{"catalogRevision":"791ff2dd3a45707290badee660f185e514d15f1cf518908628f425c2f2c56ee4","contextIds":["ctrl:aiuc-1:A003","ctrl:aiuc-1:B007","ctrl:aiuc-1:C001","ctrl:cobit-2019:APO01","ctrl:cobit-2019:APO06","ctrl:cobit-2019:APO14","ctrl:cobit-2019:DSS06","ctrl:cobit-2019:EDM01","ctrl:cobit-2019:EDM04","ctrl:cobit-2019:MEA02","ctrl:coso-erm:E1","ctrl:coso-erm:E14","ctrl:coso-erm:E3","ctrl:coso-erm:E4","ctrl:coso-ic:P1","ctrl:coso-ic:P10","ctrl:coso-ic:P11","ctrl:coso-ic:P16","ctrl:coso-ic:P2","ctrl:coso-ic:P5","ctrl:coso-ic:P8","ctrl:eu-ai-act:AIA-Art27","ctrl:eu-ai-act:AIA-Art6-7","ctrl:gdpr:GDPR-Art32","ctrl:hipaa:HIPAA-164.312(a)","ctrl:iia-2024:Principle 1","ctrl:iia-2024:Principle 10","ctrl:iia-2024:Principle 14","ctrl:iia-2024:Principle 15","ctrl:iia-2024:Principle 3","ctrl:iia-2024:Principle 4","ctrl:iia-2024:Principle 6","ctrl:iia-2024:Principle 9","ctrl:iia-2024:Std 1.1","ctrl:iia-2024:Std 1.2","ctrl:iia-2024:Std 1.3","ctrl:iia-2024:Std 10.1","ctrl:iia-2024:Std 10.2","ctrl:iia-2024:Std 10.3","ctrl:iia-2024:Std 11.3"],"directIds":[],"kind":"bundle","metadata":"/assets/agent_metadata.84eaa456936e4fa1.json","name":"Financial Reporting Controls (SOX)","next":"/assets/agent_topics-financial-reporting-controls-sox-2.3bce14a5899d92e2.json","page":1,"pageSize":40,"records":[{"attributes":{"category":"technical","framework":"aiuc-1","type":"preventive"},"canonicalUrl":"https://evidenceflows.com/frameworks/aiuc-1/","description":"Limit AI agent data access","details":{"automation":"automated","control_category":"technical","control_id":"A003","control_type":"preventive","domains":["AI Governance","Data Protection & Privacy"],"framework":"aiuc-1","group":"Data & Privacy","key_control":false,"requirement_frequency":"Every 12 months","requirement_status":"mandatory","risk_count":7,"source_pages":null,"source_url":"https://www.aiuc-1.com/data-and-privacy/implement-contextual-data-safeguards"},"direct":false,"history":{"digest":"f887d2a86a3168280ca2b27485f4bdfc028ffa39bea91251cd1ddefc50c323c8","firstSeenAt":"2026-09-17T22:28:00Z","firstSeenRevision":"f368a6cce277037e4b1e1ff46004e3acd295f96c9ac63a411a0e45775a7f468e","updatedAt":"2026-09-17T22:28:00Z","updatedRevision":"f368a6cce277037e4b1e1ff46004e3acd295f96c9ac63a411a0e45775a7f468e"},"htmlUrl":"/agents/records/ctrl-aiuc-1-a003-bea61fd9.html","id":"ctrl:aiuc-1:A003","mapUrl":"https://evidenceflows.com/?v=1&node=ctrl%3Aaiuc-1%3AA003","sourceIds":["aiuc-1"],"sourceUrl":"https://www.aiuc-1.com/data-and-privacy/implement-contextual-data-safeguards","title":"A003 — Limit AI agent data access","type":"control","updatedAt":"2026-09-17T22:28:00Z","url":"/assets/agent_record-ctrl-aiuc-1-a003-bea61fd9.046b370e6cc057fa.json"},{"attributes":{"category":"technical","framework":"aiuc-1","type":"preventive"},"canonicalUrl":"https://evidenceflows.com/frameworks/aiuc-1/","description":"Enforce user access privileges to AI systems","details":{"automation":"hybrid","control_category":"technical","control_id":"B007","control_type":"preventive","domains":["AI Governance","Access Control & Identity Management","Secure Development (SDLC) & Application Security"],"framework":"aiuc-1","group":"Security","key_control":true,"requirement_frequency":"Every 3 months","requirement_status":"mandatory","risk_count":4,"source_pages":null,"source_url":"https://www.aiuc-1.com/security/enforce-ai-access-privileges"},"direct":false,"history":{"digest":"5f9f84587d757717e91ddb689515aa8109f44903c10e5d49b52a2e278bc11ab8","firstSeenAt":"2026-09-17T22:28:00Z","firstSeenRevision":"f368a6cce277037e4b1e1ff46004e3acd295f96c9ac63a411a0e45775a7f468e","updatedAt":"2026-09-17T22:28:00Z","updatedRevision":"f368a6cce277037e4b1e1ff46004e3acd295f96c9ac63a411a0e45775a7f468e"},"htmlUrl":"/agents/records/ctrl-aiuc-1-b007-151dfcd3.html","id":"ctrl:aiuc-1:B007","mapUrl":"https://evidenceflows.com/?v=1&node=ctrl%3Aaiuc-1%3AB007","sourceIds":["aiuc-1"],"sourceUrl":"https://www.aiuc-1.com/security/enforce-ai-access-privileges","title":"B007 — Enforce user access privileges to AI systems","type":"control","updatedAt":"2026-09-17T22:28:00Z","url":"/assets/agent_record-ctrl-aiuc-1-b007-151dfcd3.da4b87b9cbb3dbdc.json"},{"attributes":{"category":"administrative","framework":"aiuc-1","type":"preventive"},"canonicalUrl":"https://evidenceflows.com/frameworks/aiuc-1/","description":"Define AI risk taxonomy","details":{"automation":"manual","control_category":"administrative","control_id":"C001","control_type":"preventive","domains":["AI Governance"],"framework":"aiuc-1","group":"Safety","key_control":false,"requirement_frequency":"Every 12 months","requirement_status":"mandatory","risk_count":8,"source_pages":null,"source_url":"https://www.aiuc-1.com/safety/define-ai-risk-taxonomy"},"direct":false,"history":{"digest":"bbf0cf938f1deeb42489a0eb7e6c27c1c52fbb2e97d2396944766448326aef56","firstSeenAt":"2026-09-17T22:28:00Z","firstSeenRevision":"f368a6cce277037e4b1e1ff46004e3acd295f96c9ac63a411a0e45775a7f468e","updatedAt":"2026-09-17T22:28:00Z","updatedRevision":"f368a6cce277037e4b1e1ff46004e3acd295f96c9ac63a411a0e45775a7f468e"},"htmlUrl":"/agents/records/ctrl-aiuc-1-c001-6bc6c173.html","id":"ctrl:aiuc-1:C001","mapUrl":"https://evidenceflows.com/?v=1&node=ctrl%3Aaiuc-1%3AC001","sourceIds":["aiuc-1"],"sourceUrl":"https://www.aiuc-1.com/safety/define-ai-risk-taxonomy","title":"C001 — Define AI risk taxonomy","type":"control","updatedAt":"2026-09-17T22:28:00Z","url":"/assets/agent_record-ctrl-aiuc-1-c001-6bc6c173.96bdf10c364b9040.json"},{"attributes":{"category":"administrative","framework":"cobit-2019","type":"preventive"},"canonicalUrl":"https://evidenceflows.com/frameworks/cobit-2019/","description":"Managed I&T Management Framework","details":{"automation":"manual","control_category":"administrative","control_id":"APO01","control_type":"preventive","domains":["Governance, Policy & Oversight","Risk Assessment & Management","Human Resources / Personnel Security","Third-Party / Supply-Chain Risk","Asset Management & Inventory"],"framework":"cobit-2019","group":"Align, Plan and Organize","key_control":false,"requirement_frequency":null,"requirement_status":null,"risk_count":3,"source_pages":null,"source_url":null},"direct":false,"history":{"digest":"13e31403624625272ea17ef51f5f2b140422bdc99f5c717f0a3cba6cf1ad91fb","firstSeenAt":"2026-09-17T22:28:00Z","firstSeenRevision":"f368a6cce277037e4b1e1ff46004e3acd295f96c9ac63a411a0e45775a7f468e","updatedAt":"2026-09-17T22:28:00Z","updatedRevision":"f368a6cce277037e4b1e1ff46004e3acd295f96c9ac63a411a0e45775a7f468e"},"htmlUrl":"/agents/records/ctrl-cobit-2019-apo01-d6a49088.html","id":"ctrl:cobit-2019:APO01","mapUrl":"https://evidenceflows.com/?v=1&node=ctrl%3Acobit-2019%3AAPO01","sourceIds":["cobit-2019"],"sourceUrl":null,"title":"APO01 — Managed I&T Management Framework","type":"control","updatedAt":"2026-09-17T22:28:00Z","url":"/assets/agent_record-ctrl-cobit-2019-apo01-d6a49088.19eb739670cbeefa.json"},{"attributes":{"category":"administrative","framework":"cobit-2019","type":"preventive"},"canonicalUrl":"https://evidenceflows.com/frameworks/cobit-2019/","description":"Managed Budget and Costs","details":{"automation":"manual","control_category":"administrative","control_id":"APO06","control_type":"preventive","domains":["Governance, Policy & Oversight","Risk Assessment & Management","Human Resources / Personnel Security","Third-Party / Supply-Chain Risk","Asset Management & Inventory"],"framework":"cobit-2019","group":"Align, Plan and Organize","key_control":false,"requirement_frequency":null,"requirement_status":null,"risk_count":2,"source_pages":null,"source_url":null},"direct":false,"history":{"digest":"c990f75d683033f065909262703d517ad5517e0e71f77c69c0cc586d7d4d3a4c","firstSeenAt":"2026-09-17T22:28:00Z","firstSeenRevision":"f368a6cce277037e4b1e1ff46004e3acd295f96c9ac63a411a0e45775a7f468e","updatedAt":"2026-09-17T22:28:00Z","updatedRevision":"f368a6cce277037e4b1e1ff46004e3acd295f96c9ac63a411a0e45775a7f468e"},"htmlUrl":"/agents/records/ctrl-cobit-2019-apo06-2191e824.html","id":"ctrl:cobit-2019:APO06","mapUrl":"https://evidenceflows.com/?v=1&node=ctrl%3Acobit-2019%3AAPO06","sourceIds":["cobit-2019"],"sourceUrl":null,"title":"APO06 — Managed Budget and Costs","type":"control","updatedAt":"2026-09-17T22:28:00Z","url":"/assets/agent_record-ctrl-cobit-2019-apo06-2191e824.0b1d19d5406b964b.json"},{"attributes":{"category":"administrative","framework":"cobit-2019","type":"preventive"},"canonicalUrl":"https://evidenceflows.com/frameworks/cobit-2019/","description":"Managed Data","details":{"automation":"manual","control_category":"administrative","control_id":"APO14","control_type":"preventive","domains":["Governance, Policy & Oversight","Risk Assessment & Management","Human Resources / Personnel Security","Third-Party / Supply-Chain Risk","Asset Management & Inventory"],"framework":"cobit-2019","group":"Align, Plan and Organize","key_control":false,"requirement_frequency":null,"requirement_status":null,"risk_count":3,"source_pages":null,"source_url":null},"direct":false,"history":{"digest":"9c70b0bbca3cafeae911c66aeb484261407292acc121e4ee51335bf97de7a11c","firstSeenAt":"2026-09-17T22:28:00Z","firstSeenRevision":"f368a6cce277037e4b1e1ff46004e3acd295f96c9ac63a411a0e45775a7f468e","updatedAt":"2026-09-17T22:28:00Z","updatedRevision":"f368a6cce277037e4b1e1ff46004e3acd295f96c9ac63a411a0e45775a7f468e"},"htmlUrl":"/agents/records/ctrl-cobit-2019-apo14-ab650d02.html","id":"ctrl:cobit-2019:APO14","mapUrl":"https://evidenceflows.com/?v=1&node=ctrl%3Acobit-2019%3AAPO14","sourceIds":["cobit-2019"],"sourceUrl":null,"title":"APO14 — Managed Data","type":"control","updatedAt":"2026-09-17T22:28:00Z","url":"/assets/agent_record-ctrl-cobit-2019-apo14-ab650d02.da44de93744596fd.json"},{"attributes":{"category":"administrative","framework":"cobit-2019","type":"preventive"},"canonicalUrl":"https://evidenceflows.com/frameworks/cobit-2019/","description":"Managed Business Process Controls","details":{"automation":"hybrid","control_category":"administrative","control_id":"DSS06","control_type":"preventive","domains":["Business Continuity & Disaster Recovery","Incident Management & Response","Logging, Monitoring & Detection","Governance, Policy & Oversight"],"framework":"cobit-2019","group":"Deliver, Service and Support","key_control":false,"requirement_frequency":null,"requirement_status":null,"risk_count":7,"source_pages":null,"source_url":null},"direct":false,"history":{"digest":"e11d04c970aa19afe3d507a79ce6e8f6d01cf65f38e62700f21a49ae915fa433","firstSeenAt":"2026-09-17T22:28:00Z","firstSeenRevision":"f368a6cce277037e4b1e1ff46004e3acd295f96c9ac63a411a0e45775a7f468e","updatedAt":"2026-09-17T22:28:00Z","updatedRevision":"f368a6cce277037e4b1e1ff46004e3acd295f96c9ac63a411a0e45775a7f468e"},"htmlUrl":"/agents/records/ctrl-cobit-2019-dss06-c2b31b0e.html","id":"ctrl:cobit-2019:DSS06","mapUrl":"https://evidenceflows.com/?v=1&node=ctrl%3Acobit-2019%3ADSS06","sourceIds":["cobit-2019"],"sourceUrl":null,"title":"DSS06 — Managed Business Process Controls","type":"control","updatedAt":"2026-09-17T22:28:00Z","url":"/assets/agent_record-ctrl-cobit-2019-dss06-c2b31b0e.bddee764f99ee89e.json"},{"attributes":{"category":"administrative","framework":"cobit-2019","type":"preventive"},"canonicalUrl":"https://evidenceflows.com/frameworks/cobit-2019/","description":"Ensured Governance Framework Setting and Maintenance","details":{"automation":"manual","control_category":"administrative","control_id":"EDM01","control_type":"preventive","domains":["Governance, Policy & Oversight","Risk Assessment & Management","Compliance, Audit & Assurance"],"framework":"cobit-2019","group":"Evaluate, Direct and Monitor","key_control":false,"requirement_frequency":null,"requirement_status":null,"risk_count":3,"source_pages":null,"source_url":null},"direct":false,"history":{"digest":"9cb83946a02fa03e2c87a35fb086c2771f073bd98f6e9921de4b3dccbe663048","firstSeenAt":"2026-09-17T22:28:00Z","firstSeenRevision":"f368a6cce277037e4b1e1ff46004e3acd295f96c9ac63a411a0e45775a7f468e","updatedAt":"2026-09-17T22:28:00Z","updatedRevision":"f368a6cce277037e4b1e1ff46004e3acd295f96c9ac63a411a0e45775a7f468e"},"htmlUrl":"/agents/records/ctrl-cobit-2019-edm01-95fe0a96.html","id":"ctrl:cobit-2019:EDM01","mapUrl":"https://evidenceflows.com/?v=1&node=ctrl%3Acobit-2019%3AEDM01","sourceIds":["cobit-2019"],"sourceUrl":null,"title":"EDM01 — Ensured Governance Framework Setting and Maintenance","type":"control","updatedAt":"2026-09-17T22:28:00Z","url":"/assets/agent_record-ctrl-cobit-2019-edm01-95fe0a96.73dfc575a0f65a54.json"},{"attributes":{"category":"administrative","framework":"cobit-2019","type":"preventive"},"canonicalUrl":"https://evidenceflows.com/frameworks/cobit-2019/","description":"Ensured Resource Optimization","details":{"automation":"manual","control_category":"administrative","control_id":"EDM04","control_type":"preventive","domains":["Governance, Policy & Oversight","Risk Assessment & Management","Compliance, Audit & Assurance"],"framework":"cobit-2019","group":"Evaluate, Direct and Monitor","key_control":false,"requirement_frequency":null,"requirement_status":null,"risk_count":2,"source_pages":null,"source_url":null},"direct":false,"history":{"digest":"12d610e5afee6948aa16c63b924a547362c101cf77cac1a639b84599f86ece20","firstSeenAt":"2026-09-17T22:28:00Z","firstSeenRevision":"f368a6cce277037e4b1e1ff46004e3acd295f96c9ac63a411a0e45775a7f468e","updatedAt":"2026-09-17T22:28:00Z","updatedRevision":"f368a6cce277037e4b1e1ff46004e3acd295f96c9ac63a411a0e45775a7f468e"},"htmlUrl":"/agents/records/ctrl-cobit-2019-edm04-7ad4bdc3.html","id":"ctrl:cobit-2019:EDM04","mapUrl":"https://evidenceflows.com/?v=1&node=ctrl%3Acobit-2019%3AEDM04","sourceIds":["cobit-2019"],"sourceUrl":null,"title":"EDM04 — Ensured Resource Optimization","type":"control","updatedAt":"2026-09-17T22:28:00Z","url":"/assets/agent_record-ctrl-cobit-2019-edm04-7ad4bdc3.17dea6b7d6f181cf.json"},{"attributes":{"category":"administrative","framework":"cobit-2019","type":"detective"},"canonicalUrl":"https://evidenceflows.com/frameworks/cobit-2019/","description":"Managed System of Internal Control","details":{"automation":"manual","control_category":"administrative","control_id":"MEA02","control_type":"detective","domains":["Compliance, Audit & Assurance","Governance, Policy & Oversight","Risk Assessment & Management"],"framework":"cobit-2019","group":"Monitor, Evaluate and Assess","key_control":false,"requirement_frequency":null,"requirement_status":null,"risk_count":3,"source_pages":null,"source_url":null},"direct":false,"history":{"digest":"4deeebfbe4c322e0b94bad978937f8dcf62b482d1846012ef44a441022b82940","firstSeenAt":"2026-09-17T22:28:00Z","firstSeenRevision":"f368a6cce277037e4b1e1ff46004e3acd295f96c9ac63a411a0e45775a7f468e","updatedAt":"2026-09-17T22:28:00Z","updatedRevision":"f368a6cce277037e4b1e1ff46004e3acd295f96c9ac63a411a0e45775a7f468e"},"htmlUrl":"/agents/records/ctrl-cobit-2019-mea02-4513eb15.html","id":"ctrl:cobit-2019:MEA02","mapUrl":"https://evidenceflows.com/?v=1&node=ctrl%3Acobit-2019%3AMEA02","sourceIds":["cobit-2019"],"sourceUrl":null,"title":"MEA02 — Managed System of Internal Control","type":"control","updatedAt":"2026-09-17T22:28:00Z","url":"/assets/agent_record-ctrl-cobit-2019-mea02-4513eb15.54fb88417ce9a189.json"},{"attributes":{"category":"administrative","framework":"coso-erm","type":"preventive"},"canonicalUrl":"https://evidenceflows.com/frameworks/coso-erm/","description":"Exercises Board Risk Oversight","details":{"automation":"manual","control_category":"administrative","control_id":"E1","control_type":"preventive","domains":["Governance, Policy & Oversight","Human Resources / Personnel Security","Risk Assessment & Management"],"framework":"coso-erm","group":"Governance & Culture","key_control":false,"requirement_frequency":null,"requirement_status":null,"risk_count":2,"source_pages":null,"source_url":null},"direct":false,"history":{"digest":"f6094db00fdc88b5b53dce64b2d5bdea3253491e80def543fd168b39e63840b3","firstSeenAt":"2026-09-17T22:28:00Z","firstSeenRevision":"f368a6cce277037e4b1e1ff46004e3acd295f96c9ac63a411a0e45775a7f468e","updatedAt":"2026-09-17T22:28:00Z","updatedRevision":"f368a6cce277037e4b1e1ff46004e3acd295f96c9ac63a411a0e45775a7f468e"},"htmlUrl":"/agents/records/ctrl-coso-erm-e1-2389ffca.html","id":"ctrl:coso-erm:E1","mapUrl":"https://evidenceflows.com/?v=1&node=ctrl%3Acoso-erm%3AE1","sourceIds":["coso-erm"],"sourceUrl":null,"title":"E1 — Exercises Board Risk Oversight","type":"control","updatedAt":"2026-09-17T22:28:00Z","url":"/assets/agent_record-ctrl-coso-erm-e1-2389ffca.c1c62e01729ce1be.json"},{"attributes":{"category":"administrative","framework":"coso-erm","type":"preventive"},"canonicalUrl":"https://evidenceflows.com/frameworks/coso-erm/","description":"Develops Portfolio View","details":{"automation":"manual","control_category":"administrative","control_id":"E14","control_type":"preventive","domains":["Risk Assessment & Management"],"framework":"coso-erm","group":"Performance","key_control":false,"requirement_frequency":null,"requirement_status":null,"risk_count":2,"source_pages":null,"source_url":null},"direct":false,"history":{"digest":"079898be679e3af0441278db40bd9d319575ec0fca3505ebcfefaeed652c125c","firstSeenAt":"2026-09-17T22:28:00Z","firstSeenRevision":"f368a6cce277037e4b1e1ff46004e3acd295f96c9ac63a411a0e45775a7f468e","updatedAt":"2026-09-17T22:28:00Z","updatedRevision":"f368a6cce277037e4b1e1ff46004e3acd295f96c9ac63a411a0e45775a7f468e"},"htmlUrl":"/agents/records/ctrl-coso-erm-e14-68b8e783.html","id":"ctrl:coso-erm:E14","mapUrl":"https://evidenceflows.com/?v=1&node=ctrl%3Acoso-erm%3AE14","sourceIds":["coso-erm"],"sourceUrl":null,"title":"E14 — Develops Portfolio View","type":"control","updatedAt":"2026-09-17T22:28:00Z","url":"/assets/agent_record-ctrl-coso-erm-e14-68b8e783.67d916256f220e35.json"},{"attributes":{"category":"administrative","framework":"coso-erm","type":"preventive"},"canonicalUrl":"https://evidenceflows.com/frameworks/coso-erm/","description":"Defines Desired Culture","details":{"automation":"manual","control_category":"administrative","control_id":"E3","control_type":"preventive","domains":["Governance, Policy & Oversight","Human Resources / Personnel Security","Risk Assessment & Management"],"framework":"coso-erm","group":"Governance & Culture","key_control":false,"requirement_frequency":null,"requirement_status":null,"risk_count":5,"source_pages":null,"source_url":null},"direct":false,"history":{"digest":"5269c094b342997f4549242de52aa1c7eef87c74db5d1976c4839e9c12b88b2f","firstSeenAt":"2026-09-17T22:28:00Z","firstSeenRevision":"f368a6cce277037e4b1e1ff46004e3acd295f96c9ac63a411a0e45775a7f468e","updatedAt":"2026-09-17T22:28:00Z","updatedRevision":"f368a6cce277037e4b1e1ff46004e3acd295f96c9ac63a411a0e45775a7f468e"},"htmlUrl":"/agents/records/ctrl-coso-erm-e3-2d76e2c2.html","id":"ctrl:coso-erm:E3","mapUrl":"https://evidenceflows.com/?v=1&node=ctrl%3Acoso-erm%3AE3","sourceIds":["coso-erm"],"sourceUrl":null,"title":"E3 — Defines Desired Culture","type":"control","updatedAt":"2026-09-17T22:28:00Z","url":"/assets/agent_record-ctrl-coso-erm-e3-2d76e2c2.7742ffedd3117ab7.json"},{"attributes":{"category":"administrative","framework":"coso-erm","type":"preventive"},"canonicalUrl":"https://evidenceflows.com/frameworks/coso-erm/","description":"Demonstrates Commitment to Core Values","details":{"automation":"manual","control_category":"administrative","control_id":"E4","control_type":"preventive","domains":["Governance, Policy & Oversight","Human Resources / Personnel Security","Risk Assessment & Management"],"framework":"coso-erm","group":"Governance & Culture","key_control":false,"requirement_frequency":null,"requirement_status":null,"risk_count":5,"source_pages":null,"source_url":null},"direct":false,"history":{"digest":"b4ffae5c7c00ea186e3aeb104148adbfd5f71d31fdf3e8e9ead5ab4652f525a4","firstSeenAt":"2026-09-17T22:28:00Z","firstSeenRevision":"f368a6cce277037e4b1e1ff46004e3acd295f96c9ac63a411a0e45775a7f468e","updatedAt":"2026-09-17T22:28:00Z","updatedRevision":"f368a6cce277037e4b1e1ff46004e3acd295f96c9ac63a411a0e45775a7f468e"},"htmlUrl":"/agents/records/ctrl-coso-erm-e4-97e5f081.html","id":"ctrl:coso-erm:E4","mapUrl":"https://evidenceflows.com/?v=1&node=ctrl%3Acoso-erm%3AE4","sourceIds":["coso-erm"],"sourceUrl":null,"title":"E4 — Demonstrates Commitment to Core Values","type":"control","updatedAt":"2026-09-17T22:28:00Z","url":"/assets/agent_record-ctrl-coso-erm-e4-97e5f081.82b7f533b728d832.json"},{"attributes":{"category":"administrative","framework":"coso-ic","type":"preventive"},"canonicalUrl":"https://evidenceflows.com/frameworks/coso-ic/","description":"The organization demonstrates a commitment to integrity and ethical values.","details":{"automation":"manual","control_category":"administrative","control_id":"P1","control_type":"preventive","domains":["Financial Reporting Controls (SOX)","Governance, Policy & Oversight"],"framework":"coso-ic","group":"Control Environment","key_control":false,"requirement_frequency":null,"requirement_status":null,"risk_count":5,"source_pages":null,"source_url":null},"direct":false,"history":{"digest":"7184afe344bcae87d65c52872d8c1a521f931dfff71b28105e9a92b7e0f85bae","firstSeenAt":"2026-09-17T22:28:00Z","firstSeenRevision":"f368a6cce277037e4b1e1ff46004e3acd295f96c9ac63a411a0e45775a7f468e","updatedAt":"2026-09-17T22:28:00Z","updatedRevision":"f368a6cce277037e4b1e1ff46004e3acd295f96c9ac63a411a0e45775a7f468e"},"htmlUrl":"/agents/records/ctrl-coso-ic-p1-f41d97ed.html","id":"ctrl:coso-ic:P1","mapUrl":"https://evidenceflows.com/?v=1&node=ctrl%3Acoso-ic%3AP1","sourceIds":["coso-ic"],"sourceUrl":null,"title":"P1 — The organization demonstrates a commitment to integrity and ethical values.","type":"control","updatedAt":"2026-09-17T22:28:00Z","url":"/assets/agent_record-ctrl-coso-ic-p1-f41d97ed.011a89e98daa73d1.json"},{"attributes":{"category":"administrative","framework":"coso-ic","type":"preventive"},"canonicalUrl":"https://evidenceflows.com/frameworks/coso-ic/","description":"The organization selects and develops control activities that contribute to the mitigation of risks to the achievement of objectives to acceptable levels.","details":{"automation":"manual","control_category":"administrative","control_id":"P10","control_type":"preventive","domains":["Access Control & Identity Management","Financial Reporting Controls (SOX)"],"framework":"coso-ic","group":"Control Activities","key_control":false,"requirement_frequency":null,"requirement_status":null,"risk_count":3,"source_pages":null,"source_url":null},"direct":false,"history":{"digest":"8e0f5f2fa6c9bc3ecfbf0280ccdf1c7d7ac804a3b67e0f4af6601f94eb6a163c","firstSeenAt":"2026-09-17T22:28:00Z","firstSeenRevision":"f368a6cce277037e4b1e1ff46004e3acd295f96c9ac63a411a0e45775a7f468e","updatedAt":"2026-09-17T22:28:00Z","updatedRevision":"f368a6cce277037e4b1e1ff46004e3acd295f96c9ac63a411a0e45775a7f468e"},"htmlUrl":"/agents/records/ctrl-coso-ic-p10-c5a97f20.html","id":"ctrl:coso-ic:P10","mapUrl":"https://evidenceflows.com/?v=1&node=ctrl%3Acoso-ic%3AP10","sourceIds":["coso-ic"],"sourceUrl":null,"title":"P10 — The organization selects and develops control activities that contribute to the mitigation of risks to the achievement of objectives to acceptable levels.","type":"control","updatedAt":"2026-09-17T22:28:00Z","url":"/assets/agent_record-ctrl-coso-ic-p10-c5a97f20.81fbfa9a76a67b6a.json"},{"attributes":{"category":"administrative","framework":"coso-ic","type":"preventive"},"canonicalUrl":"https://evidenceflows.com/frameworks/coso-ic/","description":"The organization selects and develops general control activities over technology to support the achievement of objectives.","details":{"automation":"manual","control_category":"administrative","control_id":"P11","control_type":"preventive","domains":["Access Control & Identity Management","Business Continuity & Disaster Recovery","Cryptography & Key Management","Data Protection & Privacy","Financial Reporting Controls (SOX)","Network & Communications Security","Physical & Environmental Security","Secure Configuration & Change Management","Secure Development (SDLC) & Application Security"],"framework":"coso-ic","group":"Control Activities","key_control":false,"requirement_frequency":null,"requirement_status":null,"risk_count":3,"source_pages":null,"source_url":null},"direct":false,"history":{"digest":"84687a09984a6f27a6d67439b926011136faff672ae41550191b2af31e8ddd76","firstSeenAt":"2026-09-17T22:28:00Z","firstSeenRevision":"f368a6cce277037e4b1e1ff46004e3acd295f96c9ac63a411a0e45775a7f468e","updatedAt":"2026-09-17T22:28:00Z","updatedRevision":"f368a6cce277037e4b1e1ff46004e3acd295f96c9ac63a411a0e45775a7f468e"},"htmlUrl":"/agents/records/ctrl-coso-ic-p11-2a08883b.html","id":"ctrl:coso-ic:P11","mapUrl":"https://evidenceflows.com/?v=1&node=ctrl%3Acoso-ic%3AP11","sourceIds":["coso-ic"],"sourceUrl":null,"title":"P11 — The organization selects and develops general control activities over technology to support the achievement of objectives.","type":"control","updatedAt":"2026-09-17T22:28:00Z","url":"/assets/agent_record-ctrl-coso-ic-p11-2a08883b.a1e9ab03e23d7a73.json"},{"attributes":{"category":"administrative","framework":"coso-ic","type":"detective"},"canonicalUrl":"https://evidenceflows.com/frameworks/coso-ic/","description":"The organization selects, develops, and performs ongoing and/or separate evaluations to ascertain whether the components of internal control are present and functioning.","details":{"automation":"manual","control_category":"administrative","control_id":"P16","control_type":"detective","domains":["Business Continuity & Disaster Recovery","Compliance, Audit & Assurance","Financial Reporting Controls (SOX)","Incident Management & Response","Logging, Monitoring & Detection","Vulnerability & Patch Management"],"framework":"coso-ic","group":"Monitoring Activities","key_control":false,"requirement_frequency":null,"requirement_status":null,"risk_count":3,"source_pages":null,"source_url":null},"direct":false,"history":{"digest":"f6b8b87426008a0527318d2921fee493155bf7e679769a0ba3f04dc7b7605002","firstSeenAt":"2026-09-17T22:28:00Z","firstSeenRevision":"f368a6cce277037e4b1e1ff46004e3acd295f96c9ac63a411a0e45775a7f468e","updatedAt":"2026-09-17T22:28:00Z","updatedRevision":"f368a6cce277037e4b1e1ff46004e3acd295f96c9ac63a411a0e45775a7f468e"},"htmlUrl":"/agents/records/ctrl-coso-ic-p16-4995bb68.html","id":"ctrl:coso-ic:P16","mapUrl":"https://evidenceflows.com/?v=1&node=ctrl%3Acoso-ic%3AP16","sourceIds":["coso-ic"],"sourceUrl":null,"title":"P16 — The organization selects, develops, and performs ongoing and/or separate evaluations to ascertain whether the components of internal control are present and functioning.","type":"control","updatedAt":"2026-09-17T22:28:00Z","url":"/assets/agent_record-ctrl-coso-ic-p16-4995bb68.6f50d041dbb5e168.json"},{"attributes":{"category":"administrative","framework":"coso-ic","type":"preventive"},"canonicalUrl":"https://evidenceflows.com/frameworks/coso-ic/","description":"The board of directors demonstrates independence from management and exercises oversight of the development and performance of internal control.","details":{"automation":"manual","control_category":"administrative","control_id":"P2","control_type":"preventive","domains":["Financial Reporting Controls (SOX)","Governance, Policy & Oversight"],"framework":"coso-ic","group":"Control Environment","key_control":false,"requirement_frequency":null,"requirement_status":null,"risk_count":2,"source_pages":null,"source_url":null},"direct":false,"history":{"digest":"eb72f17a69b02c008286ca39baa7b0ba00a8d41cd45e67c5cdb7866216d1941d","firstSeenAt":"2026-09-17T22:28:00Z","firstSeenRevision":"f368a6cce277037e4b1e1ff46004e3acd295f96c9ac63a411a0e45775a7f468e","updatedAt":"2026-09-17T22:28:00Z","updatedRevision":"f368a6cce277037e4b1e1ff46004e3acd295f96c9ac63a411a0e45775a7f468e"},"htmlUrl":"/agents/records/ctrl-coso-ic-p2-4f80775c.html","id":"ctrl:coso-ic:P2","mapUrl":"https://evidenceflows.com/?v=1&node=ctrl%3Acoso-ic%3AP2","sourceIds":["coso-ic"],"sourceUrl":null,"title":"P2 — The board of directors demonstrates independence from management and exercises oversight of the development and performance of internal control.","type":"control","updatedAt":"2026-09-17T22:28:00Z","url":"/assets/agent_record-ctrl-coso-ic-p2-4f80775c.1573012ad5653fd3.json"},{"attributes":{"category":"administrative","framework":"coso-ic","type":"preventive"},"canonicalUrl":"https://evidenceflows.com/frameworks/coso-ic/","description":"The organization holds individuals accountable for their internal control responsibilities in the pursuit of objectives.","details":{"automation":"manual","control_category":"administrative","control_id":"P5","control_type":"preventive","domains":["Governance, Policy & Oversight","Human Resources / Personnel Security"],"framework":"coso-ic","group":"Control Environment","key_control":false,"requirement_frequency":null,"requirement_status":null,"risk_count":3,"source_pages":null,"source_url":null},"direct":false,"history":{"digest":"7044dcce52ca62a2e7f81436029669e40cd306d15fb6209c01e3c47bf939424d","firstSeenAt":"2026-09-17T22:28:00Z","firstSeenRevision":"f368a6cce277037e4b1e1ff46004e3acd295f96c9ac63a411a0e45775a7f468e","updatedAt":"2026-09-17T22:28:00Z","updatedRevision":"f368a6cce277037e4b1e1ff46004e3acd295f96c9ac63a411a0e45775a7f468e"},"htmlUrl":"/agents/records/ctrl-coso-ic-p5-7f62f522.html","id":"ctrl:coso-ic:P5","mapUrl":"https://evidenceflows.com/?v=1&node=ctrl%3Acoso-ic%3AP5","sourceIds":["coso-ic"],"sourceUrl":null,"title":"P5 — The organization holds individuals accountable for their internal control responsibilities in the pursuit of objectives.","type":"control","updatedAt":"2026-09-17T22:28:00Z","url":"/assets/agent_record-ctrl-coso-ic-p5-7f62f522.e44fc6c53d08aebd.json"},{"attributes":{"category":"administrative","framework":"coso-ic","type":"preventive"},"canonicalUrl":"https://evidenceflows.com/frameworks/coso-ic/","description":"The