{"catalogRevision":"791ff2dd3a45707290badee660f185e514d15f1cf518908628f425c2f2c56ee4","contextIds":["ctrl:aiuc-1:B001","ctrl:aiuc-1:B002","ctrl:aiuc-1:B004","ctrl:aiuc-1:B005","ctrl:aiuc-1:B008","ctrl:aiuc-1:C010","ctrl:aiuc-1:C011","ctrl:aiuc-1:C012","ctrl:aiuc-1:D002","ctrl:aiuc-1:D004","ctrl:aiuc-1:E006","ctrl:aiuc-1:E011","ctrl:cobit-2019:BAI01","ctrl:cobit-2019:BAI02","ctrl:cobit-2019:BAI03","ctrl:cobit-2019:BAI06","ctrl:cobit-2019:BAI07","ctrl:cobit-2019:BAI09","ctrl:cobit-2019:BAI10","ctrl:cobit-2019:BAI11","ctrl:coso-ic:P12","ctrl:dora:DORA-Art45","ctrl:eu-ai-act:AIA-Art10","ctrl:eu-ai-act:AIA-Art15","ctrl:eu-ai-act:AIA-Art53","ctrl:eu-ai-act:AIA-Art55","ctrl:gdpr:GDPR-Art25","ctrl:iso-27001:A.8.20","ctrl:iso-27001:A.8.21","ctrl:iso-27001:A.8.22","ctrl:iso-27001:A.8.23","ctrl:iso-27001:A.8.25","ctrl:iso-27001:A.8.26","ctrl:iso-27001:A.8.27","ctrl:iso-27001:A.8.28","ctrl:iso-27001:A.8.29","ctrl:iso-27001:A.8.30","ctrl:iso-27001:A.8.31","ctrl:iso-27001:A.8.32","ctrl:iso-27001:A.8.33"],"directIds":[],"kind":"bundle","metadata":"/assets/agent_metadata.84eaa456936e4fa1.json","name":"Vulnerability & Patch Management","next":"/assets/agent_topics-vulnerability-patch-management-2.6c817eb223949bb3.json","page":1,"pageSize":40,"records":[{"attributes":{"category":"administrative","framework":"aiuc-1","type":"preventive"},"canonicalUrl":"https://evidenceflows.com/frameworks/aiuc-1/","description":"Third-party testing of adversarial robustness","details":{"automation":"manual","control_category":"administrative","control_id":"B001","control_type":"preventive","domains":["AI Governance","Access Control & Identity Management","Secure Development (SDLC) & Application Security"],"framework":"aiuc-1","group":"Security","key_control":true,"requirement_frequency":"Every 3 months","requirement_status":"mandatory","risk_count":5,"source_pages":null,"source_url":"https://www.aiuc-1.com/security/test-adversarial-robustness"},"direct":false,"history":{"digest":"cf7cbd803927ce2710fa4c5b5a0fcdf3d8b8cc27797b2d6230b215d91398cae5","firstSeenAt":"2026-09-17T22:28:00Z","firstSeenRevision":"f368a6cce277037e4b1e1ff46004e3acd295f96c9ac63a411a0e45775a7f468e","updatedAt":"2026-09-17T22:28:00Z","updatedRevision":"f368a6cce277037e4b1e1ff46004e3acd295f96c9ac63a411a0e45775a7f468e"},"htmlUrl":"/agents/records/ctrl-aiuc-1-b001-19a54ee3.html","id":"ctrl:aiuc-1:B001","mapUrl":"https://evidenceflows.com/?v=1&node=ctrl%3Aaiuc-1%3AB001","sourceIds":["aiuc-1"],"sourceUrl":"https://www.aiuc-1.com/security/test-adversarial-robustness","title":"B001 — Third-party testing of adversarial robustness","type":"control","updatedAt":"2026-09-17T22:28:00Z","url":"/assets/agent_record-ctrl-aiuc-1-b001-19a54ee3.64b04d73f3abef65.json"},{"attributes":{"category":"technical","framework":"aiuc-1","type":"detective"},"canonicalUrl":"https://evidenceflows.com/frameworks/aiuc-1/","description":"Detect adversarial input","details":{"automation":"automated","control_category":"technical","control_id":"B002","control_type":"detective","domains":["AI Governance","Access Control & Identity Management","Secure Development (SDLC) & Application Security"],"framework":"aiuc-1","group":"Security","key_control":false,"requirement_frequency":"Every 3 months","requirement_status":"optional","risk_count":4,"source_pages":null,"source_url":"https://www.aiuc-1.com/security/detect-adversarial-input"},"direct":false,"history":{"digest":"70cbaed5340cba564c86d75b60882fe12373526228c79e43e2385d09874caf48","firstSeenAt":"2026-09-17T22:28:00Z","firstSeenRevision":"f368a6cce277037e4b1e1ff46004e3acd295f96c9ac63a411a0e45775a7f468e","updatedAt":"2026-09-17T22:28:00Z","updatedRevision":"f368a6cce277037e4b1e1ff46004e3acd295f96c9ac63a411a0e45775a7f468e"},"htmlUrl":"/agents/records/ctrl-aiuc-1-b002-07a4b0e1.html","id":"ctrl:aiuc-1:B002","mapUrl":"https://evidenceflows.com/?v=1&node=ctrl%3Aaiuc-1%3AB002","sourceIds":["aiuc-1"],"sourceUrl":"https://www.aiuc-1.com/security/detect-adversarial-input","title":"B002 — Detect adversarial input","type":"control","updatedAt":"2026-09-17T22:28:00Z","url":"/assets/agent_record-ctrl-aiuc-1-b002-07a4b0e1.15a85559f2becc71.json"},{"attributes":{"category":"technical","framework":"aiuc-1","type":"preventive"},"canonicalUrl":"https://evidenceflows.com/frameworks/aiuc-1/","description":"Prevent AI endpoint scraping","details":{"automation":"automated","control_category":"technical","control_id":"B004","control_type":"preventive","domains":["AI Governance","Access Control & Identity Management","Secure Development (SDLC) & Application Security"],"framework":"aiuc-1","group":"Security","key_control":false,"requirement_frequency":"Every 12 months","requirement_status":"mandatory","risk_count":4,"source_pages":null,"source_url":"https://www.aiuc-1.com/security/prevent-ai-endpoint-scraping"},"direct":false,"history":{"digest":"af063c791143e7bf3dae1589e1fec08cff61982b9192f215573fc61048fe3812","firstSeenAt":"2026-09-17T22:28:00Z","firstSeenRevision":"f368a6cce277037e4b1e1ff46004e3acd295f96c9ac63a411a0e45775a7f468e","updatedAt":"2026-09-17T22:28:00Z","updatedRevision":"f368a6cce277037e4b1e1ff46004e3acd295f96c9ac63a411a0e45775a7f468e"},"htmlUrl":"/agents/records/ctrl-aiuc-1-b004-d4ff3b14.html","id":"ctrl:aiuc-1:B004","mapUrl":"https://evidenceflows.com/?v=1&node=ctrl%3Aaiuc-1%3AB004","sourceIds":["aiuc-1"],"sourceUrl":"https://www.aiuc-1.com/security/prevent-ai-endpoint-scraping","title":"B004 — Prevent AI endpoint scraping","type":"control","updatedAt":"2026-09-17T22:28:00Z","url":"/assets/agent_record-ctrl-aiuc-1-b004-d4ff3b14.30c7d7c5f6c99475.json"},{"attributes":{"category":"technical","framework":"aiuc-1","type":"detective"},"canonicalUrl":"https://evidenceflows.com/frameworks/aiuc-1/","description":"Implement real-time input filtering","details":{"automation":"automated","control_category":"technical","control_id":"B005","control_type":"detective","domains":["AI Governance","Access Control & Identity Management","Secure Development (SDLC) & Application Security"],"framework":"aiuc-1","group":"Security","key_control":false,"requirement_frequency":"Every 12 months","requirement_status":"optional","risk_count":4,"source_pages":null,"source_url":"https://www.aiuc-1.com/security/implement-real-time-input-filtering"},"direct":false,"history":{"digest":"af4eb6b2c7fc1047a1dace2ac954d47855c5c9202e28f9cdfeb12698ad6434fa","firstSeenAt":"2026-09-17T22:28:00Z","firstSeenRevision":"f368a6cce277037e4b1e1ff46004e3acd295f96c9ac63a411a0e45775a7f468e","updatedAt":"2026-09-17T22:28:00Z","updatedRevision":"f368a6cce277037e4b1e1ff46004e3acd295f96c9ac63a411a0e45775a7f468e"},"htmlUrl":"/agents/records/ctrl-aiuc-1-b005-fe985c7b.html","id":"ctrl:aiuc-1:B005","mapUrl":"https://evidenceflows.com/?v=1&node=ctrl%3Aaiuc-1%3AB005","sourceIds":["aiuc-1"],"sourceUrl":"https://www.aiuc-1.com/security/implement-real-time-input-filtering","title":"B005 — Implement real-time input filtering","type":"control","updatedAt":"2026-09-17T22:28:00Z","url":"/assets/agent_record-ctrl-aiuc-1-b005-fe985c7b.d6a135e0d88df899.json"},{"attributes":{"category":"technical","framework":"aiuc-1","type":"preventive"},"canonicalUrl":"https://evidenceflows.com/frameworks/aiuc-1/","description":"Protect AI system deployment environment","details":{"automation":"hybrid","control_category":"technical","control_id":"B008","control_type":"preventive","domains":["AI Governance","Access Control & Identity Management","Secure Development (SDLC) & Application Security"],"framework":"aiuc-1","group":"Security","key_control":false,"requirement_frequency":"Every 12 months","requirement_status":"mandatory","risk_count":8,"source_pages":null,"source_url":"https://www.aiuc-1.com/security/protect-model-deployment-environment"},"direct":false,"history":{"digest":"aba9c9145dbbc97d397d008e18a629ec03c1998cf00f2ee2296d940d3dc4ee4c","firstSeenAt":"2026-09-17T22:28:00Z","firstSeenRevision":"f368a6cce277037e4b1e1ff46004e3acd295f96c9ac63a411a0e45775a7f468e","updatedAt":"2026-09-17T22:28:00Z","updatedRevision":"f368a6cce277037e4b1e1ff46004e3acd295f96c9ac63a411a0e45775a7f468e"},"htmlUrl":"/agents/records/ctrl-aiuc-1-b008-39c816b1.html","id":"ctrl:aiuc-1:B008","mapUrl":"https://evidenceflows.com/?v=1&node=ctrl%3Aaiuc-1%3AB008","sourceIds":["aiuc-1"],"sourceUrl":"https://www.aiuc-1.com/security/protect-model-deployment-environment","title":"B008 — Protect AI system deployment environment","type":"control","updatedAt":"2026-09-17T22:28:00Z","url":"/assets/agent_record-ctrl-aiuc-1-b008-39c816b1.bd2bbaf8b774e0ea.json"},{"attributes":{"category":"administrative","framework":"aiuc-1","type":"preventive"},"canonicalUrl":"https://evidenceflows.com/frameworks/aiuc-1/","description":"Third-party testing for harmful outputs","details":{"automation":"manual","control_category":"administrative","control_id":"C010","control_type":"preventive","domains":["AI Governance"],"framework":"aiuc-1","group":"Safety","key_control":true,"requirement_frequency":"Every 3 months","requirement_status":"mandatory","risk_count":5,"source_pages":null,"source_url":"https://www.aiuc-1.com/safety/3rd-party-testing-for-harmful-outputs"},"direct":false,"history":{"digest":"93c072654fe84c18d84a04015e3b7f8aab52adccb09c63a39ea7d9ec077d22b3","firstSeenAt":"2026-09-17T22:28:00Z","firstSeenRevision":"f368a6cce277037e4b1e1ff46004e3acd295f96c9ac63a411a0e45775a7f468e","updatedAt":"2026-09-17T22:28:00Z","updatedRevision":"f368a6cce277037e4b1e1ff46004e3acd295f96c9ac63a411a0e45775a7f468e"},"htmlUrl":"/agents/records/ctrl-aiuc-1-c010-b0a758b4.html","id":"ctrl:aiuc-1:C010","mapUrl":"https://evidenceflows.com/?v=1&node=ctrl%3Aaiuc-1%3AC010","sourceIds":["aiuc-1"],"sourceUrl":"https://www.aiuc-1.com/safety/3rd-party-testing-for-harmful-outputs","title":"C010 — Third-party testing for harmful outputs","type":"control","updatedAt":"2026-09-17T22:28:00Z","url":"/assets/agent_record-ctrl-aiuc-1-c010-b0a758b4.8b68f26b8fe69ccb.json"},{"attributes":{"category":"administrative","framework":"aiuc-1","type":"preventive"},"canonicalUrl":"https://evidenceflows.com/frameworks/aiuc-1/","description":"Third-party testing for out-of-scope outputs","details":{"automation":"manual","control_category":"administrative","control_id":"C011","control_type":"preventive","domains":["AI Governance"],"framework":"aiuc-1","group":"Safety","key_control":true,"requirement_frequency":"Every 3 months","requirement_status":"mandatory","risk_count":5,"source_pages":null,"source_url":"https://www.aiuc-1.com/safety/3rd-party-testing-for-out-of-scope-outputs"},"direct":false,"history":{"digest":"d58f7fe0fe69269e1fe6b6dfdb1e629d883aa44e6417ed16dbfb309bde24e472","firstSeenAt":"2026-09-17T22:28:00Z","firstSeenRevision":"f368a6cce277037e4b1e1ff46004e3acd295f96c9ac63a411a0e45775a7f468e","updatedAt":"2026-09-17T22:28:00Z","updatedRevision":"f368a6cce277037e4b1e1ff46004e3acd295f96c9ac63a411a0e45775a7f468e"},"htmlUrl":"/agents/records/ctrl-aiuc-1-c011-7889db41.html","id":"ctrl:aiuc-1:C011","mapUrl":"https://evidenceflows.com/?v=1&node=ctrl%3Aaiuc-1%3AC011","sourceIds":["aiuc-1"],"sourceUrl":"https://www.aiuc-1.com/safety/3rd-party-testing-for-out-of-scope-outputs","title":"C011 — Third-party testing for out-of-scope outputs","type":"control","updatedAt":"2026-09-17T22:28:00Z","url":"/assets/agent_record-ctrl-aiuc-1-c011-7889db41.4cc288c524ea3a49.json"},{"attributes":{"category":"administrative","framework":"aiuc-1","type":"preventive"},"canonicalUrl":"https://evidenceflows.com/frameworks/aiuc-1/","description":"Third-party testing for customer-defined risk","details":{"automation":"manual","control_category":"administrative","control_id":"C012","control_type":"preventive","domains":["AI Governance"],"framework":"aiuc-1","group":"Safety","key_control":true,"requirement_frequency":"Every 3 months","requirement_status":"mandatory","risk_count":5,"source_pages":null,"source_url":"https://www.aiuc-1.com/safety/3rd-party-testing-for-other-risk"},"direct":false,"history":{"digest":"e27684c19b1cb9ef794c16c5fbea92fdc92e3720b85ab7bda5ed18b1022c9603","firstSeenAt":"2026-09-17T22:28:00Z","firstSeenRevision":"f368a6cce277037e4b1e1ff46004e3acd295f96c9ac63a411a0e45775a7f468e","updatedAt":"2026-09-17T22:28:00Z","updatedRevision":"f368a6cce277037e4b1e1ff46004e3acd295f96c9ac63a411a0e45775a7f468e"},"htmlUrl":"/agents/records/ctrl-aiuc-1-c012-783c55df.html","id":"ctrl:aiuc-1:C012","mapUrl":"https://evidenceflows.com/?v=1&node=ctrl%3Aaiuc-1%3AC012","sourceIds":["aiuc-1"],"sourceUrl":"https://www.aiuc-1.com/safety/3rd-party-testing-for-other-risk","title":"C012 — Third-party testing for customer-defined risk","type":"control","updatedAt":"2026-09-17T22:28:00Z","url":"/assets/agent_record-ctrl-aiuc-1-c012-783c55df.16eb92a98daaccb0.json"},{"attributes":{"category":"administrative","framework":"aiuc-1","type":"preventive"},"canonicalUrl":"https://evidenceflows.com/frameworks/aiuc-1/","description":"Third-party testing for hallucinations","details":{"automation":"manual","control_category":"administrative","control_id":"D002","control_type":"preventive","domains":["AI Governance"],"framework":"aiuc-1","group":"Reliability","key_control":true,"requirement_frequency":"Every 3 months","requirement_status":"mandatory","risk_count":5,"source_pages":null,"source_url":"https://www.aiuc-1.com/reliability/3rd-party-testing-for-hallucinations"},"direct":false,"history":{"digest":"101c1b68e971e3defed1adbd5600baf7f583df0525af4ae5e66e37a3c6c4e3f3","firstSeenAt":"2026-09-17T22:28:00Z","firstSeenRevision":"f368a6cce277037e4b1e1ff46004e3acd295f96c9ac63a411a0e45775a7f468e","updatedAt":"2026-09-17T22:28:00Z","updatedRevision":"f368a6cce277037e4b1e1ff46004e3acd295f96c9ac63a411a0e45775a7f468e"},"htmlUrl":"/agents/records/ctrl-aiuc-1-d002-34554b38.html","id":"ctrl:aiuc-1:D002","mapUrl":"https://evidenceflows.com/?v=1&node=ctrl%3Aaiuc-1%3AD002","sourceIds":["aiuc-1"],"sourceUrl":"https://www.aiuc-1.com/reliability/3rd-party-testing-for-hallucinations","title":"D002 — Third-party testing for hallucinations","type":"control","updatedAt":"2026-09-17T22:28:00Z","url":"/assets/agent_record-ctrl-aiuc-1-d002-34554b38.edb0ffec2f39f388.json"},{"attributes":{"category":"administrative","framework":"aiuc-1","type":"preventive"},"canonicalUrl":"https://evidenceflows.com/frameworks/aiuc-1/","description":"Third-party