{"catalogRevision":"791ff2dd3a45707290badee660f185e514d15f1cf518908628f425c2f2c56ee4","contextIds":["ctrl:aiuc-1:A003","ctrl:aiuc-1:A004","ctrl:aiuc-1:A005","ctrl:aiuc-1:B001","ctrl:aiuc-1:B007","ctrl:aiuc-1:C002","ctrl:aiuc-1:C008","ctrl:aiuc-1:C010","ctrl:aiuc-1:C011","ctrl:aiuc-1:C012","ctrl:aiuc-1:D002","ctrl:aiuc-1:D004","ctrl:aiuc-1:E009","ctrl:aiuc-1:E015","ctrl:cobit-2019:DSS02","ctrl:cobit-2019:DSS03","ctrl:cobit-2019:DSS05","ctrl:coso-ic:P7","ctrl:dora:DORA-Art17-23","ctrl:dora:DORA-Art24-27","ctrl:eu-ai-act:AIA-Art12","ctrl:eu-ai-act:AIA-Art19","ctrl:eu-ai-act:AIA-Art72","ctrl:gdpr:GDPR-Art32","ctrl:gdpr:GDPR-Art33","ctrl:gdpr:GDPR-Art44-49","ctrl:hipaa:HIPAA-164.312(a)","ctrl:hipaa:HIPAA-164.312(b)","ctrl:iso-27001:A.5.15","ctrl:iso-27001:A.5.16","ctrl:iso-27001:A.5.17","ctrl:iso-27001:A.5.18","ctrl:iso-27001:A.5.25","ctrl:iso-27001:A.5.26","ctrl:iso-27001:A.5.28","ctrl:iso-27001:A.5.7","ctrl:iso-27001:A.5.8","ctrl:iso-27001:A.6.3","ctrl:iso-27001:A.6.8","ctrl:iso-27001:A.8.12"],"directIds":[],"kind":"bundle","metadata":"/assets/agent_metadata.84eaa456936e4fa1.json","name":"Logging, Monitoring & Detection","next":"/assets/agent_topics-logging-monitoring-detection-2.03f97461f346ce62.json","page":1,"pageSize":40,"records":[{"attributes":{"category":"technical","framework":"aiuc-1","type":"preventive"},"canonicalUrl":"https://evidenceflows.com/frameworks/aiuc-1/","description":"Limit AI agent data access","details":{"automation":"automated","control_category":"technical","control_id":"A003","control_type":"preventive","domains":["AI Governance","Data Protection & Privacy"],"framework":"aiuc-1","group":"Data & Privacy","key_control":false,"requirement_frequency":"Every 12 months","requirement_status":"mandatory","risk_count":7,"source_pages":null,"source_url":"https://www.aiuc-1.com/data-and-privacy/implement-contextual-data-safeguards"},"direct":false,"history":{"digest":"f887d2a86a3168280ca2b27485f4bdfc028ffa39bea91251cd1ddefc50c323c8","firstSeenAt":"2026-09-17T22:28:00Z","firstSeenRevision":"f368a6cce277037e4b1e1ff46004e3acd295f96c9ac63a411a0e45775a7f468e","updatedAt":"2026-09-17T22:28:00Z","updatedRevision":"f368a6cce277037e4b1e1ff46004e3acd295f96c9ac63a411a0e45775a7f468e"},"htmlUrl":"/agents/records/ctrl-aiuc-1-a003-bea61fd9.html","id":"ctrl:aiuc-1:A003","mapUrl":"https://evidenceflows.com/?v=1&node=ctrl%3Aaiuc-1%3AA003","sourceIds":["aiuc-1"],"sourceUrl":"https://www.aiuc-1.com/data-and-privacy/implement-contextual-data-safeguards","title":"A003 — Limit AI agent data access","type":"control","updatedAt":"2026-09-17T22:28:00Z","url":"/assets/agent_record-ctrl-aiuc-1-a003-bea61fd9.046b370e6cc057fa.json"},{"attributes":{"category":"technical","framework":"aiuc-1","type":"preventive"},"canonicalUrl":"https://evidenceflows.com/frameworks/aiuc-1/","description":"Protect IP & trade secrets","details":{"automation":"hybrid","control_category":"technical","control_id":"A004","control_type":"preventive","domains":["AI Governance","Data Protection & Privacy"],"framework":"aiuc-1","group":"Data & Privacy","key_control":false,"requirement_frequency":"Every 12 months","requirement_status":"mandatory","risk_count":5,"source_pages":null,"source_url":"https://www.aiuc-1.com/data-and-privacy/protect-ip-trade-secrets"},"direct":false,"history":{"digest":"0abe505431d6645453b756fa239ed9af5c0429f8f617da4343802354c54c4dfe","firstSeenAt":"2026-09-17T22:28:00Z","firstSeenRevision":"f368a6cce277037e4b1e1ff46004e3acd295f96c9ac63a411a0e45775a7f468e","updatedAt":"2026-09-17T22:28:00Z","updatedRevision":"f368a6cce277037e4b1e1ff46004e3acd295f96c9ac63a411a0e45775a7f468e"},"htmlUrl":"/agents/records/ctrl-aiuc-1-a004-0955d43a.html","id":"ctrl:aiuc-1:A004","mapUrl":"https://evidenceflows.com/?v=1&node=ctrl%3Aaiuc-1%3AA004","sourceIds":["aiuc-1"],"sourceUrl":"https://www.aiuc-1.com/data-and-privacy/protect-ip-trade-secrets","title":"A004 — Protect IP & trade secrets","type":"control","updatedAt":"2026-09-17T22:28:00Z","url":"/assets/agent_record-ctrl-aiuc-1-a004-0955d43a.1af1f09ee2ec42f4.json"},{"attributes":{"category":"technical","framework":"aiuc-1","type":"preventive"},"canonicalUrl":"https://evidenceflows.com/frameworks/aiuc-1/","description":"Prevent cross-customer data exposure","details":{"automation":"automated","control_category":"technical","control_id":"A005","control_type":"preventive","domains":["AI Governance","Data Protection & Privacy"],"framework":"aiuc-1","group":"Data & Privacy","key_control":false,"requirement_frequency":"Every 12 months","requirement_status":"mandatory","risk_count":5,"source_pages":null,"source_url":"https://www.aiuc-1.com/data-and-privacy/prevent-cross-customer-data-exposure"},"direct":false,"history":{"digest":"96fded29e5c1db5492b8aba464930e3fd29f8d1e68dc9e8acc77d39a6a70a8a0","firstSeenAt":"2026-09-17T22:28:00Z","firstSeenRevision":"f368a6cce277037e4b1e1ff46004e3acd295f96c9ac63a411a0e45775a7f468e","updatedAt":"2026-09-17T22:28:00Z","updatedRevision":"f368a6cce277037e4b1e1ff46004e3acd295f96c9ac63a411a0e45775a7f468e"},"htmlUrl":"/agents/records/ctrl-aiuc-1-a005-12903764.html","id":"ctrl:aiuc-1:A005","mapUrl":"https://evidenceflows.com/?v=1&node=ctrl%3Aaiuc-1%3AA005","sourceIds":["aiuc-1"],"sourceUrl":"https://www.aiuc-1.com/data-and-privacy/prevent-cross-customer-data-exposure","title":"A005 — Prevent cross-customer data exposure","type":"control","updatedAt":"2026-09-17T22:28:00Z","url":"/assets/agent_record-ctrl-aiuc-1-a005-12903764.54139520a9a846f5.json"},{"attributes":{"category":"administrative","framework":"aiuc-1","type":"preventive"},"canonicalUrl":"https://evidenceflows.com/frameworks/aiuc-1/","description":"Third-party testing of adversarial robustness","details":{"automation":"manual","control_category":"administrative","control_id":"B001","control_type":"preventive","domains":["AI Governance","Access Control & Identity Management","Secure Development (SDLC) & Application Security"],"framework":"aiuc-1","group":"Security","key_control":true,"requirement_frequency":"Every 3 months","requirement_status":"mandatory","risk_count":5,"source_pages":null,"source_url":"https://www.aiuc-1.com/security/test-adversarial-robustness"},"direct":false,"history":{"digest":"cf7cbd803927ce2710fa4c5b5a0fcdf3d8b8cc27797b2d6230b215d91398cae5","firstSeenAt":"2026-09-17T22:28:00Z","firstSeenRevision":"f368a6cce277037e4b1e1ff46004e3acd295f96c9ac63a411a0e45775a7f468e","updatedAt":"2026-09-17T22:28:00Z","updatedRevision":"f368a6cce277037e4b1e1ff46004e3acd295f96c9ac63a411a0e45775a7f468e"},"htmlUrl":"/agents/records/ctrl-aiuc-1-b001-19a54ee3.html","id":"ctrl:aiuc-1:B001","mapUrl":"https://evidenceflows.com/?v=1&node=ctrl%3Aaiuc-1%3AB001","sourceIds":["aiuc-1"],"sourceUrl":"https://www.aiuc-1.com/security/test-adversarial-robustness","title":"B001 — Third-party testing of adversarial robustness","type":"control","updatedAt":"2026-09-17T22:28:00Z","url":"/assets/agent_record-ctrl-aiuc-1-b001-19a54ee3.64b04d73f3abef65.json"},{"attributes":{"category":"technical","framework":"aiuc-1","type":"preventive"},"canonicalUrl":"https://evidenceflows.com/frameworks/aiuc-1/","description":"Enforce user access privileges to AI systems","details":{"automation":"hybrid","control_category":"technical","control_id":"B007","control_type":"preventive","domains":["AI Governance","Access Control & Identity Management","Secure Development (SDLC) & Application Security"],"framework":"aiuc-1","group":"Security","key_control":true,"requirement_frequency":"Every 3 months","requirement_status":"mandatory","risk_count":4,"source_pages":null,"source_url":"https://www.aiuc-1.com/security/enforce-ai-access-privileges"},"direct":false,"history":{"digest":"5f9f84587d757717e91ddb689515aa8109f44903c10e5d49b52a2e278bc11ab8","firstSeenAt":"2026-09-17T22:28:00Z","firstSeenRevision":"f368a6cce277037e4b1e1ff46004e3acd295f96c9ac63a411a0e45775a7f468e","updatedAt":"2026-09-17T22:28:00Z","updatedRevision":"f368a6cce277037e4b1e1ff46004e3acd295f96c9ac63a411a0e45775a7f468e"},"htmlUrl":"/agents/records/ctrl-aiuc-1-b007-151dfcd3.html","id":"ctrl:aiuc-1:B007","mapUrl":"https://evidenceflows.com/?v=1&node=ctrl%3Aaiuc-1%3AB007","sourceIds":["aiuc-1"],"sourceUrl":"https://www.aiuc-1.com/security/enforce-ai-access-privileges","title":"B007 — Enforce user access privileges to AI systems","type":"control","updatedAt":"2026-09-17T22:28:00Z","url":"/assets/agent_record-ctrl-aiuc-1-b007-151dfcd3.da4b87b9cbb3dbdc.json"},{"attributes":{"category":"administrative","framework":"aiuc-1","type":"preventive"},"canonicalUrl":"https://evidenceflows.com/frameworks/aiuc-1/","description":"Conduct pre-deployment testing","details":{"automation":"hybrid","control_category":"administrative","control_id":"C002","control_type":"preventive","domains":["AI Governance"],"framework":"aiuc-1","group":"Safety","key_control":false,"requirement_frequency":"Every 12 months","requirement_status":"mandatory","risk_count":6,"source_pages":null,"source_url":"https://www.aiuc-1.com/safety/conduct-pre-deployment-testing"},"direct":false,"history":{"digest":"3c57d2624fe106cfb411bde4f5da84fe250b7f170a321d0541d2897ecd560b09","firstSeenAt":"2026-09-17T22:28:00Z","firstSeenRevision":"f368a6cce277037e4b1e1ff46004e3acd295f96c9ac63a411a0e45775a7f468e","updatedAt":"2026-09-17T22:28:00Z","updatedRevision":"f368a6cce277037e4b1e1ff46004e3acd295f96c9ac63a411a0e45775a7f468e"},"htmlUrl":"/agents/records/ctrl-aiuc-1-c002-6c739dcb.html","id":"ctrl:aiuc-1:C002","mapUrl":"https://evidenceflows.com/?v=1&node=ctrl%3Aaiuc-1%3AC002","sourceIds":["aiuc-1"],"sourceUrl":"https://www.aiuc-1.com/safety/conduct-pre-deployment-testing","title":"C002 — Conduct pre-deployment testing","type":"control","updatedAt":"2026-09-17T22:28:00Z","url":"/assets/agent_record-ctrl-aiuc-1-c002-6c739dcb.941e0001440e97d1.json"},{"attributes":{"category":"technical","framework":"aiuc-1","type":"detective"},"canonicalUrl":"https://evidenceflows.com/frameworks/aiuc-1/","description":"Monitor AI risk categories","details":{"automation":"automated","control_category":"technical","control_id":"C008","control_type":"detective","domains":["AI Governance"],"framework":"aiuc-1","group":"Safety","key_control":false,"requirement_frequency":"Every 12 months","requirement_status":"optional","risk_count":6,"source_pages":null,"source_url":"https://www.aiuc-1.com/safety/monitor-ai-risk-categories"},"direct":false,"history":{"digest":"fb675056333dfada6b58f06ece802cf05d8658af29e6524ec5bc0245c215c50a","firstSeenAt":"2026-09-17T22:28:00Z","firstSeenRevision":"f368a6cce277037e4b1e1ff46004e3acd295f96c9ac63a411a0e45775a7f468e","updatedAt":"2026-09-17T22:28:00Z","updatedRevision":"f368a6cce277037e4b1e1ff46004e3acd295f96c9ac63a411a0e45775a7f468e"},"htmlUrl":"/agents/records/ctrl-aiuc-1-c008-94bd64f2.html","id":"ctrl:aiuc-1:C008","mapUrl":"https://evidenceflows.com/?v=1&node=ctrl%3Aaiuc-1%3AC008","sourceIds":["aiuc-1"],"sourceUrl":"https://www.aiuc-1.com/safety/monitor-ai-risk-categories","title":"C008 — Monitor AI risk categories","type":"control","updatedAt":"2026-09-17T22:28:00Z","url":"/assets/agent_record-ctrl-aiuc-1-c008-94bd64f2.ba3c43b2e877cb9e.json"},{"attributes":{"category":"administrative","framework":"aiuc-1","type":"preventive"},"canonicalUrl":"https://evidenceflows.com/frameworks/aiuc-1/","description":"Third-party testing for harmful outputs","details":{"automation":"manual","control_category":"administrative","control_id":"C010","control_type":"preventive","domains":["AI Governance"],"framework":"aiuc-1","group":"Safety","key_control":true,"requirement_frequency":"Every 3 months","requirement_status":"mandatory","risk_count":5,"source_pages":null,"source_url":"https://www.aiuc-1.com/safety/3rd-party-testing-for-harmful-outputs"},"direct":false,"history":{"digest":"93c072654fe84c18d84a04015e3b7f8aab52adccb09c63a39ea7d9ec077d22b3","firstSeenAt":"2026-09-17T22:28:00Z","firstSeenRevision":"f368a6cce277037e4b1e1ff46004e3acd295f96c9ac63a411a0e45775a7f468e","updatedAt":"2026-09-17T22:28:00Z","updatedRevision":"f368a6cce277037e4b1e1ff46004e3acd295f96c9ac63a411a0e45775a7f468e"},"htmlUrl":"/agents/records/ctrl-aiuc-1-c010-b0a758b4.html","id":"ctrl:aiuc-1:C010","mapUrl":"https://evidenceflows.com/?v=1&node=ctrl%3Aaiuc-1%3AC010","sourceIds":["aiuc-1"],"sourceUrl":"https://www.aiuc-1.com/safety/3rd-party-testing-for-harmful-outputs","title":"C010 — Third-party testing for harmful outputs","type":"control","updatedAt":"2026-09-17T22:28:00Z","url":"/assets/agent_record-ctrl-aiuc-1-c010-b0a758b4.8b68f26b8fe69ccb.json"},{"attributes":{"category":"administrative","framework":"aiuc-1","type":"preventive"},"canonicalUrl":"https://evidenceflows.com/frameworks/aiuc-1/","description":"Third-party testing for out-of-scope outputs","details":{"automation":"manual","control_category":"administrative","control_id":"C011","control_type":"preventive","domains":["AI Governance"],"framework":"aiuc-1","group":"Safety","key_control":true,"requirement_frequency":"Every 3 months","requirement_status":"mandatory","risk_count":5,"source_pages":null,"source_url":"https://www.aiuc-1.com/safety/3rd-party-testing-for-out-of-scope-outputs"},"direct":false,"history":{"digest":"d58f7fe0fe69269e1fe6b6dfdb1e629d883aa44e6417ed16dbfb309bde24e472","firstSeenAt":"2026-09-17T22:28:00Z","firstSeenRevision":"f368a6cce277037e4b1e1ff46004e3acd295f96c9ac63a411a0e45775a7f468e","updatedAt":"2026-09-17T22:28:00Z","updatedRevision":"f368a6cce277037e4b1e1ff46004e3acd295f96c9ac63a411a0e45775a7f468e"},"htmlUrl":"/agents/records/ctrl-aiuc-1-c011-7889db41.html","id":"ctrl:aiuc-1:C011","mapUrl":"https://evidenceflows.com/?v=1&node=ctrl%3Aaiuc-1%3AC011","sourceIds":["aiuc-1"],"sourceUrl":"https://www.aiuc-1.com/safety/3rd-party-testing-for-out-of-scope-outputs","title":"C011 — Third-party testing for out-of-scope outputs","type":"control","updatedAt":"2026-09-17T22:28:00Z","url":"/assets/agent_record-ctrl-aiuc-1-c011-7889db41.4cc288c524ea3a49.json"},{"attributes":{"category":"administrative","framework":"aiuc-1","type":"preventive"},"canonicalUrl":"https://evidenceflows.com/frameworks/aiuc-1/","description":"Third-party testing for customer-defined risk","details":{"automation":"manual","control_category":"administrative","control_id":"C012","control_type":"preventive","domains":["AI Governance"],"framework":"aiuc-1","group":"Safety","key_control":true,"requirement_frequency":"Every 3 months","requirement_status":"mandatory","risk_count":5,"source_pages":null,"source_url":"https://www.aiuc-1.com/safety/3rd-party-testing-for-other-risk"},"direct":false,"history":{"digest":"e27684c19b1cb9ef794c16c5fbea92fdc92e3720b85ab7bda5ed18b1022c9603","firstSeenAt":"2026-09-17T22:28:00Z","firstSeenRevision":"f368a6cce277037e4b1e1ff46004e3acd295f96c9ac63a411a0e45775a7f468e","updatedAt":"2026-09-17T22:28:00Z","updatedRevision":"f368a6cce277037e4b1e1ff46004e3acd295f96c9ac63a411a0e45775a7f468e"},"htmlUrl":"/agents/records/ctrl-aiuc-1-c012-783c55df.html","id":"ctrl:aiuc-1:C012","mapUrl":"https://evidenceflows.com/?v=1&node=ctrl%3Aaiuc-1%3AC012","sourceIds":["aiuc-1"],"sourceUrl":"https://www.aiuc-1.com/safety/3rd-party-testing-for-other-risk","title":"C012 — Third-party testing for customer-defined risk","type":"control","updatedAt":"2026-09-17T22:28:00Z","url":"/assets/agent_record-ctrl-aiuc-1-c012-783c55df.16eb92a98daaccb0.json"},{"attributes":{"category":"administrative","framework":"aiuc-1","type":"preventive"},"canonicalUrl":"https://evidenceflows.com/frameworks/aiuc-1/","description":"Third-party testing for hallucinations","details":{"automation":"manual","control_category":"administrative","control_id":"D002","control_type":"preventive","domains":["AI Governance"],"framework":"aiuc-1","group":"Reliability","key_control":true,"requirement_frequency":"Every 3 months","requirement_status":"mandatory","risk_count":5,"source_pages":null,"source_url":"https://www.aiuc-1.com/reliability/3rd-party-testing-for-hallucinations"},"direct":false,"history":{"digest":"101c1b68e971e3defed1adbd5600baf7f583df0525af4ae5e66e37a3c6c4e3f3","firstSeenAt":"2026-09-17T22:28:00Z","firstSeenRevision":"f368a6cce277037e4b1e1ff46004e3acd295f96c9ac63a411a0e45775a7f468e","updatedAt":"2026-09-17T22:28:00Z","updatedRevision":"f368a6cce277037e4b1e1ff46004e3acd295f96c9ac63a411a0e45775a7f468e"},"htmlUrl":"/agents/records/ctrl-aiuc-1-d002-34554b38.html","id":"ctrl:aiuc-1:D002","mapUrl":"https://evidenceflows.com/?v=1&node=ctrl%3Aaiuc-1%3AD002","sourceIds":["aiuc-1"],"sourceUrl":"https://www.aiuc-1.com/reliability/3rd-party-testing-for-hallucinations","title":"D002 — Third-party testing for hallucinations","type":"control","updatedAt":"2026-09-17T22:28:00Z","url":"/assets/agent_record-ctrl-aiuc-1-d002-34554b38.edb0ffec2f39f388.json"},{"attributes":{"category":"administrative","framework":"aiuc-1","type":"preventive"},"canonicalUrl":"https://evidenceflows.com/frameworks/aiuc-1/","description":"Third-party testing of tool calls","details":{"automation":"manual","control_category":"administrative","control_id":"D004","control_type":"preventive","domains":["AI Governance"],"framework":"aiuc-1","group":"Reliability","key_control":true,"requirement_frequency":"Every 3 months","requirement_status":"mandatory","risk_count":5,"source_pages":null,"source_url":"https://www.aiuc-1.com/reliability/3rd-party-testing-of-tool-calls"},"direct":false,"history":{"digest":"e2ab8887ae3a8b6419c3342d94b670c8b67d018364ce2f66fd772f0906a6e91a","firstSeenAt":"2026-09-17T22:28:00Z","firstSeenRevision":"f368a6cce277037e4b1e1ff46004e3acd295f96c9ac63a411a0e45775a7f468e","updatedAt":"2026-09-17T22:28:00Z","updatedRevision":"f368a6cce277037e4b1e1ff46004e3acd295f96c9ac63a411a0e45775a7f468e"},"htmlUrl":"/agents/records/ctrl-aiuc-1-d004-21d4eeb4.html","id":"ctrl:aiuc-1:D004","mapUrl":"https://evidenceflows.com/?v=1&node=ctrl%3Aaiuc-1%3AD004","sourceIds":["aiuc-1"],"sourceUrl":"https://www.aiuc-1.com/reliability/3rd-party-testing-of-tool-calls","title":"D004 — Third-party testing of tool calls","type":"control","updatedAt":"2026-09-17T22:28:00Z","url":"/assets/agent_record-ctrl-aiuc-1-d004-21d4eeb4.b265770723c2fde4.json"},{"attributes":{"category":"technical","framework":"aiuc-1","type":"preventive"},"canonicalUrl":"https://evidenceflows.com/frameworks/aiuc-1/","description":"Monitor third-party access","details":{"automation":"automated","control_category":"technical","control_id":"E009","control_type":"preventive","domains":["AI Governance","Governance, Policy & Oversight"],"framework":"aiuc-1","group":"Accountability","key_control":false,"requirement_frequency":"Every 12 months","requirement_status":"mandatory","risk_count":4,"source_pages":null,"source_url":"https://www.aiuc-1.com/accountability/monitor-3rd-party-access"},"direct":false,"history":{"digest":"c15f9adb151a1be8cc18001cc73d8162fd0179dbb00448cee58bc5f10cae7f00","firstSeenAt":"2026-09-17T22:28:00Z","firstSeenRevision":"f368a6cce277037e4b1e1ff46004e3acd295f96c9ac63a411a0e45775a7f468e","updatedAt":"2026-09-17T22:28:00Z","updatedRevision":"f368a6cce277037e4b1e1ff46004e3acd295f96c9ac63a411a0e45775a7f468e"},"htmlUrl":"/agents/records/ctrl-aiuc-1-e009-5269a385.html","id":"ctrl:aiuc-1:E009","mapUrl":"https://evidenceflows.com/?v=1&node=ctrl%3Aaiuc-1%3AE009","sourceIds":["aiuc-1"],"sourceUrl":"https://www.aiuc-1.com/accountability/monitor-3rd-party-access","title":"E009 — Monitor third-party access","type":"control","updatedAt":"2026-09-17T22:28:00Z","url":"/assets/agent_record-ctrl-aiuc-1-e009-5269a385.edee2a0d7d1b46e2.json"},{"attributes":{"category":"technical","framework":"aiuc-1","type":"detective"},"canonicalUrl":"https://evidenceflows.com/frameworks/aiuc-1/","description":"Log AI system activity","details":{"automation":"automated","control_category":"technical","control_id":"E015","control_type":"detective","domains":["AI Governance","Governance, Policy & Oversight"],"framework":"aiuc-1","group":"Accountability","key_control":false,"requirement_frequency":"Every 12 months","requirement_status":"mandatory","risk_count":6,"source_pages":null,"source_url":"https://www.aiuc-1.com/accountability/log-model-activity"},"direct":false,"history":{"digest":"a380d2122c453c5704342b45ba204c9e5e5703099c9dacb20d2bfe41b0a77406","firstSeenAt":"2026-09-17T22:28:00Z","firstSeenRevision":"f368a6cce277037e4b1e1ff46004e3acd295f96c9ac63a411a0e45775a7f468e","updatedAt":"2026-09-17T22:28:00Z","updatedRevision":"f368a6cce277037e4b1e1ff46004e3acd295f96c9ac63a411a0e45775a7f468e"},"htmlUrl":"/agents/records/ctrl-aiuc-1-e015-94a0c8ea.html","id":"ctrl:aiuc-1:E015","mapUrl":"https://evidenceflows.com/?v=1&node=ctrl%3Aaiuc-1%3AE015","sourceIds":["aiuc-1"],"sourceUrl":"https://www.aiuc-1.com/accountability/log-model-activity","title":"E015 — Log AI system activity","type":"control","updatedAt":"2026-09-17T22:28:00Z","url":"/assets/agent_record-ctrl-aiuc-1-e015-94a0c8ea.aafa4b04d3d12698.json"},{"attributes":{"category":"administrative","framework":"cobit-2019","type":"corrective"},"canonicalUrl":"https://evidenceflows.com/frameworks/cobit-2019/","description":"Managed Service Requests and Incidents","details":{"automation":"hybrid","control_category":"administrative","control_id":"DSS02","control_type":"corrective","domains":["Business Continuity & Disaster Recovery","Incident Management & Response","Logging, Monitoring & Detection","Governance, Policy & Oversight"],"framework":"cobit-2019","group":"Deliver, Service and Support","key_control":false,"requirement_frequency":null,"requirement_status":null,"risk_count":5,"source_pages":null,"source_url":null},"direct":false,"history":{"digest":"c3054225f389c70198634f35abc5bcb285cc678d294252b2560d75044c7532bc","firstSeenAt":"2026-09-17T22:28:00Z","firstSeenRevision":"f368a6cce277037e4b1e1ff46004e3acd295f96c9ac63a411a0e45775a7f468e","updatedAt":"2026-09-17T22:28:00Z","updatedRevision":"f368a6cce277037e4b1e1ff46004e3acd295f96c9ac63a411a0e45775a7f468e"},"htmlUrl":"/agents/records/ctrl-cobit-2019-dss02-af5bca5d.html","id":"ctrl:cobit-2019:DSS02","mapUrl":"https://evidenceflows.com/?v=1&node=ctrl%3Acobit-2019%3ADSS02","sourceIds":["cobit-2019"],"sourceUrl":null,"title":"DSS02 — Managed Service Requests and Incidents","type":"control","updatedAt":"2026-09-17T22:28:00Z","url":"/assets/agent_record-ctrl-cobit-2019-dss02-af5bca5d.d9218a4b31c470e5.json"},{"attributes":{"category":"administrative","framework":"cobit-2019","type":"corrective"},"canonicalUrl":"https://evidenceflows.com/frameworks/cobit-2019/","description":"Managed Problems","details":{"automation":"manual","control_category":"administrative","control_id":"DSS03","control_type":"corrective","domains":["Business Continuity & Disaster Recovery","Incident Management & Response","Logging, Monitoring & Detection","Governance, Policy & Oversight"],"framework":"cobit-2019","group":"Deliver, Service and Support","key_control":false,"requirement_frequency":null,"requirement_status":null,"risk_count":5,"source_pages":null,"source_url":null},"direct":false,"history":{"digest":"fa94651cd7f34385dcdc64403e2f31ff96cd2d85f63dea62616c5c909067406a","firstSeenAt":"2026-09-17T22:28:00Z","firstSeenRevision":"f368a6cce277037e4b1e1ff46004e3acd295f96c9ac63a411a0e45775a7f468e","updatedAt":"2026-09-17T22:28:00Z","updatedRevision":"f368a6cce277037e4b1e1ff46004e3acd295f96c9ac63a411a0e45775a7f468e"},"htmlUrl":"/agents/records/ctrl-cobit-2019-dss03-2540740f.html","id":"ctrl:cobit-2019:DSS03","mapUrl":"https://evidenceflows.com/?v=1&node=ctrl%3Acobit-2019%3ADSS03","sourceIds":["cobit-2019"],"sourceUrl":null,"title":"DSS03 — Managed Problems","type":"control","updatedAt":"2026-09-17T22:28:00Z","url":"/assets/agent_record-ctrl-cobit-2019-dss03-2540740f.3bd6a028b224e2af.json"},{"attributes":{"category":"technical","framework":"cobit-2019","type":"preventive"},"canonicalUrl":"https://evidenceflows.com/frameworks/cobit-2019/","description":"Managed Security Services","details":{"automation":"hybrid","control_category":"technical","control_id":"DSS05","control_type":"preventive","domains":["Business Continuity & Disaster Recovery","Incident Management & Response","Logging, Monitoring & Detection","Governance, Policy & Oversight"],"framework":"cobit-2019","group":"Deliver, Service and Support","key_control":true,"requirement_frequency":null,"requirement_status":null,"risk_count":5,"source_pages":null,"source_url":null},"direct":false,"history":{"digest":"bd7c76335ff833ec1c9f5de47cb36168b025e89829d163b3ae1efe539eccc45d","firstSeenAt":"2026-09-17T22:28:00Z","firstSeenRevision":"f368a6cce277037e4b1e1ff46004e3acd295f96c9ac63a411a0e45775a7f468e","updatedAt":"2026-09-17T22:28:00Z","updatedRevision":"f368a6cce277037e4b1e1ff46004e3acd295f96c9ac63a411a0e45775a7f468e"},"htmlUrl":"/agents/records/ctrl-cobit-2019-dss05-80cfe6d8.html","id":"ctrl:cobit-2019:DSS05","mapUrl":"https://evidenceflows.com/?v=1&node=ctrl%3Acobit-2019%3ADSS05","sourceIds":["cobit-2019"],"sourceUrl":null,"title":"DSS05 — Managed Security Services","type":"control","updatedAt":"2026-09-17T22:28:00Z","url":"/assets/agent_record-ctrl-cobit-2019-dss05-80cfe6d8.99e95f4288e74e9f.json"},{"attributes":{"category":"administrative","framework":"coso-ic","type":"preventive"},"canonicalUrl":"https://evidenceflows.com/frameworks/coso-ic/","description":"The organization identifies risks to the achievement of its objectives across the entity and analyzes risks as a basis for determining how the risks should be managed.","details":{"automation":"manual","control_category":"administrative","control_id":"P7","control_type":"preventive","domains":["AI Governance","Risk Assessment & Management","Third-Party / Supply-Chain Risk"],"framework":"coso-ic","group":"Risk Assessment","key_control":false,"requirement_frequency":null,"requirement_status":null,"risk_count":3,"source_pages":null,"source_url":null},"direct":false,"history":{"digest":"658f5ea94c87fa86b06d7360e09e2d2774d56e29bb56e7224d0fdb512a7c42d7","firstSeenAt":"2026-09-17T22:28:00Z","firstSeenRevision":"f368a6cce277037e4b1e1ff46004e3acd295f96c9ac63a411a0e45775a7f468e","updatedAt":"2026-09-17T22:28:00Z","updatedRevision":"f368a6cce277037e4b1e1ff46004e3acd295f96c9ac63a411a0e45775a7f468e"},"htmlUrl":"/agents/records/ctrl-coso-ic-p7-a272f700.html","id":"ctrl:coso-ic:P7","mapUrl":"https://evidenceflows.com/?v=1&node=ctrl%3Acoso-ic%3AP7","sourceIds":["coso-ic"],"sourceUrl":null,"title":"P7 — The organization identifies risks to the achievement of its objectives across the entity and analyzes risks as a basis for determining how the risks should be managed.","type":"control","updatedAt":"2026-09-17T22:28:00Z","url":"/assets/agent_record-ctrl-coso-ic-p7-a272f700.74d7887d1c27725f.json"},{"attributes":{"category":"administrative","framework":"dora","type":"corrective"},"canonicalUrl":"https://evidenceflows.com/frameworks/dora/","description":"ICT-related incident management, classification and reporting","details":{"automation":"hybrid","control_category":"administrative","control_id":"DORA-Art17-23","control_type":"corrective","domains":["Business Continuity & Disaster Recovery","Incident Management & Response","Third-Party / Supply-Chain Risk","Governance, Policy & Oversight","Risk Assessment & Management"],"framework":"dora","group":"EU DORA (Digital Operational Resilience Act)","key_control":true,"requirement_frequency":null,"requirement_status":null,"risk_count":5,"source_pages":null,"source_url":null},"direct":false,"history":{"digest":"c6a2f613c020e4b6214e9cffde4361a389808573bab1613b6d11f598c6ab0a99","firstSeenAt":"2026-09-17T22:28:00Z","firstSeenRevision":"f368a6cce277037e4b1e1ff46004e3acd295f96c9ac63a411a0e45775a7f468e","updatedAt":"2026-09-17T22:28:00Z","updatedRevision":"f368a6cce277037e4b1e1ff46004e3acd295f96c9ac63a411a0e45775a7f468e"},"htmlUrl":"/agents/records/ctrl-dora-dora-art17-23-9aa7977f.html","id":"ctrl:dora:DORA-Art17-23","mapUrl":"https://evidenceflows.com/?v=1&node=ctrl%3Adora%3ADORA-Art17-23","sourceIds":["dora"],"sourceUrl":null,"title":"DORA-Art17-23 — ICT-related incident management, classification and reporting","type":"control","updatedAt":"2026-09-17T22:28:00Z","url":"/assets/agent_record-ctrl-dora-dora-art17-23-9aa7977f.0916c3b4c498fa50.json"},{"attributes":{"category":"technical","framework":"dora","type":"detective"},"canonicalUrl":"https://evidenceflows.com/frameworks/dora/","description":"Digital operational resilience testing (incl. threat-led penetration testing)","details":{"automation":"hybrid","control_category":"technical","control_id":"DORA-Art24-27","control_type":"detective","domains":["Business Continuity & Disaster Recovery","Incident Management & Response","Third-Party / Supply-Chain Risk","Governance, Policy & Oversight","Risk Assessment & Management"],"framework":"dora","group":"EU DORA (Digital Operational Resilience Act)","key_control":false,"requirement_frequency":null,"requirement_status":null,"risk_count":3,"source_pages":null,"source_url":null},"direct":false,"history":{"digest":"c7af532da3496808b32edc83e5e96ac4cc064445c70ea9d9c129bcda8d699de0","firstSeenAt":"2026-09-17T22:28:00Z","firstSeenRevision":"f368a6cce277037e4b1e1ff46004e3acd295f96c9ac63a411a0e45775a7f468e","updatedAt":"2026-09-17T22:28:00Z","updatedRevision":"f368a6cce277037e4b1e1ff46004e3acd295f96c9ac63a411a0e45775a7f468e"},"htmlUrl":"/agents/records/ctrl-dora-dora-art24-27-dc4b8836.html","id":"ctrl:dora:DORA-Art24-27","mapUrl":"https://evidenceflows.com/?v=1&node=ctrl%3Adora%3ADORA-Art24-27","sourceIds":["dora"],"sourceUrl":null,"title":"DORA-Art24-27 — Digital operational resilience testing (incl. threat-led penetration testing)","type":"control","updatedAt":"2026-09-17T22:28:00Z","url":"/assets/agent_record-ctrl-dora-dora-art24-27-dc4b8836.47f9ab68eb7c7509.json"},{"attributes":{"category":"technical","framework":"eu-ai-act","type":"detective"},"canonicalUrl":"https://evidenceflows.com/frameworks/eu-ai-act/","description":"Record-keeping / logging (high-risk)","details":{"automation":"automated","control_category":"technical","control_id":"AIA-Art12","control_type":"detective","domains":["AI Governance","Risk Assessment & Management","Governance, Policy & Oversight"],"framework":"eu-ai-act","group":"EU AI Act","key_control":true,"requirement_frequency":null,"requirement_status":null,"risk_count":6,"source_pages":null,"source_url":null},"direct":false,"history":{"digest":"d0fb66c6019545f481f53795e741039107de3dfa5e93675847840e8363588e6e","firstSeenAt":"2026-09-17T22:28:00Z","firstSeenRevision":"f368a6cce277037e4b1e1ff46004e3acd295f96c9ac63a411a0e45775a7f468e","updatedAt":"2026-09-17T22:28:00Z","updatedRevision":"f368a6cce277037e4b1e1ff46004e3acd295f96c9ac63a411a0e45775a7f468e"},"htmlUrl":"/agents/records/ctrl-eu-ai-act-aia-art12-3714b8af.html","id":"ctrl:eu-ai-act:AIA-Art12","mapUrl":"https://evidenceflows.com/?v=1&node=ctrl%3Aeu-ai-act%3AAIA-Art12","sourceIds":["eu-ai-act"],"sourceUrl":null,"title":"AIA-Art12 — Record-keeping / logging (high-risk)","type":"control","updatedAt":"2026-09-17T22:28:00Z","url":"/assets/agent_record-ctrl-eu-ai-act-aia-art12-3714b8af.01c087b5bc1cab53.json"},{"attributes":{"category":"technical","framework":"eu-ai-act","type":"detective"},"canonicalUrl":"https://evidenceflows.com/frameworks/eu-ai-act/","description":"Automatically generated logs — provider retention of high-risk system logs (minimum six months)","details":{"automation":"automated","control_category":"technical","control_id":"AIA-Art19","control_type":"detective","domains":["AI Governance","Risk Assessment & Management","Governance, Policy & Oversight"],"framework":"eu-ai-act","group":"EU AI Act","key_control":false,"requirement_frequency":null,"requirement_status":null,"risk_count":6,"source_pages":null,"source_url":null},"direct":false,"history":{"digest":"2f4f9dcf82da6159d54bdfc5b8fb54237d4b4067875384a5c05bb11eb65685b6","firstSeenAt":"2026-09-17T22:28:00Z","firstSeenRevision":"f368a6cce277037e4b1e1ff46004e3acd295f96c9ac63a411a0e45775a7f468e","updatedAt":"2026-09-17T22:28:00Z","updatedRevision":"f368a6cce277037e4b1e1ff46004e3acd295f96c9ac63a411a0e45775a7f468e"},"htmlUrl":"/agents/records/ctrl-eu-ai-act-aia-art19-55451bfa.html","id":"ctrl:eu-ai-act:AIA-Art19","mapUrl":"https://evidenceflows.com/?v=1&node=ctrl%3Aeu-ai-act%3AAIA-Art19","sourceIds":["eu-ai-act"],"sourceUrl":null,"title":"AIA-Art19 — Automatically generated logs — provider retention of high-risk system logs (minimum six months)","type":"control","updatedAt":"2026-09-17T22:28:00Z","url":"/assets/agent_record-ctrl-eu-ai-act-aia-art19-55451bfa.81913c17d2ad7ff9.json"},{"attributes":{"category":"administrative","framework":"eu-ai-act","type":"detective"},"canonicalUrl":"https://evidenceflows.com/frameworks/eu-ai-act/","description":"Post-market monitoring by providers of high-risk AI systems","details":{"automation":"hybrid","control_category":"administrative","control_id":"AIA-Art72","control_type":"detective","domains":["AI Governance","Risk Assessment & Management","Governance, Policy & Oversight"],"framework":"eu-ai-act","group":"EU AI Act","key_control":false,"requirement_frequency":null,"requirement_status":null,"risk_count":6,"source_pages":null,"source_url":null},"direct":false,"history":{"digest":"80e184d7af206f36e27996ac744b0f6a370a951906158f2acb95f8b376016919","firstSeenAt":"2026-09-17T22:28:00Z","firstSeenRevision":"f368a6cce277037e4b1e1ff46004e3acd295f96c9ac63a411a0e45775a7f468e","updatedAt":"2026-09-17T22:28:00Z","updatedRevision":"f368a6cce277037e4b1e1ff46004e3acd295f96c9ac63a411a0e45775a7f468e"},"htmlUrl":"/agents/records/ctrl-eu-ai-act-aia-art72-2866ca15.html","id":"ctrl:eu-ai-act:AIA-Art72","mapUrl":"https://evidenceflows.com/?v=1&node=ctrl%3Aeu-ai-act%3AAIA-Art72","sourceIds":["eu-ai-act"],"sourceUrl":null,"title":"AIA-Art72 — Post-market monitoring by providers of high-risk AI systems","type":"control","updatedAt":"2026-09-17T22:28:00Z","url":"/assets/agent_record-ctrl-eu-ai-act-aia-art72-2866ca15.fda72f65f19635df.json"},{"attributes":{"category":"technical","framework":"gdpr","type":"preventive"},"canonicalUrl":"https://evidenceflows.com/frameworks/gdpr/","description":"Security of processing","details":{"automation":"hybrid","control_category":"technical","control_id":"GDPR-Art32","control_type":"preventive","domains":["Data Protection & Privacy","Governance, Policy & Oversight","Incident Management & Response","Third-Party / Supply-Chain Risk","Risk Assessment & Management"],"framework":"gdpr","group":"EU GDPR","key_control":true,"requirement_frequency":null,"requirement_status":null,"risk_count":4,"source_pages":null,"source_url":null},"direct":false,"history":{"digest":"1627306c12b85904daf2e0a700770088bb77cd949d85dcb20895d6366be7eece","firstSeenAt":"2026-09-17T22:28:00Z","firstSeenRevision":"f368a6cce277037e4b1e1ff46004e3acd295f96c9ac63a411a0e45775a7f468e","updatedAt":"2026-09-17T22:28:00Z","updatedRevision":"f368a6cce277037e4b1e1ff46004e3acd295f96c9ac63a411a0e45775a7f468e"},"htmlUrl":"/agents/records/ctrl-gdpr-gdpr-art32-63aa3290.html","id":"ctrl:gdpr:GDPR-Art32","mapUrl":"https://evidenceflows.com/?v=1&node=ctrl%3Agdpr%3AGDPR-Art32","sourceIds":["gdpr"],"sourceUrl":null,"title":"GDPR-Art32 — Security of processing","type":"control","updatedAt":"2026-09-17T22:28:00Z","url":"/assets/agent_record-ctrl-gdpr-gdpr-art32-63aa3290.89a507d9ff525dd0.json"},{"attributes":{"category":"administrative","framework":"gdpr","type":"corrective"},"canonicalUrl":"https://evidenceflows.com/frameworks/gdpr/","description":"Notification of a personal data breach to the supervisory authority","details":{"automation":"manual","control_category":"administrative","control_id":"GDPR-Art33","control_type":"corrective","domains":["Data Protection & Privacy","Governance, Policy & Oversight","Incident Management & Response","Third-Party / Supply-Chain Risk","Risk Assessment & Management"],"framework":"gdpr","group":"EU GDPR","key_control":true,"requirement_frequency":null,"requirement_status":null,"risk_count":3,"source_pages":null,"source_url":null},"direct":false,"history":{"digest":"c90e0c16694b017ab54f7ad74842a96807b7cb7749a84081c037484df9781bc3","firstSeenAt":"2026-09-17T22:28:00Z","firstSeenRevision":"f368a6cce277037e4b1e1ff46004e3acd295f96c9ac63a411a0e45775a7f468e","updatedAt":"2026-09-17T22:28:00Z","updatedRevision":"f368a6cce277037e4b1e1ff46004e3acd295f96c9ac63a411a0e45775a7f468e"},"htmlUrl":"/agents/records/ctrl-gdpr-gdpr-art33-a2a440c2.html","id":"ctrl:gdpr:GDPR-Art33","mapUrl":"https://evidenceflows.com/?v=1&node=ctrl%3Agdpr%3AGDPR-Art33","sourceIds":["gdpr"],"sourceUrl":null,"title":"GDPR-Art33 — Notification of a personal data breach to the supervisory authority","type":"control","updatedAt":"2026-09-17T22:28:00Z","url":"/assets/agent_record-ctrl-gdpr-gdpr-art33-a2a440c2.7d4334c70de357ae.json"},{"attributes":{"category":"administrative","framework":"gdpr","type":"preventive"},"canonicalUrl":"https://evidenceflows.com/frameworks/gdpr/","description":"International transfers of personal data","details":{"automation":"manual","control_category":"administrative","control_id":"GDPR-Art44-49","control_type":"preventive","domains":["Data Protection & Privacy","Governance, Policy & Oversight","Incident Management & Response","Third-Party / Supply-Chain Risk","Risk Assessment & Management"],"framework":"gdpr","group":"EU GDPR","key_control":false,"requirement_frequency":null,"requirement_status":null,"risk_count":5,"source_pages":null,"source_url":null},"direct":false,"history":{"digest":"8729a5e6219293f4530177c7a5bf36abdb1ae2e43c0c72b3ed59b35869b89e51","firstSeenAt":"2026-09-17T22:28:00Z","firstSeenRevision":"f368a6cce277037e4b1e1ff46004e3acd295f96c9ac63a411a0e45775a7f468e","updatedAt":"2026-09-17T22:28:00Z","updatedRevision":"f368a6cce277037e4b1e1ff46004e3acd295f96c9ac63a411a0e45775a7f468e"},"htmlUrl":"/agents/records/ctrl-gdpr-gdpr-art44-49-8ad28202.html","id":"ctrl:gdpr:GDPR-Art44-49","mapUrl":"https://evidenceflows.com/?v=1&node=ctrl%3Agdpr%3AGDPR-Art44-49","sourceIds":["gdpr"],"sourceUrl":null,"title":"GDPR-Art44-49 — International transfers of personal data","type":"control","updatedAt":"2026-09-17T22:28:00Z","url":"/assets/agent_record-ctrl-gdpr-gdpr-art44-49-8ad28202.98bd0c68101c83d9.json"},{"attributes":{"category":"technical","framework":"hipaa","type":"preventive"},"canonicalUrl":"https://evidenceflows.com/frameworks/hipaa/","description":"Technical access control for ePHI (unique user ID, emergency access, automatic logoff, encryption/decryption)","details":{"automation":"hybrid","control_category":"technical","control_id":"HIPAA-164.312(a)","control_type":"preventive","domains":["Governance, Policy & Oversight","Risk Assessment & Management","Access Control & Identity Management","Physical & Environmental Security","Logging, Monitoring & Detection","Business Continuity & Disaster Recovery","Third-Party / Supply-Chain Risk","Data Protection & Privacy"],"framework":"hipaa","group":"HIPAA Security Rule","key_control":false,"requirement_frequency":null,"requirement_status":null,"risk_count":4,"source_pages":null,"source_url":null},"direct":false,"history":{"digest":"7be1255ff2e651d073f530fd245f3b119f3dbcb3b983f549e29db54bda75c8d5","firstSeenAt":"2026-09-17T22:28:00Z","firstSeenRevision":"f368a6cce277037e4b1e1ff46004e3acd295f96c9ac63a411a0e45775a7f468e","updatedAt":"2026-09-17T22:28:00Z","updatedRevision":"f368a6cce277037e4b1e1ff46004e3acd295f96c9ac63a411a0e45775a7f468e"},"htmlUrl":"/agents/records/ctrl-hipaa-hipaa-164-312-a-5c8bb707.html","id":"ctrl:hipaa:HIPAA-164.312(a)","mapUrl":"https://evidenceflows.com/?v=1&node=ctrl%3Ahipaa%3AHIPAA-164.312%28a%29","sourceIds":["hipaa"],"sourceUrl":null,"title":"HIPAA-164.312(a) — Technical access control for ePHI (unique user ID, emergency access, automatic logoff, encryption/decryption)","type":"control","updatedAt":"2026-09-17T22:28:00Z","url":"/assets/agent_record-ctrl-hipaa-hipaa-164-312-a-5c8bb707.9e205e9309455ab5.json"},{"attributes":{"category":"technical","framework":"hipaa","type":"detective"},"canonicalUrl":"https://evidenceflows.com/frameworks/hipaa/","description":"Audit controls recording activity in systems with ePHI","details":{"automation":"automated","control_category":"technical","control_id":"HIPAA-164.312(b)","control_type":"detective","domains":["Governance, Policy & Oversight","Risk Assessment & Management","Access Control & Identity Management","Physical & Environmental Security","Logging, Monitoring & Detection","Business Continuity & Disaster Recovery","Third-Party / Supply-Chain Risk","Data Protection & Privacy"],"framework":"hipaa","group":"HIPAA Security Rule","key_control":false,"requirement_frequency":null,"requirement_status":null,"risk_count":4,"source_pages":null,"source_url":null},"direct":false,"history":{"digest":"5ffd291b69b68006a2009bebd7ad6d3393111b9ae3ca2772142fbd238b5b00d6","firstSeenAt":"2026-09-17T22:28:00Z","firstSeenRevision":"f368a6cce277037e4b1e1ff46004e3acd295f96c9ac63a411a0e45775a7f468e","updatedAt":"2026-09-17T22:28:00Z","updatedRevision":"f368a6cce277037e4b1e1ff46004e3acd295f96c9ac63a411a0e45775a7f468e"},"htmlUrl":"/agents/records/ctrl-hipaa-hipaa-164-312-b-7272303c.html","id":"ctrl:hipaa:HIPAA-164.312(b)","mapUrl":"https://evidenceflows.com/?v=1&node=ctrl%3Ahipaa%3AHIPAA-164.312%28b%29","sourceIds":["hipaa"],"sourceUrl":null,"title":"HIPAA-164.312(b) — Audit controls recording activity in systems with ePHI","type":"control","updatedAt":"2026-09-17T22:28:00Z","url":"/assets/agent_record-ctrl-hipaa-hipaa-164-312-b-7272303c.c3289378a5db086a.json"},{"attributes":{"category":"administrative","framework":"iso-27001","type":"preventive"},"canonicalUrl":"https://evidenceflows.com/frameworks/iso-27001/","description":"Access control","details":{"automation":"hybrid","control_category":"administrative","control_id":"A.5.15","control_type":"preventive","domains":["Access Control & Identity Management"],"framework":"iso-27001","group":"Organizational controls","key_control":true,"requirement_frequency":null,"requirement_status":null,"risk_count":7,"source_pages":null,"source_url":null},"direct":false,"history":{"digest":"900a70b54311d1516a5d8e21d6954b7084bba1721676be6b8dfb066794ed9daa","firstSeenAt":"2026-09-17T22:28:00Z","firstSeenRevision":"f368a6cce277037e4b1e1ff46004e3acd295f96c9ac63a411a0e45775a7f468e","updatedAt":"2026-09-17T22:28:00Z","updatedRevision":"f368a6cce277037e4b1e1ff46004e3acd295f96c9ac63a411a0e45775a7f468e"},"htmlUrl":"/agents/records/ctrl-iso-27001-a-5-15-b8587804.html","id":"ctrl:iso-27001:A.5.15","mapUrl":"https://evidenceflows.com/?v=1&node=ctrl%3Aiso-27001%3AA.5.15","sourceIds":["iso-27001"],"sourceUrl":null,"title":"A.5.15 — Access control","type":"control","updatedAt":"2026-09-17T22:28:00Z","url":"/assets/agent_record-ctrl-iso-27001-a-5-15-b8587804.20a78268272b541c.json"},{"attributes":{"category":"administrative","framework":"iso-27001","type":"preventive"},"canonicalUrl":"https://evidenceflows.com/frameworks/iso-27001/","description":"Identity management","details":{"automation":"hybrid","control_category":"administrative","control_id":"A.5.16","control_type":"preventive","domains":["Access Control & Identity Management"],"framework":"iso-27001","group":"Organizational controls","key_control":true,"requirement_frequency":null,"requirement_status":null,"risk_count":3,"source_pages":null,"source_url":null},"direct":false,"history":{"digest":"5a97c55252ea5be5ededf5e91800282dbebef07a1a4203edab23d5f91c6277cd","firstSeenAt":"2026-09-17T22:28:00Z","firstSeenRevision":"f368a6cce277037e4b1e1ff46004e3acd295f96c9ac63a411a0e45775a7f468e","updatedAt":"2026-09-17T22:28:00Z","updatedRevision":"f368a6cce277037e4b1e1ff46004e3acd295f96c9ac63a411a0e45775a7f468e"},"htmlUrl":"/agents/records/ctrl-iso-27001-a-5-16-46fc8420.html","id":"ctrl:iso-27001:A.5.16","mapUrl":"https://evidenceflows.com/?v=1&node=ctrl%3Aiso-27001%3AA.5.16","sourceIds":["iso-27001"],"sourceUrl":null,"title":"A.5.16 — Identity management","type":"control","updatedAt":"2026-09-17T22:28:00Z","url":"/assets/agent_record-ctrl-iso-27001-a-5-16-46fc8420.d585853b903b920b.json"},{"attributes":{"category":"administrative","framework":"iso-27001","type":"preventive"},"canonicalUrl":"https://evidenceflows.com/frameworks/iso-27001/","description":"Authentication information","details":{"automation":"hybrid","control_category":"administrative","control_id":"A.5.17","control_type":"preventive","domains":["Access Control & Identity Management"],"framework":"iso-27001","group":"Organizational controls","key_control":true,"requirement_frequency":null,"requirement_status":null,"risk_count":4,"source_pages":null,"source_url":null},"direct":false,"history":{"digest":"a55c002a8a165ef7860c12306fa601cc94f8b3863fc43459b2556bd7209c35a8","firstSeenAt":"2026-09-17T22:28:00Z","firstSeenRevision":"f368a6cce277037e4b1e1ff46004e3acd295f96c9ac63a411a0e45775a7f468e","updatedAt":"2026-09-17T22:28:00Z","updatedRevision":"f368a6cce277037e4b1e1ff46004e3acd295f96c9ac63a411a0e45775a7f468e"},"htmlUrl":"/agents/records/ctrl-iso-27001-a-5-17-b45de021.html","id":"ctrl:iso-27001:A.5.17","mapUrl":"https://evidenceflows.com/?v=1&node=ctrl%3Aiso-27001%3AA.5.17","sourceIds":["iso-27001"],"sourceUrl":null,"title":"A.5.17 — Authentication information","type":"control","updatedAt":"2026-09-17T22:28:00Z","url":"/assets/agent_record-ctrl-iso-27001-a-5-17-b45de021.c5c2ccf484325097.json"},{"attributes":{"category":"administrative","framework":"iso-27001","type":"preventive"},"canonicalUrl":"https://evidenceflows.com/frameworks/iso-27001/","description":"Access rights","details":{"automation":"hybrid","control_category":"administrative","control_id":"A.5.18","control_type":"preventive","domains":["Access Control & Identity Management"],"framework":"iso-27001","group":"Organizational controls","key_control":true,"requirement_frequency":null,"requirement_status":null,"risk_count":4,"source_pages":null,"source_url":null},"direct":false,"history":{"digest":"13fc8b90922c39bf4704bfd1de15df15834512e9e91f8f8d03aa01d7771a4786","firstSeenAt":"2026-09-17T22:28:00Z","firstSeenRevision":"f368a6cce277037e4b1e1ff46004e3acd295f96c9ac63a411a0e45775a7f468e","updatedAt":"2026-09-17T22:28:00Z","updatedRevision":"f368a6cce277037e4b1e1ff46004e3acd295f96c9ac63a411a0e45775a7f468e"},"htmlUrl":"/agents/records/ctrl-iso-27001-a-5-18-472ef6f1.html","id":"ctrl:iso-27001:A.5.18","mapUrl":"https://evidenceflows.com/?v=1&node=ctrl%3Aiso-27001%3AA.5.18","sourceIds":["iso-27001"],"sourceUrl":null,"title":"A.5.18 — Access rights","type":"control","updatedAt":"2026-09-17T22:28:00Z","url":"/assets/agent_record-ctrl-iso-27001-a-5-18-472ef6f1.ec0da2c7a676c550.json"},{"attributes":{"category":"administrative","framework":"iso-27001","type":"detective"},"canonicalUrl":"https://evidenceflows.com/frameworks/iso-27001/","description":"Assessment and decision on information security events","details":{"automation":"manual","control_category":"administrative","control_id":"A.5.25","control_type":"detective","domains":["Incident Management & Response"],"framework":"iso-27001","group":"Organizational controls","key_control":false,"requirement_frequency":null,"requirement_status":null,"risk_count":3,"source_pages":null,"source_url":null},"direct":false,"history":{"digest":"ddf620cdb578ea9124600bf474c2822d3e98723af7f4883ffd147329b142e99a","firstSeenAt":"2026-09-17T22:28:00Z","firstSeenRevision":"f368a6cce277037e4b1e1ff46004e3acd295f96c9ac63a411a0e45775a7f468e","updatedAt":"2026-09-17T22:28:00Z","updatedRevision":"f368a6cce277037e4b1e1ff46004e3acd295f96c9ac63a411a0e45775a7f468e"},"htmlUrl":"/agents/records/ctrl-iso-27001-a-5-25-7dc7a20c.html","id":"ctrl:iso-27001:A.5.25","mapUrl":"https://evidenceflows.com/?v=1&node=ctrl%3Aiso-27001%3AA.5.25","sourceIds":["iso-27001"],"sourceUrl":null,"title":"A.5.25 — Assessment and decision on information security events","type":"control","updatedAt":"2026-09-17T22:28:00Z","url":"/assets/agent_record-ctrl-iso-27001-a-5-25-7dc7a20c.0df11ded12d141b3.json"},{"attributes":{"category":"administrative","framework":"iso-27001","type":"corrective"},"canonicalUrl":"https://evidenceflows.com/frameworks/iso-27001/","description":"Response to information security incidents","details":{"automation":"manual","control_category":"administrative","control_id":"A.5.26","control_type":"corrective","domains":["Incident Management & Response"],"framework":"iso-27001","group":"Organizational controls","key_control":false,"requirement_frequency":null,"requirement_status":null,"risk_count":3,"source_pages":null,"source_url":null},"direct":false,"history":{"digest":"90f028b1e9a8b9ebc8f8913899dc4857e9d47fc3ee41840fa48d2d02c18c3779","firstSeenAt":"2026-09-17T22:28:00Z","firstSeenRevision":"f368a6cce277037e4b1e1ff46004e3acd295f96c9ac63a411a0e45775a7f468e","updatedAt":"2026-09-17T22:28:00Z","updatedRevision":"f368a6cce277037e4b1e1ff46004e3acd295f96c9ac63a411a0e45775a7f468e"},"htmlUrl":"/agents/records/ctrl-iso-27001-a-5-26-863e832e.html","id":"ctrl:iso-27001:A.5.26","mapUrl":"https://evidenceflows.com/?v=1&node=ctrl%3Aiso-27001%3AA.5.26","sourceIds":["iso-27001"],"sourceUrl":null,"title":"A.5.26 — Response to information security incidents","type":"control","updatedAt":"2026-09-17T22:28:00Z","url":"/assets/agent_record-ctrl-iso-27001-a-5-26-863e832e.b78f1bf7e43d7bb6.json"},{"attributes":{"category":"administrative","framework":"iso-27001","type":"corrective"},"canonicalUrl":"https://evidenceflows.com/frameworks/iso-27001/","description":"Collection of evidence","details":{"automation":"manual","control_category":"administrative","control_id":"A.5.28","control_type":"corrective","domains":["Incident Management & Response"],"framework":"iso-27001","group":"Organizational controls","key_control":false,"requirement_frequency":null,"requirement_status":null,"risk_count":2,"source_pages":null,"source_url":null},"direct":false,"history":{"digest":"66d61e45cbee66bf96de828218cfeedf7209de7c4f6d440d0080f4635c860a49","firstSeenAt":"2026-09-17T22:28:00Z","firstSeenRevision":"f368a6cce277037e4b1e1ff46004e3acd295f96c9ac63a411a0e45775a7f468e","updatedAt":"2026-09-17T22:28:00Z","updatedRevision":"f368a6cce277037e4b1e1ff46004e3acd295f96c9ac63a411a0e45775a7f468e"},"htmlUrl":"/agents/records/ctrl-iso-27001-a-5-28-e9d04483.html","id":"ctrl:iso-27001:A.5.28","mapUrl":"https://evidenceflows.com/?v=1&node=ctrl%3Aiso-27001%3AA.5.28","sourceIds":["iso-27001"],"sourceUrl":null,"title":"A.5.28 — Collection of evidence","type":"control","updatedAt":"2026-09-17T22:28:00Z","url":"/assets/agent_record-ctrl-iso-27001-a-5-28-e9d04483.b93cabfbcfd02728.json"},{"attributes":{"category":"administrative","framework":"iso-27001","type":"detective"},"canonicalUrl":"https://evidenceflows.com/frameworks/iso-27001/","description":"Threat intelligence","details":{"automation":"hybrid","control_category":"administrative","control_id":"A.5.7","control_type":"detective","domains":["Risk Assessment & Management"],"framework":"iso-27001","group":"Organizational controls","key_control":false,"requirement_frequency":null,"requirement_status":null,"risk_count":2,"source_pages":null,"source_url":null},"direct":false,"history":{"digest":"0e9ecdd7a8e13a70d74f6c78c282d510d217dfbc7de11d2d132759e0aa9fc0a7","firstSeenAt":"2026-09-17T22:28:00Z","firstSeenRevision":"f368a6cce277037e4b1e1ff46004e3acd295f96c9ac63a411a0e45775a7f468e","updatedAt":"2026-09-17T22:28:00Z","updatedRevision":"f368a6cce277037e4b1e1ff46004e3acd295f96c9ac63a411a0e45775a7f468e"},"htmlUrl":"/agents/records/ctrl-iso-27001-a-5-7-0328fe6b.html","id":"ctrl:iso-27001:A.5.7","mapUrl":"https://evidenceflows.com/?v=1&node=ctrl%3Aiso-27001%3AA.5.7","sourceIds":["iso-27001"],"sourceUrl":null,"title":"A.5.7 — Threat intelligence","type":"control","updatedAt":"2026-09-17T22:28:00Z","url":"/assets/agent_record-ctrl-iso-27001-a-5-7-0328fe6b.257b91ecb80ba455.json"},{"attributes":{"category":"administrative","framework":"iso-27001","type":"preventive"},"canonicalUrl":"https://evidenceflows.com/frameworks/iso-27001/","description":"Information security in project management","details":{"automation":"manual","control_category":"administrative","control_id":"A.5.8","control_type":"preventive","domains":["Risk Assessment & Management"],"framework":"iso-27001","group":"Organizational controls","key_control":false,"requirement_frequency":null,"requirement_status":null,"risk_count":3,"source_pages":null,"source_url":null},"direct":false,"history":{"digest":"688d9e0927fa7d418d65aad74d3eaabdfd619fdf43a674f20c707a2f29b8a392","firstSeenAt":"2026-09-17T22:28:00Z","firstSeenRevision":"f368a6cce277037e4b1e1ff46004e3acd295f96c9ac63a411a0e45775a7f468e","updatedAt":"2026-09-17T22:28:00Z","updatedRevision":"f368a6cce277037e4b1e1ff46004e3acd295f96c9ac63a411a0e45775a7f468e"},"htmlUrl":"/agents/records/ctrl-iso-27001-a-5-8-bf8c2add.html","id":"ctrl:iso-27001:A.5.8","mapUrl":"https://evidenceflows.com/?v=1&node=ctrl%3Aiso-27001%3AA.5.8","sourceIds":["iso-27001"],"sourceUrl":null,"title":"A.5.8 — Information security in project management","type":"control","updatedAt":"2026-09-17T22:28:00Z","url":"/assets/agent_record-ctrl-iso-27001-a-5-8-bf8c2add.82e847fb047951d3.json"},{"attributes":{"category":"administrative","framework":"iso-27001","type":"preventive"},"canonicalUrl":"https://evidenceflows.com/frameworks/iso-27001/","description":"Information security awareness, education and training","details":{"automation":"manual","control_category":"administrative","control_id":"A.6.3","control_type":"preventive","domains":["Awareness & Training"],"framework":"iso-27001","group":"People controls","key_control":false,"requirement_frequency":null,"requirement_status":null,"risk_count":5,"source_pages":null,"source_url":null},"direct":false,"history":{"digest":"6ba701cfcb37e8266fc6220c851774194143d2c2a5af3b3c38fe5fe28400a2bb","firstSeenAt":"2026-09-17T22:28:00Z","firstSeenRevision":"f368a6cce277037e4b1e1ff46004e3acd295f96c9ac63a411a0e45775a7f468e","updatedAt":"2026-09-17T22:28:00Z","updatedRevision":"f368a6cce277037e4b1e1ff46004e3acd295f96c9ac63a411a0e45775a7f468e"},"htmlUrl":"/agents/records/ctrl-iso-27001-a-6-3-b9bb8fbd.html","id":"ctrl:iso-27001:A.6.3","mapUrl":"https://evidenceflows.com/?v=1&node=ctrl%3Aiso-27001%3AA.6.3","sourceIds":["iso-27001"],"sourceUrl":null,"title":"A.6.3 — Information security awareness, education and training","type":"control","updatedAt":"2026-09-17T22:28:00Z","url":"/assets/agent_record-ctrl-iso-27001-a-6-3-b9bb8fbd.31f473bbfd0f696d.json"},{"attributes":{"category":"administrative","framework":"iso-27001","type":"detective"},"canonicalUrl":"https://evidenceflows.com/frameworks/iso-27001/","description":"Information security event reporting","details":{"automation":"manual","control_category":"administrative","control_id":"A.6.8","control_type":"detective","domains":["Incident Management & Response"],"framework":"iso-27001","group":"People controls","key_control":false,"requirement_frequency":null,"requirement_status":null,"risk_count":3,"source_pages":null,"source_url":null},"direct":false,"history":{"digest":"a55ba871d2d44c688044ad14dbfd373c29b9b453ce6d6960f86ca3bf8301e851","firstSeenAt":"2026-09-17T22:28:00Z","firstSeenRevision":"f368a6cce277037e4b1e1ff46004e3acd295f96c9ac63a411a0e45775a7f468e","updatedAt":"2026-09-17T22:28:00Z","updatedRevision":"f368a6cce277037e4b1e1ff46004e3acd295f96c9ac63a411a0e45775a7f468e"},"htmlUrl":"/agents/records/ctrl-iso-27001-a-6-8-87f56c6a.html","id":"ctrl:iso-27001:A.6.8","mapUrl":"https://evidenceflows.com/?v=1&node=ctrl%3Aiso-27001%3AA.6.8","sourceIds":["iso-27001"],"sourceUrl":null,"title":"A.6.8 — Information security event reporting","type":"control","updatedAt":"2026-09-17T22:28:00Z","url":"/assets/agent_record-ctrl-iso-27001-a-6-8-87f56c6a.155f8b7607a6829a.json"},{"attributes":{"category":"technical","framework":"iso-27001","type":"preventive"},"canonicalUrl":"https://evidenceflows.com/frameworks/iso-27001/","description":"Data leakage prevention","details":{"automation":"automated","control_category":"technical","control_id":"A.8.12","control_type":"preventive","domains":["Data Protection & Privacy"],"framework":"iso-27001","group":"Technological controls","key_control":false,"requirement_frequency":null,"requirement_status":null,"risk_count":5,"source_pages":null,"source_url":null},"direct":false,"history":{"digest":"2c901fd27726f023f46c5692787f11773103bb8b3617b2f2b02bbb6351444ce6","firstSeenAt":"2026-09-17T22:28:00Z","firstSeenRevision":"f368a6cce277037e4b1e1ff46004e3acd295f96c9ac63a411a0e45775a7f468e","updatedAt":"2026-09-17T22:28:00Z","updatedRevision":"f368a6cce277037e4b1e1ff46004e3acd295f96c9ac63a411a0e45775a7f468e"},"htmlUrl":"/agents/records/ctrl-iso-27001-a-8-12-8310e795.html","id":"ctrl:iso-27001:A.8.12","mapUrl":"https://evidenceflows.com/?v=1&node=ctrl%3Aiso-27001%3AA.8.12","sourceIds":["iso-27001"],"sourceUrl":null,"title":"A.8.12 — Data leakage prevention","type":"control","updatedAt":"2026-09-17T22:28:00Z","url":"/assets/agent_record-ctrl-iso-27001-a-8-12-8310e795.7bfea905b5202892.json"}],"relationships":[{"expectedCatalogRevision":"791ff2dd3a45707290badee660f185e514d15f1cf518908628f425c2f2c56ee4","id":"rel:0143972f536ed73420cfad9018dabcad73590f295f5a8a7d609d0277e9c474bf","properties":{"control_id":"B007","coverage":"partial","delta":"quarterly review of user access privileges to AI systems, including administrative, configuration, and training-data access","framework":"aiuc-1","provenance":{"defaultConfidence":"medium","defaultStatus":"active","direction":"canonical_to_source","mapper":"coworkcanvas-compliance-graph","note":"Each member is a documented relationship claim from the canonical unified control to a source control or guidance proposition. relationship: equal|superset_of (full) / intersects_with|subset_of (partial) / informs (guidance). confidence 'medium' = single-mapper, documented, not yet externally corroborated. source_version is the member framework's edition from the standard version register.","reviewDate":"2026-09-07"},"relationship":"intersects_with","source_version":"July 15, 2026 release (quarterly update cadence)"},"sourceDetailPath":"/data/v1/records/uc-uc-access-05-9b7f3e34.json","sourceId":"uc:UC-ACCESS-05","targetDetailPath":"/data/v1/records/ctrl-aiuc-1-b007-151dfcd3.json","targetId":"ctrl:aiuc-1:B007","type":"maps_to"},{"expectedCatalogRevision":"791ff2dd3a45707290badee660f185e514d15f1cf518908628f425c2f2c56ee4","id":"rel:064c13ba66090a675f3ddc5ec32d06e7ad9429416e49de63db68a7cbc43d4f65","properties":{},"sourceDetailPath":"/data/v1/records/ctrl-cobit-2019-dss05-80cfe6d8.json","sourceId":"ctrl:cobit-2019:DSS05","targetDetailPath":"/data/v1/records/std-cobit-2019-2181ce0c.json","targetId":"std:cobit-2019","type":"belongs_to"},{"expectedCatalogRevision":"791ff2dd3a45707290badee660f185e514d15f1cf518908628f425c2f2c56ee4","id":"rel:076722c10b06e43d9f84521802be10ef1863a351ae38466b1fca083ff7a9fda1","properties":{},"sourceDetailPath":"/data/v1/records/ctrl-aiuc-1-c008-94bd64f2.json","sourceId":"ctrl:aiuc-1:C008","targetDetailPath":"/data/v1/records/std-aiuc-1-d2a8b650.json","targetId":"std:aiuc-1","type":"belongs_to"},{"expectedCatalogRevision":"791ff2dd3a45707290badee660f185e514d15f1cf518908628f425c2f2c56ee4","id":"rel:0d4c62ecaae2f7303c04611942d2d3c0be48b1dbbbdc87b1c12837d9d00505c0","properties":{"control_id":"A.5.16","coverage":"full","delta":null,"framework":"iso-27001","provenance":{"defaultConfidence":"medium","defaultStatus":"active","direction":"canonical_to_source","mapper":"coworkcanvas-compliance-graph","note":"Each member is a documented relationship claim from the canonical unified control to a source control or guidance proposition. relationship: equal|superset_of (full) / intersects_with|subset_of (partial) / informs (guidance). confidence 'medium' = single-mapper, documented, not yet externally corroborated. source_version is the member framework's edition from the standard version