organization considers the potential for fraud in assessing risks to the achievement of objectives.","details":{"automation":"manual","control_category":"administrative","control_id":"P8","control_type":"preventive","domains":["Risk Assessment & Management"],"framework":"coso-ic","group":"Risk Assessment","key_control":false,"requirement_frequency":null,"requirement_status":null,"risk_count":2,"source_pages":null,"source_url":null},"direct":false,"history":{"digest":"d4317a46346542f1332de126e63b00124a3a0643f8af4665986240294c97c26b","firstSeenAt":"2026-09-17T22:28:00Z","firstSeenRevision":"f368a6cce277037e4b1e1ff46004e3acd295f96c9ac63a411a0e45775a7f468e","updatedAt":"2026-09-17T22:28:00Z","updatedRevision":"f368a6cce277037e4b1e1ff46004e3acd295f96c9ac63a411a0e45775a7f468e"},"htmlUrl":"/agents/records/ctrl-coso-ic-p8-e85b1bf7.html","id":"ctrl:coso-ic:P8","mapUrl":"https://evidenceflows.com/?v=1&node=ctrl%3Acoso-ic%3AP8","sourceIds":["coso-ic"],"sourceUrl":null,"title":"P8 — The organization considers the potential for fraud in assessing risks to the achievement of objectives.","type":"control","updatedAt":"2026-09-17T22:28:00Z","url":"/assets/agent_record-ctrl-coso-ic-p8-e85b1bf7.7e60784d7a1088be.json"},{"attributes":{"category":"administrative","framework":"eu-ai-act","type":"preventive"},"canonicalUrl":"https://evidenceflows.com/frameworks/eu-ai-act/","description":"Fundamental rights impact assessment for high-risk AI systems (deployers)","details":{"automation":"manual","control_category":"administrative","control_id":"AIA-Art27","control_type":"preventive","domains":["AI Governance","Risk Assessment & Management","Governance, Policy & Oversight"],"framework":"eu-ai-act","group":"EU AI Act","key_control":false,"requirement_frequency":null,"requirement_status":null,"risk_count":8,"source_pages":null,"source_url":null},"direct":false,"history":{"digest":"435da92625d02a6c84b02f925079b1499109cd344d0306e6eee982dc0f9de2cf","firstSeenAt":"2026-09-17T22:28:00Z","firstSeenRevision":"f368a6cce277037e4b1e1ff46004e3acd295f96c9ac63a411a0e45775a7f468e","updatedAt":"2026-09-17T22:28:00Z","updatedRevision":"f368a6cce277037e4b1e1ff46004e3acd295f96c9ac63a411a0e45775a7f468e"},"htmlUrl":"/agents/records/ctrl-eu-ai-act-aia-art27-7b550500.html","id":"ctrl:eu-ai-act:AIA-Art27","mapUrl":"https://evidenceflows.com/?v=1&node=ctrl%3Aeu-ai-act%3AAIA-Art27","sourceIds":["eu-ai-act"],"sourceUrl":null,"title":"AIA-Art27 — Fundamental rights impact assessment for high-risk AI systems (deployers)","type":"control","updatedAt":"2026-09-17T22:28:00Z","url":"/assets/agent_record-ctrl-eu-ai-act-aia-art27-7b550500.cc0623481c8c4c48.json"},{"attributes":{"category":"administrative","framework":"eu-ai-act","type":"preventive"},"canonicalUrl":"https://evidenceflows.com/frameworks/eu-ai-act/","description":"Risk-based classification of high-risk AI systems","details":{"automation":"manual","control_category":"administrative","control_id":"AIA-Art6-7","control_type":"preventive","domains":["AI Governance","Risk Assessment & Management","Governance, Policy & Oversight"],"framework":"eu-ai-act","group":"EU AI Act","key_control":false,"requirement_frequency":null,"requirement_status":null,"risk_count":8,"source_pages":null,"source_url":null},"direct":false,"history":{"digest":"f0aecf73b2fa9e3fbb1121cc3a1677023c7c22ce72ca0956b28361ec2f3e2ad5","firstSeenAt":"2026-09-17T22:28:00Z","firstSeenRevision":"f368a6cce277037e4b1e1ff46004e3acd295f96c9ac63a411a0e45775a7f468e","updatedAt":"2026-09-17T22:28:00Z","updatedRevision":"f368a6cce277037e4b1e1ff46004e3acd295f96c9ac63a411a0e45775a7f468e"},"htmlUrl":"/agents/records/ctrl-eu-ai-act-aia-art6-7-cd7435c0.html","id":"ctrl:eu-ai-act:AIA-Art6-7","mapUrl":"https://evidenceflows.com/?v=1&node=ctrl%3Aeu-ai-act%3AAIA-Art6-7","sourceIds":["eu-ai-act"],"sourceUrl":null,"title":"AIA-Art6-7 — Risk-based classification of high-risk AI systems","type":"control","updatedAt":"2026-09-17T22:28:00Z","url":"/assets/agent_record-ctrl-eu-ai-act-aia-art6-7-cd7435c0.df9c0cefb4461ea3.json"},{"attributes":{"category":"technical","framework":"gdpr","type":"preventive"},"canonicalUrl":"https://evidenceflows.com/frameworks/gdpr/","description":"Security of processing","details":{"automation":"hybrid","control_category":"technical","control_id":"GDPR-Art32","control_type":"preventive","domains":["Data Protection & Privacy","Governance, Policy & Oversight","Incident Management & Response","Third-Party / Supply-Chain Risk","Risk Assessment & Management"],"framework":"gdpr","group":"EU GDPR","key_control":true,"requirement_frequency":null,"requirement_status":null,"risk_count":4,"source_pages":null,"source_url":null},"direct":false,"history":{"digest":"1627306c12b85904daf2e0a700770088bb77cd949d85dcb20895d6366be7eece","firstSeenAt":"2026-09-17T22:28:00Z","firstSeenRevision":"f368a6cce277037e4b1e1ff46004e3acd295f96c9ac63a411a0e45775a7f468e","updatedAt":"2026-09-17T22:28:00Z","updatedRevision":"f368a6cce277037e4b1e1ff46004e3acd295f96c9ac63a411a0e45775a7f468e"},"htmlUrl":"/agents/records/ctrl-gdpr-gdpr-art32-63aa3290.html","id":"ctrl:gdpr:GDPR-Art32","mapUrl":"https://evidenceflows.com/?v=1&node=ctrl%3Agdpr%3AGDPR-Art32","sourceIds":["gdpr"],"sourceUrl":null,"title":"GDPR-Art32 — Security of processing","type":"control","updatedAt":"2026-09-17T22:28:00Z","url":"/assets/agent_record-ctrl-gdpr-gdpr-art32-63aa3290.89a507d9ff525dd0.json"},{"attributes":{"category":"technical","framework":"hipaa","type":"preventive"},"canonicalUrl":"https://evidenceflows.com/frameworks/hipaa/","description":"Technical access control for ePHI (unique user ID, emergency access, automatic logoff, encryption/decryption)","details":{"automation":"hybrid","control_category":"technical","control_id":"HIPAA-164.312(a)","control_type":"preventive","domains":["Governance, Policy & Oversight","Risk Assessment & Management","Access Control & Identity Management","Physical & Environmental Security","Logging, Monitoring & Detection","Business Continuity & Disaster Recovery","Third-Party / Supply-Chain Risk","Data Protection & Privacy"],"framework":"hipaa","group":"HIPAA Security Rule","key_control":false,"requirement_frequency":null,"requirement_status":null,"risk_count":4,"source_pages":null,"source_url":null},"direct":false,"history":{"digest":"7be1255ff2e651d073f530fd245f3b119f3dbcb3b983f549e29db54bda75c8d5","firstSeenAt":"2026-09-17T22:28:00Z","firstSeenRevision":"f368a6cce277037e4b1e1ff46004e3acd295f96c9ac63a411a0e45775a7f468e","updatedAt":"2026-09-17T22:28:00Z","updatedRevision":"f368a6cce277037e4b1e1ff46004e3acd295f96c9ac63a411a0e45775a7f468e"},"htmlUrl":"/agents/records/ctrl-hipaa-hipaa-164-312-a-5c8bb707.html","id":"ctrl:hipaa:HIPAA-164.312(a)","mapUrl":"https://evidenceflows.com/?v=1&node=ctrl%3Ahipaa%3AHIPAA-164.312%28a%29","sourceIds":["hipaa"],"sourceUrl":null,"title":"HIPAA-164.312(a) — Technical access control for ePHI (unique user ID, emergency access, automatic logoff, encryption/decryption)","type":"control","updatedAt":"2026-09-17T22:28:00Z","url":"/assets/agent_record-ctrl-hipaa-hipaa-164-312-a-5c8bb707.9e205e9309455ab5.json"},{"attributes":{"category":"administrative","framework":"iia-2024","type":"preventive"},"canonicalUrl":"https://evidenceflows.com/frameworks/iia-2024/","description":"Demonstrate Integrity","details":{"automation":"manual","control_category":"administrative","control_id":"Principle 1","control_type":"preventive","domains":["Compliance, Audit & Assurance","Governance, Policy & Oversight"],"framework":"iia-2024","group":"Domain II — Ethics and Professionalism","key_control":false,"requirement_frequency":null,"requirement_status":null,"risk_count":2,"source_pages":null,"source_url":null},"direct":false,"history":{"digest":"546bec8b4a6c83c6d0d33d7d75841882279ccc7608f8787300ad30405c5462af","firstSeenAt":"2026-09-17T22:28:00Z","firstSeenRevision":"f368a6cce277037e4b1e1ff46004e3acd295f96c9ac63a411a0e45775a7f468e","updatedAt":"2026-09-17T22:28:00Z","updatedRevision":"f368a6cce277037e4b1e1ff46004e3acd295f96c9ac63a411a0e45775a7f468e"},"htmlUrl":"/agents/records/ctrl-iia-2024-principle-1-97822cbc.html","id":"ctrl:iia-2024:Principle 1","mapUrl":"https://evidenceflows.com/?v=1&node=ctrl%3Aiia-2024%3APrinciple+1","sourceIds":["iia-2024"],"sourceUrl":null,"title":"Principle 1 — Demonstrate Integrity","type":"control","updatedAt":"2026-09-17T22:28:00Z","url":"/assets/agent_record-ctrl-iia-2024-principle-1-97822cbc.f2c9930bd06af268.json"},{"attributes":{"category":"administrative","framework":"iia-2024","type":"preventive"},"canonicalUrl":"https://evidenceflows.com/frameworks/iia-2024/","description":"Manage Resources","details":{"automation":"manual","control_category":"administrative","control_id":"Principle 10","control_type":"preventive","domains":["Compliance, Audit & Assurance","Governance, Policy & Oversight","Risk Assessment & Management"],"framework":"iia-2024","group":"Domain IV — Managing the Internal Audit Function","key_control":false,"requirement_frequency":null,"requirement_status":null,"risk_count":2,"source_pages":null,"source_url":null},"direct":false,"history":{"digest":"274ddaf173392973a72237aa76aedc275d5ba110de78870ababed93fb8a1beb7","firstSeenAt":"2026-09-17T22:28:00Z","firstSeenRevision":"f368a6cce277037e4b1e1ff46004e3acd295f96c9ac63a411a0e45775a7f468e","updatedAt":"2026-09-17T22:28:00Z","updatedRevision":"f368a6cce277037e4b1e1ff46004e3acd295f96c9ac63a411a0e45775a7f468e"},"htmlUrl":"/agents/records/ctrl-iia-2024-principle-10-fc5ee25f.html","id":"ctrl:iia-2024:Principle 10","mapUrl":"https://evidenceflows.com/?v=1&node=ctrl%3Aiia-2024%3APrinciple+10","sourceIds":["iia-2024"],"sourceUrl":null,"title":"Principle 10 — Manage Resources","type":"control","updatedAt":"2026-09-17T22:28:00Z","url":"/assets/agent_record-ctrl-iia-2024-principle-10-fc5ee25f.0595ab0e94b89fb6.json"},{"attributes":{"category":"administrative","framework":"iia-2024","type":"detective"},"canonicalUrl":"https://evidenceflows.com/frameworks/iia-2024/","description":"Conduct Engagement Work","details":{"automation":"manual","control_category":"administrative","control_id":"Principle 14","control_type":"detective","domains":["Compliance, Audit & Assurance","Risk Assessment & Management"],"framework":"iia-2024","group":"Domain V — Performing Internal Audit Services","key_control":false,"requirement_frequency":null,"requirement_status":null,"risk_count":2,"source_pages":null,"source_url":null},"direct":false,"history":{"digest":"8a0481b1ff00d80d41368d662571d961c92a9367b94e97a106d0aef03ea9d3f9","firstSeenAt":"2026-09-17T22:28:00Z","firstSeenRevision":"f368a6cce277037e4b1e1ff46004e3acd295f96c9ac63a411a0e45775a7f468e","updatedAt":"2026-09-17T22:28:00Z","updatedRevision":"f368a6cce277037e4b1e1ff46004e3acd295f96c9ac63a411a0e45775a7f468e"},"htmlUrl":"/agents/records/ctrl-iia-2024-principle-14-fd4f55ab.html","id":"ctrl:iia-2024:Principle 14","mapUrl":"https://evidenceflows.com/?v=1&node=ctrl%3Aiia-2024%3APrinciple+14","sourceIds":["iia-2024"],"sourceUrl":null,"title":"Principle 14 — Conduct Engagement Work","type":"control","updatedAt":"2026-09-17T22:28:00Z","url":"/assets/agent_record-ctrl-iia-2024-principle-14-fd4f55ab.3c9f56f21cbeb159.json"},{"attributes":{"category":"administrative","framework":"iia-2024","type":"detective"},"canonicalUrl":"https://evidenceflows.com/frameworks/iia-2024/","description":"Communicate Engagement Results and Monitor Action Plans","details":{"automation":"manual","control_category":"administrative","control_id":"Principle 15","control_type":"detective","domains":["Compliance, Audit & Assurance","Risk Assessment & Management"],"framework":"iia-2024","group":"Domain V — Performing Internal Audit Services","key_control":false,"requirement_frequency":null,"requirement_status":null,"risk_count":3,"source_pages":null,"source_url":null},"direct":false,"history":{"digest":"0c14444bc65abe65d789458bb131f1a48f70c174052f4195c6c248e059fed4c9","firstSeenAt":"2026-09-17T22:28:00Z","firstSeenRevision":"f368a6cce277037e4b1e1ff46004e3acd295f96c9ac63a411a0e45775a7f468e","updatedAt":"2026-09-17T22:28:00Z","updatedRevision":"f368a6cce277037e4b1e1ff46004e3acd295f96c9ac63a411a0e45775a7f468e"},"htmlUrl":"/agents/records/ctrl-iia-2024-principle-15-b57f77c8.html","id":"ctrl:iia-2024:Principle 15","mapUrl":"https://evidenceflows.com/?v=1&node=ctrl%3Aiia-2024%3APrinciple+15","sourceIds":["iia-2024"],"sourceUrl":null,"title":"Principle 15 — Communicate Engagement Results and Monitor Action Plans","type":"control","updatedAt":"2026-09-17T22:28:00Z","url":"/assets/agent_record-ctrl-iia-2024-principle-15-b57f77c8.47302274406f46cf.json"},{"attributes":{"category":"administrative","framework":"iia-2024","type":"preventive"},"canonicalUrl":"https://evidenceflows.com/frameworks/iia-2024/","description":"Demonstrate Competency","details":{"automation":"manual","control_category":"administrative","control_id":"Principle 3","control_type":"preventive","domains":["Compliance, Audit & Assurance","Governance, Policy & Oversight"],"framework":"iia-2024","group":"Domain II — Ethics and Professionalism","key_control":false,"requirement_frequency":null,"requirement_status":null,"risk_count":2,"source_pages":null,"source_url":null},"direct":false,"history":{"digest":"0156307ad0f65ecd525085074390de795c62c26f895d58ffbc5e2f977411f1f2","firstSeenAt":"2026-09-17T22:28:00Z","firstSeenRevision":"f368a6cce277037e4b1e1ff46004e3acd295f96c9ac63a411a0e45775a7f468e","updatedAt":"2026-09-17T22:28:00Z","updatedRevision":"f368a6cce277037e4b1e1ff46004e3acd295f96c9ac63a411a0e45775a7f468e"},"htmlUrl":"/agents/records/ctrl-iia-2024-principle-3-a2a0c733.html","id":"ctrl:iia-2024:Principle 3","mapUrl":"https://evidenceflows.com/?v=1&node=ctrl%3Aiia-2024%3APrinciple+3","sourceIds":["iia-2024"],"sourceUrl":null,"title":"Principle 3 — Demonstrate Competency","type":"control","updatedAt":"2026-09-17T22:28:00Z","url":"/assets/agent_record-ctrl-iia-2024-principle-3-a2a0c733.333f9d6129783e18.json"},{"attributes":{"category":"administrative","framework":"iia-2024","type":"preventive"},"canonicalUrl":"https://evidenceflows.com/frameworks/iia-2024/","description":"Exercise Due Professional Care","details":{"automation":"manual","control_category":"administrative","control_id":"Principle 4","control_type":"preventive","domains":["Compliance, Audit & Assurance","Governance, Policy & Oversight"],"framework":"iia-2024","group":"Domain II — Ethics and Professionalism","key_control":false,"requirement_frequency":null,"requirement_status":null,"risk_count":2,"source_pages":null,"source_url":null},"direct":false,"history":{"digest":"14690c8e62069a82fc46178fc05dbf57097aa25b87150e2f83d945d0016a0f22","firstSeenAt":"2026-09-17T22:28:00Z","firstSeenRevision":"f368a6cce277037e4b1e1ff46004e3acd295f96c9ac63a411a0e45775a7f468e","updatedAt":"2026-09-17T22:28:00Z","updatedRevision":"f368a6cce277037e4b1e1ff46004e3acd295f96c9ac63a411a0e45775a7f468e"},"htmlUrl":"/agents/records/ctrl-iia-2024-principle-4-e921b675.html","id":"ctrl:iia-2024:Principle 