testing of tool calls","details":{"automation":"manual","control_category":"administrative","control_id":"D004","control_type":"preventive","domains":["AI Governance"],"framework":"aiuc-1","group":"Reliability","key_control":true,"requirement_frequency":"Every 3 months","requirement_status":"mandatory","risk_count":5,"source_pages":null,"source_url":"https://www.aiuc-1.com/reliability/3rd-party-testing-of-tool-calls"},"direct":false,"history":{"digest":"e2ab8887ae3a8b6419c3342d94b670c8b67d018364ce2f66fd772f0906a6e91a","firstSeenAt":"2026-09-17T22:28:00Z","firstSeenRevision":"f368a6cce277037e4b1e1ff46004e3acd295f96c9ac63a411a0e45775a7f468e","updatedAt":"2026-09-17T22:28:00Z","updatedRevision":"f368a6cce277037e4b1e1ff46004e3acd295f96c9ac63a411a0e45775a7f468e"},"htmlUrl":"/agents/records/ctrl-aiuc-1-d004-21d4eeb4.html","id":"ctrl:aiuc-1:D004","mapUrl":"https://evidenceflows.com/?v=1&node=ctrl%3Aaiuc-1%3AD004","sourceIds":["aiuc-1"],"sourceUrl":"https://www.aiuc-1.com/reliability/3rd-party-testing-of-tool-calls","title":"D004 — Third-party testing of tool calls","type":"control","updatedAt":"2026-09-17T22:28:00Z","url":"/assets/agent_record-ctrl-aiuc-1-d004-21d4eeb4.b265770723c2fde4.json"},{"attributes":{"category":"administrative","framework":"aiuc-1","type":"preventive"},"canonicalUrl":"https://evidenceflows.com/frameworks/aiuc-1/","description":"Conduct vendor due diligence","details":{"automation":"manual","control_category":"administrative","control_id":"E006","control_type":"preventive","domains":["AI Governance","Governance, Policy & Oversight"],"framework":"aiuc-1","group":"Accountability","key_control":false,"requirement_frequency":"Every 12 months","requirement_status":"mandatory","risk_count":5,"source_pages":null,"source_url":"https://www.aiuc-1.com/accountability/conduct-vendor-due-diligence"},"direct":false,"history":{"digest":"e87ca5b9e8cf3d1b476b9827a6cf22e48dae952c9b2c4ce4b8b7f69a8b392b57","firstSeenAt":"2026-09-17T22:28:00Z","firstSeenRevision":"f368a6cce277037e4b1e1ff46004e3acd295f96c9ac63a411a0e45775a7f468e","updatedAt":"2026-09-17T22:28:00Z","updatedRevision":"f368a6cce277037e4b1e1ff46004e3acd295f96c9ac63a411a0e45775a7f468e"},"htmlUrl":"/agents/records/ctrl-aiuc-1-e006-362f564d.html","id":"ctrl:aiuc-1:E006","mapUrl":"https://evidenceflows.com/?v=1&node=ctrl%3Aaiuc-1%3AE006","sourceIds":["aiuc-1"],"sourceUrl":"https://www.aiuc-1.com/accountability/conduct-vendor-due-diligence","title":"E006 — Conduct vendor due diligence","type":"control","updatedAt":"2026-09-17T22:28:00Z","url":"/assets/agent_record-ctrl-aiuc-1-e006-362f564d.72ef166cf0e4c7fc.json"},{"attributes":{"category":"administrative","framework":"aiuc-1","type":"preventive"},"canonicalUrl":"https://evidenceflows.com/frameworks/aiuc-1/","description":"Record processing locations","details":{"automation":"manual","control_category":"administrative","control_id":"E011","control_type":"preventive","domains":["AI Governance","Governance, Policy & Oversight"],"framework":"aiuc-1","group":"Accountability","key_control":false,"requirement_frequency":"Every 12 months","requirement_status":"mandatory","risk_count":1,"source_pages":null,"source_url":"https://www.aiuc-1.com/accountability/record-processing-locations"},"direct":false,"history":{"digest":"dd107dae2fa072297c029b2232a7d2542cb0c200e831b0546c40a28ed364bd27","firstSeenAt":"2026-09-17T22:28:00Z","firstSeenRevision":"f368a6cce277037e4b1e1ff46004e3acd295f96c9ac63a411a0e45775a7f468e","updatedAt":"2026-09-17T22:28:00Z","updatedRevision":"f368a6cce277037e4b1e1ff46004e3acd295f96c9ac63a411a0e45775a7f468e"},"htmlUrl":"/agents/records/ctrl-aiuc-1-e011-56758692.html","id":"ctrl:aiuc-1:E011","mapUrl":"https://evidenceflows.com/?v=1&node=ctrl%3Aaiuc-1%3AE011","sourceIds":["aiuc-1"],"sourceUrl":"https://www.aiuc-1.com/accountability/record-processing-locations","title":"E011 — Record processing locations","type":"control","updatedAt":"2026-09-17T22:28:00Z","url":"/assets/agent_record-ctrl-aiuc-1-e011-56758692.2f61197e322bd00d.json"},{"attributes":{"category":"administrative","framework":"cobit-2019","type":"preventive"},"canonicalUrl":"https://evidenceflows.com/frameworks/cobit-2019/","description":"Managed Programs","details":{"automation":"manual","control_category":"administrative","control_id":"BAI01","control_type":"preventive","domains":["Secure Development (SDLC) & Application Security","Secure Configuration & Change Management","Asset Management & Inventory","Business Continuity & Disaster Recovery"],"framework":"cobit-2019","group":"Build, Acquire and Implement","key_control":false,"requirement_frequency":null,"requirement_status":null,"risk_count":3,"source_pages":null,"source_url":null},"direct":false,"history":{"digest":"0360ad36aa123372f8959717ab5c3b412ab50a30180639822b7bd2ccac3a1c14","firstSeenAt":"2026-09-17T22:28:00Z","firstSeenRevision":"f368a6cce277037e4b1e1ff46004e3acd295f96c9ac63a411a0e45775a7f468e","updatedAt":"2026-09-17T22:28:00Z","updatedRevision":"f368a6cce277037e4b1e1ff46004e3acd295f96c9ac63a411a0e45775a7f468e"},"htmlUrl":"/agents/records/ctrl-cobit-2019-bai01-12e2e132.html","id":"ctrl:cobit-2019:BAI01","mapUrl":"https://evidenceflows.com/?v=1&node=ctrl%3Acobit-2019%3ABAI01","sourceIds":["cobit-2019"],"sourceUrl":null,"title":"BAI01 — Managed Programs","type":"control","updatedAt":"2026-09-17T22:28:00Z","url":"/assets/agent_record-ctrl-cobit-2019-bai01-12e2e132.ac6d0b6af7d362db.json"},{"attributes":{"category":"administrative","framework":"cobit-2019","type":"preventive"},"canonicalUrl":"https://evidenceflows.com/frameworks/cobit-2019/","description":"Managed Requirements Definition","details":{"automation":"manual","control_category":"administrative","control_id":"BAI02","control_type":"preventive","domains":["Secure Development (SDLC) & Application Security","Secure Configuration & Change Management","Asset Management & Inventory","Business Continuity & Disaster Recovery"],"framework":"cobit-2019","group":"Build, Acquire and Implement","key_control":false,"requirement_frequency":null,"requirement_status":null,"risk_count":5,"source_pages":null,"source_url":null},"direct":false,"history":{"digest":"19fb1f27af5974fb0b1792ca1da1d947e1e6c78604c5ee7ab36980771ff90814","firstSeenAt":"2026-09-17T22:28:00Z","firstSeenRevision":"f368a6cce277037e4b1e1ff46004e3acd295f96c9ac63a411a0e45775a7f468e","updatedAt":"2026-09-17T22:28:00Z","updatedRevision":"f368a6cce277037e4b1e1ff46004e3acd295f96c9ac63a411a0e45775a7f468e"},"htmlUrl":"/agents/records/ctrl-cobit-2019-bai02-80041b74.html","id":"ctrl:cobit-2019:BAI02","mapUrl":"https://evidenceflows.com/?v=1&node=ctrl%3Acobit-2019%3ABAI02","sourceIds":["cobit-2019"],"sourceUrl":null,"title":"BAI02 — Managed Requirements Definition","type":"control","updatedAt":"2026-09-17T22:28:00Z","url":"/assets/agent_record-ctrl-cobit-2019-bai02-80041b74.c5ceb308f51616e1.json"},{"attributes":{"category":"administrative","framework":"cobit-2019","type":"preventive"},"canonicalUrl":"https://evidenceflows.com/frameworks/cobit-2019/","description":"Managed Solutions Identification and Build","details":{"automation":"manual","control_category":"administrative","control_id":"BAI03","control_type":"preventive","domains":["Secure Development (SDLC) & Application Security","Secure Configuration & Change Management","Asset Management & Inventory","Business Continuity & Disaster Recovery"],"framework":"cobit-2019","group":"Build, Acquire and Implement","key_control":false,"requirement_frequency":null,"requirement_status":null,"risk_count":8,"source_pages":null,"source_url":null},"direct":false,"history":{"digest":"25bb1ef247c72cf9b780b6c56878df66bc96410bf84c5b87bbebfa3f0fca3cde","firstSeenAt":"2026-09-17T22:28:00Z","firstSeenRevision":"f368a6cce277037e4b1e1ff46004e3acd295f96c9ac63a411a0e45775a7f468e","updatedAt":"2026-09-17T22:28:00Z","updatedRevision":"f368a6cce277037e4b1e1ff46004e3acd295f96c9ac63a411a0e45775a7f468e"},"htmlUrl":"/agents/records/ctrl-cobit-2019-bai03-bfe681b0.html","id":"ctrl:cobit-2019:BAI03","mapUrl":"https://evidenceflows.com/?v=1&node=ctrl%3Acobit-2019%3ABAI03","sourceIds":["cobit-2019"],"sourceUrl":null,"title":"BAI03 — Managed Solutions Identification and Build","type":"control","updatedAt":"2026-09-17T22:28:00Z","url":"/assets/agent_record-ctrl-cobit-2019-bai03-bfe681b0.19bb1d3a4af3c2ea.json"},{"attributes":{"category":"administrative","framework":"cobit-2019","type":"preventive"},"canonicalUrl":"https://evidenceflows.com/frameworks/cobit-2019/","description":"Managed IT Changes","details":{"automation":"hybrid","control_category":"administrative","control_id":"BAI06","control_type":"preventive","domains":["Secure Development (SDLC) & Application Security","Secure Configuration & Change Management","Asset Management & Inventory","Business Continuity & Disaster Recovery"],"framework":"cobit-2019","group":"Build, Acquire and Implement","key_control":true,"requirement_frequency":null,"requirement_status":null,"risk_count":6,"source_pages":null,"source_url":null},"direct":false,"history":{"digest":"84a6803131eb62f186c0b77e5f0e002df93ce8a0c45b28e7f53b75bba265dfb6","firstSeenAt":"2026-09-17T22:28:00Z","firstSeenRevision":"f368a6cce277037e4b1e1ff46004e3acd295f96c9ac63a411a0e45775a7f468e","updatedAt":"2026-09-17T22:28:00Z","updatedRevision":"f368a6cce277037e4b1e1ff46004e3acd295f96c9ac63a411a0e45775a7f468e"},"htmlUrl":"/agents/records/ctrl-cobit-2019-bai06-306e8a70.html","id":"ctrl:cobit-2019:BAI06","mapUrl":"https://evidenceflows.com/?v=1&node=ctrl%3Acobit-2019%3ABAI06","sourceIds":["cobit-2019"],"sourceUrl":null,"title":"BAI06 — Managed IT Changes","type":"control","updatedAt":"2026-09-17T22:28:00Z","url":"/assets/agent_record-ctrl-cobit-2019-bai06-306e8a70.86c082dfc838d0e9.json"},{"attributes":{"category":"administrative","framework":"cobit-2019","type":"preventive"},"canonicalUrl":"https://evidenceflows.com/frameworks/cobit-2019/","description":"Managed IT Change Acceptance and Transitioning","details":{"automation":"manual","control_category":"administrative","control_id":"BAI07","control_type":"preventive","domains":["Secure Development (SDLC) & Application Security","Secure Configuration & Change Management","Asset Management & Inventory","Business Continuity & Disaster Recovery"],"framework":"cobit-2019","group":"Build, Acquire and Implement","key_control":false,"requirement_frequency":null,"requirement_status":null,"risk_count":6,"source_pages":null,"source_url":null},"direct":false,"history":{"digest":"115aa9e4049295f91a6b726d058d1dd121705d8868411fc891344934b7463a1f","firstSeenAt":"2026-09-17T22:28:00Z","firstSeenRevision":"f368a6cce277037e4b1e1ff46004e3acd295f96c9ac63a411a0e45775a7f468e","updatedAt":"2026-09-17T22:28:00Z","updatedRevision":"f368a6cce277037e4b1e1ff46004e3acd295f96c9ac63a411a0e45775a7f468e"},"htmlUrl":"/agents/records/ctrl-cobit-2019-bai07-dcabfa26.html","id":"ctrl:cobit-2019:BAI07","mapUrl":"https://evidenceflows.com/?v=1&node=ctrl%3Acobit-2019%3ABAI07","sourceIds":["cobit-2019"],"sourceUrl":null,"title":"BAI07 — Managed IT Change Acceptance and Transitioning","type":"control","updatedAt":"2026-09-17T22:28:00Z","url":"/assets/agent_record-ctrl-cobit-2019-bai07-dcabfa26.39f16072d1c0ed34.json"},{"attributes":{"category":"administrative","framework":"cobit-2019","type":"preventive"},"canonicalUrl":"https://evidenceflows.com/frameworks/cobit-2019/","description":"Managed Assets","details":{"automation":"hybrid","control_category":"administrative","control_id":"BAI09","control_type":"preventive","domains":["Secure Development (SDLC) & Application Security","Secure Configuration & Change Management","Asset Management & Inventory","Business Continuity & Disaster Recovery"],"framework":"cobit-2019","group":"Build, Acquire and Implement","key_control":false,"requirement_frequency":null,"requirement_status":null,"risk_count":3,"source_pages":null,"source_url":null},"direct":false,"history":{"digest":"79ed1c399eb16afaa611190439319635a66f1ff4bab8b79105e36893865924e3","firstSeenAt":"2026-09-17T22:28:00Z","firstSeenRevision":"f368a6cce277037e4b1e1ff46004e3acd295f96c9ac63a411a0e45775a7f468e","updatedAt":"2026-09-17T22:28:00Z","updatedRevision":"f368a6cce277037e4b1e1ff46004e3acd295f96c9ac63a411a0e45775a7f468e"},"htmlUrl":"/agents/records/ctrl-cobit-2019-bai09-09a008c3.html","id":"ctrl:cobit-2019:BAI09","mapUrl":"https://evidenceflows.com/?v=1&node=ctrl%3Acobit-2019%3ABAI09","sourceIds":["cobit-2019"],"sourceUrl":null,"title":"BAI09 — Managed Assets","type":"control","updatedAt":"2026-09-17T22:28:00Z","url":"/assets/agent_record-ctrl-cobit-2019-bai09-09a008c3.f5e7aa4bd9511d01.json"},{"attributes":{"category":"administrative","framework":"cobit-2019","type":"preventive"},"canonicalUrl":"https://evidenceflows.com/frameworks/cobit-2019/","description":"Managed Configuration","details":{"automation":"hybrid","control_category":"administrative","control_id":"BAI10","control_type":"preventive","domains":["Secure Development (SDLC) & Application Security","Secure Configuration & Change Management","Asset Management & Inventory","Business Continuity & Disaster Recovery"],"framework":"cobit-2019","group":"Build, Acquire and Implement","key_control":false,"requirement_frequency":null,"requirement_status":null,"risk_count":7,"source_pages":null,"source_url":null},"direct":false,"history":{"digest":"269190e98da93b35ac350c5ec7e6e06daa3f0fd82a624fb74cd47b9b4dc0bc67","firstSeenAt":"2026-09-17T22:28:00Z","firstSeenRevision":"f368a6cce277037e4b1e1ff46004e3acd295f96c9ac63a411a0e45775a7f468e","updatedAt":"2026-09-17T22:28:00Z","updatedRevision":"f368a6cce277037e4b1e1ff46004e3acd295f96c9ac63a411a0e45775a7f468e"},"htmlUrl":"/agents/records/ctrl-cobit-2019-bai10-40479176.html","id":"ctrl:cobit-2019:BAI10","mapUrl":"https://evidenceflows.com/?v=1&node=ctrl%3Acobit-2019%3ABAI10","sourceIds":["cobit-2019"],"sourceUrl":null,"title":"BAI10 — Managed Configuration","type":"control","updatedAt":"2026-09-17T22:28:00Z","url":"/assets/agent_record-ctrl-cobit-2019-bai10-40479176.633397e758d0b397.json"},{"attributes":{"category":"administrative","framework":"cobit-2019","type":"preventive"},"canonicalUrl":"https://evidenceflows.com/frameworks/cobit-2019/","description":"Managed