register.","reviewDate":"2026-09-07"},"relationship":"superset_of","source_version":"2022"},"sourceDetailPath":"/data/v1/records/uc-uc-access-06-623f356c.json","sourceId":"uc:UC-ACCESS-06","targetDetailPath":"/data/v1/records/ctrl-iso-27001-a-5-16-46fc8420.json","targetId":"ctrl:iso-27001:A.5.16","type":"maps_to"},{"expectedCatalogRevision":"791ff2dd3a45707290badee660f185e514d15f1cf518908628f425c2f2c56ee4","id":"rel:1034a1bf8aadb88c03724051eb8a21ece1a44c8b14c592c16dc9039e08476a12","properties":{},"sourceDetailPath":"/data/v1/records/ctrl-gdpr-gdpr-art44-49-8ad28202.json","sourceId":"ctrl:gdpr:GDPR-Art44-49","targetDetailPath":"/data/v1/records/std-gdpr-17d65d0b.json","targetId":"std:gdpr","type":"belongs_to"},{"expectedCatalogRevision":"791ff2dd3a45707290badee660f185e514d15f1cf518908628f425c2f2c56ee4","id":"rel:125837fa57ffac78b2e9e962c9d8e11ca5fc8d0bffd212767c6b8ede1c62b007","properties":{},"sourceDetailPath":"/data/v1/records/ctrl-iso-27001-a-5-18-472ef6f1.json","sourceId":"ctrl:iso-27001:A.5.18","targetDetailPath":"/data/v1/records/std-iso-27001-656201bd.json","targetId":"std:iso-27001","type":"belongs_to"},{"expectedCatalogRevision":"791ff2dd3a45707290badee660f185e514d15f1cf518908628f425c2f2c56ee4","id":"rel:151c6358382dbbca56287fa96b5e2f91eda2817b774910275f3b508306cd9bfe","properties":{},"sourceDetailPath":"/data/v1/records/ctrl-aiuc-1-a005-12903764.json","sourceId":"ctrl:aiuc-1:A005","targetDetailPath":"/data/v1/records/std-aiuc-1-d2a8b650.json","targetId":"std:aiuc-1","type":"belongs_to"},{"expectedCatalogRevision":"791ff2dd3a45707290badee660f185e514d15f1cf518908628f425c2f2c56ee4","id":"rel:176888462abb754dc37b3a4a12b0775af91b62a797ccf757969e2c9fc7078651","properties":{},"sourceDetailPath":"/data/v1/records/ctrl-aiuc-1-e015-94a0c8ea.json","sourceId":"ctrl:aiuc-1:E015","targetDetailPath":"/data/v1/records/std-aiuc-1-d2a8b650.json","targetId":"std:aiuc-1","type":"belongs_to"},{"expectedCatalogRevision":"791ff2dd3a45707290badee660f185e514d15f1cf518908628f425c2f2c56ee4","id":"rel:196ceefc0745c6ddc8a3f0db75c1ea4386ea6dd54352a7744060fe898f7b82cc","properties":{"control_id":"GDPR-Art32","coverage":"partial","delta":"also requires encryption, resilience, and effectiveness testing addressed in other domains","framework":"gdpr","provenance":{"defaultConfidence":"medium","defaultStatus":"active","direction":"canonical_to_source","mapper":"coworkcanvas-compliance-graph","note":"Each member is a documented relationship claim from the canonical unified control to a source control or guidance proposition. relationship: equal|superset_of (full) / intersects_with|subset_of (partial) / informs (guidance). confidence 'medium' = single-mapper, documented, not yet externally corroborated. source_version is the member framework's edition from the standard version register.","reviewDate":"2026-09-07"},"relationship":"intersects_with","source_version":"Regulation (EU) 2016/679"},"sourceDetailPath":"/data/v1/records/uc-uc-access-05-9b7f3e34.json","sourceId":"uc:UC-ACCESS-05","targetDetailPath":"/data/v1/records/ctrl-gdpr-gdpr-art32-63aa3290.json","targetId":"ctrl:gdpr:GDPR-Art32","type":"maps_to"},{"expectedCatalogRevision":"791ff2dd3a45707290badee660f185e514d15f1cf518908628f425c2f2c56ee4","id":"rel:199e523235255b49f7b7f37170eadd985d243e5d71a80080efd22243a1989120","properties":{},"sourceDetailPath":"/data/v1/records/ctrl-gdpr-gdpr-art32-63aa3290.json","sourceId":"ctrl:gdpr:GDPR-Art32","targetDetailPath":"/data/v1/records/std-gdpr-17d65d0b.json","targetId":"std:gdpr","type":"belongs_to"},{"expectedCatalogRevision":"791ff2dd3a45707290badee660f185e514d15f1cf518908628f425c2f2c56ee4","id":"rel:1b1ee959cc26f4a87a9386efa482ae23a1501dc8f85d4ce4a62122317e320641","properties":{"control_id":"AIA-Art72","coverage":"partial","delta":"a documented post-market monitoring plan, proportionate to the system's risk, that actively collects and analyses lifetime performance data including interaction with other AI systems","framework":"eu-ai-act","provenance":{"defaultConfidence":"medium","defaultStatus":"active","direction":"canonical_to_source","mapper":"coworkcanvas-compliance-graph","note":"Each member is a documented relationship claim from the canonical unified control to a source control or guidance proposition. relationship: equal|superset_of (full) / intersects_with|subset_of (partial) / informs (guidance). confidence 'medium' = single-mapper, documented, not yet externally corroborated. source_version is the member framework's edition from the standard version register.","reviewDate":"2026-09-07"},"relationship":"intersects_with","source_version":"Regulation (EU) 2024/1689"},"sourceDetailPath":"/data/v1/records/uc-uc-ai-08-fada68b7.json","sourceId":"uc:UC-AI-08","targetDetailPath":"/data/v1/records/ctrl-eu-ai-act-aia-art72-2866ca15.json","targetId":"ctrl:eu-ai-act:AIA-Art72","type":"maps_to"},{"expectedCatalogRevision":"791ff2dd3a45707290badee660f185e514d15f1cf518908628f425c2f2c56ee4","id":"rel:1bb99a7220444665b11dad31e587befeb9ef3f26c3fb61bf4ac73c2b49cf1faa","properties":{"control_id":"C002","coverage":"full","delta":null,"framework":"aiuc-1","provenance":{"defaultConfidence":"medium","defaultStatus":"active","direction":"canonical_to_source","mapper":"coworkcanvas-compliance-graph","note":"Each member is a documented relationship claim from the canonical unified control to a source control or guidance proposition. relationship: equal|superset_of (full) / intersects_with|subset_of (partial) / informs (guidance). confidence 'medium' = single-mapper, documented, not yet externally corroborated. source_version is the member framework's edition from the standard version register.","reviewDate":"2026-09-07"},"relationship":"superset_of","source_version":"July 15, 2026 release (quarterly update cadence)"},"sourceDetailPath":"/data/v1/records/uc-uc-ai-07-9c5c9573.json","sourceId":"uc:UC-AI-07","targetDetailPath":"/data/v1/records/ctrl-aiuc-1-c002-6c739dcb.json","targetId":"ctrl:aiuc-1:C002","type":"maps_to"},{"expectedCatalogRevision":"791ff2dd3a45707290badee660f185e514d15f1cf518908628f425c2f2c56ee4","id":"rel:1df7d03ef432f33e2aa5d7ac1451629578a6aa10389545ab9db5a521f3bbf50a","properties":{"control_id":"C010","coverage":"full","delta":null,"framework":"aiuc-1","provenance":{"defaultConfidence":"medium","defaultStatus":"active","direction":"canonical_to_source","mapper":"coworkcanvas-compliance-graph","note":"Each member is a documented relationship claim from the canonical unified control to a source control or guidance proposition. relationship: equal|superset_of (full) / intersects_with|subset_of (partial) / informs (guidance). confidence 'medium' = single-mapper, documented, not yet externally corroborated. source_version is the member framework's edition from the standard version register.","reviewDate":"2026-09-07"},"relationship":"superset_of","source_version":"July 15, 2026 release (quarterly update cadence)"},"sourceDetailPath":"/data/v1/records/uc-uc-ai-21-8afd47db.json","sourceId":"uc:UC-AI-21","targetDetailPath":"/data/v1/records/ctrl-aiuc-1-c010-b0a758b4.json","targetId":"ctrl:aiuc-1:C010","type":"maps_to"},{"expectedCatalogRevision":"791ff2dd3a45707290badee660f185e514d15f1cf518908628f425c2f2c56ee4","id":"rel:20e4b2a31e5517b32fa223ea9b1b8fd79f1f9756c4fd2ee3519a688b1e5e002f","properties":{"control_id":"DSS02","coverage":"full","delta":null,"framework":"cobit-2019","provenance":{"defaultConfidence":"medium","defaultStatus":"active","direction":"canonical_to_source","mapper":"coworkcanvas-compliance-graph","note":"Each member is a documented relationship claim from the canonical unified control to a source control or guidance proposition. relationship: equal|superset_of (full) / intersects_with|subset_of (partial) / informs (guidance). confidence 'medium' = single-mapper, documented, not yet externally corroborated. source_version is the member framework's edition from the standard version register.","reviewDate":"2026-09-07"},"relationship":"superset_of","source_version":"2019"},"sourceDetailPath":"/data/v1/records/uc-uc-bcdr-06-c505e5bd.json","sourceId":"uc:UC-BCDR-06","targetDetailPath":"/data/v1/records/ctrl-cobit-2019-dss02-af5bca5d.json","targetId":"ctrl:cobit-2019:DSS02","type":"maps_to"},{"expectedCatalogRevision":"791ff2dd3a45707290badee660f185e514d15f1cf518908628f425c2f2c56ee4","id":"rel:241e3ed1ff8130607909052d7a1a4961af0c9fa568fdacf408d7b8d9d359cb20","properties":{"control_id":"A.6.8","coverage":"full","delta":null,"framework":"iso-27001","provenance":{"defaultConfidence":"medium","defaultStatus":"active","direction":"canonical_to_source","mapper":"coworkcanvas-compliance-graph","note":"Each member is a documented relationship claim from the canonical unified control to a source control or guidance proposition. relationship: equal|superset_of (full) / intersects_with|subset_of (partial) / informs (guidance). confidence 'medium' = single-mapper, documented, not yet externally corroborated. source_version is the member framework's edition from the standard version register.","reviewDate":"2026-09-07"},"relationship":"superset_of","source_version":"2022"},"sourceDetailPath":"/data/v1/records/uc-uc-ir-03-477c1ef0.json","sourceId":"uc:UC-IR-03","targetDetailPath":"/data/v1/records/ctrl-iso-27001-a-6-8-87f56c6a.json","targetId":"ctrl:iso-27001:A.6.8","type":"maps_to"},{"expectedCatalogRevision":"791ff2dd3a45707290badee660f185e514d15f1cf518908628f425c2f2c56ee4","id":"rel:2fa9ee745188901dc9cf334d826e8e52a294a06c63ae786f99df85acdb98780d","properties":{},"sourceDetailPath":"/data/v1/records/ctrl-cobit-2019-dss02-af5bca5d.json","sourceId":"ctrl:cobit-2019:DSS02","targetDetailPath":"/data/v1/records/std-cobit-2019-2181ce0c.json","targetId":"std:cobit-2019","type":"belongs_to"},{"expectedCatalogRevision":"791ff2dd3a45707290badee660f185e514d15f1cf518908628f425c2f2c56ee4","id":"rel:3169f2abc7f4fe1d152757d80f0cb5ad870bd962db2898bc84fe7d135ea5f6f1","properties":{"control_id":"GDPR-Art33","coverage":"full","delta":null,"framework":"gdpr","provenance":{"defaultConfidence":"medium","defaultStatus":"active","direction":"canonical_to_source","mapper":"coworkcanvas-compliance-graph","note":"Each member is a documented relationship claim from the canonical unified control to a source control or guidance proposition. relationship: equal|superset_of (full) / intersects_with|subset_of (partial) / informs (guidance). confidence 'medium' = single-mapper, documented, not yet externally corroborated. source_version is the member framework's edition from the standard version register.","reviewDate":"2026-09-07"},"relationship":"superset_of","source_version":"Regulation (EU) 2016/679"},"sourceDetailPath":"/data/v1/records/uc-uc-log-06-735bbc3e.json","sourceId":"uc:UC-LOG-06","targetDetailPath":"/data/v1/records/ctrl-gdpr-gdpr-art33-a2a440c2.json","targetId":"ctrl:gdpr:GDPR-Art33","type":"maps_to"},{"expectedCatalogRevision":"791ff2dd3a45707290badee660f185e514d15f1cf518908628f425c2f2c56ee4","id":"rel:32bf6421f2b8d665a50dabd9afe913d3db465ae6fd73f6978e767f8a3e387d37","properties":{},"sourceDetailPath":"/data/v1/records/ctrl-hipaa-hipaa-164-312-a-5c8bb707.json","sourceId":"ctrl:hipaa:HIPAA-164.312(a)","targetDetailPath":"/data/v1/records/std-hipaa-a825d271.json","targetId":"std:hipaa","type":"belongs_to"},{"expectedCatalogRevision":"791ff2dd3a45707290badee660f185e514d15f1cf518908628f425c2f2c56ee4","id":"rel:3725ab082d6da8f966bc8172699871ad9290c976ed4a2cb8b98b5400c81d7929","properties":{"control_id":"C012","coverage":"full","delta":null,"framework":"aiuc-1","provenance":{"defaultConfidence":"medium","defaultStatus":"active","direction":"canonical_to_source","mapper":"coworkcanvas-compliance-graph","note":"Each member is a documented relationship claim from the canonical unified control to a source control or guidance proposition. relationship: equal|superset_of (full) / intersects_with|subset_of (partial) / informs (guidance). confidence 'medium' = single-mapper, documented, not yet externally corroborated. source_version is the member framework's edition from the standard version register.","reviewDate":"2026-09-07"},"relationship":"superset_of","source_version":"July 15, 2026 release (quarterly update cadence)"},"sourceDetailPath":"/data/v1/records/uc-uc-ai-21-8afd47db.json","sourceId":"uc:UC-AI-21","targetDetailPath":"/data/v1/records/ctrl-aiuc-1-c012-783c55df.json","targetId":"ctrl:aiuc-1:C012","type":"maps_to"},{"expectedCatalogRevision":"791ff2dd3a45707290badee660f185e514d15f1cf518908628f425c2f2c56ee4","id":"rel:39ba831adcb789e31ed1c2a108d886bd4232ca89968b0be5c4a70945c663fa9b","properties":{},"sourceDetailPath":"/data/v1/records/ctrl-iso-27001-a-8-12-8310e795.json","sourceId":"ctrl:iso-27001:A.8.12","targetDetailPath":"/data/v1/records/std-iso-27001-656201bd.json","targetId":"std:iso-27001","type":"belongs_to"},{"expectedCatalogRevision":"791ff2dd3a45707290badee660f185e514d15f1cf518908628f425c2f2c56ee4","id":"rel:3c511ac1363b3cf7707cbe89a44ceff9ac1a631ccce30cd2f437a7b52ab0cf44","properties":{},"sourceDetailPath":"/data/v1/records/ctrl-eu-ai-act-aia-art72-2866ca15.json","sourceId":"ctrl:eu-ai-act:AIA-Art72","targetDetailPath":"/data/v1/records/std-eu-ai-act-54986689.json","targetId":"std:eu-ai-act","type":"belongs_to"},{"expectedCatalogRevision":"791ff2dd3a45707290badee660f185e514d15f1cf518908628f425c2f2c56ee4","id":"rel:42509eb5656a89b1a92a9c36f3a2a4cdefa1a038aa8cc37f1f6b3d0b23eeb1fe","properties":{},"sourceDetailPath":"/data/v1/records/ctrl-aiuc-1-c012-783c55df.json","sourceId":"ctrl:aiuc-1:C012","targetDetailPath":"/data/v1/records/std-aiuc-1-d2a8b650.json","targetId":"std:aiuc-1","type":"belongs_to"},{"expectedCatalogRevision":"791ff2dd3a45707290badee660f185e514d15f1cf518908628f425c2f2c56ee4","id":"rel:45a1e5145b0928b28d18bf5921388ea0c0962d3cd43c1e225eae980c86022c05","properties":{},"sourceDetailPath":"/data/v1/records/ctrl-aiuc-1-a003-bea61fd9.json","sourceId":"ctrl:aiuc-1:A003","targetDetailPath":"/data/v1/records/std-aiuc-1-d2a8b650.json","targetId":"std:aiuc-1","type":"belongs_to"},{"expectedCatalogRevision":"791ff2dd3a45707290badee660f185e514d15f1cf518908628f425c2f2c56ee4","id":"rel:46649b5491420104088389b6488bcc81c25e0f04301e1b993c9c416d4ab952b2","properties":{"control_id":"GDPR-Art44-49","coverage":"full","delta":null,"framework":"gdpr","provenance":{"defaultConfidence":"medium","defaultStatus":"active","direction":"canonical_to_source","mapper":"coworkcanvas-compliance-graph","note":"Each member is a documented relationship claim from the canonical unified control to a source control or guidance proposition. relationship: equal|superset_of (full) / intersects_with|subset_of (partial) / informs (guidance). confidence 'medium' = single-mapper, documented, not yet externally corroborated. source_version is the member framework's edition from the standard version register.","reviewDate":"2026-09-07"},"relationship":"superset_of","source_version":"Regulation (EU) 2016/679"},"sourceDetailPath":"/data/v1/records/uc-uc-data-11-baf71fe4.json","sourceId":"uc:UC-DATA-11","targetDetailPath":"/data/v1/records/ctrl-gdpr-gdpr-art44-49-8ad28202.json","targetId":"ctrl:gdpr:GDPR-Art44-49","type":"maps_to"},{"expectedCatalogRevision":"791ff2dd3a45707290badee660f185e514d15f1cf518908628f425c2f2c56ee4","id":"rel:46aa39a4ea46095a7cf37e080fc784c4480c2b0ec372694e0227c4b9c014074a","properties":{"control_id":"P7","coverage":"full","delta":null,"framework":"coso-ic","provenance":{"defaultConfidence":"medium","defaultStatus":"active","direction":"canonical_to_source","mapper":"coworkcanvas-compliance-graph","note":"Each