Back to Frameworks

UK Bribery Act 2010

United Kingdom (SFO)
v2010
8 domains
20 controls

The UK Bribery Act 2010 is considered one of the strictest anti-bribery laws globally. It creates four offences: bribing another person (Section 1), being bribed (Section 2), bribing foreign public officials (Section 6), and failure of a commercial organisation to prevent bribery (Section 7). The Section 7 corporate offence has strict liability - the only defence is demonstrating 'adequate procedures' to prevent bribery. The Serious Fraud Office (SFO) prosecutes. Applies to UK companies and any company carrying on business in the UK. No facilitation payment exception.

Verified

UK Bribery Act 2010 is a compliance framework from United Kingdom (SFO) with 8 domains and 20 controls that map to 108 other frameworks. The largest domains are Bribery Act Sections 10 to 15: Prosecution, Penalties and Jurisdiction (7 controls), Bribery Act Sections 1 to 6: Offences (5 controls), Bribery Act Sections 7 to 9: Failure to Prevent and Adequate Procedures (3 controls). Every control below carries what it requires and what an assessor expects to see.

Maintained by Gerard BlokdykVerified against the published standard Control text last updated

Framework summaries on this platform are AI-assisted interpretations for educational and compliance planning purposes. They do not reproduce or replace the official standards. Refer to the authoritative source for the definitive text. Framework names and trademarks belong to their respective organisations.

Framework Domains (8)

Bribery Act Sections 1 to 6: Offences

5 controls
Controls in the Bribery Act Sections 1 to 6: Offences domain of UK Bribery Act 20105 controls
CodeTitle
Section 1Offence of Bribing Another Person
Section 3Function or Activity to Which Bribe Relates
Section 4Improper Performance Test
Section 6(3)Influence and Business Advantage
Section 6(5)Definition of Foreign Public Official

Bribery Act Sections 10 to 15: Prosecution, Penalties and Jurisdiction

7 controls
Controls in the Bribery Act Sections 10 to 15: Prosecution, Penalties and Jurisdiction domain of UK Bribery Act 20107 controls
CodeTitle
Section 10Consent to Prosecution
Section 11Penalties for Individuals
Section 11(3)Penalties for Organisations
Section 12Territorial Jurisdiction
Section 13Defence for Intelligence Services
Section 14Senior Officer Consent or Connivance
Section 15Deferred Prosecution Agreements

Bribery Act Sections 7 to 9: Failure to Prevent and Adequate Procedures

3 controls
Controls in the Bribery Act Sections 7 to 9: Failure to Prevent and Adequate Procedures domain of UK Bribery Act 20103 controls
CodeTitle
Section 7(2)Adequate Procedures Defence
Section 8Definition of Associated Person
Section 9Guidance on Adequate Procedures

Due Diligence

1 controls
Controls in the Due Diligence domain of UK Bribery Act 20101 controls
CodeTitle
UKBRIBE-3Due Diligence on Third Parties

Monitoring

1 controls
Controls in the Monitoring domain of UK Bribery Act 20101 controls
CodeTitle
UKBRIBE-5Monitoring, Review, Reporting

Risk Assessment

1 controls
Controls in the Risk Assessment domain of UK Bribery Act 20101 controls
CodeTitle
UKBRIBE-1Section 7 Strategic Risk Assessment and Adequate Procedures

Top-Level Commitment

1 controls
Controls in the Top-Level Commitment domain of UK Bribery Act 20101 controls
CodeTitle
UKBRIBE-2Top-Level Commitment and Governance

Training

1 controls
Controls in the Training domain of UK Bribery Act 20101 controls
CodeTitle
UKBRIBE-4Communication, Training, Awareness

Your Compliance Coverage

If you comply with UK Bribery Act 2010, you already cover:

Maps to 108 other frameworks

20 total controls
NIST SP 800-171A Rev 3 - Assessing CUI Security Requirements
3 source controls mapped|3 target controls covered
15%
IEC 62304:2015 Medical Device Software Lifecycle Processes
3 source controls mapped|3 target controls covered
15%
ISO/IEC 29100:2024
3 source controls mapped|1 target controls covered
15%
Annex 11 to EU GMP - Computerised Systems
3 source controls mapped|3 target controls covered
15%
ISO 14064 - Greenhouse Gas Accounting and Verification (Parts 1-3)
3 source controls mapped|1 target controls covered
15%
DAMA-DMBOK2 - Data Management Body of Knowledge (2nd Edition)
3 source controls mapped|3 target controls covered
15%
ISO/IEC 17025:2017 - General Requirements for Testing and Calibration
3 source controls mapped|2 target controls covered
15%
ISO 22320:2018
3 source controls mapped|3 target controls covered
15%
IEC 60601-1 - Medical Electrical Equipment Safety
3 source controls mapped|2 target controls covered
15%
ISO/IEC 27031:2011
3 source controls mapped|1 target controls covered
15%
Science Based Targets Initiative (SBTi) - Net-Zero Standard
3 source controls mapped|2 target controls covered
15%
ISO/IEC 27007:2020
3 source controls mapped|1 target controls covered
15%
15%
ISO 37000:2021 - Governance of Organizations
3 source controls mapped|3 target controls covered
15%
ISO 19011
3 source controls mapped|2 target controls covered
15%
15%
ISO 31000:2018
3 source controls mapped|1 target controls covered
15%
SANS Incident Handler's Handbook and PICERL Methodology
3 source controls mapped|2 target controls covered
15%
Azerbaijan Law on Personal Data (2010)
3 source controls mapped|1 target controls covered
15%
AICPA Privacy Management Framework (PMF)
3 source controls mapped|2 target controls covered
15%
NIST Cybersecurity Framework 2.0
3 source controls mapped|2 target controls covered
15%
ISO 56002
3 source controls mapped|2 target controls covered
15%
CISA Cross-Sector Cybersecurity Performance Goals (CPG) 2.0
3 source controls mapped|1 target controls covered
15%
PCI DSS 4.0
3 source controls mapped|1 target controls covered
15%
ISO 22739:2024 - Blockchain and Distributed Ledger Technologies Vocabulary
3 source controls mapped|3 target controls covered
15%
ISO 28001:2007 Supply Chain Security Management
3 source controls mapped|1 target controls covered
15%
ISO 26262:2018 - Functional Safety for Road Vehicles
3 source controls mapped|1 target controls covered
15%
ASIS SPC.1-2009 - Organizational Resilience Standard
3 source controls mapped|1 target controls covered
15%
ISO/IEC 30111:2019
3 source controls mapped|1 target controls covered
15%
Nebraska Data Privacy Act
3 source controls mapped|2 target controls covered
15%
ISO/IEC 38500:2024 - Governance of IT
3 source controls mapped|3 target controls covered
15%
Barbados Data Protection Act 2019
3 source controls mapped|1 target controls covered
15%
PCI PIN Security
3 source controls mapped|1 target controls covered
15%
ISO/IEC 25012:2008 - Data Quality Model
3 source controls mapped|2 target controls covered
15%
Automotive SPICE (ASPICE) v4.0 - Process Assessment Model
3 source controls mapped|2 target controls covered
15%
ISO 27018
3 source controls mapped|1 target controls covered
15%
ISO 20400:2017 - Sustainable Procurement
3 source controls mapped|2 target controls covered
15%
BRCGS Global Standard for Food Safety Issue 9
3 source controls mapped|3 target controls covered
15%
ISO/IEC 27004:2016
3 source controls mapped|2 target controls covered
15%
ISO/IEC 27003:2017
3 source controls mapped|1 target controls covered
15%
ISO/SAE 21434
3 source controls mapped|1 target controls covered
15%
ISO/IEC 23894:2023
3 source controls mapped|3 target controls covered
15%
UK Open Banking Standard
3 source controls mapped|1 target controls covered
15%
NIST SP 800-190
3 source controls mapped|1 target controls covered
15%
ISO 27043
3 source controls mapped|1 target controls covered
15%
Switzerland New Federal Act on Data Protection (nFADP/nDSG, 2023)
3 source controls mapped|1 target controls covered
15%
ISO 27017
3 source controls mapped|1 target controls covered
15%
Singapore Government Instruction Manual on ICT&SS Management (IM8)
3 source controls mapped|1 target controls covered
15%
ISO/IEC 27557:2022 - Organisational Privacy Risk Management
3 source controls mapped|1 target controls covered
15%
PCI P2PE
3 source controls mapped|1 target controls covered
15%
FedRAMP High
3 source controls mapped|1 target controls covered
15%
NIST SP 800-53 Revision 5.1 HIGH