Projects","details":{"automation":"manual","control_category":"administrative","control_id":"BAI11","control_type":"preventive","domains":["Secure Development (SDLC) & Application Security","Secure Configuration & Change Management","Asset Management & Inventory","Business Continuity & Disaster Recovery"],"framework":"cobit-2019","group":"Build, Acquire and Implement","key_control":false,"requirement_frequency":null,"requirement_status":null,"risk_count":3,"source_pages":null,"source_url":null},"direct":false,"history":{"digest":"dbcc21b4e0d0d474a077f154f61a6b5427f324f2703d21baece11cf85bbc5fcd","firstSeenAt":"2026-09-17T22:28:00Z","firstSeenRevision":"f368a6cce277037e4b1e1ff46004e3acd295f96c9ac63a411a0e45775a7f468e","updatedAt":"2026-09-17T22:28:00Z","updatedRevision":"f368a6cce277037e4b1e1ff46004e3acd295f96c9ac63a411a0e45775a7f468e"},"htmlUrl":"/agents/records/ctrl-cobit-2019-bai11-fbe7d977.html","id":"ctrl:cobit-2019:BAI11","mapUrl":"https://evidenceflows.com/?v=1&node=ctrl%3Acobit-2019%3ABAI11","sourceIds":["cobit-2019"],"sourceUrl":null,"title":"BAI11 — Managed Projects","type":"control","updatedAt":"2026-09-17T22:28:00Z","url":"/assets/agent_record-ctrl-cobit-2019-bai11-fbe7d977.eb5129a2db35e6b5.json"},{"attributes":{"category":"administrative","framework":"coso-ic","type":"preventive"},"canonicalUrl":"https://evidenceflows.com/frameworks/coso-ic/","description":"The organization deploys control activities through policies that establish what is expected and procedures that put policies into action.","details":{"automation":"manual","control_category":"administrative","control_id":"P12","control_type":"preventive","domains":["AI Governance","Financial Reporting Controls (SOX)","Secure Configuration & Change Management","Secure Development (SDLC) & Application Security"],"framework":"coso-ic","group":"Control Activities","key_control":false,"requirement_frequency":null,"requirement_status":null,"risk_count":2,"source_pages":null,"source_url":null},"direct":false,"history":{"digest":"072fb42d64c243218d83a3850c9e4395827cfa7773414eec68fc9f03a9da6aa8","firstSeenAt":"2026-09-17T22:28:00Z","firstSeenRevision":"f368a6cce277037e4b1e1ff46004e3acd295f96c9ac63a411a0e45775a7f468e","updatedAt":"2026-09-17T22:28:00Z","updatedRevision":"f368a6cce277037e4b1e1ff46004e3acd295f96c9ac63a411a0e45775a7f468e"},"htmlUrl":"/agents/records/ctrl-coso-ic-p12-233c8710.html","id":"ctrl:coso-ic:P12","mapUrl":"https://evidenceflows.com/?v=1&node=ctrl%3Acoso-ic%3AP12","sourceIds":["coso-ic"],"sourceUrl":null,"title":"P12 — The organization deploys control activities through policies that establish what is expected and procedures that put policies into action.","type":"control","updatedAt":"2026-09-17T22:28:00Z","url":"/assets/agent_record-ctrl-coso-ic-p12-233c8710.cb229df0d78471d6.json"},{"attributes":{"category":"administrative","framework":"dora","type":"preventive"},"canonicalUrl":"https://evidenceflows.com/frameworks/dora/","description":"Information and intelligence sharing arrangements","details":{"automation":"manual","control_category":"administrative","control_id":"DORA-Art45","control_type":"preventive","domains":["Business Continuity & Disaster Recovery","Incident Management & Response","Third-Party / Supply-Chain Risk","Governance, Policy & Oversight","Risk Assessment & Management"],"framework":"dora","group":"EU DORA (Digital Operational Resilience Act)","key_control":false,"requirement_frequency":null,"requirement_status":null,"risk_count":3,"source_pages":null,"source_url":null},"direct":false,"history":{"digest":"5722b7055019d966abfd78d8c9b070e0226f91ba0ac40cbdeaa04a28aa154911","firstSeenAt":"2026-09-17T22:28:00Z","firstSeenRevision":"f368a6cce277037e4b1e1ff46004e3acd295f96c9ac63a411a0e45775a7f468e","updatedAt":"2026-09-17T22:28:00Z","updatedRevision":"f368a6cce277037e4b1e1ff46004e3acd295f96c9ac63a411a0e45775a7f468e"},"htmlUrl":"/agents/records/ctrl-dora-dora-art45-bb72d2e3.html","id":"ctrl:dora:DORA-Art45","mapUrl":"https://evidenceflows.com/?v=1&node=ctrl%3Adora%3ADORA-Art45","sourceIds":["dora"],"sourceUrl":null,"title":"DORA-Art45 — Information and intelligence sharing arrangements","type":"control","updatedAt":"2026-09-17T22:28:00Z","url":"/assets/agent_record-ctrl-dora-dora-art45-bb72d2e3.a9b2c1aa0b3e5b8f.json"},{"attributes":{"category":"administrative","framework":"eu-ai-act","type":"preventive"},"canonicalUrl":"https://evidenceflows.com/frameworks/eu-ai-act/","description":"Data and data governance (high-risk)","details":{"automation":"manual","control_category":"administrative","control_id":"AIA-Art10","control_type":"preventive","domains":["AI Governance","Risk Assessment & Management","Governance, Policy & Oversight"],"framework":"eu-ai-act","group":"EU AI Act","key_control":false,"requirement_frequency":null,"requirement_status":null,"risk_count":8,"source_pages":null,"source_url":null},"direct":false,"history":{"digest":"712192eec9e276cfc124185e693be1bcc0ed872e1c6b1aca8fe805412802efb5","firstSeenAt":"2026-09-17T22:28:00Z","firstSeenRevision":"f368a6cce277037e4b1e1ff46004e3acd295f96c9ac63a411a0e45775a7f468e","updatedAt":"2026-09-17T22:28:00Z","updatedRevision":"f368a6cce277037e4b1e1ff46004e3acd295f96c9ac63a411a0e45775a7f468e"},"htmlUrl":"/agents/records/ctrl-eu-ai-act-aia-art10-76043f54.html","id":"ctrl:eu-ai-act:AIA-Art10","mapUrl":"https://evidenceflows.com/?v=1&node=ctrl%3Aeu-ai-act%3AAIA-Art10","sourceIds":["eu-ai-act"],"sourceUrl":null,"title":"AIA-Art10 — Data and data governance (high-risk)","type":"control","updatedAt":"2026-09-17T22:28:00Z","url":"/assets/agent_record-ctrl-eu-ai-act-aia-art10-76043f54.828171c17241e827.json"},{"attributes":{"category":"technical","framework":"eu-ai-act","type":"preventive"},"canonicalUrl":"https://evidenceflows.com/frameworks/eu-ai-act/","description":"Accuracy, robustness and cybersecurity (high-risk)","details":{"automation":"hybrid","control_category":"technical","control_id":"AIA-Art15","control_type":"preventive","domains":["AI Governance","Risk Assessment & Management","Governance, Policy & Oversight"],"framework":"eu-ai-act","group":"EU AI Act","key_control":false,"requirement_frequency":null,"requirement_status":null,"risk_count":8,"source_pages":null,"source_url":null},"direct":false,"history":{"digest":"6da75e33b59a6d80b74b26b123af6ddb891951ed56afa25c58bd624c4cbdd5bf","firstSeenAt":"2026-09-17T22:28:00Z","firstSeenRevision":"f368a6cce277037e4b1e1ff46004e3acd295f96c9ac63a411a0e45775a7f468e","updatedAt":"2026-09-17T22:28:00Z","updatedRevision":"f368a6cce277037e4b1e1ff46004e3acd295f96c9ac63a411a0e45775a7f468e"},"htmlUrl":"/agents/records/ctrl-eu-ai-act-aia-art15-c3704411.html","id":"ctrl:eu-ai-act:AIA-Art15","mapUrl":"https://evidenceflows.com/?v=1&node=ctrl%3Aeu-ai-act%3AAIA-Art15","sourceIds":["eu-ai-act"],"sourceUrl":null,"title":"AIA-Art15 — Accuracy, robustness and cybersecurity (high-risk)","type":"control","updatedAt":"2026-09-17T22:28:00Z","url":"/assets/agent_record-ctrl-eu-ai-act-aia-art15-c3704411.0a20fa129f58988e.json"},{"attributes":{"category":"administrative","framework":"eu-ai-act","type":"preventive"},"canonicalUrl":"https://evidenceflows.com/frameworks/eu-ai-act/","description":"Obligations for providers of general-purpose AI (GPAI) models","details":{"automation":"manual","control_category":"administrative","control_id":"AIA-Art53","control_type":"preventive","domains":["AI Governance","Risk Assessment & Management","Governance, Policy & Oversight"],"framework":"eu-ai-act","group":"EU AI Act","key_control":false,"requirement_frequency":null,"requirement_status":null,"risk_count":4,"source_pages":null,"source_url":null},"direct":false,"history":{"digest":"e26fbc1ae02c48e0398218d0567e88ffd2ed79b13584f859e5f2ad3a73a3713b","firstSeenAt":"2026-09-17T22:28:00Z","firstSeenRevision":"f368a6cce277037e4b1e1ff46004e3acd295f96c9ac63a411a0e45775a7f468e","updatedAt":"2026-09-17T22:28:00Z","updatedRevision":"f368a6cce277037e4b1e1ff46004e3acd295f96c9ac63a411a0e45775a7f468e"},"htmlUrl":"/agents/records/ctrl-eu-ai-act-aia-art53-fd785909.html","id":"ctrl:eu-ai-act:AIA-Art53","mapUrl":"https://evidenceflows.com/?v=1&node=ctrl%3Aeu-ai-act%3AAIA-Art53","sourceIds":["eu-ai-act"],"sourceUrl":null,"title":"AIA-Art53 — Obligations for providers of general-purpose AI (GPAI) models","type":"control","updatedAt":"2026-09-17T22:28:00Z","url":"/assets/agent_record-ctrl-eu-ai-act-aia-art53-fd785909.b82615de8b5f4351.json"},{"attributes":{"category":"administrative","framework":"eu-ai-act","type":"preventive"},"canonicalUrl":"https://evidenceflows.com/frameworks/eu-ai-act/","description":"Obligations for GPAI models with systemic risk","details":{"automation":"manual","control_category":"administrative","control_id":"AIA-Art55","control_type":"preventive","domains":["AI Governance","Risk Assessment & Management","Governance, Policy & Oversight"],"framework":"eu-ai-act","group":"EU AI Act","key_control":false,"requirement_frequency":null,"requirement_status":null,"risk_count":4,"source_pages":null,"source_url":null},"direct":false,"history":{"digest":"a2ecb4ccf90d19888489911dbcad671ae6c9e51f94dcc2ae36e30e9e945f2ed7","firstSeenAt":"2026-09-17T22:28:00Z","firstSeenRevision":"f368a6cce277037e4b1e1ff46004e3acd295f96c9ac63a411a0e45775a7f468e","updatedAt":"2026-09-17T22:28:00Z","updatedRevision":"f368a6cce277037e4b1e1ff46004e3acd295f96c9ac63a411a0e45775a7f468e"},"htmlUrl":"/agents/records/ctrl-eu-ai-act-aia-art55-53ccdfc5.html","id":"ctrl:eu-ai-act:AIA-Art55","mapUrl":"https://evidenceflows.com/?v=1&node=ctrl%3Aeu-ai-act%3AAIA-Art55","sourceIds":["eu-ai-act"],"sourceUrl":null,"title":"AIA-Art55 — Obligations for GPAI models with systemic risk","type":"control","updatedAt":"2026-09-17T22:28:00Z","url":"/assets/agent_record-ctrl-eu-ai-act-aia-art55-53ccdfc5.4e1254560d5b4722.json"},{"attributes":{"category":"administrative","framework":"gdpr","type":"preventive"},"canonicalUrl":"https://evidenceflows.com/frameworks/gdpr/","description":"Data protection by design and by default","details":{"automation":"manual","control_category":"administrative","control_id":"GDPR-Art25","control_type":"preventive","domains":["Data Protection & Privacy","Governance, Policy & Oversight","Incident Management & Response","Third-Party / Supply-Chain Risk","Risk Assessment & Management"],"framework":"gdpr","group":"EU GDPR","key_control":false,"requirement_frequency":null,"requirement_status":null,"risk_count":4,"source_pages":null,"source_url":null},"direct":false,"history":{"digest":"49773ed61d2e38e1b9a2c03285da03ca0e6fc52363590f62665a6869bb6e783d","firstSeenAt":"2026-09-17T22:28:00Z","firstSeenRevision":"f368a6cce277037e4b1e1ff46004e3acd295f96c9ac63a411a0e45775a7f468e","updatedAt":"2026-09-17T22:28:00Z","updatedRevision":"f368a6cce277037e4b1e1ff46004e3acd295f96c9ac63a411a0e45775a7f468e"},"htmlUrl":"/agents/records/ctrl-gdpr-gdpr-art25-ccf26a83.html","id":"ctrl:gdpr:GDPR-Art25","mapUrl":"https://evidenceflows.com/?v=1&node=ctrl%3Agdpr%3AGDPR-Art25","sourceIds":["gdpr"],"sourceUrl":null,"title":"GDPR-Art25 — Data protection by design and by default","type":"control","updatedAt":"2026-09-17T22:28:00Z","url":"/assets/agent_record-ctrl-gdpr-gdpr-art25-ccf26a83.e69982ca75fadf20.json"},{"attributes":{"category":"technical","framework":"iso-27001","type":"preventive"},"canonicalUrl":"https://evidenceflows.com/frameworks/iso-27001/","description":"Networks security","details":{"automation":"hybrid","control_category":"technical","control_id":"A.8.20","control_type":"preventive","domains":["Logging, Monitoring & Detection","Network & Communications Security"],"framework":"iso-27001","group":"Technological controls","key_control":false,"requirement_frequency":null,"requirement_status":null,"risk_count":2,"source_pages":null,"source_url":null},"direct":false,"history":{"digest":"e5dea8024efefd3f31769b5fd3d3e75a418eda553147e5f512a0d6808280c026","firstSeenAt":"2026-09-17T22:28:00Z","firstSeenRevision":"f368a6cce277037e4b1e1ff46004e3acd295f96c9ac63a411a0e45775a7f468e","updatedAt":"2026-09-17T22:28:00Z","updatedRevision":"f368a6cce277037e4b1e1ff46004e3acd295f96c9ac63a411a0e45775a7f468e"},"htmlUrl":"/agents/records/ctrl-iso-27001-a-8-20-68d4486b.html","id":"ctrl:iso-27001:A.8.20","mapUrl":"https://evidenceflows.com/?v=1&node=ctrl%3Aiso-27001%3AA.8.20","sourceIds":["iso-27001"],"sourceUrl":null,"title":"A.8.20 — Networks security","type":"control","updatedAt":"2026-09-17T22:28:00Z","url":"/assets/agent_record-ctrl-iso-27001-a-8-20-68d4486b.c6ee059453768f2c.json"},{"attributes":{"category":"technical","framework":"iso-27001","type":"preventive"},"canonicalUrl":"https://evidenceflows.com/frameworks/iso-27001/","description":"Security of network services","details":{"automation":"hybrid","control_category":"technical","control_id":"A.8.21","control_type":"preventive","domains":["Logging, Monitoring & Detection","Network & Communications Security"],"framework":"iso-27001","group":"Technological controls","key_control":false,"requirement_frequency":null,"requirement_status":null,"risk_count":2,"source_pages":null,"source_url":null},"direct":false,"history":{"digest":"927da518597c5ed4a51771faa1e0e909871cdb74a4fc0462b31dfda0fc94200e","firstSeenAt":"2026-09-17T22:28:00Z","firstSeenRevision":"f368a6cce277037e4b1e1ff46004e3acd295f96c9ac63a411a0e45775a7f468e","updatedAt":"2026-09-17T22:28:00Z","updatedRevision":"f368a6cce277037e4b1e1ff46004e3acd295f96c9ac63a411a0e45775a7f468e"},"htmlUrl":"/agents/records/ctrl-iso-27001-a-8-21-5b64f0ec.html","id":"ctrl:iso-27001:A.8.21","mapUrl":"https://evidenceflows.com/?v=1&node=ctrl%3Aiso-27001%3AA.8.21","sourceIds":["iso-27001"],"sourceUrl":null,"title":"A.8.21 — Security of network services","type":"control","updatedAt":"2026-09-17T22:28:00Z","url":"/assets/agent_record-ctrl-iso-27001-a-8-21-5b64f0ec.d596927a223a8de8.json"},{"attributes":{"category":"technical","framework":"iso-27001","type":"preventive"},"canonicalUrl":"https://evidenceflows.com/frameworks/iso-27001/","description":"Segregation of networks","details":{"automation":"automated","control_category":"technical","control_id":"A.8.22","control_type":"preventive","domains":["Network & Communications Security"],"framework":"iso-27001","group":"Technological controls","key_control":false,"requirement_frequency":null,"requirement_status":null,"risk_count":6,"source_pages":null,"source_url":null},"direct":false,"history":{"digest":"b82f8ddfadb1d5713a6ff84b9e5880008565d9860c092f915356e96e0a89a5c0","firstSeenAt":"2026-09-17T22:28:00Z","firstSeenRevision":"f368a6cce277037e4b1e1ff46004e3acd295f96c9ac63a411a0e45775a7f468e","updatedAt":"2026-09-17T22:28:00Z","updatedRevision":"f368a6cce277037e4b1e1ff46004e3acd295f96c9ac63a411a0e45775a7f468e"},"htmlUrl":"/agents/records/ctrl-iso-27001-a-8-22-be69b805.html","id":"ctrl:iso-27001:A.8.22","mapUrl":"https://evidenceflows.com/?v=1&node=ctrl%3Aiso-27001%3AA.8.22","sourceIds":["iso-27001"],"sourceUrl":null,"title":"A.8.22 — Segregation of networks","type":"control","updatedAt":"2026-09-17T22:28:00Z","url":"/assets/agent_record-ctrl-iso-27001-a-8-22-be69b805.bfbcc0888876e10c.json"},{"attributes":{"category":"technical","framework":"iso-27001","type":"preventive"},"canonicalUrl":"https://evidenceflows.com/frameworks/iso-27001/","description":"Web filtering","details":{"automation":"automated","control_category":"technical","control_id":"A.8.23","control_type":"preventive","domains":["Network & Communications Security"],"framework":"iso-27001","group":"Technological controls","key_control":false,"requirement_frequency":null,"requirement_status":null,"risk_count":2,"source_pages":null,"source_url":null},"direct":false,"history":{"digest":"287bbd3cdef0e126b9a483e511597207e9a5903194e638e235c1466f404c368d","firstSeenAt":"2026-09-17T22:28:00Z","firstSeenRevision":"f368a6cce277037e4b1e1ff46004e3acd295f96c9ac63a411a0e45775a7f468e","updatedAt":"2026-09-17T22:28:00Z","updatedRevision":"f368a6cce277037e4b1e1ff46004e3acd295f96c9ac63a411a0e45775a7f468e"},"htmlUrl":"/agents/records/ctrl-iso-27001-a-8-23-91f17a7e.html","id":"ctrl:iso-27001:A.8.23","mapUrl":"https://evidenceflows.com/?v=1&node=ctrl%3Aiso-27001%3AA.8.23","sourceIds":["iso-27001"],"sourceUrl":null,"title":"A.8.23 — Web filtering","type":"control","updatedAt":"2026-09-17T22:28:00Z","url":"/assets/agent_record-ctrl-iso-27001-a-8-23-91f17a7e.6bdae0fc14d300f5.json"},{"attributes":{"category":"technical","framework":"iso-27001","type":"preventive"},"canonicalUrl":"https://evidenceflows.com/frameworks/iso-27001/","description":"Secure development life cycle","details":{"automation":"manual","control_category":"technical","control_id":"A.8.25","control_type":"preventive","domains":["AI Governance","Secure Development (SDLC) & Application Security"],"framework":"iso-27001","group":"Technological controls","key_control":false,"requirement_frequency":null,"requirement_status":null,"risk_count":4,"source_pages":null,"source_url":null},"direct":false,"history":{"digest":"a6635f13bf9311b392c1013b5b88988c279688bac83685faf99bac4f6ed19de5","firstSeenAt":"2026-09-17T22:28:00Z","firstSeenRevision":"f368a6cce277037e4b1e1ff46004e3acd295f96c9ac63a411a0e45775a7f468e","updatedAt":"2026-09-17T22:28:00Z","updatedRevision":"f368a6cce277037e4b1e1ff46004e3acd295f96c9ac63a411a0e45775a7f468e"},"htmlUrl":"/agents/records/ctrl-iso-27001-a-8-25-3cbe2191.html","id":"ctrl:iso-27001:A.8.25","mapUrl":"https://evidenceflows.com/?v=1&node=ctrl%3Aiso-27001%3AA.8.25","sourceIds":["iso-27001"],"sourceUrl":null,"title":"A.8.25 — Secure development life cycle","type":"control","updatedAt":"2026-09-17T22:28:00Z","url":"/assets/agent_record-ctrl-iso-27001-a-8-25-3cbe2191.102229c888f40333.json"},{"attributes":{"category":"technical","framework":"iso-27001","type":"preventive"},"canonicalUrl":"https://evidenceflows.com/frameworks/iso-27001/","description":"Application security requirements","details":{"automation":"manual","control_category":"technical","control_id":"A.8.26","control_type":"preventive","domains":["AI Governance","Secure Development (SDLC) & Application Security"],"framework":"iso-27001","group":"Technological controls","key_control":false,"requirement_frequency":null,"requirement_status":null,"risk_count":5,"source_pages":null,"source_url":null},"direct":false,"history":{"digest":"b993811d663f74970fc233560b8a341119a27f8e65c7d43694be7526ff2b2cfa","firstSeenAt":"2026-09-17T22:28:00Z","firstSeenRevision":"f368a6cce277037e4b1e1ff46004e3acd295f96c9ac63a411a0e45775a7f468e","updatedAt":"2026-09-17T22:28:00Z","updatedRevision":"f368a6cce277037e4b1e1ff46004e3acd295f96c9ac63a411a0e45775a7f468e"},"htmlUrl":"/agents/records/ctrl-iso-27001-a-8-26-34d8988d.html","id":"ctrl:iso-27001:A.8.26","mapUrl":"https://evidenceflows.com/?v=1&node=ctrl%3Aiso-27001%3AA.8.26","sourceIds":["iso-27001"],"sourceUrl":null,"title":"A.8.26 — Application security requirements","type":"control","updatedAt":"2026-09-17T22:28:00Z","url":"/assets/agent_record-ctrl-iso-27001-a-8-26-34d8988d.2692a4aa1ecfbd82.json"},{"attributes":{"category":"technical","framework":"iso-27001","type":"preventive"},"canonicalUrl":"https://evidenceflows.com/frameworks/iso-27001/","description":"Secure system architecture and engineering principles","details":{"automation":"manual","control_category":"technical","control_id":"A.8.27","control_type":"preventive","domains":["Secure Development (SDLC) & Application Security"],"framework":"iso-27001","group":"Technological controls","key_control":false,"requirement_frequency":null,"requirement_status":null,"risk_count":8,"source_pages":null,"source_url":null},"direct":false,"history":{"digest":"26cc57c5c2be30e73eb9f274126a8ad8a31fd068e42bc632c41771cafcf32d8c","firstSeenAt":"2026-09-17T22:28:00Z","firstSeenRevision":"f368a6cce277037e4b1e1ff46004e3acd295f96c9ac63a411a0e45775a7f468e","updatedAt":"2026-09-17T22:28:00Z","updatedRevision":"f368a6cce277037e4b1e1ff46004e3acd295f96c9ac63a411a0e45775a7f468e"},"htmlUrl":"/agents/records/ctrl-iso-27001-a-8-27-a4a3784c.html","id":"ctrl:iso-27001:A.8.27","mapUrl":"https://evidenceflows.com/?v=1&node=ctrl%3Aiso-27001%3AA.8.27","sourceIds":["iso-27001"],"sourceUrl":null,"title":"A.8.27 — Secure system architecture and engineering principles","type":"control","updatedAt":"2026-09-17T22:28:00Z","url":"/assets/agent_record-ctrl-iso-27001-a-8-27-a4a3784c.1dd09114939a2a0e.json"},{"attributes":{"category":"technical","framework":"iso-27001","type":"preventive"},"canonicalUrl":"https://evidenceflows.com/frameworks/iso-27001/","description":"Secure coding","details":{"automation":"hybrid","control_category":"technical","control_id":"A.8.28","control_type":"preventive","domains":["Secure Development (SDLC) & Application Security"],"framework":"iso-27001","group":"Technological controls","key_control":false,"requirement_frequency":null,"requirement_status":null,"risk_count":8,"source_pages":null,"source_url":null},"direct":false,"history":{"digest":"7d3622fb3827cf968f5c02b38d63bdaa0994207f34188207f22155d763473e62","firstSeenAt":"2026-09-17T22:28:00Z","firstSeenRevision":"f368a6cce277037e4b1e1ff46004e3acd295f96c9ac63a411a0e45775a7f468e","updatedAt":"2026-09-17T22:28:00Z","updatedRevision":"f368a6cce277037e4b1e1ff46004e3acd295f96c9ac63a411a0e45775a7f468e"},"htmlUrl":"/agents/records/ctrl-iso-27001-a-8-28-03be11c2.html","id":"ctrl:iso-27001:A.8.28","mapUrl":"https://evidenceflows.com/?v=1&node=ctrl%3Aiso-27001%3AA.8.28","sourceIds":["iso-27001"],"sourceUrl":null,"title":"A.8.28 — Secure coding","type":"control","updatedAt":"2026-09-17T22:28:00Z","url":"/assets/agent_record-ctrl-iso-27001-a-8-28-03be11c2.b01a88e1e0951711.json"},{"attributes":{"category":"technical","framework":"iso-27001","type":"detective"},"canonicalUrl":"https://evidenceflows.com/frameworks/iso-27001/","description":"Security testing in development and acceptance","details":{"automation":"hybrid","control_category":"technical","control_id":"A.8.29","control_type":"detective","domains":["Secure Development (SDLC) & Application Security","Vulnerability & Patch Management"],"framework":"iso-27001","group":"Technological controls","key_control":false,"requirement_frequency":null,"requirement_status":null,"risk_count":4,"source_pages":null,"source_url":null},"direct":false,"history":{"digest":"00b4f4510e99888b1aecacf21b40de9b66caa0fe7a7d634e50fb0321a48a3571","firstSeenAt":"2026-09-17T22:28:00Z","firstSeenRevision":"f368a6cce277037e4b1e1ff46004e3acd295f96c9ac63a411a0e45775a7f468e","updatedAt":"2026-09-17T22:28:00Z","updatedRevision":"f368a6cce277037e4b1e1ff46004e3acd295f96c9ac63a411a0e45775a7f468e"},"htmlUrl":"/agents/records/ctrl-iso-27001-a-8-29-e0df0522.html","id":"ctrl:iso-27001:A.8.29","mapUrl":"https://evidenceflows.com/?v=1&node=ctrl%3Aiso-27001%3AA.8.29","sourceIds":["iso-27001"],"sourceUrl":null,"title":"A.8.29 — Security testing in development and acceptance","type":"control","updatedAt":"2026-09-17T22:28:00Z","url":"/assets/agent_record-ctrl-iso-27001-a-8-29-e0df0522.0acbd86f72c0b2f6.json"},{"attributes":{"category":"technical","framework":"iso-27001","type":"preventive"},"canonicalUrl":"https://evidenceflows.com/frameworks/iso-27001/","description":"Outsourced development","details":{"automation":"manual","control_category":"technical","control_id":"A.8.30","control_type":"preventive","domains":["Secure Development (SDLC) & Application Security"],"framework":"iso-27001","group":"Technological controls","key_control":false,"requirement_frequency":null,"requirement_status":null,"risk_count":4,"source_pages":null,"source_url":null},"direct":false,"history":{"digest":"1e8c720a57cd7002c3246719789af583fc04f2fccf9a8fd6a5a58ca1ff54682b","firstSeenAt":"2026-09-17T22:28:00Z","firstSeenRevision":"f368a6cce277037e4b1e1ff46004e3acd295f96c9ac63a411a0e45775a7f468e","updatedAt":"2026-09-17T22:28:00Z","updatedRevision":"f368a6cce277037e4b1e1ff46004e3acd295f96c9ac63a411a0e45775a7f468e"},"htmlUrl":"/agents/records/ctrl-iso-27001-a-8-30-6a684665.html","id":"ctrl:iso-27001:A.8.30","mapUrl":"https://evidenceflows.com/?v=1&node=ctrl%3Aiso-27001%3AA.8.30","sourceIds":["iso-27001"],"sourceUrl":null,"title":"A.8.30 — Outsourced development","type":"control","updatedAt":"2026-09-17T22:28:00Z","url":"/assets/agent_record-ctrl-iso-27001-a-8-30-6a684665.6e4398e0a52ea672.json"},{"attributes":{"category":"technical","framework":"iso-27001","type":"preventive"},"canonicalUrl":"https://evidenceflows.com/frameworks/iso-27001/","description":"Separation of development, test and production environments","details":{"automation":"hybrid","control_category":"technical","control_id":"A.8.31","control_type":"preventive","domains":["Secure Configuration & Change Management","Secure Development (SDLC) & Application Security"],"framework":"iso-27001","group":"Technological controls","key_control":false,"requirement_frequency":null,"requirement_status":null,"risk_count":2,"source_pages":null,"source_url":null},"direct":false,"history":{"digest":"92838676c224ca5222cf4187ff5f0e6252536c119a6ad1b94a4b0b29c46f0c7e","firstSeenAt":"2026-09-17T22:28:00Z","firstSeenRevision":"f368a6cce277037e4b1e1ff46004e3acd295f96c9ac63a411a0e45775a7f468e","updatedAt":"2026-09-17T22:28:00Z","updatedRevision":"f368a6cce277037e4b1e1ff46004e3acd295f96c9ac63a411a0e45775a7f468e"},"htmlUrl":"/agents/records/ctrl-iso-27001-a-8-31-eabf2a51.html","id":"ctrl:iso-27001:A.8.31","mapUrl":"https://evidenceflows.com/?v=1&node=ctrl%3Aiso-27001%3AA.8.31","sourceIds":["iso-27001"],"sourceUrl":null,"title":"A.8.31 — Separation of development, test and production environments","type":"control","updatedAt":"2026-09-17T22:28:00Z","url":"/assets/agent_record-ctrl-iso-27001-a-8-31-eabf2a51.036a9a5ef541beae.json"},{"attributes":{"category":"technical","framework":"iso-27001","type":"preventive"},"canonicalUrl":"https://evidenceflows.com/frameworks/iso-27001/","description":"Change management","details":{"automation":"hybrid","control_category":"technical","control_id":"A.8.32","control_type":"preventive","domains":["Secure Configuration & Change Management"],"framework":"iso-27001","group":"Technological controls","key_control":true,"requirement_frequency":null,"requirement_status":null,"risk_count":4,"source_pages":null,"source_url":null},"direct":false,"history":{"digest":"8cb00564c3b10a9ad4821c4ef1e53e5268f5c01790c8f60a7e18bb15898500d7","firstSeenAt":"2026-09-17T22:28:00Z","firstSeenRevision":"f368a6cce277037e4b1e1ff46004e3acd295f96c9ac63a411a0e45775a7f468e","updatedAt":"2026-09-17T22:28:00Z","updatedRevision":"f368a6cce277037e4b1e1ff46004e3acd295f96c9ac63a411a0e45775a7f468e"},"htmlUrl":"/agents/records/ctrl-iso-27001-a-8-32-b855772a.html","id":"ctrl:iso-27001:A.8.32","mapUrl":"https://evidenceflows.com/?v=1&node=ctrl%3Aiso-27001%3AA.8.32","sourceIds":["iso-27001"],"sourceUrl":null,"title":"A.8.32 — Change management","type":"control","updatedAt":"2026-09-17T22:28:00Z","url":"/assets/agent_record-ctrl-iso-27001-a-8-32-b855772a.abd5475478072069.json"},{"attributes":{"category":"technical","framework":"iso-27001","type":"preventive"},"canonicalUrl":"https://evidenceflows.com/frameworks/iso-27001/","description":"Test information","details":{"automation":"manual","control_category":"technical","control_id":"A.8.33","control_type":"preventive","domains":["Secure Configuration & Change Management","Secure Development (SDLC) & Application Security"],"framework":"iso-27001","group":"Technological controls","key_control":false,"requirement_frequency":null,"requirement_status":null,"risk_count":2,"source_pages":null,"source_url":null},"direct":false,"history":{"digest":"afc94c93a4d841bac5e4edd8b474b58fdc7e9e5099c1e914017ea4933aee66c6","firstSeenAt":"2026-09-17T22:28:00Z","firstSeenRevision":"f368a6cce277037e4b1e1ff46004e3acd295f96c9ac63a411a0e45775a7f468e","updatedAt":"2026-09-17T22:28:00Z","updatedRevision":"f368a6cce277037e4b1e1ff46004e3acd295f96c9ac63a411a0e45775a7f468e"},"htmlUrl":"/agents/records/ctrl-iso-27001-a-8-33-cabca252.html","id":"ctrl:iso-27001:A.8.33","mapUrl":"https://evidenceflows.com/?v=1&node=ctrl%3Aiso-27001%3AA.8.33","sourceIds":["iso-27001"],"sourceUrl":null,"title":"A.8.33 — Test