member is a documented relationship claim from the canonical unified control to a source control or guidance proposition. relationship: equal|superset_of (full) / intersects_with|subset_of (partial) / informs (guidance). confidence 'medium' = single-mapper, documented, not yet externally corroborated. source_version is the member framework's edition from the standard version register.","reviewDate":"2026-09-07"},"relationship":"superset_of","source_version":"2013"},"sourceDetailPath":"/data/v1/records/uc-uc-risk-06-e9599494.json","sourceId":"uc:UC-RISK-06","targetDetailPath":"/data/v1/records/ctrl-coso-ic-p7-a272f700.json","targetId":"ctrl:coso-ic:P7","type":"maps_to"},{"expectedCatalogRevision":"791ff2dd3a45707290badee660f185e514d15f1cf518908628f425c2f2c56ee4","id":"rel:47472f6f81d5e60212915d60644980d00c90385e35c468c9335aebda80a424de","properties":{"control_id":"HIPAA-164.312(a)","coverage":"partial","delta":"automatic logoff and encryption/decryption of ePHI are satisfied by the session-lock (UC-ACCESS-12) and cryptographic (UC-CRYPTO-01) companion controls; emergency-access is an availability arm","framework":"hipaa","provenance":{"defaultConfidence":"medium","defaultStatus":"active","direction":"canonical_to_source","mapper":"coworkcanvas-compliance-graph","note":"Each member is a documented relationship claim from the canonical unified control to a source control or guidance proposition. relationship: equal|superset_of (full) / intersects_with|subset_of (partial) / informs (guidance). confidence 'medium' = single-mapper, documented, not yet externally corroborated. source_version is the member framework's edition from the standard version register.","reviewDate":"2026-09-07"},"relationship":"intersects_with","source_version":"45 CFR Parts 160/164 (Security, Privacy, Breach Notification)"},"sourceDetailPath":"/data/v1/records/uc-uc-access-05-9b7f3e34.json","sourceId":"uc:UC-ACCESS-05","targetDetailPath":"/data/v1/records/ctrl-hipaa-hipaa-164-312-a-5c8bb707.json","targetId":"ctrl:hipaa:HIPAA-164.312(a)","type":"maps_to"},{"expectedCatalogRevision":"791ff2dd3a45707290badee660f185e514d15f1cf518908628f425c2f2c56ee4","id":"rel:47bc91a357dabf951399db5e73d90410a16ea531245923ce66ba8d2c4e5a6628","properties":{},"sourceDetailPath":"/data/v1/records/ctrl-eu-ai-act-aia-art12-3714b8af.json","sourceId":"ctrl:eu-ai-act:AIA-Art12","targetDetailPath":"/data/v1/records/std-eu-ai-act-54986689.json","targetId":"std:eu-ai-act","type":"belongs_to"},{"expectedCatalogRevision":"791ff2dd3a45707290badee660f185e514d15f1cf518908628f425c2f2c56ee4","id":"rel:4f4bfb919d761c9352da8a35038bb54e93595b16f4e9d3163a8df47218198b62","properties":{},"sourceDetailPath":"/data/v1/records/ctrl-aiuc-1-c002-6c739dcb.json","sourceId":"ctrl:aiuc-1:C002","targetDetailPath":"/data/v1/records/std-aiuc-1-d2a8b650.json","targetId":"std:aiuc-1","type":"belongs_to"},{"expectedCatalogRevision":"791ff2dd3a45707290badee660f185e514d15f1cf518908628f425c2f2c56ee4","id":"rel:4fb51c383bd08d7e4cb798d652a83c0b888d8fd0853a69efefe852a66ecbb53a","properties":{},"sourceDetailPath":"/data/v1/records/ctrl-hipaa-hipaa-164-312-b-7272303c.json","sourceId":"ctrl:hipaa:HIPAA-164.312(b)","targetDetailPath":"/data/v1/records/std-hipaa-a825d271.json","targetId":"std:hipaa","type":"belongs_to"},{"expectedCatalogRevision":"791ff2dd3a45707290badee660f185e514d15f1cf518908628f425c2f2c56ee4","id":"rel:512ba21439e87bc291748f791f63165c51c302598232ea229c29542a3578a201","properties":{},"sourceDetailPath":"/data/v1/records/ctrl-cobit-2019-dss03-2540740f.json","sourceId":"ctrl:cobit-2019:DSS03","targetDetailPath":"/data/v1/records/std-cobit-2019-2181ce0c.json","targetId":"std:cobit-2019","type":"belongs_to"},{"expectedCatalogRevision":"791ff2dd3a45707290badee660f185e514d15f1cf518908628f425c2f2c56ee4","id":"rel:54a5127b09fa0df51fdec8c2d52d749eb8f7b18dcdc92569ca6cf4f78c2bd536","properties":{},"sourceDetailPath":"/data/v1/records/ctrl-aiuc-1-b001-19a54ee3.json","sourceId":"ctrl:aiuc-1:B001","targetDetailPath":"/data/v1/records/std-aiuc-1-d2a8b650.json","targetId":"std:aiuc-1","type":"belongs_to"},{"expectedCatalogRevision":"791ff2dd3a45707290badee660f185e514d15f1cf518908628f425c2f2c56ee4","id":"rel:60f2083b85eec41e5629c01567e3bc03ebc043b72a575f38df3d7bd42caa9029","properties":{"control_id":"A.5.26","coverage":"full","delta":null,"framework":"iso-27001","provenance":{"defaultConfidence":"medium","defaultStatus":"active","direction":"canonical_to_source","mapper":"coworkcanvas-compliance-graph","note":"Each member is a documented relationship claim from the canonical unified control to a source control or guidance proposition. relationship: equal|superset_of (full) / intersects_with|subset_of (partial) / informs (guidance). confidence 'medium' = single-mapper, documented, not yet externally corroborated. source_version is the member framework's edition from the standard version register.","reviewDate":"2026-09-07"},"relationship":"superset_of","source_version":"2022"},"sourceDetailPath":"/data/v1/records/uc-uc-ir-06-0b166c2a.json","sourceId":"uc:UC-IR-06","targetDetailPath":"/data/v1/records/ctrl-iso-27001-a-5-26-863e832e.json","targetId":"ctrl:iso-27001:A.5.26","type":"maps_to"},{"expectedCatalogRevision":"791ff2dd3a45707290badee660f185e514d15f1cf518908628f425c2f2c56ee4","id":"rel:639af74f867207985c0d330720da0b18bcbac5a07f9e93504c9405e222505aca","properties":{"control_id":"A005","coverage":"partial","delta":"tenant isolation inside AI systems: retrieval indexes, memory, fine-tuning data, and caches segregated so one customer's data cannot surface in another customer's outputs","framework":"aiuc-1","provenance":{"defaultConfidence":"medium","defaultStatus":"active","direction":"canonical_to_source","mapper":"coworkcanvas-compliance-graph","note":"Each member is a documented relationship claim from the canonical unified control to a source control or guidance proposition. relationship: equal|superset_of (full) / intersects_with|subset_of (partial) / informs (guidance). confidence 'medium' = single-mapper, documented, not yet externally corroborated. source_version is the member framework's edition from the standard version register.","reviewDate":"2026-09-07"},"relationship":"intersects_with","source_version":"July 15, 2026 release (quarterly update cadence)"},"sourceDetailPath":"/data/v1/records/uc-uc-data-11-baf71fe4.json","sourceId":"uc:UC-DATA-11","targetDetailPath":"/data/v1/records/ctrl-aiuc-1-a005-12903764.json","targetId":"ctrl:aiuc-1:A005","type":"maps_to"},{"expectedCatalogRevision":"791ff2dd3a45707290badee660f185e514d15f1cf518908628f425c2f2c56ee4","id":"rel:6c1846fb9812d3a66dd47cb08fabc59bc2947d21d3b9398e0ec8166b1e2f5445","properties":{},"sourceDetailPath":"/data/v1/records/ctrl-aiuc-1-a004-0955d43a.json","sourceId":"ctrl:aiuc-1:A004","targetDetailPath":"/data/v1/records/std-aiuc-1-d2a8b650.json","targetId":"std:aiuc-1","type":"belongs_to"},{"expectedCatalogRevision":"791ff2dd3a45707290badee660f185e514d15f1cf518908628f425c2f2c56ee4","id":"rel:711a1e90cc08e74c4fa39e7c5ba0baed9abb795e999c10d2a47d3e0db122c51f","properties":{"control_id":"AIA-Art12","coverage":"full","delta":null,"framework":"eu-ai-act","provenance":{"defaultConfidence":"medium","defaultStatus":"active","direction":"canonical_to_source","mapper":"coworkcanvas-compliance-graph","note":"Each member is a documented relationship claim from the canonical unified control to a source control or guidance proposition. relationship: equal|superset_of (full) / intersects_with|subset_of (partial) / informs (guidance). confidence 'medium' = single-mapper, documented, not yet externally corroborated. source_version is the member framework's edition from the standard version register.","reviewDate":"2026-09-07"},"relationship":"superset_of","source_version":"Regulation (EU) 2024/1689"},"sourceDetailPath":"/data/v1/records/uc-uc-ai-08-fada68b7.json","sourceId":"uc:UC-AI-08","targetDetailPath":"/data/v1/records/ctrl-eu-ai-act-aia-art12-3714b8af.json","targetId":"ctrl:eu-ai-act:AIA-Art12","type":"maps_to"},{"expectedCatalogRevision":"791ff2dd3a45707290badee660f185e514d15f1cf518908628f425c2f2c56ee4","id":"rel:7135470f5a63fc7121113c02de833d6fde647eb75c6bb98fd804caa7badca929","properties":{},"sourceDetailPath":"/data/v1/records/ctrl-iso-27001-a-5-7-0328fe6b.json","sourceId":"ctrl:iso-27001:A.5.7","targetDetailPath":"/data/v1/records/std-iso-27001-656201bd.json","targetId":"std:iso-27001","type":"belongs_to"},{"expectedCatalogRevision":"791ff2dd3a45707290badee660f185e514d15f1cf518908628f425c2f2c56ee4","id":"rel:72b94ed91e964541cc87bf386c4b6994337ba2ac851d16d3f3454cfd9b8d8eb3","properties":{"control_id":"D002","coverage":"full","delta":null,"framework":"aiuc-1","provenance":{"defaultConfidence":"medium","defaultStatus":"active","direction":"canonical_to_source","mapper":"coworkcanvas-compliance-graph","note":"Each member is a documented relationship claim from the canonical unified control to a source control or guidance proposition. relationship: equal|superset_of (full) / intersects_with|subset_of (partial) / informs (guidance). confidence 'medium' = single-mapper, documented, not yet externally corroborated. source_version is the member framework's edition from the standard version register.","reviewDate":"2026-09-07"},"relationship":"superset_of","source_version":"July 15, 2026 release (quarterly update cadence)"},"sourceDetailPath":"/data/v1/records/uc-uc-ai-21-8afd47db.json","sourceId":"uc:UC-AI-21","targetDetailPath":"/data/v1/records/ctrl-aiuc-1-d002-34554b38.json","targetId":"ctrl:aiuc-1:D002","type":"maps_to"},{"expectedCatalogRevision":"791ff2dd3a45707290badee660f185e514d15f1cf518908628f425c2f2c56ee4","id":"rel:7373d57591824458194e96497f8a2b6c6ae3fe9bd3cf3df2640217f46ee2c232","properties":{},"sourceDetailPath":"/data/v1/records/ctrl-iso-27001-a-5-8-bf8c2add.json","sourceId":"ctrl:iso-27001:A.5.8","targetDetailPath":"/data/v1/records/std-iso-27001-656201bd.json","targetId":"std:iso-27001","type":"belongs_to"},{"expectedCatalogRevision":"791ff2dd3a45707290badee660f185e514d15f1cf518908628f425c2f2c56ee4","id":"rel:7378e9eab62be8ba3d1a1ed5bd35f653d390c7165684821983a39c6e739cf851","properties":{"control_id":"C011","coverage":"full","delta":null,"framework":"aiuc-1","provenance":{"defaultConfidence":"medium","defaultStatus":"active","direction":"canonical_to_source","mapper":"coworkcanvas-compliance-graph","note":"Each member is a documented relationship claim from the canonical unified control to a source control or guidance proposition. relationship: equal|superset_of (full) / intersects_with|subset_of (partial) / informs (guidance). confidence 'medium' = single-mapper, documented, not yet externally corroborated. source_version is the member framework's edition from the standard version register.","reviewDate":"2026-09-07"},"relationship":"superset_of","source_version":"July 15, 2026 release (quarterly update cadence)"},"sourceDetailPath":"/data/v1/records/uc-uc-ai-21-8afd47db.json","sourceId":"uc:UC-AI-21","targetDetailPath":"/data/v1/records/ctrl-aiuc-1-c011-7889db41.json","targetId":"ctrl:aiuc-1:C011","type":"maps_to"},{"expectedCatalogRevision":"791ff2dd3a45707290badee660f185e514d15f1cf518908628f425c2f2c56ee4","id":"rel:7566c86da6687604708ae8825c0fd65a28909fb3e0c43ea698aedff05673ebe4","properties":{"control_id":"A.5.25","coverage":"full","delta":null,"framework":"iso-27001","provenance":{"defaultConfidence":"medium","defaultStatus":"active","direction":"canonical_to_source","mapper":"coworkcanvas-compliance-graph","note":"Each member is a documented relationship claim from the canonical unified control to a source control or guidance proposition. relationship: equal|superset_of (full) / intersects_with|subset_of (partial) / informs (guidance). confidence 'medium' = single-mapper, documented, not yet externally corroborated. source_version is the member framework's edition from the standard version register.","reviewDate":"2026-09-07"},"relationship":"superset_of","source_version":"2022"},"sourceDetailPath":"/data/v1/records/uc-uc-ir-04-6067c069.json","sourceId":"uc:UC-IR-04","targetDetailPath":"/data/v1/records/ctrl-iso-27001-a-5-25-7dc7a20c.json","targetId":"ctrl:iso-27001:A.5.25","type":"maps_to"},{"expectedCatalogRevision":"791ff2dd3a45707290badee660f185e514d15f1cf518908628f425c2f2c56ee4","id":"rel:771fe71b653da797589e3eeb3d84a995ac2416455b1e8170bcd03ca056f8d16e","properties":{},"sourceDetailPath":"/data/v1/records/ctrl-aiuc-1-d004-21d4eeb4.json","sourceId":"ctrl:aiuc-1:D004","targetDetailPath":"/data/v1/records/std-aiuc-1-d2a8b650.json","targetId":"std:aiuc-1","type":"belongs_to"},{"expectedCatalogRevision":"791ff2dd3a45707290badee660f185e514d15f1cf518908628f425c2f2c56ee4","id":"rel:7fe14f045eb5b989ed2b172e29123795c887a077790aec281603ac0cb5b7b76a","properties":{},"sourceDetailPath":"/data/v1/records/ctrl-aiuc-1-c010-b0a758b4.json","sourceId":"ctrl:aiuc-1:C010","targetDetailPath":"/data/v1/records/std-aiuc-1-d2a8b650.json","targetId":"std:aiuc-1","type":"belongs_to"},{"expectedCatalogRevision":"791ff2dd3a45707290badee660f185e514d15f1cf518908628f425c2f2c56ee4","id":"rel:831bb87ed52b4b8496a2df0763736f691983d642227954b2a9794574ad122e52","properties":{},"sourceDetailPath":"/data/v1/records/ctrl-iso-27001-a-5-15-b8587804.json","sourceId":"ctrl:iso-27001:A.5.15","targetDetailPath":"/data/v1/records/std-iso-27001-656201bd.json","targetId":"std:iso-27001","type":"belongs_to"},{"expectedCatalogRevision":"791ff2dd3a45707290badee660f185e514d15f1cf518908628f425c2f2c56ee4","id":"rel:89206e47cbd4bf028123c0d6072f24d0408b695ea872f1bf5bc128ad8cd1c09c","properties":{},"sourceDetailPath":"/data/v1/records/ctrl-iso-27001-a-5-17-b45de021.json","sourceId":"ctrl:iso-27001:A.5.17","targetDetailPath":"/data/v1/records/std-iso-27001-656201bd.json","targetId":"std:iso-27001","type":"belongs_to"},{"expectedCatalogRevision":"791ff2dd3a45707290badee660f185e514d15f1cf518908628f425c2f2c56ee4","id":"rel:8ad43eeb9707d403a42533306a14908e951226d382dfc555c22e8baefaf7633b","properties":{"control_id":"A.5.17","coverage":"partial","delta":"advising personnel on proper handling and protection of authentication information","framework":"iso-27001","provenance":{"defaultConfidence":"medium","defaultStatus":"active","direction":"canonical_to_source","mapper":"coworkcanvas-compliance-graph","note":"Each member is a documented relationship claim from the canonical unified control to a source control or guidance proposition. relationship: equal|superset_of (full) / intersects_with|subset_of (partial) / informs (guidance). confidence 'medium' = single-mapper, documented, not yet externally corroborated. source_version is the member framework's edition from the standard version