4","mapUrl":"https://evidenceflows.com/?v=1&node=ctrl%3Aiia-2024%3APrinciple+4","sourceIds":["iia-2024"],"sourceUrl":null,"title":"Principle 4 — Exercise Due Professional Care","type":"control","updatedAt":"2026-09-17T22:28:00Z","url":"/assets/agent_record-ctrl-iia-2024-principle-4-e921b675.eef900d60d7699b3.json"},{"attributes":{"category":"administrative","framework":"iia-2024","type":"preventive"},"canonicalUrl":"https://evidenceflows.com/frameworks/iia-2024/","description":"Authorized by the Board","details":{"automation":"manual","control_category":"administrative","control_id":"Principle 6","control_type":"preventive","domains":["Compliance, Audit & Assurance","Governance, Policy & Oversight"],"framework":"iia-2024","group":"Domain III — Governing the Internal Audit Function","key_control":false,"requirement_frequency":null,"requirement_status":null,"risk_count":2,"source_pages":null,"source_url":null},"direct":false,"history":{"digest":"826a1937be834bcd1de282b600e9e6db768a023704cae185abb98f94297a24c7","firstSeenAt":"2026-09-17T22:28:00Z","firstSeenRevision":"f368a6cce277037e4b1e1ff46004e3acd295f96c9ac63a411a0e45775a7f468e","updatedAt":"2026-09-17T22:28:00Z","updatedRevision":"f368a6cce277037e4b1e1ff46004e3acd295f96c9ac63a411a0e45775a7f468e"},"htmlUrl":"/agents/records/ctrl-iia-2024-principle-6-dc3030fa.html","id":"ctrl:iia-2024:Principle 6","mapUrl":"https://evidenceflows.com/?v=1&node=ctrl%3Aiia-2024%3APrinciple+6","sourceIds":["iia-2024"],"sourceUrl":null,"title":"Principle 6 — Authorized by the Board","type":"control","updatedAt":"2026-09-17T22:28:00Z","url":"/assets/agent_record-ctrl-iia-2024-principle-6-dc3030fa.0567586bbea6c847.json"},{"attributes":{"category":"administrative","framework":"iia-2024","type":"preventive"},"canonicalUrl":"https://evidenceflows.com/frameworks/iia-2024/","description":"Plan Strategically","details":{"automation":"manual","control_category":"administrative","control_id":"Principle 9","control_type":"preventive","domains":["Compliance, Audit & Assurance","Governance, Policy & Oversight","Risk Assessment & Management"],"framework":"iia-2024","group":"Domain IV — Managing the Internal Audit Function","key_control":false,"requirement_frequency":null,"requirement_status":null,"risk_count":2,"source_pages":null,"source_url":null},"direct":false,"history":{"digest":"7cbda6d7eb10f102495f7884ca3d95450f3544c6d6da246403f5520269f6fd5b","firstSeenAt":"2026-09-17T22:28:00Z","firstSeenRevision":"f368a6cce277037e4b1e1ff46004e3acd295f96c9ac63a411a0e45775a7f468e","updatedAt":"2026-09-17T22:28:00Z","updatedRevision":"f368a6cce277037e4b1e1ff46004e3acd295f96c9ac63a411a0e45775a7f468e"},"htmlUrl":"/agents/records/ctrl-iia-2024-principle-9-068ca212.html","id":"ctrl:iia-2024:Principle 9","mapUrl":"https://evidenceflows.com/?v=1&node=ctrl%3Aiia-2024%3APrinciple+9","sourceIds":["iia-2024"],"sourceUrl":null,"title":"Principle 9 — Plan Strategically","type":"control","updatedAt":"2026-09-17T22:28:00Z","url":"/assets/agent_record-ctrl-iia-2024-principle-9-068ca212.91791322cf9311e5.json"},{"attributes":{"category":"administrative","framework":"iia-2024","type":"preventive"},"canonicalUrl":"https://evidenceflows.com/frameworks/iia-2024/","description":"Honesty and Professional Courage","details":{"automation":"manual","control_category":"administrative","control_id":"Std 1.1","control_type":"preventive","domains":["Compliance, Audit & Assurance","Governance, Policy & Oversight"],"framework":"iia-2024","group":"Domain II — Ethics and Professionalism","key_control":false,"requirement_frequency":null,"requirement_status":null,"risk_count":2,"source_pages":null,"source_url":null},"direct":false,"history":{"digest":"390e2f2234b5f8cbd6d00e6b60266cb32cad59552e55bc20157e662574b813d1","firstSeenAt":"2026-09-17T22:28:00Z","firstSeenRevision":"f368a6cce277037e4b1e1ff46004e3acd295f96c9ac63a411a0e45775a7f468e","updatedAt":"2026-09-17T22:28:00Z","updatedRevision":"f368a6cce277037e4b1e1ff46004e3acd295f96c9ac63a411a0e45775a7f468e"},"htmlUrl":"/agents/records/ctrl-iia-2024-std-1-1-e8b262ce.html","id":"ctrl:iia-2024:Std 1.1","mapUrl":"https://evidenceflows.com/?v=1&node=ctrl%3Aiia-2024%3AStd+1.1","sourceIds":["iia-2024"],"sourceUrl":null,"title":"Std 1.1 — Honesty and Professional Courage","type":"control","updatedAt":"2026-09-17T22:28:00Z","url":"/assets/agent_record-ctrl-iia-2024-std-1-1-e8b262ce.0391d29875cef092.json"},{"attributes":{"category":"administrative","framework":"iia-2024","type":"preventive"},"canonicalUrl":"https://evidenceflows.com/frameworks/iia-2024/","description":"Organization's Ethical Expectations","details":{"automation":"manual","control_category":"administrative","control_id":"Std 1.2","control_type":"preventive","domains":["Compliance, Audit & Assurance","Governance, Policy & Oversight"],"framework":"iia-2024","group":"Domain II — Ethics and Professionalism","key_control":false,"requirement_frequency":null,"requirement_status":null,"risk_count":2,"source_pages":null,"source_url":null},"direct":false,"history":{"digest":"3f8c72140e749d016d0eb70739ac4eaf24ff4b796fcc08b9626d884bf2c80c4e","firstSeenAt":"2026-09-17T22:28:00Z","firstSeenRevision":"f368a6cce277037e4b1e1ff46004e3acd295f96c9ac63a411a0e45775a7f468e","updatedAt":"2026-09-17T22:28:00Z","updatedRevision":"f368a6cce277037e4b1e1ff46004e3acd295f96c9ac63a411a0e45775a7f468e"},"htmlUrl":"/agents/records/ctrl-iia-2024-std-1-2-da892b84.html","id":"ctrl:iia-2024:Std 1.2","mapUrl":"https://evidenceflows.com/?v=1&node=ctrl%3Aiia-2024%3AStd+1.2","sourceIds":["iia-2024"],"sourceUrl":null,"title":"Std 1.2 — Organization's Ethical Expectations","type":"control","updatedAt":"2026-09-17T22:28:00Z","url":"/assets/agent_record-ctrl-iia-2024-std-1-2-da892b84.e6b508946f9adf38.json"},{"attributes":{"category":"administrative","framework":"iia-2024","type":"preventive"},"canonicalUrl":"https://evidenceflows.com/frameworks/iia-2024/","description":"Legal and Ethical Behavior","details":{"automation":"manual","control_category":"administrative","control_id":"Std 1.3","control_type":"preventive","domains":["Compliance, Audit & Assurance","Governance, Policy & Oversight"],"framework":"iia-2024","group":"Domain II — Ethics and Professionalism","key_control":false,"requirement_frequency":null,"requirement_status":null,"risk_count":2,"source_pages":null,"source_url":null},"direct":false,"history":{"digest":"8137cefbbaab64285b6156af45633002710b0df969a73f57ddc9544682e06819","firstSeenAt":"2026-09-17T22:28:00Z","firstSeenRevision":"f368a6cce277037e4b1e1ff46004e3acd295f96c9ac63a411a0e45775a7f468e","updatedAt":"2026-09-17T22:28:00Z","updatedRevision":"f368a6cce277037e4b1e1ff46004e3acd295f96c9ac63a411a0e45775a7f468e"},"htmlUrl":"/agents/records/ctrl-iia-2024-std-1-3-d38479a0.html","id":"ctrl:iia-2024:Std 1.3","mapUrl":"https://evidenceflows.com/?v=1&node=ctrl%3Aiia-2024%3AStd+1.3","sourceIds":["iia-2024"],"sourceUrl":null,"title":"Std 1.3 — Legal and Ethical Behavior","type":"control","updatedAt":"2026-09-17T22:28:00Z","url":"/assets/agent_record-ctrl-iia-2024-std-1-3-d38479a0.8f87a8a01f7239fa.json"},{"attributes":{"category":"administrative","framework":"iia-2024","type":"preventive"},"canonicalUrl":"https://evidenceflows.com/frameworks/iia-2024/","description":"Financial Resource Management","details":{"automation":"manual","control_category":"administrative","control_id":"Std 10.1","control_type":"preventive","domains":["Compliance, Audit & Assurance","Governance, Policy & Oversight","Risk Assessment & Management"],"framework":"iia-2024","group":"Domain IV — Managing the Internal Audit Function","key_control":false,"requirement_frequency":null,"requirement_status":null,"risk_count":2,"source_pages":null,"source_url":null},"direct":false,"history":{"digest":"acb0bff48dfebf55f411038d0ab8bf8ca560d50a0cf9fb6474803c89fc71ec21","firstSeenAt":"2026-09-17T22:28:00Z","firstSeenRevision":"f368a6cce277037e4b1e1ff46004e3acd295f96c9ac63a411a0e45775a7f468e","updatedAt":"2026-09-17T22:28:00Z","updatedRevision":"f368a6cce277037e4b1e1ff46004e3acd295f96c9ac63a411a0e45775a7f468e"},"htmlUrl":"/agents/records/ctrl-iia-2024-std-10-1-a5b61f0d.html","id":"ctrl:iia-2024:Std 10.1","mapUrl":"https://evidenceflows.com/?v=1&node=ctrl%3Aiia-2024%3AStd+10.1","sourceIds":["iia-2024"],"sourceUrl":null,"title":"Std 10.1 — Financial Resource Management","type":"control","updatedAt":"2026-09-17T22:28:00Z","url":"/assets/agent_record-ctrl-iia-2024-std-10-1-a5b61f0d.42601376861a234e.json"},{"attributes":{"category":"administrative","framework":"iia-2024","type":"preventive"},"canonicalUrl":"https://evidenceflows.com/frameworks/iia-2024/","description":"Human Resources Management","details":{"automation":"manual","control_category":"administrative","control_id":"Std 10.2","control_type":"preventive","domains":["Compliance, Audit & Assurance","Governance, Policy & Oversight","Risk Assessment & Management"],"framework":"iia-2024","group":"Domain IV — Managing the Internal Audit Function","key_control":false,"requirement_frequency":null,"requirement_status":null,"risk_count":2,"source_pages":null,"source_url":null},"direct":false,"history":{"digest":"eda7a5076cb53e043c41ed6ba6336fe7e3bf0c91cd5a202f74fc5c6cf164c628","firstSeenAt":"2026-09-17T22:28:00Z","firstSeenRevision":"f368a6cce277037e4b1e1ff46004e3acd295f96c9ac63a411a0e45775a7f468e","updatedAt":"2026-09-17T22:28:00Z","updatedRevision":"f368a6cce277037e4b1e1ff46004e3acd295f96c9ac63a411a0e45775a7f468e"},"htmlUrl":"/agents/records/ctrl-iia-2024-std-10-2-4da20260.html","id":"ctrl:iia-2024:Std 10.2","mapUrl":"https://evidenceflows.com/?v=1&node=ctrl%3Aiia-2024%3AStd+10.2","sourceIds":["iia-2024"],"sourceUrl":null,"title":"Std 10.2 — Human Resources Management","type":"control","updatedAt":"2026-09-17T22:28:00Z","url":"/assets/agent_record-ctrl-iia-2024-std-10-2-4da20260.d91a2dd533321143.json"},{"attributes":{"category":"administrative","framework":"iia-2024","type":"preventive"},"canonicalUrl":"https://evidenceflows.com/frameworks/iia-2024/","description":"Technological Resources","details":{"automation":"manual","control_category":"administrative","control_id":"Std 10.3","control_type":"preventive","domains":["Compliance, Audit & Assurance","Governance, Policy & Oversight","Risk Assessment & Management"],"framework":"iia-2024","group":"Domain IV — Managing the Internal Audit Function","key_control":false,"requirement_frequency":null,"requirement_status":null,"risk_count":2,"source_pages":null,"source_url":null},"direct":false,"history":{"digest":"73c584794e361719e56618ebec5e13f2685494c0f8d78d6414fef7d09a5d9c9a","firstSeenAt":"2026-09-17T22:28:00Z","firstSeenRevision":"f368a6cce277037e4b1e1ff46004e3acd295f96c9ac63a411a0e45775a7f468e","updatedAt":"2026-09-17T22:28:00Z","updatedRevision":"f368a6cce277037e4b1e1ff46004e3acd295f96c9ac63a411a0e45775a7f468e"},"htmlUrl":"/agents/records/ctrl-iia-2024-std-10-3-0c2d9d4e.html","id":"ctrl:iia-2024:Std 10.3","mapUrl":"https://evidenceflows.com/?v=1&node=ctrl%3Aiia-2024%3AStd+10.3","sourceIds":["iia-2024"],"sourceUrl":null,"title":"Std 10.3 — Technological Resources","type":"control","updatedAt":"2026-09-17T22:28:00Z","url":"/assets/agent_record-ctrl-iia-2024-std-10-3-0c2d9d4e.d039cba44e768096.json"},{"attributes":{"category":"administrative","framework":"iia-2024","type":"preventive"},"canonicalUrl":"https://evidenceflows.com/frameworks/iia-2024/","description":"Communicating Results","details":{"automation":"manual","control_category":"administrative","control_id":"Std 11.3","control_type":"preventive","domains":["Compliance, Audit & Assurance","Governance, Policy & Oversight","Risk Assessment & Management"],"framework":"iia-2024","group":"Domain IV — Managing the Internal Audit Function","key_control":false,"requirement_frequency":null,"requirement_status":null,"risk_count":3,"source_pages":null,"source_url":null},"direct":false,"history":{"digest":"ecc01c66ded149393806e3c9f895f6f4cc7e1686d5f1407973c6b7ced6669edc","firstSeenAt":"2026-09-17T22:28:00Z","firstSeenRevision":"f368a6cce277037e4b1e1ff46004e3acd295f96c9ac63a411a0e45775a7f468e","updatedAt":"2026-09-17T22:28:00Z","updatedRevision":"f368a6cce277037e4b1e1ff46004e3acd295f96c9ac63a411a0e45775a7f468e"},"htmlUrl":"/agents/records/ctrl-iia-2024-std-11-3-dbfc7dce.html","id":"ctrl:iia-2024:Std 11.3","mapUrl":"https://evidenceflows.com/?v=1&node=ctrl%3Aiia-2024%3AStd+11.3","sourceIds":["iia-2024"],"sourceUrl":null,"title":"Std 11.3 — Communicating Results","type":"control","updatedAt":"2026-09-17T22:28:00Z","url":"/assets/agent_record-ctrl-iia-2024-std-11-3-dbfc7dce.89928a312c3c5d09.json"}],"relationships":[{"expectedCatalogRevision":"791ff2dd3a45707290badee660f185e514d15f1cf518908628f425c2f2c56ee4","id":"rel:0143972f536ed73420cfad9018dabcad73590f295f5a8a7d609d0277e9c474bf","properties":{"control_id":"B007","coverage":"partial","delta":"quarterly review of user access privileges to AI systems, including administrative, configuration, and training-data access","framework":"aiuc-1","provenance":{"defaultConfidence":"medium","defaultStatus":"active","direction":"canonical_to_source","mapper":"coworkcanvas-compliance-graph","note":"Each member is a documented relationship claim from the canonical unified control to a source control or guidance proposition. relationship: equal|superset_of (full) / intersects_with|subset_of (partial) / informs (guidance). confidence 'medium' = single-mapper, documented, not yet externally corroborated. source_version is the member framework's edition from the standard version register.","reviewDate":"2026-09-07"},"relationship":"intersects_with","source_version":"July 15, 2026 release (quarterly update cadence)"},"sourceDetailPath":"/data/v1/records/uc-uc-access-05-9b7f3e34.json","sourceId":"uc:UC-ACCESS-05","targetDetailPath":"/data/v1/records/ctrl-aiuc-1-b007-151dfcd3.json","targetId":"ctrl:aiuc-1:B007","type":"maps_to"},{"expectedCatalogRevision":"791ff2dd3a45707290badee660f185e514d15f1cf518908628f425c2f2c56ee4","id":"rel:08901f92f139567733352fa9c46f6b8381406d516a043727a779bb251a871be5","properties":{},"sourceDetailPath":"/data/v1/records/ctrl-coso-ic-p5-7f62f522.json","sourceId":"ctrl:coso-ic:P5","targetDetailPath":"/data/v1/records/std-coso-ic-3f80f565.json","targetId":"std:coso-ic","type":"belongs_to"},{"expectedCatalogRevision":"791ff2dd3a45707290badee660f185e514d15f1cf518908628f425c2f2c56ee4","id":"rel:09b009e3bb4f13bcbe1f793932891f64ce77bb75af518f7875349255a838ae41","properties":{},"sourceDetailPath":"/data/v1/records/ctrl-iia-2024-principle-10-fc5ee25f.json","sourceId":"ctrl:iia-2024:Principle 10","targetDetailPath":"/data/v1/records/std-iia-2024-1687734b.json","targetId":"std:iia-2024","type":"belongs_to"},{"expectedCatalogRevision":"791ff2dd3a45707290badee660f185e514d15f1cf518908628f425c2f2c56ee4","id":"rel:0b5c040cb1331091458dc9021e9eed5222d84d5a30ad45691eb9818e70b5ff55","properties":{"control_id":"Std 10.2","coverage":"full","delta":null,"framework":"iia-2024","provenance":{"defaultConfidence":"medium","defaultStatus":"active","direction":"canonical_to_source","mapper":"coworkcanvas-compliance-graph","note":"Each