information","type":"control","updatedAt":"2026-09-17T22:28:00Z","url":"/assets/agent_record-ctrl-iso-27001-a-8-33-cabca252.f3b489379be0e009.json"}],"relationships":[{"expectedCatalogRevision":"791ff2dd3a45707290badee660f185e514d15f1cf518908628f425c2f2c56ee4","id":"rel:02142d848bc8e970a3bed03fdd88575c3085b70e94789cdea473a192b7224dae","properties":{},"sourceDetailPath":"/data/v1/records/ctrl-iso-27001-a-8-33-cabca252.json","sourceId":"ctrl:iso-27001:A.8.33","targetDetailPath":"/data/v1/records/std-iso-27001-656201bd.json","targetId":"std:iso-27001","type":"belongs_to"},{"expectedCatalogRevision":"791ff2dd3a45707290badee660f185e514d15f1cf518908628f425c2f2c56ee4","id":"rel:022e3abf61eda2578d0ac1bf1bb385c27ffcff99c107ff432c71a0a37c23689c","properties":{},"sourceDetailPath":"/data/v1/records/ctrl-iso-27001-a-8-32-b855772a.json","sourceId":"ctrl:iso-27001:A.8.32","targetDetailPath":"/data/v1/records/std-iso-27001-656201bd.json","targetId":"std:iso-27001","type":"belongs_to"},{"expectedCatalogRevision":"791ff2dd3a45707290badee660f185e514d15f1cf518908628f425c2f2c56ee4","id":"rel:030c847a1be8b9e26a68bc890c648c03d31e6d385bf1a1132c0be8f4cb1c9848","properties":{"control_id":"BAI01","coverage":"partial","delta":"BAI01 governs the enterprise programme/portfolio management practice; this development-scoped objective covers project-level planning and resourcing, not enterprise portfolio governance","framework":"cobit-2019","provenance":{"defaultConfidence":"medium","defaultStatus":"active","direction":"canonical_to_source","mapper":"coworkcanvas-compliance-graph","note":"Each member is a documented relationship claim from the canonical unified control to a source control or guidance proposition. relationship: equal|superset_of (full) / intersects_with|subset_of (partial) / informs (guidance). confidence 'medium' = single-mapper, documented, not yet externally corroborated. source_version is the member framework's edition from the standard version register.","reviewDate":"2026-09-07"},"relationship":"intersects_with","source_version":"2019"},"sourceDetailPath":"/data/v1/records/uc-uc-sdlc-02-c3b003c2.json","sourceId":"uc:UC-SDLC-02","targetDetailPath":"/data/v1/records/ctrl-cobit-2019-bai01-12e2e132.json","targetId":"ctrl:cobit-2019:BAI01","type":"maps_to"},{"expectedCatalogRevision":"791ff2dd3a45707290badee660f185e514d15f1cf518908628f425c2f2c56ee4","id":"rel:0b6a063f429cabad5d3ba85857b4eaa9eec0c6399f8ddbd5aa5c4c32b8e505d1","properties":{},"sourceDetailPath":"/data/v1/records/ctrl-gdpr-gdpr-art25-ccf26a83.json","sourceId":"ctrl:gdpr:GDPR-Art25","targetDetailPath":"/data/v1/records/std-gdpr-17d65d0b.json","targetId":"std:gdpr","type":"belongs_to"},{"expectedCatalogRevision":"791ff2dd3a45707290badee660f185e514d15f1cf518908628f425c2f2c56ee4","id":"rel:0c22dd4d48750ebdb122b83f160bc279432bdd300e42e74990a61d32ceb5c445","properties":{},"sourceDetailPath":"/data/v1/records/ctrl-iso-27001-a-8-29-e0df0522.json","sourceId":"ctrl:iso-27001:A.8.29","targetDetailPath":"/data/v1/records/std-iso-27001-656201bd.json","targetId":"std:iso-27001","type":"belongs_to"},{"expectedCatalogRevision":"791ff2dd3a45707290badee660f185e514d15f1cf518908628f425c2f2c56ee4","id":"rel:135a001d73a464c593700d51e085d380a9024497c0fa6fb20e8821952e63674e","properties":{},"sourceDetailPath":"/data/v1/records/ctrl-iso-27001-a-8-26-34d8988d.json","sourceId":"ctrl:iso-27001:A.8.26","targetDetailPath":"/data/v1/records/std-iso-27001-656201bd.json","targetId":"std:iso-27001","type":"belongs_to"},{"expectedCatalogRevision":"791ff2dd3a45707290badee660f185e514d15f1cf518908628f425c2f2c56ee4","id":"rel:1df7d03ef432f33e2aa5d7ac1451629578a6aa10389545ab9db5a521f3bbf50a","properties":{"control_id":"C010","coverage":"full","delta":null,"framework":"aiuc-1","provenance":{"defaultConfidence":"medium","defaultStatus":"active","direction":"canonical_to_source","mapper":"coworkcanvas-compliance-graph","note":"Each member is a documented relationship claim from the canonical unified control to a source control or guidance proposition. relationship: equal|superset_of (full) / intersects_with|subset_of (partial) / informs (guidance). confidence 'medium' = single-mapper, documented, not yet externally corroborated. source_version is the member framework's edition from the standard version register.","reviewDate":"2026-09-07"},"relationship":"superset_of","source_version":"July 15, 2026 release (quarterly update cadence)"},"sourceDetailPath":"/data/v1/records/uc-uc-ai-21-8afd47db.json","sourceId":"uc:UC-AI-21","targetDetailPath":"/data/v1/records/ctrl-aiuc-1-c010-b0a758b4.json","targetId":"ctrl:aiuc-1:C010","type":"maps_to"},{"expectedCatalogRevision":"791ff2dd3a45707290badee660f185e514d15f1cf518908628f425c2f2c56ee4","id":"rel:1e008c7e98dc9d2c91316291b2e08e53b40f4b0e8a6ff8f3833feb47799c8c7a","properties":{},"sourceDetailPath":"/data/v1/records/ctrl-iso-27001-a-8-27-a4a3784c.json","sourceId":"ctrl:iso-27001:A.8.27","targetDetailPath":"/data/v1/records/std-iso-27001-656201bd.json","targetId":"std:iso-27001","type":"belongs_to"},{"expectedCatalogRevision":"791ff2dd3a45707290badee660f185e514d15f1cf518908628f425c2f2c56ee4","id":"rel:1ebe8d4b78547cfd82fbcc2891be071626367e03eaf85d40e73f49495cd9dd48","properties":{},"sourceDetailPath":"/data/v1/records/ctrl-cobit-2019-bai02-80041b74.json","sourceId":"ctrl:cobit-2019:BAI02","targetDetailPath":"/data/v1/records/std-cobit-2019-2181ce0c.json","targetId":"std:cobit-2019","type":"belongs_to"},{"expectedCatalogRevision":"791ff2dd3a45707290badee660f185e514d15f1cf518908628f425c2f2c56ee4","id":"rel:266413b704059cefdeb68ba76808b5444e25095d835aa595a43d1476260b7d3e","properties":{"control_id":"BAI10","coverage":"full","delta":null,"framework":"cobit-2019","provenance":{"defaultConfidence":"medium","defaultStatus":"active","direction":"canonical_to_source","mapper":"coworkcanvas-compliance-graph","note":"Each member is a documented relationship claim from the canonical unified control to a source control or guidance proposition. relationship: equal|superset_of (full) / intersects_with|subset_of (partial) / informs (guidance). confidence 'medium' = single-mapper, documented, not yet externally corroborated. source_version is the member framework's edition from the standard version register.","reviewDate":"2026-09-07"},"relationship":"superset_of","source_version":"2019"},"sourceDetailPath":"/data/v1/records/uc-uc-sdlc-06-c1afc713.json","sourceId":"uc:UC-SDLC-06","targetDetailPath":"/data/v1/records/ctrl-cobit-2019-bai10-40479176.json","targetId":"ctrl:cobit-2019:BAI10","type":"maps_to"},{"expectedCatalogRevision":"791ff2dd3a45707290badee660f185e514d15f1cf518908628f425c2f2c56ee4","id":"rel:35eebd189f1575ee338fadccdde6be2f9eded242acad4ddcb3aa02c74807db27","properties":{"control_id":"BAI09","coverage":"full","delta":null,"framework":"cobit-2019","provenance":{"defaultConfidence":"medium","defaultStatus":"active","direction":"canonical_to_source","mapper":"coworkcanvas-compliance-graph","note":"Each member is a documented relationship claim from the canonical unified control to a source control or guidance proposition. relationship: equal|superset_of (full) / intersects_with|subset_of (partial) / informs (guidance). confidence 'medium' = single-mapper, documented, not yet externally corroborated. source_version is the member framework's edition from the standard version register.","reviewDate":"2026-09-07"},"relationship":"superset_of","source_version":"2019"},"sourceDetailPath":"/data/v1/records/uc-uc-sdlc-12-08ce2fc7.json","sourceId":"uc:UC-SDLC-12","targetDetailPath":"/data/v1/records/ctrl-cobit-2019-bai09-09a008c3.json","targetId":"ctrl:cobit-2019:BAI09","type":"maps_to"},{"expectedCatalogRevision":"791ff2dd3a45707290badee660f185e514d15f1cf518908628f425c2f2c56ee4","id":"rel:3725ab082d6da8f966bc8172699871ad9290c976ed4a2cb8b98b5400c81d7929","properties":{"control_id":"C012","coverage":"full","delta":null,"framework":"aiuc-1","provenance":{"defaultConfidence":"medium","defaultStatus":"active","direction":"canonical_to_source","mapper":"coworkcanvas-compliance-graph","note":"Each member is a documented relationship claim from the canonical unified control to a source control or guidance proposition. relationship: equal|superset_of (full) / intersects_with|subset_of (partial) / informs (guidance). confidence 'medium' = single-mapper, documented, not yet externally corroborated. source_version is the member framework's edition from the standard version register.","reviewDate":"2026-09-07"},"relationship":"superset_of","source_version":"July 15, 2026 release (quarterly update cadence)"},"sourceDetailPath":"/data/v1/records/uc-uc-ai-21-8afd47db.json","sourceId":"uc:UC-AI-21","targetDetailPath":"/data/v1/records/ctrl-aiuc-1-c012-783c55df.json","targetId":"ctrl:aiuc-1:C012","type":"maps_to"},{"expectedCatalogRevision":"791ff2dd3a45707290badee660f185e514d15f1cf518908628f425c2f2c56ee4","id":"rel:3792d426d2413f6963cd974cd28773026f37c0f551d8cf6724eda4f0744e5f95","properties":{},"sourceDetailPath":"/data/v1/records/ctrl-iso-27001-a-8-20-68d4486b.json","sourceId":"ctrl:iso-27001:A.8.20","targetDetailPath":"/data/v1/records/std-iso-27001-656201bd.json","targetId":"std:iso-27001","type":"belongs_to"},{"expectedCatalogRevision":"791ff2dd3a45707290badee660f185e514d15f1cf518908628f425c2f2c56ee4","id":"rel:41e2f7c3bbdb79c83f3d756c399e0ab252e00ec7add49757cef7164b72148cc1","properties":{"control_id":"AIA-Art15","coverage":"partial","delta":"AI-specific accuracy metrics and lifecycle-consistent performance require dedicated AI controls","framework":"eu-ai-act","provenance":{"defaultConfidence":"medium","defaultStatus":"active","direction":"canonical_to_source","mapper":"coworkcanvas-compliance-graph","note":"Each member is a documented relationship claim from the canonical unified control to a source control or guidance proposition. relationship: equal|superset_of (full) / intersects_with|subset_of (partial) / informs (guidance). confidence 'medium' = single-mapper, documented, not yet externally corroborated. source_version is the member framework's edition from the standard version register.","reviewDate":"2026-09-07"},"relationship":"intersects_with","source_version":"Regulation (EU) 2024/1689"},"sourceDetailPath":"/data/v1/records/uc-uc-sdlc-04-ee9d76b1.json","sourceId":"uc:UC-SDLC-04","targetDetailPath":"/data/v1/records/ctrl-eu-ai-act-aia-art15-c3704411.json","targetId":"ctrl:eu-ai-act:AIA-Art15","type":"maps_to"},{"expectedCatalogRevision":"791ff2dd3a45707290badee660f185e514d15f1cf518908628f425c2f2c56ee4","id":"rel:42509eb5656a89b1a92a9c36f3a2a4cdefa1a038aa8cc37f1f6b3d0b23eeb1fe","properties":{},"sourceDetailPath":"/data/v1/records/ctrl-aiuc-1-c012-783c55df.json","sourceId":"ctrl:aiuc-1:C012","targetDetailPath":"/data/v1/records/std-aiuc-1-d2a8b650.json","targetId":"std:aiuc-1","type":"belongs_to"},{"expectedCatalogRevision":"791ff2dd3a45707290badee660f185e514d15f1cf518908628f425c2f2c56ee4","id":"rel:435470550375d418dcc629b659104f189e5fcbbef8cdb77b62204259ad3388e1","properties":{"control_id":"DORA-Art45","coverage":"full","delta":null,"framework":"dora","provenance":{"defaultConfidence":"medium","defaultStatus":"active","direction":"canonical_to_source","mapper":"coworkcanvas-compliance-graph","note":"Each member is a documented relationship claim from the canonical unified control to a source control or guidance proposition. relationship: equal|superset_of (full) / intersects_with|subset_of (partial) / informs (guidance). confidence 'medium' = single-mapper, documented, not yet externally corroborated. source_version is the member framework's edition from the standard version register.","reviewDate":"2026-09-07"},"relationship":"equal","source_version":"Regulation (EU) 2022/2554"},"sourceDetailPath":"/data/v1/records/uc-uc-bcdr-16-462251f1.json","sourceId":"uc:UC-BCDR-16","targetDetailPath":"/data/v1/records/ctrl-dora-dora-art45-bb72d2e3.json","targetId":"ctrl:dora:DORA-Art45","type":"maps_to"},{"expectedCatalogRevision":"791ff2dd3a45707290badee660f185e514d15f1cf518908628f425c2f2c56ee4","id":"rel:494f71c171b62c71568247a14a50ed91f12978cf48211592b92b04d4f030328e","properties":{"control_id":"BAI03","coverage":"partial","delta":"full solution build, component, and maintenance life cycle satisfied by companion controls","framework":"cobit-2019","provenance":{"defaultConfidence":"medium","defaultStatus":"active","direction":"canonical_to_source","mapper":"coworkcanvas-compliance-graph","note":"Each member is a documented relationship claim from the canonical unified control to a source control or guidance proposition. relationship: equal|superset_of (full) / intersects_with|subset_of (partial) / informs (guidance). confidence 'medium' = single-mapper, documented, not yet externally corroborated. source_version is the member framework's edition from the standard version register.","reviewDate":"2026-09-07"},"relationship":"intersects_with","source_version":"2019"},"sourceDetailPath":"/data/v1/records/uc-uc-sdlc-04-ee9d76b1.json","sourceId":"uc:UC-SDLC-04","targetDetailPath":"/data/v1/records/ctrl-cobit-2019-bai03-bfe681b0.json","targetId":"ctrl:cobit-2019:BAI03","type":"maps_to"},{"expectedCatalogRevision":"791ff2dd3a45707290badee660f185e514d15f1cf518908628f425c2f2c56ee4","id":"rel:4a230971ca35f4362a01c4861ad078e87bea0a79bdaac6d7720dda0f8cc8d033","properties":{"control_id":"GDPR-Art25","coverage":"partial","delta":"Art.25(2) data-protection-by-default applies organization-wide beyond software design; this control covers the by-design engineering arm","framework":"gdpr","provenance":{"defaultConfidence":"medium","defaultStatus":"active","direction":"canonical_to_source","mapper":"coworkcanvas-compliance-graph","note":"Each member is a documented relationship claim from the canonical unified control to a source control or guidance proposition. relationship: equal|superset_of (full) / intersects_with|subset_of (partial) / informs (guidance). confidence 'medium' = single-mapper, documented, not yet externally corroborated. source_version is the member framework's edition from the standard version register.","reviewDate":"2026-09-07"},"relationship":"intersects_with","source_version":"Regulation (EU) 