controls covered
2%
ASIS SPC.1-2009 - Organizational Resilience Standard
1 source controls mapped|1 target controls covered
2%
ISO/IEC 27010:2015
1 source controls mapped|1 target controls covered
2%
Federal Decree-Law No. 45 of 2021 on the Protection of Personal Data (UAE PDPL)
1 source controls mapped|2 target controls covered
2%
FTC GLBA Safeguards Rule (16 CFR Part 314)
1 source controls mapped|1 target controls covered
2%
IAEA Nuclear Security Series - Computer Security at Nuclear Facilities (NSS-17-T Rev 1)
1 source controls mapped|1 target controls covered
2%
Iceland Data Protection and Processing of Personal Data Act (Act No. 90/2018)
1 source controls mapped|1 target controls covered
2%
Indiana Consumer Data Protection Act
1 source controls mapped|1 target controls covered
2%
ISMAP (Japan)
1 source controls mapped|1 target controls covered
2%
Jamaica Data Protection Act 2020
1 source controls mapped|2 target controls covered
2%
Japan FSA Cybersecurity Guidelines for Financial Institutions
1 source controls mapped|1 target controls covered
2%
Kentucky Consumer Data Protection Act
1 source controls mapped|2 target controls covered
2%
South Korea PIPA
1 source controls mapped|2 target controls covered
2%
Laos Law on Prevention and Combating Cybercrime (2015)
1 source controls mapped|1 target controls covered
2%
LGPD
1 source controls mapped|1 target controls covered
2%
Liechtenstein DPA
1 source controls mapped|1 target controls covered
2%
Malaysia PDPA 2010
1 source controls mapped|2 target controls covered
2%
Maryland Online Data Privacy Act of 2024
1 source controls mapped|2 target controls covered
2%
Mauritius DPA
1 source controls mapped|1 target controls covered
2%
Mexico LFPDPPP
1 source controls mapped|1 target controls covered
2%
Minnesota Consumer Data Privacy Act
1 source controls mapped|1 target controls covered
2%
Monetary Authority of Singapore Technology Risk Management Guidelines
1 source controls mapped|1 target controls covered
2%
Montana Consumer Data Privacy Act
1 source controls mapped|1 target controls covered
2%
MTCS (Singapore)
1 source controls mapped|2 target controls covered
2%
Nebraska Data Privacy Act
1 source controls mapped|4 target controls covered
2%
NERC CIP
1 source controls mapped|1 target controls covered
2%
Nevada Gaming Control Board Cybersecurity Requirements
1 source controls mapped|1 target controls covered
2%
New Hampshire Data Privacy Act
1 source controls mapped|1 target controls covered
2%
New Jersey Data Privacy Act
1 source controls mapped|2 target controls covered
2%
Nigeria Data Protection Act 2023 (NDPA)
1 source controls mapped|4 target controls covered
2%
Nigeria Data Protection Regulation (NDPR)
1 source controls mapped|1 target controls covered
2%
Nigeria Open Banking Regulatory Framework (CBN, 2023)
1 source controls mapped|1 target controls covered
2%
NIST SP 800-122
1 source controls mapped|1 target controls covered
2%
NIST SP 800-144
1 source controls mapped|1 target controls covered
2%
NIST SP 800-145
1 source controls mapped|1 target controls covered
2%
NIST SP 800-146
1 source controls mapped|1 target controls covered
2%
NIST SP 800-82 Revision 3: Guide to Industrial Control Systems (ICS) Security
1 source controls mapped|1 target controls covered
2%
NRF Cybersecurity and Data Privacy Framework (National Retail Federation)
1 source controls mapped|1 target controls covered
2%
OECD AI Principles
1 source controls mapped|1 target controls covered
2%
OECD Guidelines for Multinational Enterprises on Responsible Business Conduct (2023 Update)
1 source controls mapped|1 target controls covered
2%
OECD Recommendation on Artificial Intelligence (2024 Update)
1 source controls mapped|2 target controls covered
2%
Oman National Cybersecurity Framework
1 source controls mapped|1 target controls covered
2%
Open Banking Security
1 source controls mapped|2 target controls covered
2%
Oregon Consumer Privacy Act
1 source controls mapped|1 target controls covered
2%
OSFI B-13
1 source controls mapped|3 target controls covered
2%
Virginia CDPA
1 source controls mapped|1 target controls covered
2%
Vietnam PDPD
1 source controls mapped|1 target controls covered
2%
Uruguay DPL
1 source controls mapped|1 target controls covered
2%
UK Gambling Commission LCCP and Remote Technical Standards
1 source controls mapped|1 target controls covered
2%
UK GDPR (UK General Data Protection Regulation)
1 source controls mapped|1 target controls covered
2%
Turkey KVKK
1 source controls mapped|1 target controls covered
2%
Trinidad and Tobago Data Protection Act 2011
1 source controls mapped|1 target controls covered
2%
TSA Pipeline Cybersecurity Directives
1 source controls mapped|1 target controls covered
2%
Texas Data Privacy and Security Act (TDPSA)
1 source controls mapped|1 target controls covered
2%
Tanzania Personal Data Protection Act 2022
1 source controls mapped|1 target controls covered
2%
Taiwan PDPA
1 source controls mapped|1 target controls covered
2%
PSD2 SCA
1 source controls mapped|2 target controls covered
2%
Qatar DPL
1 source controls mapped|2 target controls covered
2%
Privacy Act 2020
1 source controls mapped|1 target controls covered
2%
POPIA
1 source controls mapped|1 target controls covered
2%
Peru DPL
1 source controls mapped|2 target controls covered
2%
Personal Data Act (personopplysningsloven)
1 source controls mapped|1 target controls covered
2%
PDPA Thailand
1 source controls mapped|1 target controls covered
2%
PDPA Singapore
1 source controls mapped|1 target controls covered
2%
PAS 1192-5:2015 - Security-Minded Approach to BIM and Digital Built Environments
1 source controls mapped|1 target controls covered
2%
Compare Voluntary Principles on Security and Human Rights (VPs) with Papua New Guinea National Cybersecurity Policy & Cybercrime Act (2016)