register.","reviewDate":"2026-09-07"},"relationship":"intersects_with","source_version":"2022"},"sourceDetailPath":"/data/v1/records/uc-uc-access-08-7c9dc13e.json","sourceId":"uc:UC-ACCESS-08","targetDetailPath":"/data/v1/records/ctrl-iso-27001-a-5-17-b45de021.json","targetId":"ctrl:iso-27001:A.5.17","type":"maps_to"},{"expectedCatalogRevision":"791ff2dd3a45707290badee660f185e514d15f1cf518908628f425c2f2c56ee4","id":"rel:8b9de4df2b9b11f4758d16caba3a14418486d52562080438d56995febeaf4511","properties":{"control_id":"DORA-Art17-23","coverage":"partial","delta":"major-incident report clocks: initial 24h, intermediate 72h, final 1 month","framework":"dora","provenance":{"defaultConfidence":"medium","defaultStatus":"active","direction":"canonical_to_source","mapper":"coworkcanvas-compliance-graph","note":"Each member is a documented relationship claim from the canonical unified control to a source control or guidance proposition. relationship: equal|superset_of (full) / intersects_with|subset_of (partial) / informs (guidance). confidence 'medium' = single-mapper, documented, not yet externally corroborated. source_version is the member framework's edition from the standard version register.","reviewDate":"2026-09-07"},"relationship":"intersects_with","source_version":"Regulation (EU) 2022/2554"},"sourceDetailPath":"/data/v1/records/uc-uc-bcdr-06-c505e5bd.json","sourceId":"uc:UC-BCDR-06","targetDetailPath":"/data/v1/records/ctrl-dora-dora-art17-23-9aa7977f.json","targetId":"ctrl:dora:DORA-Art17-23","type":"maps_to"},{"expectedCatalogRevision":"791ff2dd3a45707290badee660f185e514d15f1cf518908628f425c2f2c56ee4","id":"rel:8ba1fcd2dce54d62b11512c22b5f9ff1de51a9fb9f041e24912fc85eded145cd","properties":{"control_id":"A.8.12","coverage":"full","delta":null,"framework":"iso-27001","provenance":{"defaultConfidence":"medium","defaultStatus":"active","direction":"canonical_to_source","mapper":"coworkcanvas-compliance-graph","note":"Each member is a documented relationship claim from the canonical unified control to a source control or guidance proposition. relationship: equal|superset_of (full) / intersects_with|subset_of (partial) / informs (guidance). confidence 'medium' = single-mapper, documented, not yet externally corroborated. source_version is the member framework's edition from the standard version register.","reviewDate":"2026-09-07"},"relationship":"superset_of","source_version":"2022"},"sourceDetailPath":"/data/v1/records/uc-uc-data-11-baf71fe4.json","sourceId":"uc:UC-DATA-11","targetDetailPath":"/data/v1/records/ctrl-iso-27001-a-8-12-8310e795.json","targetId":"ctrl:iso-27001:A.8.12","type":"maps_to"},{"expectedCatalogRevision":"791ff2dd3a45707290badee660f185e514d15f1cf518908628f425c2f2c56ee4","id":"rel:8cf6a557412855d991f5fbe276861808067d53cad6d0a3017419b255fa47e568","properties":{"control_id":"A.5.15","coverage":"partial","delta":"also requires rules controlling physical access to information and assets","framework":"iso-27001","provenance":{"defaultConfidence":"medium","defaultStatus":"active","direction":"canonical_to_source","mapper":"coworkcanvas-compliance-graph","note":"Each member is a documented relationship claim from the canonical unified control to a source control or guidance proposition. relationship: equal|superset_of (full) / intersects_with|subset_of (partial) / informs (guidance). confidence 'medium' = single-mapper, documented, not yet externally corroborated. source_version is the member framework's edition from the standard version register.","reviewDate":"2026-09-07"},"relationship":"intersects_with","source_version":"2022"},"sourceDetailPath":"/data/v1/records/uc-uc-access-03-43eeb212.json","sourceId":"uc:UC-ACCESS-03","targetDetailPath":"/data/v1/records/ctrl-iso-27001-a-5-15-b8587804.json","targetId":"ctrl:iso-27001:A.5.15","type":"maps_to"},{"expectedCatalogRevision":"791ff2dd3a45707290badee660f185e514d15f1cf518908628f425c2f2c56ee4","id":"rel:8f00b3af18bd976ece45fa4f771f6deb906c8ac51a41df201a46be8c80fdd8ca","properties":{},"sourceDetailPath":"/data/v1/records/ctrl-coso-ic-p7-a272f700.json","sourceId":"ctrl:coso-ic:P7","targetDetailPath":"/data/v1/records/std-coso-ic-3f80f565.json","targetId":"std:coso-ic","type":"belongs_to"},{"expectedCatalogRevision":"791ff2dd3a45707290badee660f185e514d15f1cf518908628f425c2f2c56ee4","id":"rel:8ff93d7e4e334d9453ecbad99b8cd3527f3de070de51c8adc3daad60b069d2b6","properties":{"control_id":"A.6.3","coverage":"full","delta":null,"framework":"iso-27001","provenance":{"defaultConfidence":"medium","defaultStatus":"active","direction":"canonical_to_source","mapper":"coworkcanvas-compliance-graph","note":"Each member is a documented relationship claim from the canonical unified control to a source control or guidance proposition. relationship: equal|superset_of (full) / intersects_with|subset_of (partial) / informs (guidance). confidence 'medium' = single-mapper, documented, not yet externally corroborated. source_version is the member framework's edition from the standard version register.","reviewDate":"2026-09-07"},"relationship":"superset_of","source_version":"2022"},"sourceDetailPath":"/data/v1/records/uc-uc-train-01-5f513831.json","sourceId":"uc:UC-TRAIN-01","targetDetailPath":"/data/v1/records/ctrl-iso-27001-a-6-3-b9bb8fbd.json","targetId":"ctrl:iso-27001:A.6.3","type":"maps_to"},{"expectedCatalogRevision":"791ff2dd3a45707290badee660f185e514d15f1cf518908628f425c2f2c56ee4","id":"rel:98e288190a80f4b9684f719b462f304e3ad2604643cf30159ec607b9f18aa498","properties":{"control_id":"A004","coverage":"partial","delta":"leakage of intellectual property and confidential information through AI system outputs, requiring model-output safeguards beyond network and channel flow controls","framework":"aiuc-1","provenance":{"defaultConfidence":"medium","defaultStatus":"active","direction":"canonical_to_source","mapper":"coworkcanvas-compliance-graph","note":"Each member is a documented relationship claim from the canonical unified control to a source control or guidance proposition. relationship: equal|superset_of (full) / intersects_with|subset_of (partial) / informs (guidance). confidence 'medium' = single-mapper, documented, not yet externally corroborated. source_version is the member framework's edition from the standard version register.","reviewDate":"2026-09-07"},"relationship":"intersects_with","source_version":"July 15, 2026 release (quarterly update cadence)"},"sourceDetailPath":"/data/v1/records/uc-uc-data-11-baf71fe4.json","sourceId":"uc:UC-DATA-11","targetDetailPath":"/data/v1/records/ctrl-aiuc-1-a004-0955d43a.json","targetId":"ctrl:aiuc-1:A004","type":"maps_to"},{"expectedCatalogRevision":"791ff2dd3a45707290badee660f185e514d15f1cf518908628f425c2f2c56ee4","id":"rel:9f229e45003f2c7c825f7932294437466bf8be9e39c6c4ab0bcb25d8dc6b2192","properties":{},"sourceDetailPath":"/data/v1/records/ctrl-dora-dora-art17-23-9aa7977f.json","sourceId":"ctrl:dora:DORA-Art17-23","targetDetailPath":"/data/v1/records/std-dora-95cf939d.json","targetId":"std:dora","type":"belongs_to"},{"expectedCatalogRevision":"791ff2dd3a45707290badee660f185e514d15f1cf518908628f425c2f2c56ee4","id":"rel:a09570a6185e464a33d447ed7e365813f9ec4e119b3b996bb917758789fe6d6c","properties":{"control_id":"A.5.8","coverage":"full","delta":null,"framework":"iso-27001","provenance":{"defaultConfidence":"medium","defaultStatus":"active","direction":"canonical_to_source","mapper":"coworkcanvas-compliance-graph","note":"Each member is a documented relationship claim from the canonical unified control to a source control or guidance proposition. relationship: equal|superset_of (full) / intersects_with|subset_of (partial) / informs (guidance). confidence 'medium' = single-mapper, documented, not yet externally corroborated. source_version is the member framework's edition from the standard version register.","reviewDate":"2026-09-07"},"relationship":"superset_of","source_version":"2022"},"sourceDetailPath":"/data/v1/records/uc-uc-risk-02-0f8519bb.json","sourceId":"uc:UC-RISK-02","targetDetailPath":"/data/v1/records/ctrl-iso-27001-a-5-8-bf8c2add.json","targetId":"ctrl:iso-27001:A.5.8","type":"maps_to"},{"expectedCatalogRevision":"791ff2dd3a45707290badee660f185e514d15f1cf518908628f425c2f2c56ee4","id":"rel:a0c14c0293d1afba8a4199022904af26b4f4095f4319e0f53f6796d1a5facba9","properties":{},"sourceDetailPath":"/data/v1/records/ctrl-aiuc-1-b007-151dfcd3.json","sourceId":"ctrl:aiuc-1:B007","targetDetailPath":"/data/v1/records/std-aiuc-1-d2a8b650.json","targetId":"std:aiuc-1","type":"belongs_to"},{"expectedCatalogRevision":"791ff2dd3a45707290badee660f185e514d15f1cf518908628f425c2f2c56ee4","id":"rel:a663d636ace716e1441d87cd25897840f98c0c489bea339a8e1d75115860ac39","properties":{},"sourceDetailPath":"/data/v1/records/ctrl-iso-27001-a-6-3-b9bb8fbd.json","sourceId":"ctrl:iso-27001:A.6.3","targetDetailPath":"/data/v1/records/std-iso-27001-656201bd.json","targetId":"std:iso-27001","type":"belongs_to"},{"expectedCatalogRevision":"791ff2dd3a45707290badee660f185e514d15f1cf518908628f425c2f2c56ee4","id":"rel:a8cee9dde29a243b600f5ad0128cf7aa74a7d87d1be4519238792fcbf2469e27","properties":{"control_id":"DSS05","coverage":"partial","delta":"also identity/logical access, physical access, and sensitive-document/output-device controls","framework":"cobit-2019","provenance":{"defaultConfidence":"medium","defaultStatus":"active","direction":"canonical_to_source","mapper":"coworkcanvas-compliance-graph","note":"Each member is a documented relationship claim from the canonical unified control to a source control or guidance proposition. relationship: equal|superset_of (full) / intersects_with|subset_of (partial) / informs (guidance). confidence 'medium' = single-mapper, documented, not yet externally corroborated. source_version is the member framework's edition from the standard version register.","reviewDate":"2026-09-07"},"relationship":"intersects_with","source_version":"2019"},"sourceDetailPath":"/data/v1/records/uc-uc-bcdr-13-aa7feb8e.json","sourceId":"uc:UC-BCDR-13","targetDetailPath":"/data/v1/records/ctrl-cobit-2019-dss05-80cfe6d8.json","targetId":"ctrl:cobit-2019:DSS05","type":"maps_to"},{"expectedCatalogRevision":"791ff2dd3a45707290badee660f185e514d15f1cf518908628f425c2f2c56ee4","id":"rel:aa2bb7ba717c5ce844028d7bbfbbb392a9b458f4a4f55e65abf03c53175313f7","properties":{},"sourceDetailPath":"/data/v1/records/ctrl-eu-ai-act-aia-art19-55451bfa.json","sourceId":"ctrl:eu-ai-act:AIA-Art19","targetDetailPath":"/data/v1/records/std-eu-ai-act-54986689.json","targetId":"std:eu-ai-act","type":"belongs_to"},{"expectedCatalogRevision":"791ff2dd3a45707290badee660f185e514d15f1cf518908628f425c2f2c56ee4","id":"rel:b16d94a2172ca8f0cd1a12637021852d2064f9132dd64f4ad2453c881c7973b1","properties":{},"sourceDetailPath":"/data/v1/records/ctrl-iso-27001-a-5-26-863e832e.json","sourceId":"ctrl:iso-27001:A.5.26","targetDetailPath":"/data/v1/records/std-iso-27001-656201bd.json","targetId":"std:iso-27001","type":"belongs_to"},{"expectedCatalogRevision":"791ff2dd3a45707290badee660f185e514d15f1cf518908628f425c2f2c56ee4","id":"rel:b49441ad04e7bb2572f9ca20f5e87f347a22f75d23a7969d40c00117e61d6d09","properties":{"control_id":"D004","coverage":"full","delta":null,"framework":"aiuc-1","provenance":{"defaultConfidence":"medium","defaultStatus":"active","direction":"canonical_to_source","mapper":"coworkcanvas-compliance-graph","note":"Each member is a documented relationship claim from the canonical unified control to a source control or guidance proposition. relationship: equal|superset_of (full) / intersects_with|subset_of (partial) / informs (guidance). confidence 'medium' = single-mapper, documented, not yet externally corroborated. source_version is the member framework's edition from the standard version register.","reviewDate":"2026-09-07"},"relationship":"superset_of","source_version":"July 15, 2026 release (quarterly update cadence)"},"sourceDetailPath":"/data/v1/records/uc-uc-ai-21-8afd47db.json","sourceId":"uc:UC-AI-21","targetDetailPath":"/data/v1/records/ctrl-aiuc-1-d004-21d4eeb4.json","targetId":"ctrl:aiuc-1:D004","type":"maps_to"},{"expectedCatalogRevision":"791ff2dd3a45707290badee660f185e514d15f1cf518908628f425c2f2c56ee4","id":"rel:bb8674403229a0ce2c5ec8c9080da85bd8087859e0a852a85af0bac50d670a98","properties":{"control_id":"DORA-Art24-27","coverage":"partial","delta":"vulnerability assessments and the Art 25 security-testing catalogue satisfied by companion controls; TLPT regime specifics - three-yearly cadence, authority-approved scope, independent/certified testers (Arts 26-27), and tester independence (Art 24(4)) - require dedicated controls","framework":"dora","provenance":{"defaultConfidence":"medium","defaultStatus":"active","direction":"canonical_to_source","mapper":"coworkcanvas-compliance-graph","note":"Each member is a documented relationship claim from the canonical unified control to a source control or guidance proposition. relationship: equal|superset_of (full) / intersects_with|subset_of (partial) / informs (guidance). confidence 'medium' = single-mapper, documented, not yet externally corroborated. source_version is the member framework's edition from the standard version register.","reviewDate":"2026-09-07"},"relationship":"intersects_with","source_version":"Regulation (EU) 2022/2554"},"sourceDetailPath":"/data/v1/records/uc-uc-bcdr-10-602160e4.json","sourceId":"uc:UC-BCDR-10","targetDetailPath":"/data/v1/records/ctrl-dora-dora-art24-27-dc4b8836.json","targetId":"ctrl:dora:DORA-Art24-27","type":"maps_to"},{"expectedCatalogRevision":"791ff2dd3a45707290badee660f185e514d15f1cf518908628f425c2f2c56ee4","id":"rel:bf5f7706b3e73a46db661616cf5be6eac2a75128746032843f715220ed4b0d51","properties":{"control_id":"HIPAA-164.312(b)","coverage":"full","delta":null,"framework":"hipaa","provenance":{"defaultConfidence":"medium","defaultStatus":"active","direction":"canonical_to_source","mapper":"coworkcanvas-compliance-graph","note":"Each member is a documented relationship claim from the canonical unified control to a source control or guidance proposition. relationship: equal|superset_of (full) / intersects_with|subset_of (partial) / informs (guidance). confidence 'medium' = single-mapper, documented, not yet externally corroborated. source_version is the member framework's edition from the standard version register.","reviewDate":"2026-09-07"},"relationship":"superset_of","source_version":"45 CFR Parts 160/164 (Security, Privacy, Breach Notification)"},"sourceDetailPath":"/data/v1/records/uc-uc-log-01-022e9745.json","sourceId":"uc:UC-LOG-01","targetDetailPath":"/data/v1/records/ctrl-hipaa-hipaa-164-312-b-7272303c.json","targetId":"ctrl:hipaa:HIPAA-164.312(b)","type":"maps_to"},{"expectedCatalogRevision":"791ff2dd3a45707290badee660f185e514d15f1cf518908628f425c2f2c56ee4","id":"rel:bfb7de3a8015b3a23a00a22565f5ec4ed0ddcdd12489f4bb54574cd8ddbc7472","properties":{"control_id":"DSS03","coverage":"full","delta":null,"framework":"cobit-2019","provenance":{"defaultConfidence":"medium","defaultStatus":"active","direction":"canonical_to_source","mapper":"coworkcanvas-compliance-graph","note":"Each