member is a documented relationship claim from the canonical unified control to a source control or guidance proposition. relationship: equal|superset_of (full) / intersects_with|subset_of (partial) / informs (guidance). confidence 'medium' = single-mapper, documented, not yet externally corroborated. source_version is the member framework's edition from the standard version register.","reviewDate":"2026-09-07"},"relationship":"superset_of","source_version":"2024 edition"},"sourceDetailPath":"/data/v1/records/uc-uc-audit-10-fc9abe7f.json","sourceId":"uc:UC-AUDIT-10","targetDetailPath":"/data/v1/records/ctrl-iia-2024-std-10-2-4da20260.json","targetId":"ctrl:iia-2024:Std 10.2","type":"maps_to"},{"expectedCatalogRevision":"791ff2dd3a45707290badee660f185e514d15f1cf518908628f425c2f2c56ee4","id":"rel:0d46be746c1f09cd9aa592f74a9c5676560a0be62dce9471bf6ca38af741e84e","properties":{"control_id":"Std 1.2","coverage":"full","delta":null,"framework":"iia-2024","provenance":{"defaultConfidence":"medium","defaultStatus":"active","direction":"canonical_to_source","mapper":"coworkcanvas-compliance-graph","note":"Each member is a documented relationship claim from the canonical unified control to a source control or guidance proposition. relationship: equal|superset_of (full) / intersects_with|subset_of (partial) / informs (guidance). confidence 'medium' = single-mapper, documented, not yet externally corroborated. source_version is the member framework's edition from the standard version register.","reviewDate":"2026-09-07"},"relationship":"superset_of","source_version":"2024 edition"},"sourceDetailPath":"/data/v1/records/uc-uc-audit-04-c880e18f.json","sourceId":"uc:UC-AUDIT-04","targetDetailPath":"/data/v1/records/ctrl-iia-2024-std-1-2-da892b84.json","targetId":"ctrl:iia-2024:Std 1.2","type":"maps_to"},{"expectedCatalogRevision":"791ff2dd3a45707290badee660f185e514d15f1cf518908628f425c2f2c56ee4","id":"rel:136507dff54ef0af3b27852a8536c3f3de34c304c0f271557c3d0a9835e36313","properties":{},"sourceDetailPath":"/data/v1/records/ctrl-iia-2024-principle-1-97822cbc.json","sourceId":"ctrl:iia-2024:Principle 1","targetDetailPath":"/data/v1/records/std-iia-2024-1687734b.json","targetId":"std:iia-2024","type":"belongs_to"},{"expectedCatalogRevision":"791ff2dd3a45707290badee660f185e514d15f1cf518908628f425c2f2c56ee4","id":"rel:160197ef08f9452b849b32bbca9891899e287a820c310d1d8fead407896dae68","properties":{},"sourceDetailPath":"/data/v1/records/ctrl-cobit-2019-mea02-4513eb15.json","sourceId":"ctrl:cobit-2019:MEA02","targetDetailPath":"/data/v1/records/std-cobit-2019-2181ce0c.json","targetId":"std:cobit-2019","type":"belongs_to"},{"expectedCatalogRevision":"791ff2dd3a45707290badee660f185e514d15f1cf518908628f425c2f2c56ee4","id":"rel:196ceefc0745c6ddc8a3f0db75c1ea4386ea6dd54352a7744060fe898f7b82cc","properties":{"control_id":"GDPR-Art32","coverage":"partial","delta":"also requires encryption, resilience, and effectiveness testing addressed in other domains","framework":"gdpr","provenance":{"defaultConfidence":"medium","defaultStatus":"active","direction":"canonical_to_source","mapper":"coworkcanvas-compliance-graph","note":"Each member is a documented relationship claim from the canonical unified control to a source control or guidance proposition. relationship: equal|superset_of (full) / intersects_with|subset_of (partial) / informs (guidance). confidence 'medium' = single-mapper, documented, not yet externally corroborated. source_version is the member framework's edition from the standard version register.","reviewDate":"2026-09-07"},"relationship":"intersects_with","source_version":"Regulation (EU) 2016/679"},"sourceDetailPath":"/data/v1/records/uc-uc-access-05-9b7f3e34.json","sourceId":"uc:UC-ACCESS-05","targetDetailPath":"/data/v1/records/ctrl-gdpr-gdpr-art32-63aa3290.json","targetId":"ctrl:gdpr:GDPR-Art32","type":"maps_to"},{"expectedCatalogRevision":"791ff2dd3a45707290badee660f185e514d15f1cf518908628f425c2f2c56ee4","id":"rel:199e523235255b49f7b7f37170eadd985d243e5d71a80080efd22243a1989120","properties":{},"sourceDetailPath":"/data/v1/records/ctrl-gdpr-gdpr-art32-63aa3290.json","sourceId":"ctrl:gdpr:GDPR-Art32","targetDetailPath":"/data/v1/records/std-gdpr-17d65d0b.json","targetId":"std:gdpr","type":"belongs_to"},{"expectedCatalogRevision":"791ff2dd3a45707290badee660f185e514d15f1cf518908628f425c2f2c56ee4","id":"rel:1cbe84b3d02248a688536c82e7822f036836bb524da8e6cbd17b9c0c80bf40af","properties":{},"sourceDetailPath":"/data/v1/records/ctrl-aiuc-1-c001-6bc6c173.json","sourceId":"ctrl:aiuc-1:C001","targetDetailPath":"/data/v1/records/std-aiuc-1-d2a8b650.json","targetId":"std:aiuc-1","type":"belongs_to"},{"expectedCatalogRevision":"791ff2dd3a45707290badee660f185e514d15f1cf518908628f425c2f2c56ee4","id":"rel:20a8da436eef1b4a0fbbbe4d5b5bd38b34fd731b712d63eb54a70e05277bf953","properties":{"control_id":"MEA02","coverage":"full","delta":null,"framework":"cobit-2019","provenance":{"defaultConfidence":"medium","defaultStatus":"active","direction":"canonical_to_source","mapper":"coworkcanvas-compliance-graph","note":"Each member is a documented relationship claim from the canonical unified control to a source control or guidance proposition. relationship: equal|superset_of (full) / intersects_with|subset_of (partial) / informs (guidance). confidence 'medium' = single-mapper, documented, not yet externally corroborated. source_version is the member framework's edition from the standard version register.","reviewDate":"2026-09-07"},"relationship":"superset_of","source_version":"2019"},"sourceDetailPath":"/data/v1/records/uc-uc-audit-21-6406caa4.json","sourceId":"uc:UC-AUDIT-21","targetDetailPath":"/data/v1/records/ctrl-cobit-2019-mea02-4513eb15.json","targetId":"ctrl:cobit-2019:MEA02","type":"maps_to"},{"expectedCatalogRevision":"791ff2dd3a45707290badee660f185e514d15f1cf518908628f425c2f2c56ee4","id":"rel:22743411c609fa2727ce920b35a7ec482323a75c49df8a4e062e554cc2f1d1c9","properties":{},"sourceDetailPath":"/data/v1/records/ctrl-iia-2024-principle-15-b57f77c8.json","sourceId":"ctrl:iia-2024:Principle 15","targetDetailPath":"/data/v1/records/std-iia-2024-1687734b.json","targetId":"std:iia-2024","type":"belongs_to"},{"expectedCatalogRevision":"791ff2dd3a45707290badee660f185e514d15f1cf518908628f425c2f2c56ee4","id":"rel:28c41d74ce54894c8ad970e817e0c4086c4a329a9082e423ca06dfbd359c6f8b","properties":{},"sourceDetailPath":"/data/v1/records/ctrl-iia-2024-std-10-1-a5b61f0d.json","sourceId":"ctrl:iia-2024:Std 10.1","targetDetailPath":"/data/v1/records/std-iia-2024-1687734b.json","targetId":"std:iia-2024","type":"belongs_to"},{"expectedCatalogRevision":"791ff2dd3a45707290badee660f185e514d15f1cf518908628f425c2f2c56ee4","id":"rel:2b5d7dd7103d37c5bdcd9de34e005051b766a7dad31760bed8fbcf19854795ae","properties":{},"sourceDetailPath":"/data/v1/records/ctrl-iia-2024-std-10-2-4da20260.json","sourceId":"ctrl:iia-2024:Std 10.2","targetDetailPath":"/data/v1/records/std-iia-2024-1687734b.json","targetId":"std:iia-2024","type":"belongs_to"},{"expectedCatalogRevision":"791ff2dd3a45707290badee660f185e514d15f1cf518908628f425c2f2c56ee4","id":"rel:2c09c6aa382cf10f688a037000963947c1f9b7d147e88c98e51e6092f8d40391","properties":{"control_id":"APO01","coverage":"full","delta":null,"framework":"cobit-2019","provenance":{"defaultConfidence":"medium","defaultStatus":"active","direction":"canonical_to_source","mapper":"coworkcanvas-compliance-graph","note":"Each member is a documented relationship claim from the canonical unified control to a source control or guidance proposition. relationship: equal|superset_of (full) / intersects_with|subset_of (partial) / informs (guidance). confidence 'medium' = single-mapper, documented, not yet externally corroborated. source_version is the member framework's edition from the standard version register.","reviewDate":"2026-09-07"},"relationship":"superset_of","source_version":"2019"},"sourceDetailPath":"/data/v1/records/uc-uc-gov-01-e1e2136d.json","sourceId":"uc:UC-GOV-01","targetDetailPath":"/data/v1/records/ctrl-cobit-2019-apo01-d6a49088.json","targetId":"ctrl:cobit-2019:APO01","type":"maps_to"},{"expectedCatalogRevision":"791ff2dd3a45707290badee660f185e514d15f1cf518908628f425c2f2c56ee4","id":"rel:2d8557480c52ad380a7c58fe80f500f44daf5311d37b2a0eab646aa8adfa0974","properties":{"control_id":"P16","coverage":"full","delta":null,"framework":"coso-ic","provenance":{"defaultConfidence":"medium","defaultStatus":"active","direction":"canonical_to_source","mapper":"coworkcanvas-compliance-graph","note":"Each member is a documented relationship claim from the canonical unified control to a source control or guidance proposition. relationship: equal|superset_of (full) / intersects_with|subset_of (partial) / informs (guidance). confidence 'medium' = single-mapper, documented, not yet externally corroborated. source_version is the member framework's edition from the standard version register.","reviewDate":"2026-09-07"},"relationship":"superset_of","source_version":"2013"},"sourceDetailPath":"/data/v1/records/uc-uc-audit-21-6406caa4.json","sourceId":"uc:UC-AUDIT-21","targetDetailPath":"/data/v1/records/ctrl-coso-ic-p16-4995bb68.json","targetId":"ctrl:coso-ic:P16","type":"maps_to"},{"expectedCatalogRevision":"791ff2dd3a45707290badee660f185e514d15f1cf518908628f425c2f2c56ee4","id":"rel:2f398e5ab32b0939305cf5ee430512a6c80434c63b71bdde4af99fd0c940b146","properties":{"control_id":"Std 10.3","coverage":"full","delta":null,"framework":"iia-2024","provenance":{"defaultConfidence":"medium","defaultStatus":"active","direction":"canonical_to_source","mapper":"coworkcanvas-compliance-graph","note":"Each member is a documented relationship claim from the canonical unified control to a source control or guidance proposition. relationship: equal|superset_of (full) / intersects_with|subset_of (partial) / informs (guidance). confidence 'medium' = single-mapper, documented, not yet externally corroborated. source_version is the member framework's edition from the standard version register.","reviewDate":"2026-09-07"},"relationship":"superset_of","source_version":"2024 edition"},"sourceDetailPath":"/data/v1/records/uc-uc-audit-10-fc9abe7f.json","sourceId":"uc:UC-AUDIT-10","targetDetailPath":"/data/v1/records/ctrl-iia-2024-std-10-3-0c2d9d4e.json","targetId":"ctrl:iia-2024:Std 10.3","type":"maps_to"},{"expectedCatalogRevision":"791ff2dd3a45707290badee660f185e514d15f1cf518908628f425c2f2c56ee4","id":"rel:301e35f4f0c71b54ab2bebf37b762c44e4373f1ce97bfd2ec5cbfe0bb8cda212","properties":{},"sourceDetailPath":"/data/v1/records/ctrl-coso-erm-e4-97e5f081.json","sourceId":"ctrl:coso-erm:E4","targetDetailPath":"/data/v1/records/std-coso-erm-7265cc54.json","targetId":"std:coso-erm","type":"belongs_to"},{"expectedCatalogRevision":"791ff2dd3a45707290badee660f185e514d15f1cf518908628f425c2f2c56ee4","id":"rel:32bf6421f2b8d665a50dabd9afe913d3db465ae6fd73f6978e767f8a3e387d37","properties":{},"sourceDetailPath":"/data/v1/records/ctrl-hipaa-hipaa-164-312-a-5c8bb707.json","sourceId":"ctrl:hipaa:HIPAA-164.312(a)","targetDetailPath":"/data/v1/records/std-hipaa-a825d271.json","targetId":"std:hipaa","type":"belongs_to"},{"expectedCatalogRevision":"791ff2dd3a45707290badee660f185e514d15f1cf518908628f425c2f2c56ee4","id":"rel:35469ce4cb671182840373ba75e324ed800a0a4e4d47d09d3d1e037f6d10f617","properties":{"control_id":"E1","coverage":"full","delta":null,"framework":"coso-erm","provenance":{"defaultConfidence":"medium","defaultStatus":"active","direction":"canonical_to_source","mapper":"coworkcanvas-compliance-graph","note":"Each member is a documented relationship claim from the canonical unified control to a source control or guidance proposition. relationship: equal|superset_of (full) / intersects_with|subset_of (partial) / informs (guidance). confidence 'medium' = single-mapper, documented, not yet externally corroborated. source_version is the member framework's edition from the standard version register.","reviewDate":"2026-09-07"},"relationship":"superset_of","source_version":"2017"},"sourceDetailPath":"/data/v1/records/uc-uc-gov-05-b3a47944.json","sourceId":"uc:UC-GOV-05","targetDetailPath":"/data/v1/records/ctrl-coso-erm-e1-2389ffca.json","targetId":"ctrl:coso-erm:E1","type":"maps_to"},{"expectedCatalogRevision":"791ff2dd3a45707290badee660f185e514d15f1cf518908628f425c2f2c56ee4","id":"rel:36f91bc8683791aea147f40d7dd77c7320b5911488e4c14d195ffbf634d8ec4b","properties":{},"sourceDetailPath":"/data/v1/records/ctrl-iia-2024-std-10-3-0c2d9d4e.json","sourceId":"ctrl:iia-2024:Std 10.3","targetDetailPath":"/data/v1/records/std-iia-2024-1687734b.json","targetId":"std:iia-2024","type":"belongs_to"},{"expectedCatalogRevision":"791ff2dd3a45707290badee660f185e514d15f1cf518908628f425c2f2c56ee4","id":"rel:39dff700e2a0bbdef624f431f6804954b71d44876cada877e7f382362a2cddea","properties":{"control_id":"APO14","coverage":"partial","delta":"operational data management - data-management strategy, business glossary/metadata, data-quality profiling and cleansing, archiving/backup - beyond governance policy and oversight bodies","framework":"cobit-2019","provenance":{"defaultConfidence":"medium","defaultStatus":"active","direction":"canonical_to_source","mapper":"coworkcanvas-compliance-graph","note":"Each member is a documented relationship claim from the canonical unified control to a source control or guidance proposition. relationship: equal|superset_of (full) / intersects_with|subset_of (partial) / informs (guidance). confidence 'medium' = single-mapper, documented, not yet externally corroborated. source_version is the member framework's edition from the standard version register.","reviewDate":"2026-09-07"},"relationship":"intersects_with","source_version":"2019"},"sourceDetailPath":"/data/v1/records/uc-uc-gov-20-4a468c1a.json","sourceId":"uc:UC-GOV-20","targetDetailPath":"/data/v1/records/ctrl-cobit-2019-apo14-ab650d02.json","targetId":"ctrl:cobit-2019:APO14","type":"maps_to"},{"expectedCatalogRevision":"791ff2dd3a45707290badee660f185e514d15f1cf518908628f425c2f2c56ee4","id":"rel:3b9ed6f05fd9d237f6102e13c13ce5fc7df7836d69f775bccdc377d4039dfeed","properties":{},"sourceDetailPath":"/data/v1/records/ctrl-eu-ai-act-aia-art6-7-cd7435c0.json","sourceId":"ctrl:eu-ai-act:AIA-Art6-7","targetDetailPath":"/data/v1/records/std-eu-ai-act-54986689.json","targetId":"std:eu-ai-act","type":"belongs_to"},{"expectedCatalogRevision":"791ff2dd3a45707290badee660f185e514d15f1cf518908628f425c2f2c56ee4","id":"rel:4122f81ea991bcd47e0c3183b4b835b5072fd53212d5155233684f99f1cba7d3","properties":{"control_id":"Principle 10","coverage":"full","delta":null,"framework":"iia-2024","provenance":{"defaultConfidence":"medium","defaultStatus":"active","direction":"canonical_to_source","mapper":"coworkcanvas-compliance-graph","note":"Each member is a documented relationship claim from the canonical unified control to a source control or guidance proposition. relationship: equal|superset_of (full) / intersects_with|subset_of (partial) / informs (guidance). confidence 'medium' = single-mapper, documented, not yet externally corroborated. source_version is the member framework's edition from the standard version register.","reviewDate":"2026-09-07"},"relationship":"superset_of","source_version":"2024 edition"},"sourceDetailPath":"/data/v1/records/uc-uc-audit-10-fc9abe7f.json","sourceId":"uc:UC-AUDIT-10","targetDetailPath":"/data/v1/records/ctrl-iia-2024-principle-10-fc5ee25f.json","targetId":"ctrl:iia-2024:Principle 10","type":"maps_to"},{"expectedCatalogRevision":"791ff2dd3a45707290badee660f185e514d15f1cf518908628f425c2f2c56ee4","id":"rel:41692619f3ba888f986fdccccd6c9ec1066f62d55e05d9d1299f22409cf139ec","properties":{},"sourceDetailPath":"/data/v1/records/ctrl-iia-2024-principle-14-fd4f55ab.json","sourceId":"ctrl:iia-2024:Principle 14","targetDetailPath":"/data/v1/records/std-iia-2024-1687734b.json","targetId":"std:iia-2024","type":"belongs_to"},{"expectedCatalogRevision":"791ff2dd3a45707290badee660f185e514d15f1cf518908628f425c2f2c56ee4","id":"rel:45a1e5145b0928b28d18bf5921388ea0c0962d3cd43c1e225eae980c86022c05","properties":{},"sourceDetailPath":"/data/v1/records/ctrl-aiuc-1-a003-bea61fd9.json","sourceId":"ctrl:aiuc-1:A003","targetDetailPath":"/data/v1/records/std-aiuc-1-d2a8b650.json","targetId":"std:aiuc-1","type":"belongs_to"},{"expectedCatalogRevision":"791ff2dd3a45707290badee660f185e514d15f1cf518908628f425c2f2c56ee4","id":"rel:45ba062bf9ad1f3c5aa1ddb880443104a414c5794361f9832e9585af0b2bbeb2","properties":{"control_id":"Principle 6","coverage":"full","delta":null,"framework":"iia-2024","provenance":{"defaultConfidence":"medium","defaultStatus":"active","direction":"canonical_to_source","mapper":"coworkcanvas-compliance-graph","note":"Each member is a documented relationship claim from the canonical unified control to a source control or guidance proposition. relationship: equal|superset_of (full) / intersects_with|subset_of (partial) / informs (guidance). confidence 'medium' = single-mapper, documented, not yet externally corroborated. source_version is the member framework's edition from the standard version register.","reviewDate":"2026-09-07"},"relationship":"superset_of","source_version":"2024 edition"},"sourceDetailPath":"/data/v1/records/uc-uc-audit-02-0279f203.json","sourceId":"uc:UC-AUDIT-02","targetDetailPath":"/data/v1/records/ctrl-iia-2024-principle-6-dc3030fa.json","targetId":"ctrl:iia-2024:Principle 6","type":"maps_to"},{"expectedCatalogRevision":"791ff2dd3a45707290badee660f185e514d15f1cf518908628f425c2f2c56ee4","id":"rel:47472f6f81d5e60212915d60644980d00c90385e35c468c9335aebda80a424de","properties":{"control_id":"HIPAA-164.312(a)","coverage":"partial","delta":"automatic logoff and encryption/decryption of ePHI are satisfied by the session-lock (UC-ACCESS-12) and cryptographic (UC-CRYPTO-01) companion controls; emergency-access is an availability arm","framework":"hipaa","provenance":{"defaultConfidence":"medium","defaultStatus":"active","direction":"canonical_to_source","mapper":"coworkcanvas-compliance-graph","note":"Each member is a documented relationship claim from the canonical unified control to a source control or guidance proposition. relationship: equal|superset_of (full) / intersects_with|subset_of (partial) / informs (guidance). confidence 'medium' = single-mapper, documented, not yet externally corroborated. source_version is the member framework's edition from the standard version register.","reviewDate":"2026-09-07"},"relationship":"intersects_with","source_version":"45 CFR Parts 160/164 (Security, Privacy, Breach Notification)"},"sourceDetailPath":"/data/v1/records/uc-uc-access-05-9b7f3e34.json","sourceId":"uc:UC-ACCESS-05","targetDetailPath":"/data/v1/records/ctrl-hipaa-hipaa-164-312-a-5c8bb707.json","targetId":"ctrl:hipaa:HIPAA-164.312(a)","type":"maps_to"},{"expectedCatalogRevision":"791ff2dd3a45707290badee660f185e514d15f1cf518908628f425c2f2c56ee4","id":"rel:4afb84782e3cec6bd552916b34f8b15f3759125ed7ec2be222c7c91b5a6e3a61","properties":{"control_id":"APO06","coverage":"partial","delta":"full IT financial management including cost transparency and allocation models","framework":"cobit-2019","provenance":{"defaultConfidence":"medium","defaultStatus":"active","direction":"canonical_to_source","mapper":"coworkcanvas-compliance-graph","note":"Each member is a documented relationship claim from the canonical unified control to a source control or guidance proposition. relationship: equal|superset_of (full) / intersects_with|subset_of (partial) / informs (guidance). confidence 'medium' = single-mapper, documented, not yet externally corroborated. source_version is the member framework's edition from the standard version register.","reviewDate":"2026-09-07"},"relationship":"intersects_with","source_version":"2019"},"sourceDetailPath":"/data/v1/records/uc-uc-gov-11-a13b60d3.json","sourceId":"uc:UC-GOV-11","targetDetailPath":"/data/v1/records/ctrl-cobit-2019-apo06-2191e824.json","targetId":"ctrl:cobit-2019:APO06","type":"maps_to"},{"expectedCatalogRevision":"791ff2dd3a45707290badee660f185e514d15f1cf518908628f425c2f2c56ee4","id":"rel:4c7effc1e728339a4e8a777ea4487a722140f1a715d83dbe1b941a4af5afdd1d","properties":{},"sourceDetailPath":"/data/v1/records/ctrl-cobit-2019-apo01-d6a49088.json","sourceId":"ctrl:cobit-2019:APO01","targetDetailPath":"/data/v1/records/std-cobit-2019-2181ce0c.json","targetId":"std:cobit-2019","type":"belongs_to"},{"expectedCatalogRevision":"791ff2dd3a45707290badee660f185e514d15f1cf518908628f425c2f2c56ee4","id":"rel:522d28aed24ab32fe41449ac950acc152ef604cf0a9e3b0e0aee1ab0b91027e2","properties":{"control_id":"P5","coverage":"full","delta":null,"framework":"coso-ic","provenance":{"defaultConfidence":"medium","defaultStatus":"active","direction":"canonical_to_source","mapper":"coworkcanvas-compliance-graph","note":"Each member is a documented relationship claim from the canonical unified control to a source control or guidance proposition. relationship: equal|superset_of (full) / intersects_with|subset_of (partial) / informs (guidance). confidence 'medium' = single-mapper, documented, not yet externally corroborated. source_version is the member framework's edition from the standard version register.","reviewDate":"2026-09-07"},"relationship":"superset_of","source_version":"2013"},"sourceDetailPath":"/data/v1/records/uc-uc-gov-07-2a8998f7.json","sourceId":"uc:UC-GOV-07","targetDetailPath":"/data/v1/records/ctrl-coso-ic-p5-7f62f522.json","targetId":"ctrl:coso-ic:P5","type":"maps_to"},{"expectedCatalogRevision":"791ff2dd3a45707290badee660f185e514d15f1cf518908628f425c2f2c56ee4","id":"rel:5868785f2387ea5e5baf5f8d80fdbe1d23749713f245e3a69e8790c3536e9c2e","properties":{"control_id":"P1","coverage":"full","delta":null,"framework":"coso-ic","provenance":{"defaultConfidence":"medium","defaultStatus":"active","direction":"canonical_to_source","mapper":"coworkcanvas-compliance-graph","note":"Each member is a documented relationship claim from the canonical unified control to a source control or guidance proposition. relationship: equal|superset_of (full) / intersects_with|subset_of (partial) / informs (guidance). confidence 'medium' = single-mapper, documented, not yet externally corroborated. source_version is the member framework's edition from the standard version register.","reviewDate":"2026-09-07"},"relationship":"superset_of","source_version":"2013"},"sourceDetailPath":"/data/v1/records/uc-uc-gov-04-849a3e91.json","sourceId":"uc:UC-GOV-04","targetDetailPath":"/data/v1/records/ctrl-coso-ic-p1-f41d97ed.json","targetId":"ctrl:coso-ic:P1","type":"maps_to"},{"expectedCatalogRevision":"791ff2dd3a45707290badee660f185e514d15f1cf518908628f425c2f2c56ee4","id":"rel:5e326730f8ab2cb1e2ab11f630ba19a793966e4dac100e3e7d4d1a544232f1fc","properties":{},"sourceDetailPath":"/data/v1/records/ctrl-coso-ic-p16-4995bb68.json","sourceId":"ctrl:coso-ic:P16","targetDetailPath":"/data/v1/records/std-coso-ic-3f80f565.json","targetId":"std:coso-ic","type":"belongs_to"},{"expectedCatalogRevision":"791ff2dd3a45707290badee660f185e514d15f1cf518908628f425c2f2c56ee4","id":"rel:6e062e768ccd5a27ae74097131b061d024e4d8c49db22e35bd13c427c83f108e","properties":{},"sourceDetailPath":"/data/v1/records/ctrl-iia-2024-std-1-2-da892b84.json","sourceId":"ctrl:iia-2024:Std 1.2","targetDetailPath":"/data/v1/records/std-iia-2024-1687734b.json","targetId":"std:iia-2024","type":"belongs_to"},{"expectedCatalogRevision":"791ff2dd3a45707290badee660f185e514d15f1cf518908628f425c2f2c56ee4","id":"rel:6e4a82ac5680b85a4a0a1b293996eefad4f8970f2b0ec15e7c53c155b25a3b7d","properties":{"control_id":"P2","coverage":"full","delta":null,"framework":"coso-ic","provenance":{"defaultConfidence":"medium","defaultStatus":"active","direction":"canonical_to_source","mapper":"coworkcanvas-compliance-graph","note":"Each member is a documented relationship claim from the canonical unified control to a source control or guidance proposition. relationship: equal|superset_of (full) / intersects_with|subset_of (partial) / informs (guidance). confidence 'medium' = single-mapper, documented, not yet externally corroborated. source_version is the member framework's edition from the standard version register.","reviewDate":"2026-09-07"},"relationship":"superset_of","source_version":"2013"},"sourceDetailPath":"/data/v1/records/uc-uc-gov-05-b3a47944.json","sourceId":"uc:UC-GOV-05","targetDetailPath":"/data/v1/records/ctrl-coso-ic-p2-4f80775c.json","targetId":"ctrl:coso-ic:P2","type":"maps_to"},{"expectedCatalogRevision":"791ff2dd3a45707290badee660f185e514d15f1cf518908628f425c2f2c56ee4","id":"rel:6ecddf3dfc0606d5faa60338779f21b6e6ce0b511273bf6699b901a79b8b0f64","properties":{},"sourceDetailPath":"/data/v1/records/ctrl-coso-ic-p1-f41d97ed.json","sourceId":"ctrl:coso-ic:P1","targetDetailPath":"/data/v1/records/std-coso-ic-3f80f565.json","targetId":"std:coso-ic","type":"belongs_to"},{"expectedCatalogRevision":"791ff2dd3a45707290badee660f185e514d15f1cf518908628f425c2f2c56ee4","id":"rel:74bc65e8e9aa1bfb54f93555a389e7974ee95deaf69f27e0c445b8aa95797baf","properties":{},"sourceDetailPath":"/data/v1/records/ctrl-eu-ai-act-aia-art27-7b550500.json","sourceId":"ctrl:eu-ai-act:AIA-Art27","targetDetailPath":"/data/v1/records/std-eu-ai-act-54986689.json","targetId":"std:eu-ai-act","type":"belongs_to"},{"expectedCatalogRevision":"791ff2dd3a45707290badee660f185e514d15f1cf518908628f425c2f2c56ee4","id":"rel:74e883a4246ff37ceb111e94ede879200b02479a84eda309b5816228465bece2","properties":{},"sourceDetailPath":"/data/v1/records/ctrl-cobit-2019-dss06-c2b31b0e.json","sourceId":"ctrl:cobit-2019:DSS06","targetDetailPath":"/data/v1/records/std-cobit-2019-2181ce0c.json","targetId":"std:cobit-2019","type":"belongs_to"},{"expectedCatalogRevision":"791ff2dd3a45707290badee660f185e514d15f1cf518908628f425c2f2c56ee4","id":"rel:76ea898dec4991a063d580a93d29b534d6d9ed2a3aac2b2e7037d9911d54508a","properties":{},"sourceDetailPath":"/data/v1/records/ctrl-iia-2024-principle-4-e921b675.json","sourceId":"ctrl:iia-2024:Principle 4","targetDetailPath":"/data/v1/records/std-iia-2024-1687734b.json","targetId":"std:iia-2024","type":"belongs_to"},{"expectedCatalogRevision":"791ff2dd3a45707290badee660f185e514d15f1cf518908628f425c2f2c56ee4","id":"rel:76f616cc9d689545baa7759562f2c82713d99f16be87637a3b8abeb1523b4053","properties":{"control_id":"Std 1.1","coverage":"full","delta":null,"framework":"iia-2024","provenance":{"defaultConfidence":"medium","defaultStatus":"active","direction":"canonical_to_source","mapper":"coworkcanvas-compliance-graph","note":"Each member is a documented relationship claim from the canonical unified control to a source control or guidance proposition. relationship: equal|superset_of (full) / intersects_with|subset_of (partial) / informs (guidance). confidence 'medium' = single-mapper, documented, not yet externally corroborated. source_version is the member framework's edition from the standard version register.","reviewDate":"2026-09-07"},"relationship":"superset_of","source_version":"2024 edition"},"sourceDetailPath":"/data/v1/records/uc-uc-audit-04-c880e18f.json","sourceId":"uc:UC-AUDIT-04","targetDetailPath":"/data/v1/records/ctrl-iia-2024-std-1-1-e8b262ce.json","targetId":"ctrl:iia-2024:Std 1.1","type":"maps_to"},{"expectedCatalogRevision":"791ff2dd3a45707290badee660f185e514d15f1cf518908628f425c2f2c56ee4","id":"rel:7b987e2457e3123d2ab502637159c47dbd0be45ceb05c4e95eff9095762ad1b8","properties":{},"sourceDetailPath":"/data/v1/records/ctrl-coso-erm-e14-68b8e783.json","sourceId":"ctrl:coso-erm:E14","targetDetailPath":"/data/v1/records/std-coso-erm-7265cc54.json","targetId":"std:coso-erm","type":"belongs_to"},{"expectedCatalogRevision":"791ff2dd3a45707290badee660f185e514d15f1cf518908628f425c2f2c56ee4","id":"rel:7d7f47e94e080166ff4b43be28d637d82c7939b51d35c1a61664ce6a8d58db45","properties":{"control_id":"Principle 1","coverage":"full","delta":null,"framework":"iia-2024","provenance":{"defaultConfidence":"medium","defaultStatus":"active","direction":"canonical_to_source","mapper":"coworkcanvas-compliance-graph","note":"Each member is a documented relationship claim from the canonical unified control to a source control or guidance proposition. relationship: equal|superset_of (full) / intersects_with|subset_of (partial) / informs (guidance). confidence 'medium' = single-mapper, documented, not yet externally corroborated. source_version is the member framework's edition from the standard version register.","reviewDate":"2026-09-07"},"relationship":"superset_of","source_version":"2024 edition"},"sourceDetailPath":"/data/v1/records/uc-uc-audit-04-c880e18f.json","sourceId":"uc:UC-AUDIT-04","targetDetailPath":"/data/v1/records/ctrl-iia-2024-principle-1-97822cbc.json","targetId":"ctrl:iia-2024:Principle 1","type":"maps_to"},{"expectedCatalogRevision":"791ff2dd3a45707290badee660f185e514d15f1cf518908628f425c2f2c56ee4","id":"rel:83e136a1f18ac7b92e27bb2448dc3cc6c17ecab0f55475fb78cd384b1480466b","properties":{},"sourceDetailPath":"/data/v1/records/ctrl-coso-ic-p2-4f80775c.json","sourceId":"ctrl:coso-ic:P2","targetDetailPath":"/data/v1/records/std-coso-ic-3f80f565.json","targetId":"std:coso-ic","type":"belongs_to"},{"expectedCatalogRevision":"791ff2dd3a45707290badee660f185e514d15f1cf518908628f425c2f2c56ee4","id":"rel:8617482233ffe8bfa5309d39b6d520746dc930ecdc68348f52565c031c767fce","properties":{"control_id":"EDM04","coverage":"partial","delta":"governance of optimization across all enterprise IT resources (people, technology, infrastructure), beyond security-scoped budget and personnel","framework":"cobit-2019","provenance":{"defaultConfidence":"medium","defaultStatus":"active","direction":"canonical_to_source","mapper":"coworkcanvas-compliance-graph","note":"Each member is a documented relationship claim from the canonical unified control to a source control or guidance proposition. relationship: equal|superset_of (full) / intersects_with|subset_of (partial) / informs (guidance). confidence 'medium' = single-mapper, documented, not