Coverage is not the same as your position

This page shows what Voluntary Principles on Security and Human Rights (VPs) overlaps with in general. Where your organisation actually stands, against the standard you are going for and the certifications you already hold, is a different question. Same graph and the same recorded refutations, scoped to you rather than to a pair.

The Compliance Position Diagnostic, $5,000 fixed, ten business days

What is Voluntary Principles on Security and Human Rights (VPs) and who does it apply to?

Voluntary Principles on Security and Human Rights (VPs) is a compliance framework from International (Voluntary Principles Initiative) with 4 domains and 35 controls. The Voluntary Principles on Security and Human Rights (2000): voluntary principles guiding extractive and energy companies on security and human rights risk assessment and on relations with public and private security, with the Voluntary Principles Initiative's participation, reporting and verification expectations for members (Governance Rules, December 2024). 35 leaves read against the principles text and Governance Rules. It is used by organisations to establish and maintain compliance with industry standards and regulatory requirements.

What does Voluntary Principles on Security and Human Rights (VPs) actually require?

Voluntary Principles on Security and Human Rights (VPs) has 35 controls organised across 4 domains. The largest domains are Part II: Interactions between companies and public security – Voluntary Principles on Security and Human Rights (VPs) (14 controls), Part III: Interactions between companies and private security – Voluntary Principles on Security and Human Rights (VPs) (13 controls), Part I: Risk assessment – Voluntary Principles on Security and Human Rights (VPs) (6 controls). Each control defines specific requirements that organisations must implement to achieve compliance.

If I already comply with another framework, how much of Voluntary Principles on Security and Human Rights (VPs) do I already cover?

Voluntary Principles on Security and Human Rights (VPs) maps to 108 other compliance frameworks. The top mapping partners are Papua New Guinea National Cybersecurity Policy & Cybercrime Act (2016) (2% coverage), ISO 31000:2018 (2% coverage), ISO/IEC 23894:2023 (2% coverage). Use our comparison tool to explore control-level mappings between frameworks.

How do I implement Voluntary Principles on Security and Human Rights (VPs)?

Start your Voluntary Principles on Security and Human Rights (VPs) compliance journey by running a self-assessment on our platform to identify your current compliance posture. Our AI advisory can answer specific questions about Voluntary Principles on Security and Human Rights (VPs) requirements, and cross-framework mapping helps you leverage existing controls from other frameworks you may already comply with. Create a free account to access all 35 controls and track your progress.

Start Your Compliance Journey

Create a free account to run self-assessments, get AI advisory, and track your compliance progress across 1,120 frameworks.

Get Started Free →

Free forever, no credit card required