member is a documented relationship claim from the canonical unified control to a source control or guidance proposition. relationship: equal|superset_of (full) / intersects_with|subset_of (partial) / informs (guidance). confidence 'medium' = single-mapper, documented, not yet externally corroborated. source_version is the member framework's edition from the standard version register.","reviewDate":"2026-09-07"},"relationship":"superset_of","source_version":"2019"},"sourceDetailPath":"/data/v1/records/uc-uc-bcdr-06-c505e5bd.json","sourceId":"uc:UC-BCDR-06","targetDetailPath":"/data/v1/records/ctrl-cobit-2019-dss03-2540740f.json","targetId":"ctrl:cobit-2019:DSS03","type":"maps_to"},{"expectedCatalogRevision":"791ff2dd3a45707290badee660f185e514d15f1cf518908628f425c2f2c56ee4","id":"rel:c004356ed83fe24ae6123dec85b7ce5b0a8df574641f5cf6abb86bf0567cdd12","properties":{"control_id":"E015","coverage":"full","delta":null,"framework":"aiuc-1","provenance":{"defaultConfidence":"medium","defaultStatus":"active","direction":"canonical_to_source","mapper":"coworkcanvas-compliance-graph","note":"Each member is a documented relationship claim from the canonical unified control to a source control or guidance proposition. relationship: equal|superset_of (full) / intersects_with|subset_of (partial) / informs (guidance). confidence 'medium' = single-mapper, documented, not yet externally corroborated. source_version is the member framework's edition from the standard version register.","reviewDate":"2026-09-07"},"relationship":"superset_of","source_version":"July 15, 2026 release (quarterly update cadence)"},"sourceDetailPath":"/data/v1/records/uc-uc-ai-08-fada68b7.json","sourceId":"uc:UC-AI-08","targetDetailPath":"/data/v1/records/ctrl-aiuc-1-e015-94a0c8ea.json","targetId":"ctrl:aiuc-1:E015","type":"maps_to"},{"expectedCatalogRevision":"791ff2dd3a45707290badee660f185e514d15f1cf518908628f425c2f2c56ee4","id":"rel:c530cc1fc512c2a65966b3618d10b34c3e8e6c8d48b0b90f66500505f8fac21e","properties":{},"sourceDetailPath":"/data/v1/records/ctrl-iso-27001-a-5-28-e9d04483.json","sourceId":"ctrl:iso-27001:A.5.28","targetDetailPath":"/data/v1/records/std-iso-27001-656201bd.json","targetId":"std:iso-27001","type":"belongs_to"},{"expectedCatalogRevision":"791ff2dd3a45707290badee660f185e514d15f1cf518908628f425c2f2c56ee4","id":"rel:cef3659c19b299952916eb1c72046246e40f0deee302865659cc3f0729e3018d","properties":{"control_id":"A.5.18","coverage":"partial","delta":"provisioning, adjustment, and revocation satisfied by the account lifecycle control","framework":"iso-27001","provenance":{"defaultConfidence":"medium","defaultStatus":"active","direction":"canonical_to_source","mapper":"coworkcanvas-compliance-graph","note":"Each member is a documented relationship claim from the canonical unified control to a source control or guidance proposition. relationship: equal|superset_of (full) / intersects_with|subset_of (partial) / informs (guidance). confidence 'medium' = single-mapper, documented, not yet externally corroborated. source_version is the member framework's edition from the standard version register.","reviewDate":"2026-09-07"},"relationship":"intersects_with","source_version":"2022"},"sourceDetailPath":"/data/v1/records/uc-uc-access-02-0132e278.json","sourceId":"uc:UC-ACCESS-02","targetDetailPath":"/data/v1/records/ctrl-iso-27001-a-5-18-472ef6f1.json","targetId":"ctrl:iso-27001:A.5.18","type":"maps_to"},{"expectedCatalogRevision":"791ff2dd3a45707290badee660f185e514d15f1cf518908628f425c2f2c56ee4","id":"rel:cff1193b4288fe551157bf960ab5acccac13ae290735955d5c5e704f34cab9db","properties":{},"sourceDetailPath":"/data/v1/records/ctrl-dora-dora-art24-27-dc4b8836.json","sourceId":"ctrl:dora:DORA-Art24-27","targetDetailPath":"/data/v1/records/std-dora-95cf939d.json","targetId":"std:dora","type":"belongs_to"},{"expectedCatalogRevision":"791ff2dd3a45707290badee660f185e514d15f1cf518908628f425c2f2c56ee4","id":"rel:d16f10ed1a0c7529a9cb3f843113b2246df77c34d6c0e5cdc78c5c436dd87122","properties":{"control_id":"A.5.7","coverage":"full","delta":null,"framework":"iso-27001","provenance":{"defaultConfidence":"medium","defaultStatus":"active","direction":"canonical_to_source","mapper":"coworkcanvas-compliance-graph","note":"Each member is a documented relationship claim from the canonical unified control to a source control or guidance proposition. relationship: equal|superset_of (full) / intersects_with|subset_of (partial) / informs (guidance). confidence 'medium' = single-mapper, documented, not yet externally corroborated. source_version is the member framework's edition from the standard version register.","reviewDate":"2026-09-07"},"relationship":"superset_of","source_version":"2022"},"sourceDetailPath":"/data/v1/records/uc-uc-risk-17-4ea73b39.json","sourceId":"uc:UC-RISK-17","targetDetailPath":"/data/v1/records/ctrl-iso-27001-a-5-7-0328fe6b.json","targetId":"ctrl:iso-27001:A.5.7","type":"maps_to"},{"expectedCatalogRevision":"791ff2dd3a45707290badee660f185e514d15f1cf518908628f425c2f2c56ee4","id":"rel:d5dca93df6c9f5e530850413d15cfae38b5b043a13806a8d64c2bcb79f49bcf8","properties":{},"sourceDetailPath":"/data/v1/records/ctrl-iso-27001-a-5-25-7dc7a20c.json","sourceId":"ctrl:iso-27001:A.5.25","targetDetailPath":"/data/v1/records/std-iso-27001-656201bd.json","targetId":"std:iso-27001","type":"belongs_to"},{"expectedCatalogRevision":"791ff2dd3a45707290badee660f185e514d15f1cf518908628f425c2f2c56ee4","id":"rel:dbe656ec41a00e61bfd294b0ea18e81c7a16e4ddca41c534718e390300f999c0","properties":{},"sourceDetailPath":"/data/v1/records/ctrl-gdpr-gdpr-art33-a2a440c2.json","sourceId":"ctrl:gdpr:GDPR-Art33","targetDetailPath":"/data/v1/records/std-gdpr-17d65d0b.json","targetId":"std:gdpr","type":"belongs_to"},{"expectedCatalogRevision":"791ff2dd3a45707290badee660f185e514d15f1cf518908628f425c2f2c56ee4","id":"rel:ddc52a3e4e143989b6eafea19376f24a04235bec1d452011589e6ebfc946cb37","properties":{},"sourceDetailPath":"/data/v1/records/ctrl-aiuc-1-d002-34554b38.json","sourceId":"ctrl:aiuc-1:D002","targetDetailPath":"/data/v1/records/std-aiuc-1-d2a8b650.json","targetId":"std:aiuc-1","type":"belongs_to"},{"expectedCatalogRevision":"791ff2dd3a45707290badee660f185e514d15f1cf518908628f425c2f2c56ee4","id":"rel:e25af5768f22128e1055e10a2199c3d56161178d27b3c68001e5f625c5a67e54","properties":{},"sourceDetailPath":"/data/v1/records/ctrl-aiuc-1-e009-5269a385.json","sourceId":"ctrl:aiuc-1:E009","targetDetailPath":"/data/v1/records/std-aiuc-1-d2a8b650.json","targetId":"std:aiuc-1","type":"belongs_to"},{"expectedCatalogRevision":"791ff2dd3a45707290badee660f185e514d15f1cf518908628f425c2f2c56ee4","id":"rel:e606dc337059883eca825fc58e55c1db8da105553e224d4723b18417ca8583ac","properties":{"control_id":"B001","coverage":"full","delta":null,"framework":"aiuc-1","provenance":{"defaultConfidence":"medium","defaultStatus":"active","direction":"canonical_to_source","mapper":"coworkcanvas-compliance-graph","note":"Each member is a documented relationship claim from the canonical unified control to a source control or guidance proposition. relationship: equal|superset_of (full) / intersects_with|subset_of (partial) / informs (guidance). confidence 'medium' = single-mapper, documented, not yet externally corroborated. source_version is the member framework's edition from the standard version register.","reviewDate":"2026-09-07"},"relationship":"superset_of","source_version":"July 15, 2026 release (quarterly update cadence)"},"sourceDetailPath":"/data/v1/records/uc-uc-ai-21-8afd47db.json","sourceId":"uc:UC-AI-21","targetDetailPath":"/data/v1/records/ctrl-aiuc-1-b001-19a54ee3.json","targetId":"ctrl:aiuc-1:B001","type":"maps_to"},{"expectedCatalogRevision":"791ff2dd3a45707290badee660f185e514d15f1cf518908628f425c2f2c56ee4","id":"rel:eb0ed37196560f352a362b415b0bec4f7d604169244d4e8fe9f149661b959caf","properties":{},"sourceDetailPath":"/data/v1/records/ctrl-aiuc-1-c011-7889db41.json","sourceId":"ctrl:aiuc-1:C011","targetDetailPath":"/data/v1/records/std-aiuc-1-d2a8b650.json","targetId":"std:aiuc-1","type":"belongs_to"},{"expectedCatalogRevision":"791ff2dd3a45707290badee660f185e514d15f1cf518908628f425c2f2c56ee4","id":"rel:f0c83635efeba62d090fe35f8b2986eb6385b02b17fd74179801aaf67ac7f465","properties":{"control_id":"A.5.28","coverage":"full","delta":null,"framework":"iso-27001","provenance":{"defaultConfidence":"medium","defaultStatus":"active","direction":"canonical_to_source","mapper":"coworkcanvas-compliance-graph","note":"Each member is a documented relationship claim from the canonical unified control to a source control or guidance proposition. relationship: equal|superset_of (full) / intersects_with|subset_of (partial) / informs (guidance). confidence 'medium' = single-mapper, documented, not yet externally corroborated. source_version is the member framework's edition from the standard version register.","reviewDate":"2026-09-07"},"relationship":"superset_of","source_version":"2022"},"sourceDetailPath":"/data/v1/records/uc-uc-ir-07-b4d61eff.json","sourceId":"uc:UC-IR-07","targetDetailPath":"/data/v1/records/ctrl-iso-27001-a-5-28-e9d04483.json","targetId":"ctrl:iso-27001:A.5.28","type":"maps_to"},{"expectedCatalogRevision":"791ff2dd3a45707290badee660f185e514d15f1cf518908628f425c2f2c56ee4","id":"rel:f26464c19c5287e54a6d2bf630191ccc3b3196567844c1979896c115397f8603","properties":{"control_id":"C008","coverage":"partial","delta":"monitoring keyed to the AI risk taxonomy categories with per-category alert thresholds and response actions","framework":"aiuc-1","provenance":{"defaultConfidence":"medium","defaultStatus":"active","direction":"canonical_to_source","mapper":"coworkcanvas-compliance-graph","note":"Each member is a documented relationship claim from the canonical unified control to a source control or guidance proposition. relationship: equal|superset_of (full) / intersects_with|subset_of (partial) / informs (guidance). confidence 'medium' = single-mapper, documented, not yet externally corroborated. source_version is the member framework's edition from the standard version register.","reviewDate":"2026-09-07"},"relationship":"intersects_with","source_version":"July 15, 2026 release (quarterly update cadence)"},"sourceDetailPath":"/data/v1/records/uc-uc-ai-08-fada68b7.json","sourceId":"uc:UC-AI-08","targetDetailPath":"/data/v1/records/ctrl-aiuc-1-c008-94bd64f2.json","targetId":"ctrl:aiuc-1:C008","type":"maps_to"},{"expectedCatalogRevision":"791ff2dd3a45707290badee660f185e514d15f1cf518908628f425c2f2c56ee4","id":"rel:f2dc4ec8b339793b1bff17301c96cd06c5e9a52ec5e53e22202d4a3ea2c5932c","properties":{},"sourceDetailPath":"/data/v1/records/ctrl-iso-27001-a-5-16-46fc8420.json","sourceId":"ctrl:iso-27001:A.5.16","targetDetailPath":"/data/v1/records/std-iso-27001-656201bd.json","targetId":"std:iso-27001","type":"belongs_to"},{"expectedCatalogRevision":"791ff2dd3a45707290badee660f185e514d15f1cf518908628f425c2f2c56ee4","id":"rel:f88f1f5f58d8e1ec14714587c7e139ff273175c626d9948d5a60b0dd530f56fe","properties":{"control_id":"E009","coverage":"partial","delta":"monitoring of third-party API connections, integrations, and sessions into AI systems, including revocation of stale access","framework":"aiuc-1","provenance":{"defaultConfidence":"medium","defaultStatus":"active","direction":"canonical_to_source","mapper":"coworkcanvas-compliance-graph","note":"Each member is a documented relationship claim from the canonical unified control to a source control or guidance proposition. relationship: equal|superset_of (full) / intersects_with|subset_of (partial) / informs (guidance). confidence 'medium' = single-mapper, documented, not yet externally corroborated. source_version is the member framework's edition from the standard version register.","reviewDate":"2026-09-07"},"relationship":"intersects_with","source_version":"July 15, 2026 release (quarterly update cadence)"},"sourceDetailPath":"/data/v1/records/uc-uc-log-09-54136146.json","sourceId":"uc:UC-LOG-09","targetDetailPath":"/data/v1/records/ctrl-aiuc-1-e009-5269a385.json","targetId":"ctrl:aiuc-1:E009","type":"maps_to"},{"expectedCatalogRevision":"791ff2dd3a45707290badee660f185e514d15f1cf518908628f425c2f2c56ee4","id":"rel:fa025a0315b5823b158620adb1e426d69f3be952af40edb9d2b815f9a31e2bc6","properties":{"control_id":"A003","coverage":"partial","delta":"agent-specific enforcement: data access scoped per task, user role, agent role, and context at inference time","framework":"aiuc-1","provenance":{"defaultConfidence":"medium","defaultStatus":"active","direction":"canonical_to_source","mapper":"coworkcanvas-compliance-graph","note":"Each member is a documented relationship claim from the canonical unified control to a source control or guidance proposition. relationship: equal|superset_of (full) / intersects_with|subset_of (partial) / informs (guidance). confidence 'medium' = single-mapper, documented, not yet externally corroborated. source_version is the member framework's edition from the standard version register.","reviewDate":"2026-09-07"},"relationship":"intersects_with","source_version":"July 15, 2026 release (quarterly update cadence)"},"sourceDetailPath":"/data/v1/records/uc-uc-access-03-43eeb212.json","sourceId":"uc:UC-ACCESS-03","targetDetailPath":"/data/v1/records/ctrl-aiuc-1-a003-bea61fd9.json","targetId":"ctrl:aiuc-1:A003","type":"maps_to"},{"expectedCatalogRevision":"791ff2dd3a45707290badee660f185e514d15f1cf518908628f425c2f2c56ee4","id":"rel:fb1c8dd28ee831d63f9bbf5d171a0a088378fd7d5d6fc7e7be7195d57e5b27f1","properties":{"control_id":"AIA-Art19","coverage":"full","delta":null,"framework":"eu-ai-act","provenance":{"defaultConfidence":"medium","defaultStatus":"active","direction":"canonical_to_source","mapper":"coworkcanvas-compliance-graph","note":"Each member is a documented relationship claim from the canonical unified control to a source control or guidance proposition. relationship: equal|superset_of (full) / intersects_with|subset_of (partial) / informs (guidance). confidence 'medium' = single-mapper, documented, not yet externally corroborated. source_version is the member framework's edition from the standard version register.","reviewDate":"2026-09-07"},"relationship":"superset_of","source_version":"Regulation (EU) 2024/1689"},"sourceDetailPath":"/data/v1/records/uc-uc-ai-08-fada68b7.json","sourceId":"uc:UC-AI-08","targetDetailPath":"/data/v1/records/ctrl-eu-ai-act-aia-art19-55451bfa.json","targetId":"ctrl:eu-ai-act:AIA-Art19","type":"maps_to"},{"expectedCatalogRevision":"791ff2dd3a45707290badee660f185e514d15f1cf518908628f425c2f2c56ee4","id":"rel:fbcc32d3308dfe1e2b2af67ca3fa556f7fabce7f55b7f1833e4b6cc79879460f","properties":{},"sourceDetailPath":"/data/v1/records/ctrl-iso-27001-a-6-8-87f56c6a.json","sourceId":"ctrl:iso-27001:A.6.8","targetDetailPath":"/data/v1/records/std-iso-27001-656201bd.json","targetId":"std:iso-27001","type":"belongs_to"}],"schemaVersion":1,"scope":"topics","total":377}