yet externally corroborated. source_version is the member framework's edition from the standard version register.","reviewDate":"2026-09-07"},"relationship":"intersects_with","source_version":"2019"},"sourceDetailPath":"/data/v1/records/uc-uc-gov-11-a13b60d3.json","sourceId":"uc:UC-GOV-11","targetDetailPath":"/data/v1/records/ctrl-cobit-2019-edm04-7ad4bdc3.json","targetId":"ctrl:cobit-2019:EDM04","type":"maps_to"},{"expectedCatalogRevision":"791ff2dd3a45707290badee660f185e514d15f1cf518908628f425c2f2c56ee4","id":"rel:8a42451d0b65b2f78abe66a322743070f045bb0d4cc748770959deed39bbcaf0","properties":{},"sourceDetailPath":"/data/v1/records/ctrl-coso-ic-p11-2a08883b.json","sourceId":"ctrl:coso-ic:P11","targetDetailPath":"/data/v1/records/std-coso-ic-3f80f565.json","targetId":"std:coso-ic","type":"belongs_to"},{"expectedCatalogRevision":"791ff2dd3a45707290badee660f185e514d15f1cf518908628f425c2f2c56ee4","id":"rel:8d541a5cf5c4693768950d074cf5285533f6708c692c8404b375d1e8a65d9b21","properties":{"control_id":"Principle 9","coverage":"partial","delta":"Principle 9 also spans methodologies (9.3) and assurance coordination/reliance (9.5)","framework":"iia-2024","provenance":{"defaultConfidence":"medium","defaultStatus":"active","direction":"canonical_to_source","mapper":"coworkcanvas-compliance-graph","note":"Each member is a documented relationship claim from the canonical unified control to a source control or guidance proposition. relationship: equal|superset_of (full) / intersects_with|subset_of (partial) / informs (guidance). confidence 'medium' = single-mapper, documented, not yet externally corroborated. source_version is the member framework's edition from the standard version register.","reviewDate":"2026-09-07"},"relationship":"intersects_with","source_version":"2024 edition"},"sourceDetailPath":"/data/v1/records/uc-uc-audit-09-f23ecfe4.json","sourceId":"uc:UC-AUDIT-09","targetDetailPath":"/data/v1/records/ctrl-iia-2024-principle-9-068ca212.json","targetId":"ctrl:iia-2024:Principle 9","type":"maps_to"},{"expectedCatalogRevision":"791ff2dd3a45707290badee660f185e514d15f1cf518908628f425c2f2c56ee4","id":"rel:8fe0a77df14eb5ed5f66711d269b25dd250f9ed2ad6eb19f812f1fadba1e4dca","properties":{"control_id":"Principle 4","coverage":"full","delta":null,"framework":"iia-2024","provenance":{"defaultConfidence":"medium","defaultStatus":"active","direction":"canonical_to_source","mapper":"coworkcanvas-compliance-graph","note":"Each member is a documented relationship claim from the canonical unified control to a source control or guidance proposition. relationship: equal|superset_of (full) / intersects_with|subset_of (partial) / informs (guidance). confidence 'medium' = single-mapper, documented, not yet externally corroborated. source_version is the member framework's edition from the standard version register.","reviewDate":"2026-09-07"},"relationship":"superset_of","source_version":"2024 edition"},"sourceDetailPath":"/data/v1/records/uc-uc-audit-07-50f8c2fa.json","sourceId":"uc:UC-AUDIT-07","targetDetailPath":"/data/v1/records/ctrl-iia-2024-principle-4-e921b675.json","targetId":"ctrl:iia-2024:Principle 4","type":"maps_to"},{"expectedCatalogRevision":"791ff2dd3a45707290badee660f185e514d15f1cf518908628f425c2f2c56ee4","id":"rel:951f198617fd4e6985371dc92e0a4c9ef65a0e645d8465f2002e7785532ca2a6","properties":{},"sourceDetailPath":"/data/v1/records/ctrl-coso-ic-p8-e85b1bf7.json","sourceId":"ctrl:coso-ic:P8","targetDetailPath":"/data/v1/records/std-coso-ic-3f80f565.json","targetId":"std:coso-ic","type":"belongs_to"},{"expectedCatalogRevision":"791ff2dd3a45707290badee660f185e514d15f1cf518908628f425c2f2c56ee4","id":"rel:970b37f571d1289fab1672f15a9bbee65cc4f9e65d4b8ebc43b29dbcfe7256f8","properties":{"control_id":"EDM01","coverage":"full","delta":null,"framework":"cobit-2019","provenance":{"defaultConfidence":"medium","defaultStatus":"active","direction":"canonical_to_source","mapper":"coworkcanvas-compliance-graph","note":"Each member is a documented relationship claim from the canonical unified control to a source control or guidance proposition. relationship: equal|superset_of (full) / intersects_with|subset_of (partial) / informs (guidance). confidence 'medium' = single-mapper, documented, not yet externally corroborated. source_version is the member framework's edition from the standard version register.","reviewDate":"2026-09-07"},"relationship":"superset_of","source_version":"2019"},"sourceDetailPath":"/data/v1/records/uc-uc-gov-01-e1e2136d.json","sourceId":"uc:UC-GOV-01","targetDetailPath":"/data/v1/records/ctrl-cobit-2019-edm01-95fe0a96.json","targetId":"ctrl:cobit-2019:EDM01","type":"maps_to"},{"expectedCatalogRevision":"791ff2dd3a45707290badee660f185e514d15f1cf518908628f425c2f2c56ee4","id":"rel:9932a4f02e142b017c507e3b409efd0cb48f21bb451588f489f5337f3cfa0c24","properties":{},"sourceDetailPath":"/data/v1/records/ctrl-iia-2024-std-1-3-d38479a0.json","sourceId":"ctrl:iia-2024:Std 1.3","targetDetailPath":"/data/v1/records/std-iia-2024-1687734b.json","targetId":"std:iia-2024","type":"belongs_to"},{"expectedCatalogRevision":"791ff2dd3a45707290badee660f185e514d15f1cf518908628f425c2f2c56ee4","id":"rel:9f5a2586a94972fdb29f62aa7a871ed85bd12341b34300a37eb3c3a4e9db887e","properties":{"control_id":"Std 11.3","coverage":"full","delta":null,"framework":"iia-2024","provenance":{"defaultConfidence":"medium","defaultStatus":"active","direction":"canonical_to_source","mapper":"coworkcanvas-compliance-graph","note":"Each member is a documented relationship claim from the canonical unified control to a source control or guidance proposition. relationship: equal|superset_of (full) / intersects_with|subset_of (partial) / informs (guidance). confidence 'medium' = single-mapper, documented, not yet externally corroborated. source_version is the member framework's edition from the standard version register.","reviewDate":"2026-09-07"},"relationship":"superset_of","source_version":"2024 edition"},"sourceDetailPath":"/data/v1/records/uc-uc-audit-16-03aa1161.json","sourceId":"uc:UC-AUDIT-16","targetDetailPath":"/data/v1/records/ctrl-iia-2024-std-11-3-dbfc7dce.json","targetId":"ctrl:iia-2024:Std 11.3","type":"maps_to"},{"expectedCatalogRevision":"791ff2dd3a45707290badee660f185e514d15f1cf518908628f425c2f2c56ee4","id":"rel:a0c14c0293d1afba8a4199022904af26b4f4095f4319e0f53f6796d1a5facba9","properties":{},"sourceDetailPath":"/data/v1/records/ctrl-aiuc-1-b007-151dfcd3.json","sourceId":"ctrl:aiuc-1:B007","targetDetailPath":"/data/v1/records/std-aiuc-1-d2a8b650.json","targetId":"std:aiuc-1","type":"belongs_to"},{"expectedCatalogRevision":"791ff2dd3a45707290badee660f185e514d15f1cf518908628f425c2f2c56ee4","id":"rel:a4da889c3e8d9a23cacd902b671a9a5be1365ce9c64cb898768e45d8f0589034","properties":{"control_id":"P8","coverage":"full","delta":null,"framework":"coso-ic","provenance":{"defaultConfidence":"medium","defaultStatus":"active","direction":"canonical_to_source","mapper":"coworkcanvas-compliance-graph","note":"Each member is a documented relationship claim from the canonical unified control to a source control or guidance proposition. relationship: equal|superset_of (full) / intersects_with|subset_of (partial) / informs (guidance). confidence 'medium' = single-mapper, documented, not yet externally corroborated. source_version is the member framework's edition from the standard version register.","reviewDate":"2026-09-07"},"relationship":"superset_of","source_version":"2013"},"sourceDetailPath":"/data/v1/records/uc-uc-risk-12-210e108b.json","sourceId":"uc:UC-RISK-12","targetDetailPath":"/data/v1/records/ctrl-coso-ic-p8-e85b1bf7.json","targetId":"ctrl:coso-ic:P8","type":"maps_to"},{"expectedCatalogRevision":"791ff2dd3a45707290badee660f185e514d15f1cf518908628f425c2f2c56ee4","id":"rel:ad0e3cf5d28f24b95a2da30e0f428b9a4d26bd2d74f219c1209d4dbc84be7283","properties":{},"sourceDetailPath":"/data/v1/records/ctrl-coso-ic-p10-c5a97f20.json","sourceId":"ctrl:coso-ic:P10","targetDetailPath":"/data/v1/records/std-coso-ic-3f80f565.json","targetId":"std:coso-ic","type":"belongs_to"},{"expectedCatalogRevision":"791ff2dd3a45707290badee660f185e514d15f1cf518908628f425c2f2c56ee4","id":"rel:b8a1adc13a002c1b9d51e184ce6fa06c7bb6cde5e84ced80eafef7cd10ecd1e3","properties":{"control_id":"Principle 15","coverage":"partial","delta":"Principle 15 also requires monitoring/confirming implementation of recommendations and action plans (15.2)","framework":"iia-2024","provenance":{"defaultConfidence":"medium","defaultStatus":"active","direction":"canonical_to_source","mapper":"coworkcanvas-compliance-graph","note":"Each member is a documented relationship claim from the canonical unified control to a source control or guidance proposition. relationship: equal|superset_of (full) / intersects_with|subset_of (partial) / informs (guidance). confidence 'medium' = single-mapper, documented, not yet externally corroborated. source_version is the member framework's edition from the standard version register.","reviewDate":"2026-09-07"},"relationship":"intersects_with","source_version":"2024 edition"},"sourceDetailPath":"/data/v1/records/uc-uc-audit-16-03aa1161.json","sourceId":"uc:UC-AUDIT-16","targetDetailPath":"/data/v1/records/ctrl-iia-2024-principle-15-b57f77c8.json","targetId":"ctrl:iia-2024:Principle 15","type":"maps_to"},{"expectedCatalogRevision":"791ff2dd3a45707290badee660f185e514d15f1cf518908628f425c2f2c56ee4","id":"rel:baa1cf29b74729ad0cedb9794b800c963f716d47933df0994e7ae2bbdd13db4d","properties":{"control_id":"Std 1.3","coverage":"full","delta":null,"framework":"iia-2024","provenance":{"defaultConfidence":"medium","defaultStatus":"active","direction":"canonical_to_source","mapper":"coworkcanvas-compliance-graph","note":"Each member is a documented relationship claim from the canonical unified control to a source control or guidance proposition. relationship: equal|superset_of (full) / intersects_with|subset_of (partial) / informs (guidance). confidence 'medium' = single-mapper, documented, not yet externally corroborated. source_version is the member framework's edition from the standard version register.","reviewDate":"2026-09-07"},"relationship":"superset_of","source_version":"2024 edition"},"sourceDetailPath":"/data/v1/records/uc-uc-audit-04-c880e18f.json","sourceId":"uc:UC-AUDIT-04","targetDetailPath":"/data/v1/records/ctrl-iia-2024-std-1-3-d38479a0.json","targetId":"ctrl:iia-2024:Std 1.3","type":"maps_to"},{"expectedCatalogRevision":"791ff2dd3a45707290badee660f185e514d15f1cf518908628f425c2f2c56ee4","id":"rel:bdc44b1da37bbb6e2bbc0430ad30f108abcae9f7f623ab8b27037ee18c326bd1","properties":{},"sourceDetailPath":"/data/v1/records/ctrl-iia-2024-principle-9-068ca212.json","sourceId":"ctrl:iia-2024:Principle 9","targetDetailPath":"/data/v1/records/std-iia-2024-1687734b.json","targetId":"std:iia-2024","type":"belongs_to"},{"expectedCatalogRevision":"791ff2dd3a45707290badee660f185e514d15f1cf518908628f425c2f2c56ee4","id":"rel:c35bda6f401c7e185f678db00808439de2948ae69fc0c5849eef9a052d198c43","properties":{},"sourceDetailPath":"/data/v1/records/ctrl-iia-2024-std-1-1-e8b262ce.json","sourceId":"ctrl:iia-2024:Std 1.1","targetDetailPath":"/data/v1/records/std-iia-2024-1687734b.json","targetId":"std:iia-2024","type":"belongs_to"},{"expectedCatalogRevision":"791ff2dd3a45707290badee660f185e514d15f1cf518908628f425c2f2c56ee4","id":"rel:c56f2b88ba16f4e02b686a0edb022ea251b93d628af0755d9b7f6b517fc4cafe","properties":{},"sourceDetailPath":"/data/v1/records/ctrl-iia-2024-principle-3-a2a0c733.json","sourceId":"ctrl:iia-2024:Principle 3","targetDetailPath":"/data/v1/records/std-iia-2024-1687734b.json","targetId":"std:iia-2024","type":"belongs_to"},{"expectedCatalogRevision":"791ff2dd3a45707290badee660f185e514d15f1cf518908628f425c2f2c56ee4","id":"rel:c928b3c5d2c020d22ad226062bb2e1ad663ed8de9a59a550ae28c7cd54a72a21","properties":{},"sourceDetailPath":"/data/v1/records/ctrl-cobit-2019-edm04-7ad4bdc3.json","sourceId":"ctrl:cobit-2019:EDM04","targetDetailPath":"/data/v1/records/std-cobit-2019-2181ce0c.json","targetId":"std:cobit-2019","type":"belongs_to"},{"expectedCatalogRevision":"791ff2dd3a45707290badee660f185e514d15f1cf518908628f425c2f2c56ee4","id":"rel:cb4bb91299330aba65c724847882f00b89cc0fa6a325e17292b684496c582f1b","properties":{"control_id":"P11","coverage":"partial","delta":"principle applies across all technology domains, not only access","framework":"coso-ic","provenance":{"defaultConfidence":"medium","defaultStatus":"active","direction":"canonical_to_source","mapper":"coworkcanvas-compliance-graph","note":"Each member is a documented relationship claim from the canonical unified control to a source control or guidance proposition. relationship: equal|superset_of (full) / intersects_with|subset_of (partial) / informs (guidance). confidence 'medium' = single-mapper, documented, not yet externally corroborated. source_version is the member framework's edition from the standard version register.","reviewDate":"2026-09-07"},"relationship":"intersects_with","source_version":"2013"},"sourceDetailPath":"/data/v1/records/uc-uc-access-15-84699cae.json","sourceId":"uc:UC-ACCESS-15","targetDetailPath":"/data/v1/records/ctrl-coso-ic-p11-2a08883b.json","targetId":"ctrl:coso-ic:P11","type":"maps_to"},{"expectedCatalogRevision":"791ff2dd3a45707290badee660f185e514d15f1cf518908628f425c2f2c56ee4","id":"rel:cd2736c7f54ef2e0fa56024aff7c35d1791ffc268f0a89ba93a8d8d3b3d3a0c5","properties":{"control_id":"Std 10.1","coverage":"full","delta":null,"framework":"iia-2024","provenance":{"defaultConfidence":"medium","defaultStatus":"active","direction":"canonical_to_source","mapper":"coworkcanvas-compliance-graph","note":"Each member is a documented relationship claim from the canonical unified control to a source control or guidance proposition. relationship: equal|superset_of (full) / intersects_with|subset_of (partial) / informs (guidance). confidence 'medium' = single-mapper, documented, not yet externally corroborated. source_version is the member framework's edition from the standard version register.","reviewDate":"2026-09-07"},"relationship":"superset_of","source_version":"2024 edition"},"sourceDetailPath":"/data/v1/records/uc-uc-audit-10-fc9abe7f.json","sourceId":"uc:UC-AUDIT-10","targetDetailPath":"/data/v1/records/ctrl-iia-2024-std-10-1-a5b61f0d.json","targetId":"ctrl:iia-2024:Std 10.1","type":"maps_to"},{"expectedCatalogRevision":"791ff2dd3a45707290badee660f185e514d15f1cf518908628f425c2f2c56ee4","id":"rel:cefd16afb3bee8931d0986f095a7fc954359fc5ac0bb3e0ba28519365d40a052","properties":{},"sourceDetailPath":"/data/v1/records/ctrl-coso-erm-e1-2389ffca.json","sourceId":"ctrl:coso-erm:E1","targetDetailPath":"/data/v1/records/std-coso-erm-7265cc54.json","targetId":"std:coso-erm","type":"belongs_to"},{"expectedCatalogRevision":"791ff2dd3a45707290badee660f185e514d15f1cf518908628f425c2f2c56ee4","id":"rel:d23c16c0475ddff17cb84767adaa69eb11e7677c2c55a2aa5d8ac340b162dc89","properties":{"control_id":"C001","coverage":"partial","delta":"a system-specific AI risk