2016/679"},"sourceDetailPath":"/data/v1/records/uc-uc-config-04-ed033b30.json","sourceId":"uc:UC-CONFIG-04","targetDetailPath":"/data/v1/records/ctrl-gdpr-gdpr-art25-ccf26a83.json","targetId":"ctrl:gdpr:GDPR-Art25","type":"maps_to"},{"expectedCatalogRevision":"791ff2dd3a45707290badee660f185e514d15f1cf518908628f425c2f2c56ee4","id":"rel:4dfb4f9e9ede5a7868a3faef7128824fa4aa94fa1d19b18c33452b64e08fbeaf","properties":{"control_id":"A.8.28","coverage":"full","delta":null,"framework":"iso-27001","provenance":{"defaultConfidence":"medium","defaultStatus":"active","direction":"canonical_to_source","mapper":"coworkcanvas-compliance-graph","note":"Each member is a documented relationship claim from the canonical unified control to a source control or guidance proposition. relationship: equal|superset_of (full) / intersects_with|subset_of (partial) / informs (guidance). confidence 'medium' = single-mapper, documented, not yet externally corroborated. source_version is the member framework's edition from the standard version register.","reviewDate":"2026-09-07"},"relationship":"superset_of","source_version":"2022"},"sourceDetailPath":"/data/v1/records/uc-uc-sdlc-05-053afd62.json","sourceId":"uc:UC-SDLC-05","targetDetailPath":"/data/v1/records/ctrl-iso-27001-a-8-28-03be11c2.json","targetId":"ctrl:iso-27001:A.8.28","type":"maps_to"},{"expectedCatalogRevision":"791ff2dd3a45707290badee660f185e514d15f1cf518908628f425c2f2c56ee4","id":"rel:523c13c2ff61fdfd308b100e2a64bf9acb3dda9d0aaefd85f7c02cd51c8b727a","properties":{},"sourceDetailPath":"/data/v1/records/ctrl-iso-27001-a-8-28-03be11c2.json","sourceId":"ctrl:iso-27001:A.8.28","targetDetailPath":"/data/v1/records/std-iso-27001-656201bd.json","targetId":"std:iso-27001","type":"belongs_to"},{"expectedCatalogRevision":"791ff2dd3a45707290badee660f185e514d15f1cf518908628f425c2f2c56ee4","id":"rel:54a5127b09fa0df51fdec8c2d52d749eb8f7b18dcdc92569ca6cf4f78c2bd536","properties":{},"sourceDetailPath":"/data/v1/records/ctrl-aiuc-1-b001-19a54ee3.json","sourceId":"ctrl:aiuc-1:B001","targetDetailPath":"/data/v1/records/std-aiuc-1-d2a8b650.json","targetId":"std:aiuc-1","type":"belongs_to"},{"expectedCatalogRevision":"791ff2dd3a45707290badee660f185e514d15f1cf518908628f425c2f2c56ee4","id":"rel:557dcc6e47909eda2548a51127f406d05ce4754c2c644bd8370cc6b5b906285f","properties":{"control_id":"AIA-Art10","coverage":"full","delta":null,"framework":"eu-ai-act","provenance":{"defaultConfidence":"medium","defaultStatus":"active","direction":"canonical_to_source","mapper":"coworkcanvas-compliance-graph","note":"Each member is a documented relationship claim from the canonical unified control to a source control or guidance proposition. relationship: equal|superset_of (full) / intersects_with|subset_of (partial) / informs (guidance). confidence 'medium' = single-mapper, documented, not yet externally corroborated. source_version is the member framework's edition from the standard version register.","reviewDate":"2026-09-07"},"relationship":"superset_of","source_version":"Regulation (EU) 2024/1689"},"sourceDetailPath":"/data/v1/records/uc-uc-ai-09-d6934cb6.json","sourceId":"uc:UC-AI-09","targetDetailPath":"/data/v1/records/ctrl-eu-ai-act-aia-art10-76043f54.json","targetId":"ctrl:eu-ai-act:AIA-Art10","type":"maps_to"},{"expectedCatalogRevision":"791ff2dd3a45707290badee660f185e514d15f1cf518908628f425c2f2c56ee4","id":"rel:62a6fd6b6e2a9e76fd2322f78498159ad83a219fdb36c5d6f7523a98e64315fd","properties":{"control_id":"B008","coverage":"partial","delta":"hardening of the model-serving and agent runtime environment, including model-artifact protection and isolation from other workloads","framework":"aiuc-1","provenance":{"defaultConfidence":"medium","defaultStatus":"active","direction":"canonical_to_source","mapper":"coworkcanvas-compliance-graph","note":"Each member is a documented relationship claim from the canonical unified control to a source control or guidance proposition. relationship: equal|superset_of (full) / intersects_with|subset_of (partial) / informs (guidance). confidence 'medium' = single-mapper, documented, not yet externally corroborated. source_version is the member framework's edition from the standard version register.","reviewDate":"2026-09-07"},"relationship":"intersects_with","source_version":"July 15, 2026 release (quarterly update cadence)"},"sourceDetailPath":"/data/v1/records/uc-uc-sdlc-04-ee9d76b1.json","sourceId":"uc:UC-SDLC-04","targetDetailPath":"/data/v1/records/ctrl-aiuc-1-b008-39c816b1.json","targetId":"ctrl:aiuc-1:B008","type":"maps_to"},{"expectedCatalogRevision":"791ff2dd3a45707290badee660f185e514d15f1cf518908628f425c2f2c56ee4","id":"rel:65364c502c601d992737a86ccb5ece989090bb03969c8d4658bd9fa45839eade","properties":{"control_id":"A.8.33","coverage":"full","delta":null,"framework":"iso-27001","provenance":{"defaultConfidence":"medium","defaultStatus":"active","direction":"canonical_to_source","mapper":"coworkcanvas-compliance-graph","note":"Each member is a documented relationship claim from the canonical unified control to a source control or guidance proposition. relationship: equal|superset_of (full) / intersects_with|subset_of (partial) / informs (guidance). confidence 'medium' = single-mapper, documented, not yet externally corroborated. source_version is the member framework's edition from the standard version register.","reviewDate":"2026-09-07"},"relationship":"superset_of","source_version":"2022"},"sourceDetailPath":"/data/v1/records/uc-uc-config-03-3a08a2b1.json","sourceId":"uc:UC-CONFIG-03","targetDetailPath":"/data/v1/records/ctrl-iso-27001-a-8-33-cabca252.json","targetId":"ctrl:iso-27001:A.8.33","type":"maps_to"},{"expectedCatalogRevision":"791ff2dd3a45707290badee660f185e514d15f1cf518908628f425c2f2c56ee4","id":"rel:66c476cbded0770a1dfb5dac88dbddc813fd47b5a6cffddb59a967f1f0fe2087","properties":{},"sourceDetailPath":"/data/v1/records/ctrl-cobit-2019-bai10-40479176.json","sourceId":"ctrl:cobit-2019:BAI10","targetDetailPath":"/data/v1/records/std-cobit-2019-2181ce0c.json","targetId":"std:cobit-2019","type":"belongs_to"},{"expectedCatalogRevision":"791ff2dd3a45707290badee660f185e514d15f1cf518908628f425c2f2c56ee4","id":"rel:687aade0ed345b958e16046bbe0bcd893b874ad9fafd1bb20a1d02d2f1d37595","properties":{},"sourceDetailPath":"/data/v1/records/ctrl-cobit-2019-bai11-fbe7d977.json","sourceId":"ctrl:cobit-2019:BAI11","targetDetailPath":"/data/v1/records/std-cobit-2019-2181ce0c.json","targetId":"std:cobit-2019","type":"belongs_to"},{"expectedCatalogRevision":"791ff2dd3a45707290badee660f185e514d15f1cf518908628f425c2f2c56ee4","id":"rel:6955bdd8dc48a0d0ede2fae85bb4731d83dc0803edd79e3ba3236e1ecfe7c72f","properties":{},"sourceDetailPath":"/data/v1/records/ctrl-iso-27001-a-8-30-6a684665.json","sourceId":"ctrl:iso-27001:A.8.30","targetDetailPath":"/data/v1/records/std-iso-27001-656201bd.json","targetId":"std:iso-27001","type":"belongs_to"},{"expectedCatalogRevision":"791ff2dd3a45707290badee660f185e514d15f1cf518908628f425c2f2c56ee4","id":"rel:72b94ed91e964541cc87bf386c4b6994337ba2ac851d16d3f3454cfd9b8d8eb3","properties":{"control_id":"D002","coverage":"full","delta":null,"framework":"aiuc-1","provenance":{"defaultConfidence":"medium","defaultStatus":"active","direction":"canonical_to_source","mapper":"coworkcanvas-compliance-graph","note":"Each member is a documented relationship claim from the canonical unified control to a source control or guidance proposition. relationship: equal|superset_of (full) / intersects_with|subset_of (partial) / informs (guidance). confidence 'medium' = single-mapper, documented, not yet externally corroborated. source_version is the member framework's edition from the standard version register.","reviewDate":"2026-09-07"},"relationship":"superset_of","source_version":"July 15, 2026 release (quarterly update cadence)"},"sourceDetailPath":"/data/v1/records/uc-uc-ai-21-8afd47db.json","sourceId":"uc:UC-AI-21","targetDetailPath":"/data/v1/records/ctrl-aiuc-1-d002-34554b38.json","targetId":"ctrl:aiuc-1:D002","type":"maps_to"},{"expectedCatalogRevision":"791ff2dd3a45707290badee660f185e514d15f1cf518908628f425c2f2c56ee4","id":"rel:72e2c51e42ec5d4e06ea479257fb786ce96675e104d4393ae8c45a3e27c710b3","properties":{},"sourceDetailPath":"/data/v1/records/ctrl-eu-ai-act-aia-art10-76043f54.json","sourceId":"ctrl:eu-ai-act:AIA-Art10","targetDetailPath":"/data/v1/records/std-eu-ai-act-54986689.json","targetId":"std:eu-ai-act","type":"belongs_to"},{"expectedCatalogRevision":"791ff2dd3a45707290badee660f185e514d15f1cf518908628f425c2f2c56ee4","id":"rel:7378e9eab62be8ba3d1a1ed5bd35f653d390c7165684821983a39c6e739cf851","properties":{"control_id":"C011","coverage":"full","delta":null,"framework":"aiuc-1","provenance":{"defaultConfidence":"medium","defaultStatus":"active","direction":"canonical_to_source","mapper":"coworkcanvas-compliance-graph","note":"Each member is a documented relationship claim from the canonical unified control to a source control or guidance proposition. relationship: equal|superset_of (full) / intersects_with|subset_of (partial) / informs (guidance). confidence 'medium' = single-mapper, documented, not yet externally corroborated. source_version is the member framework's edition from the standard version register.","reviewDate":"2026-09-07"},"relationship":"superset_of","source_version":"July 15, 2026 release (quarterly update cadence)"},"sourceDetailPath":"/data/v1/records/uc-uc-ai-21-8afd47db.json","sourceId":"uc:UC-AI-21","targetDetailPath":"/data/v1/records/ctrl-aiuc-1-c011-7889db41.json","targetId":"ctrl:aiuc-1:C011","type":"maps_to"},{"expectedCatalogRevision":"791ff2dd3a45707290badee660f185e514d15f1cf518908628f425c2f2c56ee4","id":"rel:752575973f408428ecdab2255da7065768c9873e1533285b323787a612c45118","properties":{},"sourceDetailPath":"/data/v1/records/ctrl-coso-ic-p12-233c8710.json","sourceId":"ctrl:coso-ic:P12","targetDetailPath":"/data/v1/records/std-coso-ic-3f80f565.json","targetId":"std:coso-ic","type":"belongs_to"},{"expectedCatalogRevision":"791ff2dd3a45707290badee660f185e514d15f1cf518908628f425c2f2c56ee4","id":"rel:7647e814defe233d67bf447de566e85cc21393edc103da90c9a15a326da809d8","properties":{},"sourceDetailPath":"/data/v1/records/ctrl-aiuc-1-e011-56758692.json","sourceId":"ctrl:aiuc-1:E011","targetDetailPath":"/data/v1/records/std-aiuc-1-d2a8b650.json","targetId":"std:aiuc-1","type":"belongs_to"},{"expectedCatalogRevision":"791ff2dd3a45707290badee660f185e514d15f1cf518908628f425c2f2c56ee4","id":"rel:771fe71b653da797589e3eeb3d84a995ac2416455b1e8170bcd03ca056f8d16e","properties":{},"sourceDetailPath":"/data/v1/records/ctrl-aiuc-1-d004-21d4eeb4.json","sourceId":"ctrl:aiuc-1:D004","targetDetailPath":"/data/v1/records/std-aiuc-1-d2a8b650.json","targetId":"std:aiuc-1","type":"belongs_to"},{"expectedCatalogRevision":"791ff2dd3a45707290badee660f185e514d15f1cf518908628f425c2f2c56ee4","id":"rel:7a773fb1e78534dc51329b05ae6a49c568389eee53a7cead548ae2dae672337f","properties":{"control_id":"AIA-Art53","coverage":"full","delta":null,"framework":"eu-ai-act","provenance":{"defaultConfidence":"medium","defaultStatus":"active","direction":"canonical_to_source","mapper":"coworkcanvas-compliance-graph","note":"Each member is a documented relationship claim from the canonical unified control to a source control or guidance proposition. relationship: equal|superset_of (full) / intersects_with|subset_of (partial) / informs (guidance). confidence 'medium' = single-mapper, documented, not yet externally corroborated. source_version is the member framework's edition from the standard version register.","reviewDate":"2026-09-07"},"relationship":"superset_of","source_version":"Regulation (EU) 2024/1689"},"sourceDetailPath":"/data/v1/records/uc-uc-ai-15-eb9589c6.json","sourceId":"uc:UC-AI-15","targetDetailPath":"/data/v1/records/ctrl-eu-ai-act-aia-art53-fd785909.json","targetId":"ctrl:eu-ai-act:AIA-Art53","type":"maps_to"},{"expectedCatalogRevision":"791ff2dd3a45707290badee660f185e514d15f1cf518908628f425c2f2c56ee4","id":"rel:7fe14f045eb5b989ed2b172e29123795c887a077790aec281603ac0cb5b7b76a","properties":{},"sourceDetailPath":"/data/v1/records/ctrl-aiuc-1-c010-b0a758b4.json","sourceId":"ctrl:aiuc-1:C010","targetDetailPath":"/data/v1/records/std-aiuc-1-d2a8b650.json","targetId":"std:aiuc-1","type":"belongs_to"},{"expectedCatalogRevision":"791ff2dd3a45707290badee660f185e514d15f1cf518908628f425c2f2c56ee4","id":"rel:80b5dcf1a0401185d2ebceb311894266c3b925724abab44029a60a3f07ae66d1","properties":{"control_id":"A.8.29","coverage":"full","delta":null,"framework":"iso-27001","provenance":{"defaultConfidence":"medium","defaultStatus":"active","direction":"canonical_to_source","mapper":"coworkcanvas-compliance-graph","note":"Each member is a documented relationship claim from the canonical unified control to a source control or guidance proposition. relationship: equal|superset_of (full) / intersects_with|subset_of (partial) / informs (guidance). confidence 'medium' = single-mapper, documented, not yet externally corroborated. source_version is the member framework's edition from the standard version register.","reviewDate":"2026-09-07"},"relationship":"superset_of","source_version":"2022"},"sourceDetailPath":"/data/v1/records/uc-uc-vuln-04-d07c87cf.json","sourceId":"uc:UC-VULN-04","targetDetailPath":"/data/v1/records/ctrl-iso-27001-a-8-29-e0df0522.json","targetId":"ctrl:iso-27001:A.8.29","type":"maps_to"},{"expectedCatalogRevision":"791ff2dd3a45707290badee660f185e514d15f1cf518908628f425c2f2c56ee4","id":"rel:81d44294f99278af7978ea2c1252664038b73ac319ebe9256bebcaf995fe82a1","properties":{},"sourceDetailPath":"/data/v1/records/ctrl-eu-ai-act-aia-art15-c3704411.json","sourceId":"ctrl:eu-ai-act:AIA-Art15","targetDetailPath":"/data/v1/records/std-eu-ai-act-54986689.json","targetId":"std:eu-ai-act","type":"belongs_to"},{"expectedCatalogRevision":"791ff2dd3a45707290badee660f185e514d15f1cf518908628f425c2f2c56ee4","id":"rel:8fdc7830079a5918f12dfa65dd2161ce222fcb194b0dc79ac6ab41841a9a5717","properties":{"control_id":"BAI06","coverage":"full","delta":null,"framework":"cobit-2019","provenance":{"defaultConfidence":"medium","defaultStatus":"active","direction":"canonical_to_source","mapper":"coworkcanvas-compliance-graph","note":"Each member is a documented relationship claim from the canonical unified control to a source control or guidance proposition. relationship: equal|superset_of (full) / intersects_with|subset_of (partial) / informs (guidance). confidence 'medium' = single-mapper, documented, not yet externally corroborated. source_version is the member framework's edition from the standard version register.","reviewDate":"2026-09-07"},"relationship":"superset_of","source_version":"2019"},"sourceDetailPath":"/data/v1/records/uc-uc-sdlc-07-22470d8b.json","sourceId":"uc:UC-SDLC-07","targetDetailPath":"/data/v1/records/ctrl-cobit-2019-bai06-306e8a70.json","targetId":"ctrl:cobit-2019:BAI06","type":"maps_to"},{"expectedCatalogRevision":"791ff2dd3a45707290badee660f185e514d15f1cf518908628f425c2f2c56ee4","id":"rel:908c341aa078ce102be83a656c1dbff4928a9841491d3385d0d228153e5925dc","properties":{"control_id":"B005","coverage":"full","delta":null,"framework":"aiuc-1","provenance":{"defaultConfidence":"medium","defaultStatus":"active","direction":"canonical_to_source","mapper":"coworkcanvas-compliance-graph","note":"Each member is a documented relationship claim from the canonical unified control to a source control or guidance proposition. relationship: equal|superset_of (full) / intersects_with|subset_of (partial) / informs (guidance). confidence 'medium' = single-mapper, documented, not yet externally corroborated. source_version is the member framework's edition from the standard version register.","reviewDate":"2026-09-07"},"relationship":"superset_of","source_version":"July 15, 2026 release (quarterly update cadence)"},"sourceDetailPath":"/data/v1/records/uc-uc-ai-18-f15ac93a.json","sourceId":"uc:UC-AI-18","targetDetailPath":"/data/v1/records/ctrl-aiuc-1-b005-fe985c7b.json","targetId":"ctrl:aiuc-1:B005","type":"maps_to"},{"expectedCatalogRevision":"791ff2dd3a45707290badee660f185e514d15f1cf518908628f425c2f2c56ee4","id":"rel:94968332499f1103f173cd77196d50bc0dcff5ac97d9906f1d4138683c245e28","properties":{"control_id":"BAI11","coverage":"full","delta":null,"framework":"cobit-2019","provenance":{"defaultConfidence":"medium","defaultStatus":"active","direction":"canonical_to_source","mapper":"coworkcanvas-compliance-graph","note":"Each member is a documented relationship claim from the canonical unified control to a source control or guidance proposition. relationship: equal|superset_of (full) / intersects_with|subset_of (partial) / informs (guidance). confidence 'medium' = single-mapper, documented, not yet externally corroborated. source_version is the member framework's edition from the standard version register.","reviewDate":"2026-09-07"},"relationship":"superset_of","source_version":"2019"},"sourceDetailPath":"/data/v1/records/uc-uc-sdlc-02-c3b003c2.json","sourceId":"uc:UC-SDLC-02","targetDetailPath":"/data/v1/records/ctrl-cobit-2019-bai11-fbe7d977.json","targetId":"ctrl:cobit-2019:BAI11","type":"maps_to"},{"expectedCatalogRevision":"791ff2dd3a45707290badee660f185e514d15f1cf518908628f425c2f2c56ee4","id":"rel:96fe8cd5e6550663eb4ec5bf19b88679bf108221016937cf868e836905365c8f","properties":{"control_id":"BAI07","coverage":"full","delta":null,"framework":"cobit-2019","provenance":{"defaultConfidence":"medium","defaultStatus":"active","direction":"canonical_to_source","mapper":"coworkcanvas-compliance-graph","note":"Each member is a documented relationship claim from the canonical unified control to a source control or guidance proposition. relationship: equal|superset_of (full) / intersects_with|subset_of (partial) / informs (guidance). confidence 'medium' = single-mapper, documented, not yet externally corroborated. source_version is the member framework's edition from the standard version register.","reviewDate":"2026-09-07"},"relationship":"superset_of","source_version":"2019"},"sourceDetailPath":"/data/v1/records/uc-uc-sdlc-07-22470d8b.json","sourceId":"uc:UC-SDLC-07","targetDetailPath":"/data/v1/records/ctrl-cobit-2019-bai07-dcabfa26.json","targetId":"ctrl:cobit-2019:BAI07","type":"maps_to"},{"expectedCatalogRevision":"791ff2dd3a45707290badee660f185e514d15f1cf518908628f425c2f2c56ee4","id":"rel:98948334f16c82e75fc7875acb9c6157cf1ad71bc9ad5f00b29cd6d8000c1963","properties":{},"sourceDetailPath":"/data/v1/records/ctrl-cobit-2019-bai06-306e8a70.json","sourceId":"ctrl:cobit-2019:BAI06","targetDetailPath":"/data/v1/records/std-cobit-2019-2181ce0c.json","targetId":"std:cobit-2019","type":"belongs_to"},{"expectedCatalogRevision":"791ff2dd3a45707290badee660f185e514d15f1cf518908628f425c2f2c56ee4","id":"rel:9a6fbed9e489613a8371aa786123991431f383218b1fad7b83994f3b1fa9b4fe","properties":{},"sourceDetailPath":"/data/v1/records/ctrl-cobit-2019-bai01-12e2e132.json","sourceId":"ctrl:cobit-2019:BAI01","targetDetailPath":"/data/v1/records/std-cobit-2019-2181ce0c.json","targetId":"std:cobit-2019","type":"belongs_to"},{"expectedCatalogRevision":"791ff2dd3a45707290badee660f185e514d15f1cf518908628f425c2f2c56ee4","id":"rel:9b1ac6bfa799e9a878a2f3298cc3d84973dc3ed7da85beabe618a4380720ef55","properties":{},"sourceDetailPath":"/data/v1/records/ctrl-cobit-2019-bai03-bfe681b0.json","sourceId":"ctrl:cobit-2019:BAI03","targetDetailPath":"/data/v1/records/std-cobit-2019-2181ce0c.json","targetId":"std:cobit-2019","type":"belongs_to"},{"expectedCatalogRevision":"791ff2dd3a45707290badee660f185e514d15f1cf518908628f425c2f2c56ee4","id":"rel:9d5e344a30149135e006ecccf476eb173557ce440799713ad29392ae13c3c7b7","properties":{"control_id":"A.8.25","coverage":"full","delta":null,"framework":"iso-27001","provenance":{"defaultConfidence":"medium","defaultStatus":"active","direction":"canonical_to_source","mapper":"coworkcanvas-compliance-graph","note":"Each member is a documented relationship claim from the canonical unified control to a source control or guidance proposition. relationship: equal|superset_of (full) / intersects_with|subset_of (partial) / informs (guidance). confidence 'medium' = single-mapper, documented, not yet externally corroborated. source_version is the member framework's edition from the standard version register.","reviewDate":"2026-09-07"},"relationship":"superset_of","source_version":"2022"},"sourceDetailPath":"/data/v1/records/uc-uc-sdlc-01-b3583fd1.json","sourceId":"uc:UC-SDLC-01","targetDetailPath":"/data/v1/records/ctrl-iso-27001-a-8-25-3cbe2191.json","targetId":"ctrl:iso-27001:A.8.25","type":"maps_to"},{"expectedCatalogRevision":"791ff2dd3a45707290badee660f185e514d15f1cf518908628f425c2f2c56ee4","id":"rel:9fa3d3c91726a4a890c2543bd8ae26001b16207ec017301c6e58893cd622b8a6","properties":{},"sourceDetailPath":"/data/v1/records/ctrl-cobit-2019-bai09-09a008c3.json","sourceId":"ctrl:cobit-2019:BAI09","targetDetailPath":"/data/v1/records/std-cobit-2019-2181ce0c.json","targetId":"std:cobit-2019","type":"belongs_to"},{"expectedCatalogRevision":"791ff2dd3a45707290badee660f185e514d15f1cf518908628f425c2f2c56ee4","id":"rel:a4b962f8681ae302dd3d263e2057be52d76ae3a42d983d3a9f7daf50642b8a4f","properties":{},"sourceDetailPath":"/data/v1/records/ctrl-iso-27001-a-8-21-5b64f0ec.json","sourceId":"ctrl:iso-27001:A.8.21","targetDetailPath":"/data/v1/records/std-iso-27001-656201bd.json","targetId":"std:iso-27001","type":"belongs_to"},{"expectedCatalogRevision":"791ff2dd3a45707290badee660f185e514d15f1cf518908628f425c2f2c56ee4","id":"rel:a9c21cb9b25d0672e34ba3509ac1069d58338117d3fe68376e2e33f9616b19e6","properties":{},"sourceDetailPath":"/data/v1/records/ctrl-cobit-2019-bai07-dcabfa26.json","sourceId":"ctrl:cobit-2019:BAI07","targetDetailPath":"/data/v1/records/std-cobit-2019-2181ce0c.json","targetId":"std:cobit-2019","type":"belongs_to"},{"expectedCatalogRevision":"791ff2dd3a45707290badee660f185e514d15f1cf518908628f425c2f2c56ee4","id":"rel:ad79ca3242cac5551158b9c9ff960685018e66075adf393b637d03e7c34308b8","properties":{},"sourceDetailPath":"/data/v1/records/ctrl-aiuc-1-b008-39c816b1.json","sourceId":"ctrl:aiuc-1:B008","targetDetailPath":"/data/v1/records/std-aiuc-1-d2a8b650.json","targetId":"std:aiuc-1","type":"belongs_to"},{"expectedCatalogRevision":"791ff2dd3a45707290badee660f185e514d15f1cf518908628f425c2f2c56ee4","id":"rel:aecd717d6185bfe73df9e6b08b317c80a2a700620a5315a7d9f2548452e607d2","properties":{"control_id":"E011","coverage":"partial","delta":"a customer-facing record of the regions and sub-processors where AI inputs and outputs are processed and stored","framework":"aiuc-1","provenance":{"defaultConfidence":"medium","defaultStatus":"active","direction":"canonical_to_source","mapper":"coworkcanvas-compliance-graph","note":"Each member is a documented relationship claim from the canonical unified control to a source control or guidance proposition. relationship: equal|superset_of (full) / intersects_with|subset_of (partial) / informs (guidance). confidence 'medium' = single-mapper, documented, not yet externally corroborated. source_version is the member framework's edition from the standard version register.","reviewDate":"2026-09-07"},"relationship":"intersects_with","source_version":"July 15, 2026 release (quarterly update cadence)"},"sourceDetailPath":"/data/v1/records/uc-uc-config-10-921518b8.json","sourceId":"uc:UC-CONFIG-10","targetDetailPath":"/data/v1/records/ctrl-aiuc-1-e011-56758692.json","targetId":"ctrl:aiuc-1:E011","type":"maps_to"},{"expectedCatalogRevision":"791ff2dd3a45707290badee660f185e514d15f1cf518908628f425c2f2c56ee4","id":"rel:af5137d288d7b0fecc90f33139d073dc1e3f344133042f275bae26df7a0576ec","properties":{},"sourceDetailPath":"/data/v1/records/ctrl-iso-27001-a-8-23-91f17a7e.json","sourceId":"ctrl:iso-27001:A.8.23","targetDetailPath":"/data/v1/records/std-iso-27001-656201bd.json","targetId":"std:iso-27001","type":"belongs_to"},{"expectedCatalogRevision":"791ff2dd3a45707290badee660f185e514d15f1cf518908628f425c2f2c56ee4","id":"rel:b28ea7bff8a7a69df01a6a4d9b3d714b1e0a06a3413cb514b0e7aa17e4b438dd","properties":{"control_id":"AIA-Art55","coverage":"full","delta":null,"framework":"eu-ai-act","provenance":{"defaultConfidence":"medium","defaultStatus":"active","direction":"canonical_to_source","mapper":"coworkcanvas-compliance-graph","note":"Each member is a documented relationship claim from the canonical unified control to a source control or guidance proposition. relationship: equal|superset_of (full) / intersects_with|subset_of (partial) / informs (guidance). confidence 'medium' = single-mapper, documented, not yet externally corroborated. source_version is the member framework's edition from the standard version register.","reviewDate":"2026-09-07"},"relationship":"superset_of","source_version":"Regulation (EU) 2024/1689"},"sourceDetailPath":"/data/v1/records/uc-uc-ai-15-eb9589c6.json","sourceId":"uc:UC-AI-15","targetDetailPath":"/data/v1/records/ctrl-eu-ai-act-aia-art55-53ccdfc5.json","targetId":"ctrl:eu-ai-act:AIA-Art55","type":"maps_to"},{"expectedCatalogRevision":"791ff2dd3a45707290badee660f185e514d15f1cf518908628f425c2f2c56ee4","id":"rel:b2d12d84f6b7b23a587ee3058dd3cb7d236c00fa995c84821b0bdc4d8a445e93","properties":{"control_id":"A.8.26","coverage":"full","delta":null,"framework":"iso-27001","provenance":{"defaultConfidence":"medium","defaultStatus":"active","direction":"canonical_to_source","mapper":"coworkcanvas-compliance-graph","note":"Each member is a documented relationship claim from the canonical unified control to a source control or guidance proposition. relationship: equal|superset_of (full) / intersects_with|subset_of (partial) / informs (guidance). confidence 'medium' = single-mapper, documented, not yet externally corroborated. source_version is the member framework's edition from the standard version register.","reviewDate":"2026-09-07"},"relationship":"superset_of","source_version":"2022"},"sourceDetailPath":"/data/v1/records/uc-uc-sdlc-03-5de4daf8.json","sourceId":"uc:UC-SDLC-03","targetDetailPath":"/data/v1/records/ctrl-iso-27001-a-8-26-34d8988d.json","targetId":"ctrl:iso-27001:A.8.26","type":"maps_to"},{"expectedCatalogRevision":"791ff2dd3a45707290badee660f185e514d15f1cf518908628f425c2f2c56ee4","id":"rel:b49441ad04e7bb2572f9ca20f5e87f347a22f75d23a7969d40c00117e61d6d09","properties":{"control_id":"D004","coverage":"full","delta":null,"framework":"aiuc-1","provenance":{"defaultConfidence":"medium","defaultStatus":"active","direction":"canonical_to_source","mapper":"coworkcanvas-compliance-graph","note":"Each member is a documented relationship claim from the canonical unified control to a source control or guidance proposition. relationship: equal|superset_of (full) / intersects_with|subset_of (partial) / informs (guidance). confidence 'medium' = single-mapper, documented, not yet externally corroborated. source_version is the member framework's edition from the standard version register.","reviewDate":"2026-09-07"},"relationship":"superset_of","source_version":"July 15, 2026 release (quarterly update cadence)"},"sourceDetailPath":"/data/v1/records/uc-uc-ai-21-8afd47db.json","sourceId":"uc:UC-AI-21","targetDetailPath":"/data/v1/records/ctrl-aiuc-1-d004-21d4eeb4.json","targetId":"ctrl:aiuc-1:D004","type":"maps_to"},{"expectedCatalogRevision":"791ff2dd3a45707290badee660f185e514d15f1cf518908628f425c2f2c56ee4","id":"rel:b746704844a32ce3da334aa3bb3c92c52a59c320118c0ce5d8e906cf943e8916","properties":{"control_id":"A.8.32","coverage":"full","delta":null,"framework":"iso-27001","provenance":{"defaultConfidence":"medium","defaultStatus":"active","direction":"canonical_to_source","mapper":"coworkcanvas-compliance-graph","note":"Each member is a documented relationship claim from the canonical unified control to a source control or guidance proposition. relationship: equal|superset_of (full) / intersects_with|subset_of (partial) / informs (guidance). confidence 'medium' = single-mapper, documented, not yet externally corroborated. source_version is the member framework's edition from the standard version register.","reviewDate":"2026-09-07"},"relationship":"superset_of","source_version":"2022"},"sourceDetailPath":"/data/v1/records/uc-uc-config-02-175d55b0.json","sourceId":"uc:UC-CONFIG-02","targetDetailPath":"/data/v1/records/ctrl-iso-27001-a-8-32-b855772a.json","targetId":"ctrl:iso-27001:A.8.32","type":"maps_to"},{"expectedCatalogRevision":"791ff2dd3a45707290badee660f185e514d15f1cf518908628f425c2f2c56ee4","id":"rel:b78df392b933c68f3c14d3ef4c2af8faf28b2a88601ab2e6d22eda2aa8113e2b","properties":{"control_id":"A.8.30","coverage":"full","delta":null,"framework":"iso-27001","provenance":{"defaultConfidence":"medium","defaultStatus":"active","direction":"canonical_to_source","mapper":"coworkcanvas-compliance-graph","note":"Each