3 source controls mapped|1 target controls covered
15%
FedRAMP Moderate
3 source controls mapped|1 target controls covered
15%
NIST SP 800-53 Rev 5 MODERATE
3 source controls mapped|1 target controls covered
15%
NIST SP 800-53 Rev 5 LOW
3 source controls mapped|1 target controls covered
15%
Florida Digital Bill of Rights (FDBR)
3 source controls mapped|2 target controls covered
15%
Kuwait National Cybersecurity Framework
3 source controls mapped|1 target controls covered
15%
Illinois Biometric Information Privacy Act (BIPA)
3 source controls mapped|1 target controls covered
15%
PCI SSF
3 source controls mapped|1 target controls covered
15%
ISO 8000 - Data Quality
3 source controls mapped|2 target controls covered
15%
ISO/IEC 29147:2018
3 source controls mapped|1 target controls covered
15%
FFIEC IT Examination Handbook
3 source controls mapped|1 target controls covered
15%
IEC 62351 - Power Systems Communication Security
3 source controls mapped|1 target controls covered
15%
US Foreign Corrupt Practices Act (FCPA)
3 source controls mapped|1 target controls covered
15%
IAIS Insurance Core Principles (ICPs)
3 source controls mapped|1 target controls covered
15%
COBIT 2019
3 source controls mapped|1 target controls covered
15%
Austria Data Protection Act (Datenschutzgesetz, DSG, amended 2018)
3 source controls mapped|2 target controls covered
15%
ISO 41001:2018 - Facility Management Systems
3 source controls mapped|2 target controls covered
15%
South Korea ISMS-P
3 source controls mapped|1 target controls covered
15%
WCAG 2.2
2 source controls mapped|1 target controls covered
10%
UK GDPR (UK General Data Protection Regulation)
2 source controls mapped|1 target controls covered
10%
SOC 2
2 source controls mapped|2 target controls covered
10%
SSAE 18 - Attestation Standards (SOC Reporting)
2 source controls mapped|2 target controls covered
10%
NRC 10 CFR 73.54 - Nuclear Facility Cybersecurity
2 source controls mapped|3 target controls covered
10%
Rhode Island Data Transparency and Privacy Protection Act (RIDTPPA)
2 source controls mapped|1 target controls covered
10%
Sweden Data Protection Act (Dataskyddslag, 2018:218)
2 source controls mapped|1 target controls covered
10%
Singapore Cybersecurity Act 2018
2 source controls mapped|1 target controls covered
10%
WHO Global Strategy on Digital Health 2020-2025
2 source controls mapped|1 target controls covered
10%
UK Telecommunications (Security) Act 2021
2 source controls mapped|1 target controls covered
10%
US SEC Digital Assets and Crypto Regulatory Framework
2 source controls mapped|2 target controls covered
10%
ISO 37001:2016
2 source controls mapped|2 target controls covered
10%
ISO 45001:2018
1 source controls mapped|1 target controls covered
5%
ISO 22301:2019
1 source controls mapped|1 target controls covered
5%
ISO 22000:2018
1 source controls mapped|1 target controls covered
5%
ISO 55001:2014
1 source controls mapped|1 target controls covered
5%
ISO 37301:2021
1 source controls mapped|1 target controls covered
5%
ISO 50001:2018 - Energy Management Systems
1 source controls mapped|1 target controls covered
5%
ISO 27701:2019
1 source controls mapped|1 target controls covered
5%
ISO 14001:2015
1 source controls mapped|1 target controls covered
5%
ISO 13485:2016
1 source controls mapped|1 target controls covered
5%
ISO 9001:2015
1 source controls mapped|1 target controls covered
5%
ISO 14004:2016
1 source controls mapped|1 target controls covered
5%
W3C Verifiable Credentials (VC) Data Model 2.0
1 source controls mapped|1 target controls covered
5%
Vietnam Law on Cybersecurity (No. 24/2018/QH14)
1 source controls mapped|1 target controls covered
5%
USMCA Chapter 19 - Digital Trade (United States-Mexico-Canada Agreement)
1 source controls mapped|1 target controls covered
5%
ICH Q10 - Pharmaceutical Quality System
1 source controls mapped|2 target controls covered
5%
Trinidad and Tobago Data Protection Act 2011
1 source controls mapped|3 target controls covered
5%
Tanzania Personal Data Protection Act (Draft)
1 source controls mapped|2 target controls covered
5%
SLSA
1 source controls mapped|1 target controls covered
5%
SIG (Shared Assessments)
1 source controls mapped|1 target controls covered
5%
Philippines Cybercrime Prevention Act (RA 10175)
1 source controls mapped|1 target controls covered
5%
OWASP SAMM
1 source controls mapped|1 target controls covered
5%
FTC GLBA Safeguards Rule (16 CFR Part 314)
1 source controls mapped|1 target controls covered
5%
French Sapin II Law (Law No. 2016-1691)
1 source controls mapped|1 target controls covered
5%