taxonomy with severity tiers that drives output filtering, monitoring categories, and third-party test scope","framework":"aiuc-1","provenance":{"defaultConfidence":"medium","defaultStatus":"active","direction":"canonical_to_source","mapper":"coworkcanvas-compliance-graph","note":"Each member is a documented relationship claim from the canonical unified control to a source control or guidance proposition. relationship: equal|superset_of (full) / intersects_with|subset_of (partial) / informs (guidance). confidence 'medium' = single-mapper, documented, not yet externally corroborated. source_version is the member framework's edition from the standard version register.","reviewDate":"2026-09-07"},"relationship":"intersects_with","source_version":"July 15, 2026 release (quarterly update cadence)"},"sourceDetailPath":"/data/v1/records/uc-uc-ai-04-b35afd39.json","sourceId":"uc:UC-AI-04","targetDetailPath":"/data/v1/records/ctrl-aiuc-1-c001-6bc6c173.json","targetId":"ctrl:aiuc-1:C001","type":"maps_to"},{"expectedCatalogRevision":"791ff2dd3a45707290badee660f185e514d15f1cf518908628f425c2f2c56ee4","id":"rel:d580895fb25016a0f880c3525c9fd4e54d24821bb7ee37bffaaf22bb474926b9","properties":{"control_id":"Principle 3","coverage":"full","delta":null,"framework":"iia-2024","provenance":{"defaultConfidence":"medium","defaultStatus":"active","direction":"canonical_to_source","mapper":"coworkcanvas-compliance-graph","note":"Each member is a documented relationship claim from the canonical unified control to a source control or guidance proposition. relationship: equal|superset_of (full) / intersects_with|subset_of (partial) / informs (guidance). confidence 'medium' = single-mapper, documented, not yet externally corroborated. source_version is the member framework's edition from the standard version register.","reviewDate":"2026-09-07"},"relationship":"superset_of","source_version":"2024 edition"},"sourceDetailPath":"/data/v1/records/uc-uc-audit-06-3a5916e0.json","sourceId":"uc:UC-AUDIT-06","targetDetailPath":"/data/v1/records/ctrl-iia-2024-principle-3-a2a0c733.json","targetId":"ctrl:iia-2024:Principle 3","type":"maps_to"},{"expectedCatalogRevision":"791ff2dd3a45707290badee660f185e514d15f1cf518908628f425c2f2c56ee4","id":"rel:dc58a262b9c5130739984b7631650a439ee6b18ce8a57263d9b917ac82a47ad5","properties":{"control_id":"P10","coverage":"partial","delta":"principle applies across all control domains, not only access","framework":"coso-ic","provenance":{"defaultConfidence":"medium","defaultStatus":"active","direction":"canonical_to_source","mapper":"coworkcanvas-compliance-graph","note":"Each member is a documented relationship claim from the canonical unified control to a source control or guidance proposition. relationship: equal|superset_of (full) / intersects_with|subset_of (partial) / informs (guidance). confidence 'medium' = single-mapper, documented, not yet externally corroborated. source_version is the member framework's edition from the standard version register.","reviewDate":"2026-09-07"},"relationship":"intersects_with","source_version":"2013"},"sourceDetailPath":"/data/v1/records/uc-uc-access-15-84699cae.json","sourceId":"uc:UC-ACCESS-15","targetDetailPath":"/data/v1/records/ctrl-coso-ic-p10-c5a97f20.json","targetId":"ctrl:coso-ic:P10","type":"maps_to"},{"expectedCatalogRevision":"791ff2dd3a45707290badee660f185e514d15f1cf518908628f425c2f2c56ee4","id":"rel:de8d6709ab9dabdb8f48b03bd4d7b13076c63669a00fce9accb486fdca9e9713","properties":{"control_id":"E3","coverage":"full","delta":null,"framework":"coso-erm","provenance":{"defaultConfidence":"medium","defaultStatus":"active","direction":"canonical_to_source","mapper":"coworkcanvas-compliance-graph","note":"Each member is a documented relationship claim from the canonical unified control to a source control or guidance proposition. relationship: equal|superset_of (full) / intersects_with|subset_of (partial) / informs (guidance). confidence 'medium' = single-mapper, documented, not yet externally corroborated. source_version is the member framework's edition from the standard version register.","reviewDate":"2026-09-07"},"relationship":"superset_of","source_version":"2017"},"sourceDetailPath":"/data/v1/records/uc-uc-gov-04-849a3e91.json","sourceId":"uc:UC-GOV-04","targetDetailPath":"/data/v1/records/ctrl-coso-erm-e3-2d76e2c2.json","targetId":"ctrl:coso-erm:E3","type":"maps_to"},{"expectedCatalogRevision":"791ff2dd3a45707290badee660f185e514d15f1cf518908628f425c2f2c56ee4","id":"rel:def23d1c288a2739ddb09d7a99d80475f3e63aff401fc28cbc44da318c7d47e9","properties":{"control_id":"E14","coverage":"full","delta":null,"framework":"coso-erm","provenance":{"defaultConfidence":"medium","defaultStatus":"active","direction":"canonical_to_source","mapper":"coworkcanvas-compliance-graph","note":"Each member is a documented relationship claim from the canonical unified control to a source control or guidance proposition. relationship: equal|superset_of (full) / intersects_with|subset_of (partial) / informs (guidance). confidence 'medium' = single-mapper, documented, not yet externally corroborated. source_version is the member framework's edition from the standard version register.","reviewDate":"2026-09-07"},"relationship":"superset_of","source_version":"2017"},"sourceDetailPath":"/data/v1/records/uc-uc-risk-10-6d44f690.json","sourceId":"uc:UC-RISK-10","targetDetailPath":"/data/v1/records/ctrl-coso-erm-e14-68b8e783.json","targetId":"ctrl:coso-erm:E14","type":"maps_to"},{"expectedCatalogRevision":"791ff2dd3a45707290badee660f185e514d15f1cf518908628f425c2f2c56ee4","id":"rel:e1d3b60ec55d2ba06662780df041b309092dbbf76738f7d5a030fa2f637b11dc","properties":{"control_id":"DSS06","coverage":"full","delta":null,"framework":"cobit-2019","provenance":{"defaultConfidence":"medium","defaultStatus":"active","direction":"canonical_to_source","mapper":"coworkcanvas-compliance-graph","note":"Each member is a documented relationship claim from the canonical unified control to a source control or guidance proposition. relationship: equal|superset_of (full) / intersects_with|subset_of (partial) / informs (guidance). confidence 'medium' = single-mapper, documented, not yet externally corroborated. source_version is the member framework's edition from the standard version register.","reviewDate":"2026-09-07"},"relationship":"equal","source_version":"2019"},"sourceDetailPath":"/data/v1/records/uc-uc-bcdr-14-997de451.json","sourceId":"uc:UC-BCDR-14","targetDetailPath":"/data/v1/records/ctrl-cobit-2019-dss06-c2b31b0e.json","targetId":"ctrl:cobit-2019:DSS06","type":"maps_to"},{"expectedCatalogRevision":"791ff2dd3a45707290badee660f185e514d15f1cf518908628f425c2f2c56ee4","id":"rel:e863c1c1ab2504a5a9f49f75d138cb6c0f587bea79ee2d5f3497ab636a63df12","properties":{},"sourceDetailPath":"/data/v1/records/ctrl-iia-2024-principle-6-dc3030fa.json","sourceId":"ctrl:iia-2024:Principle 6","targetDetailPath":"/data/v1/records/std-iia-2024-1687734b.json","targetId":"std:iia-2024","type":"belongs_to"},{"expectedCatalogRevision":"791ff2dd3a45707290badee660f185e514d15f1cf518908628f425c2f2c56ee4","id":"rel:eb2763c24ae0bb6b3625b11233e6e45a9a11273627780a51ee50b96a9c66f2a8","properties":{},"sourceDetailPath":"/data/v1/records/ctrl-cobit-2019-apo14-ab650d02.json","sourceId":"ctrl:cobit-2019:APO14","targetDetailPath":"/data/v1/records/std-cobit-2019-2181ce0c.json","targetId":"std:cobit-2019","type":"belongs_to"},{"expectedCatalogRevision":"791ff2dd3a45707290badee660f185e514d15f1cf518908628f425c2f2c56ee4","id":"rel:ec12eedda1de13de98fa6891f9f791b3b3dae6903f4d6bd9259f131e9b9310df","properties":{},"sourceDetailPath":"/data/v1/records/ctrl-cobit-2019-edm01-95fe0a96.json","sourceId":"ctrl:cobit-2019:EDM01","targetDetailPath":"/data/v1/records/std-cobit-2019-2181ce0c.json","targetId":"std:cobit-2019","type":"belongs_to"},{"expectedCatalogRevision":"791ff2dd3a45707290badee660f185e514d15f1cf518908628f425c2f2c56ee4","id":"rel:edc524182fec3365afded04e66505533a46f61f318adf773398145e3a01d5efc","properties":{"control_id":"AIA-Art27","coverage":"full","delta":null,"framework":"eu-ai-act","provenance":{"defaultConfidence":"medium","defaultStatus":"active","direction":"canonical_to_source","mapper":"coworkcanvas-compliance-graph","note":"Each member is a documented relationship claim from the canonical unified control to a source control or guidance proposition. relationship: equal|superset_of (full) / intersects_with|subset_of (partial) / informs (guidance). confidence 'medium' = single-mapper, documented, not yet externally corroborated. source_version is the member framework's edition from the standard version register.","reviewDate":"2026-09-07"},"relationship":"superset_of","source_version":"Regulation (EU) 2024/1689"},"sourceDetailPath":"/data/v1/records/uc-uc-ai-04-b35afd39.json","sourceId":"uc:UC-AI-04","targetDetailPath":"/data/v1/records/ctrl-eu-ai-act-aia-art27-7b550500.json","targetId":"ctrl:eu-ai-act:AIA-Art27","type":"maps_to"},{"expectedCatalogRevision":"791ff2dd3a45707290badee660f185e514d15f1cf518908628f425c2f2c56ee4","id":"rel:f08b3091da2f2ebef68bbc42112348fdd319a558f738645d33dbdb66a0e005e4","properties":{"control_id":"AIA-Art6-7","coverage":"full","delta":null,"framework":"eu-ai-act","provenance":{"defaultConfidence":"medium","defaultStatus":"active","direction":"canonical_to_source","mapper":"coworkcanvas-compliance-graph","note":"Each member is a documented relationship claim from the canonical unified control to a source control or guidance proposition. relationship: equal|superset_of (full) / intersects_with|subset_of (partial) / informs (guidance). confidence 'medium' = single-mapper, documented, not yet externally corroborated. source_version is the member framework's edition from the standard version register.","reviewDate":"2026-09-07"},"relationship":"superset_of","source_version":"Regulation (EU) 2024/1689"},"sourceDetailPath":"/data/v1/records/uc-uc-ai-04-b35afd39.json","sourceId":"uc:UC-AI-04","targetDetailPath":"/data/v1/records/ctrl-eu-ai-act-aia-art6-7-cd7435c0.json","targetId":"ctrl:eu-ai-act:AIA-Art6-7","type":"maps_to"},{"expectedCatalogRevision":"791ff2dd3a45707290badee660f185e514d15f1cf518908628f425c2f2c56ee4","id":"rel:f1542a50f9e5cd553a0b2a8d3980b06d3b635104cfff72d656321d8373429ebd","properties":{"control_id":"Principle 14","coverage":"partial","delta":"Principle 14 also spans evaluation of findings, recommendations and action plans, and engagement conclusions (Std 14.3-14.5 home) and engagement documentation (Std 14.6 home)","framework":"iia-2024","provenance":{"defaultConfidence":"medium","defaultStatus":"active","direction":"canonical_to_source","mapper":"coworkcanvas-compliance-graph","note":"Each member is a documented relationship claim from the canonical unified control to a source control or guidance proposition. relationship: equal|superset_of (full) / intersects_with|subset_of (partial) / informs (guidance). confidence 'medium' = single-mapper, documented, not yet externally corroborated. source_version is the member framework's edition from the standard version register.","reviewDate":"2026-09-07"},"relationship":"intersects_with","source_version":"2024 edition"},"sourceDetailPath":"/data/v1/records/uc-uc-audit-13-3dae730e.json","sourceId":"uc:UC-AUDIT-13","targetDetailPath":"/data/v1/records/ctrl-iia-2024-principle-14-fd4f55ab.json","targetId":"ctrl:iia-2024:Principle 14","type":"maps_to"},{"expectedCatalogRevision":"791ff2dd3a45707290badee660f185e514d15f1cf518908628f425c2f2c56ee4","id":"rel:f16e284a257e8b96794e10fbe08c1efc2c5e2fe1149b35ef766faf310ffbd634","properties":{},"sourceDetailPath":"/data/v1/records/ctrl-cobit-2019-apo06-2191e824.json","sourceId":"ctrl:cobit-2019:APO06","targetDetailPath":"/data/v1/records/std-cobit-2019-2181ce0c.json","targetId":"std:cobit-2019","type":"belongs_to"},{"expectedCatalogRevision":"791ff2dd3a45707290badee660f185e514d15f1cf518908628f425c2f2c56ee4","id":"rel:fa025a0315b5823b158620adb1e426d69f3be952af40edb9d2b815f9a31e2bc6","properties":{"control_id":"A003","coverage":"partial","delta":"agent-specific enforcement: data access scoped per task, user role, agent role, and context at inference time","framework":"aiuc-1","provenance":{"defaultConfidence":"medium","defaultStatus":"active","direction":"canonical_to_source","mapper":"coworkcanvas-compliance-graph","note":"Each member is a documented relationship claim from the canonical unified control to a source control or guidance proposition. relationship: equal|superset_of (full) / intersects_with|subset_of (partial) / informs (guidance). confidence 'medium' = single-mapper, documented, not yet externally corroborated. source_version is the member framework's edition from the standard version register.","reviewDate":"2026-09-07"},"relationship":"intersects_with","source_version":"July 15, 2026 release (quarterly update cadence)"},"sourceDetailPath":"/data/v1/records/uc-uc-access-03-43eeb212.json","sourceId":"uc:UC-ACCESS-03","targetDetailPath":"/data/v1/records/ctrl-aiuc-1-a003-bea61fd9.json","targetId":"ctrl:aiuc-1:A003","type":"maps_to"},{"expectedCatalogRevision":"791ff2dd3a45707290badee660f185e514d15f1cf518908628f425c2f2c56ee4","id":"rel:fc1864e38234f319edeb1291aab138591e799e19c843dbcba7d1b80c5e00e01a","properties":{"control_id":"E4","coverage":"full","delta":null,"framework":"coso-erm","provenance":{"defaultConfidence":"medium","defaultStatus":"active","direction":"canonical_to_source","mapper":"coworkcanvas-compliance-graph","note":"Each member is a documented relationship claim from the canonical unified control to a source control or guidance proposition. relationship: equal|superset_of (full) / intersects_with|subset_of (partial) / informs (guidance). confidence 'medium' = single-mapper, documented, not yet externally corroborated. source_version is the member framework's edition from the standard version register.","reviewDate":"2026-09-07"},"relationship":"superset_of","source_version":"2017"},"sourceDetailPath":"/data/v1/records/uc-uc-gov-04-849a3e91.json","sourceId":"uc:UC-GOV-04","targetDetailPath":"/data/v1/records/ctrl-coso-erm-e4-97e5f081.json","targetId":"ctrl:coso-erm:E4","type":"maps_to"},{"expectedCatalogRevision":"791ff2dd3a45707290badee660f185e514d15f1cf518908628f425c2f2c56ee4","id":"rel:fc56b9ed453de3b0261ce897bc26c0edde1bcc41dc9640cc6c37b84f738ade3f","properties":{},"sourceDetailPath":"/data/v1/records/ctrl-iia-2024-std-11-3-dbfc7dce.json","sourceId":"ctrl:iia-2024:Std 11.3","targetDetailPath":"/data/v1/records/std-iia-2024-1687734b.json","targetId":"std:iia-2024","type":"belongs_to"},{"expectedCatalogRevision":"791ff2dd3a45707290badee660f185e514d15f1cf518908628f425c2f2c56ee4","id":"rel:fda71e41615a40a1fba57d5edf79eb5cec9502bc8b254d7a4b3a461c70f91a37","properties":{},"sourceDetailPath":"/data/v1/records/ctrl-coso-erm-e3-2d76e2c2.json","sourceId":"ctrl:coso-erm:E3","targetDetailPath":"/data/v1/records/std-coso-erm-7265cc54.json","targetId":"std:coso-erm","type":"belongs_to"}],"schemaVersion":1,"scope":"topics","total":331}