What is UK Bribery Act 2010 and who does it apply to?

UK Bribery Act 2010 is a compliance framework from United Kingdom (SFO) with 8 domains and 20 controls. The UK Bribery Act 2010 is considered one of the strictest anti-bribery laws globally. It creates four offences: bribing another person (Section 1), being bribed (Section 2), bribing foreign public officials (Section 6), and failure of a commercial organisation to prevent bribery (Section 7). The Section 7 corporate offence has strict liability - the only defence is demonstrating 'adequate procedures' to prevent bribery. The Serious Fraud Office (SFO) prosecutes. Applies to UK companies and any company carrying on business in the UK. No facilitation payment exception. It is used by organisations to establish and maintain compliance with industry standards and regulatory requirements.

What does UK Bribery Act 2010 actually require?

UK Bribery Act 2010 has 20 controls organised across 8 domains. The largest domains are Bribery Act Sections 10 to 15: Prosecution, Penalties and Jurisdiction (7 controls), Bribery Act Sections 1 to 6: Offences (5 controls), Bribery Act Sections 7 to 9: Failure to Prevent and Adequate Procedures (3 controls). Each control defines specific requirements that organisations must implement to achieve compliance.

If I already comply with another framework, how much of UK Bribery Act 2010 do I already cover?

UK Bribery Act 2010 maps to 108 other compliance frameworks. The top mapping partners are NIST SP 800-171A Rev 3 - Assessing CUI Security Requirements (15% coverage), IEC 62304:2015 Medical Device Software Lifecycle Processes (15% coverage), ISO/IEC 29100:2024 (15% coverage). Use our comparison tool to explore control-level mappings between frameworks.

How do I implement UK Bribery Act 2010?

Start your UK Bribery Act 2010 compliance journey by running a self-assessment on our platform to identify your current compliance posture. Our AI advisory can answer specific questions about UK Bribery Act 2010 requirements, and cross-framework mapping helps you leverage existing controls from other frameworks you may already comply with. Create a free account to access all 20 controls and track your progress.

Start Your Compliance Journey

Create a free account to run self-assessments, get AI advisory, and track your compliance progress across 686 frameworks.

Get Started Free →

Free forever — no credit card required