member is a documented relationship claim from the canonical unified control to a source control or guidance proposition. relationship: equal|superset_of (full) / intersects_with|subset_of (partial) / informs (guidance). confidence 'medium' = single-mapper, documented, not yet externally corroborated. source_version is the member framework's edition from the standard version register.","reviewDate":"2026-09-07"},"relationship":"superset_of","source_version":"2022"},"sourceDetailPath":"/data/v1/records/uc-uc-sdlc-10-3ac58852.json","sourceId":"uc:UC-SDLC-10","targetDetailPath":"/data/v1/records/ctrl-iso-27001-a-8-30-6a684665.json","targetId":"ctrl:iso-27001:A.8.30","type":"maps_to"},{"expectedCatalogRevision":"791ff2dd3a45707290badee660f185e514d15f1cf518908628f425c2f2c56ee4","id":"rel:b7b3ceac0daac147fd82e8033c375b3cfbb55fab37fca4f509a85bfb003a4830","properties":{"control_id":"A.8.20","coverage":"full","delta":null,"framework":"iso-27001","provenance":{"defaultConfidence":"medium","defaultStatus":"active","direction":"canonical_to_source","mapper":"coworkcanvas-compliance-graph","note":"Each member is a documented relationship claim from the canonical unified control to a source control or guidance proposition. relationship: equal|superset_of (full) / intersects_with|subset_of (partial) / informs (guidance). confidence 'medium' = single-mapper, documented, not yet externally corroborated. source_version is the member framework's edition from the standard version register.","reviewDate":"2026-09-07"},"relationship":"superset_of","source_version":"2022"},"sourceDetailPath":"/data/v1/records/uc-uc-log-08-61745e12.json","sourceId":"uc:UC-LOG-08","targetDetailPath":"/data/v1/records/ctrl-iso-27001-a-8-20-68d4486b.json","targetId":"ctrl:iso-27001:A.8.20","type":"maps_to"},{"expectedCatalogRevision":"791ff2dd3a45707290badee660f185e514d15f1cf518908628f425c2f2c56ee4","id":"rel:c167e1277136936a9d4545736150b97fc15aa63218aa40c5de8daffcfc664e3b","properties":{"control_id":"A.8.31","coverage":"full","delta":null,"framework":"iso-27001","provenance":{"defaultConfidence":"medium","defaultStatus":"active","direction":"canonical_to_source","mapper":"coworkcanvas-compliance-graph","note":"Each member is a documented relationship claim from the canonical unified control to a source control or guidance proposition. relationship: equal|superset_of (full) / intersects_with|subset_of (partial) / informs (guidance). confidence 'medium' = single-mapper, documented, not yet externally corroborated. source_version is the member framework's edition from the standard version register.","reviewDate":"2026-09-07"},"relationship":"superset_of","source_version":"2022"},"sourceDetailPath":"/data/v1/records/uc-uc-config-03-3a08a2b1.json","sourceId":"uc:UC-CONFIG-03","targetDetailPath":"/data/v1/records/ctrl-iso-27001-a-8-31-eabf2a51.json","targetId":"ctrl:iso-27001:A.8.31","type":"maps_to"},{"expectedCatalogRevision":"791ff2dd3a45707290badee660f185e514d15f1cf518908628f425c2f2c56ee4","id":"rel:cac87c52f8cad781925ff1df93d3ecdcadc88de1e2481e2c5f6ec35ca0f68006","properties":{"control_id":"B004","coverage":"full","delta":null,"framework":"aiuc-1","provenance":{"defaultConfidence":"medium","defaultStatus":"active","direction":"canonical_to_source","mapper":"coworkcanvas-compliance-graph","note":"Each member is a documented relationship claim from the canonical unified control to a source control or guidance proposition. relationship: equal|superset_of (full) / intersects_with|subset_of (partial) / informs (guidance). confidence 'medium' = single-mapper, documented, not yet externally corroborated. source_version is the member framework's edition from the standard version register.","reviewDate":"2026-09-07"},"relationship":"superset_of","source_version":"July 15, 2026 release (quarterly update cadence)"},"sourceDetailPath":"/data/v1/records/uc-uc-ai-18-f15ac93a.json","sourceId":"uc:UC-AI-18","targetDetailPath":"/data/v1/records/ctrl-aiuc-1-b004-d4ff3b14.json","targetId":"ctrl:aiuc-1:B004","type":"maps_to"},{"expectedCatalogRevision":"791ff2dd3a45707290badee660f185e514d15f1cf518908628f425c2f2c56ee4","id":"rel:cb331171f2173812819b3693734a404afeb336920f1e8b5f4e994f54618b914a","properties":{},"sourceDetailPath":"/data/v1/records/ctrl-eu-ai-act-aia-art55-53ccdfc5.json","sourceId":"ctrl:eu-ai-act:AIA-Art55","targetDetailPath":"/data/v1/records/std-eu-ai-act-54986689.json","targetId":"std:eu-ai-act","type":"belongs_to"},{"expectedCatalogRevision":"791ff2dd3a45707290badee660f185e514d15f1cf518908628f425c2f2c56ee4","id":"rel:d01f94392dc563be0aa2b00b6b75d9fc39ee97811b15eb3cf2774047f5b49b79","properties":{},"sourceDetailPath":"/data/v1/records/ctrl-dora-dora-art45-bb72d2e3.json","sourceId":"ctrl:dora:DORA-Art45","targetDetailPath":"/data/v1/records/std-dora-95cf939d.json","targetId":"std:dora","type":"belongs_to"},{"expectedCatalogRevision":"791ff2dd3a45707290badee660f185e514d15f1cf518908628f425c2f2c56ee4","id":"rel:d12810bb743c19ee31493be295824f2014ba01c0b4c01ccb177620aa79dd0909","properties":{},"sourceDetailPath":"/data/v1/records/ctrl-aiuc-1-b005-fe985c7b.json","sourceId":"ctrl:aiuc-1:B005","targetDetailPath":"/data/v1/records/std-aiuc-1-d2a8b650.json","targetId":"std:aiuc-1","type":"belongs_to"},{"expectedCatalogRevision":"791ff2dd3a45707290badee660f185e514d15f1cf518908628f425c2f2c56ee4","id":"rel:d30ef7fd2bbb90d2d22640fe778b901d09a3b65df04eb887c2b165df9dec0ab5","properties":{},"sourceDetailPath":"/data/v1/records/ctrl-aiuc-1-e006-362f564d.json","sourceId":"ctrl:aiuc-1:E006","targetDetailPath":"/data/v1/records/std-aiuc-1-d2a8b650.json","targetId":"std:aiuc-1","type":"belongs_to"},{"expectedCatalogRevision":"791ff2dd3a45707290badee660f185e514d15f1cf518908628f425c2f2c56ee4","id":"rel:d76ebfe31f21c2186bd8d943cc9a6d3c0ec35cc97fd13308cabc92f979186c55","properties":{"control_id":"A.8.22","coverage":"full","delta":null,"framework":"iso-27001","provenance":{"defaultConfidence":"medium","defaultStatus":"active","direction":"canonical_to_source","mapper":"coworkcanvas-compliance-graph","note":"Each member is a documented relationship claim from the canonical unified control to a source control or guidance proposition. relationship: equal|superset_of (full) / intersects_with|subset_of (partial) / informs (guidance). confidence 'medium' = single-mapper, documented, not yet externally corroborated. source_version is the member framework's edition from the standard version register.","reviewDate":"2026-09-07"},"relationship":"superset_of","source_version":"2022"},"sourceDetailPath":"/data/v1/records/uc-uc-net-01-30bfdc5f.json","sourceId":"uc:UC-NET-01","targetDetailPath":"/data/v1/records/ctrl-iso-27001-a-8-22-be69b805.json","targetId":"ctrl:iso-27001:A.8.22","type":"maps_to"},{"expectedCatalogRevision":"791ff2dd3a45707290badee660f185e514d15f1cf518908628f425c2f2c56ee4","id":"rel:dadba8095e99ffd7e92198bac506ab1dd4ad19cf0bb742d44e096f3eba524948","properties":{"control_id":"E006","coverage":"partial","delta":"assess foundation and upstream model providers against explicit data-handling, PII-control, security, and compliance criteria, and retain the due-diligence evidence","framework":"aiuc-1","provenance":{"defaultConfidence":"medium","defaultStatus":"active","direction":"canonical_to_source","mapper":"coworkcanvas-compliance-graph","note":"Each member is a documented relationship claim from the canonical unified control to a source control or guidance proposition. relationship: equal|superset_of (full) / intersects_with|subset_of (partial) / informs (guidance). confidence 'medium' = single-mapper, documented, not yet externally corroborated. source_version is the member framework's edition from the standard version register.","reviewDate":"2026-09-07"},"relationship":"intersects_with","source_version":"July 15, 2026 release (quarterly update cadence)"},"sourceDetailPath":"/data/v1/records/uc-uc-ai-14-cc67739e.json","sourceId":"uc:UC-AI-14","targetDetailPath":"/data/v1/records/ctrl-aiuc-1-e006-362f564d.json","targetId":"ctrl:aiuc-1:E006","type":"maps_to"},{"expectedCatalogRevision":"791ff2dd3a45707290badee660f185e514d15f1cf518908628f425c2f2c56ee4","id":"rel:ddc52a3e4e143989b6eafea19376f24a04235bec1d452011589e6ebfc946cb37","properties":{},"sourceDetailPath":"/data/v1/records/ctrl-aiuc-1-d002-34554b38.json","sourceId":"ctrl:aiuc-1:D002","targetDetailPath":"/data/v1/records/std-aiuc-1-d2a8b650.json","targetId":"std:aiuc-1","type":"belongs_to"},{"expectedCatalogRevision":"791ff2dd3a45707290badee660f185e514d15f1cf518908628f425c2f2c56ee4","id":"rel:dfbda93476c25cd552d1253bfc6e614f83807e71b80d04d3c61355f7d3b2f5c3","properties":{"control_id":"BAI02","coverage":"full","delta":null,"framework":"cobit-2019","provenance":{"defaultConfidence":"medium","defaultStatus":"active","direction":"canonical_to_source","mapper":"coworkcanvas-compliance-graph","note":"Each member is a documented relationship claim from the canonical unified control to a source control or guidance proposition. relationship: equal|superset_of (full) / intersects_with|subset_of (partial) / informs (guidance). confidence 'medium' = single-mapper, documented, not yet externally corroborated. source_version is the member framework's edition from the standard version register.","reviewDate":"2026-09-07"},"relationship":"superset_of","source_version":"2019"},"sourceDetailPath":"/data/v1/records/uc-uc-sdlc-03-5de4daf8.json","sourceId":"uc:UC-SDLC-03","targetDetailPath":"/data/v1/records/ctrl-cobit-2019-bai02-80041b74.json","targetId":"ctrl:cobit-2019:BAI02","type":"maps_to"},{"expectedCatalogRevision":"791ff2dd3a45707290badee660f185e514d15f1cf518908628f425c2f2c56ee4","id":"rel:dfe4a2f352199a3a665ddddedaf3a66dee1ff1c8687930b9b84f4439e5433a9a","properties":{"control_id":"B002","coverage":"full","delta":null,"framework":"aiuc-1","provenance":{"defaultConfidence":"medium","defaultStatus":"active","direction":"canonical_to_source","mapper":"coworkcanvas-compliance-graph","note":"Each member is a documented relationship claim from the canonical unified control to a source control or guidance proposition. relationship: equal|superset_of (full) / intersects_with|subset_of (partial) / informs (guidance). confidence 'medium' = single-mapper, documented, not yet externally corroborated. source_version is the member framework's edition from the standard version register.","reviewDate":"2026-09-07"},"relationship":"superset_of","source_version":"July 15, 2026 release (quarterly update cadence)"},"sourceDetailPath":"/data/v1/records/uc-uc-ai-18-f15ac93a.json","sourceId":"uc:UC-AI-18","targetDetailPath":"/data/v1/records/ctrl-aiuc-1-b002-07a4b0e1.json","targetId":"ctrl:aiuc-1:B002","type":"maps_to"},{"expectedCatalogRevision":"791ff2dd3a45707290badee660f185e514d15f1cf518908628f425c2f2c56ee4","id":"rel:e317a50a1f93d9c972822f8bf753183654e8add73e9e71d070892ad169295c57","properties":{},"sourceDetailPath":"/data/v1/records/ctrl-aiuc-1-b002-07a4b0e1.json","sourceId":"ctrl:aiuc-1:B002","targetDetailPath":"/data/v1/records/std-aiuc-1-d2a8b650.json","targetId":"std:aiuc-1","type":"belongs_to"},{"expectedCatalogRevision":"791ff2dd3a45707290badee660f185e514d15f1cf518908628f425c2f2c56ee4","id":"rel:e606dc337059883eca825fc58e55c1db8da105553e224d4723b18417ca8583ac","properties":{"control_id":"B001","coverage":"full","delta":null,"framework":"aiuc-1","provenance":{"defaultConfidence":"medium","defaultStatus":"active","direction":"canonical_to_source","mapper":"coworkcanvas-compliance-graph","note":"Each member is a documented relationship claim from the canonical unified control to a source control or guidance proposition. relationship: equal|superset_of (full) / intersects_with|subset_of (partial) / informs (guidance). confidence 'medium' = single-mapper, documented, not yet externally corroborated. source_version is the member framework's edition from the standard version register.","reviewDate":"2026-09-07"},"relationship":"superset_of","source_version":"July 15, 2026 release (quarterly update cadence)"},"sourceDetailPath":"/data/v1/records/uc-uc-ai-21-8afd47db.json","sourceId":"uc:UC-AI-21","targetDetailPath":"/data/v1/records/ctrl-aiuc-1-b001-19a54ee3.json","targetId":"ctrl:aiuc-1:B001","type":"maps_to"},{"expectedCatalogRevision":"791ff2dd3a45707290badee660f185e514d15f1cf518908628f425c2f2c56ee4","id":"rel:e9fa5370e6d6ce54f4497643a6a0d97dfe8e051a981f49756dab4989842e6fd8","properties":{},"sourceDetailPath":"/data/v1/records/ctrl-iso-27001-a-8-31-eabf2a51.json","sourceId":"ctrl:iso-27001:A.8.31","targetDetailPath":"/data/v1/records/std-iso-27001-656201bd.json","targetId":"std:iso-27001","type":"belongs_to"},{"expectedCatalogRevision":"791ff2dd3a45707290badee660f185e514d15f1cf518908628f425c2f2c56ee4","id":"rel:eb0ed37196560f352a362b415b0bec4f7d604169244d4e8fe9f149661b959caf","properties":{},"sourceDetailPath":"/data/v1/records/ctrl-aiuc-1-c011-7889db41.json","sourceId":"ctrl:aiuc-1:C011","targetDetailPath":"/data/v1/records/std-aiuc-1-d2a8b650.json","targetId":"std:aiuc-1","type":"belongs_to"},{"expectedCatalogRevision":"791ff2dd3a45707290badee660f185e514d15f1cf518908628f425c2f2c56ee4","id":"rel:eb8ae9550dcdacfecbd0859c5e133b80925bd0724b8cfc9d5c03f7b8194b1bd5","properties":{},"sourceDetailPath":"/data/v1/records/ctrl-aiuc-1-b004-d4ff3b14.json","sourceId":"ctrl:aiuc-1:B004","targetDetailPath":"/data/v1/records/std-aiuc-1-d2a8b650.json","targetId":"std:aiuc-1","type":"belongs_to"},{"expectedCatalogRevision":"791ff2dd3a45707290badee660f185e514d15f1cf518908628f425c2f2c56ee4","id":"rel:eb9b2fc276833be22e81f68e87785ccf8cb27bd7adccf57070cac1d600ea9e8d","properties":{"control_id":"A.8.27","coverage":"full","delta":null,"framework":"iso-27001","provenance":{"defaultConfidence":"medium","defaultStatus":"active","direction":"canonical_to_source","mapper":"coworkcanvas-compliance-graph","note":"Each member is a documented relationship claim from the canonical unified control to a source control or guidance proposition. relationship: equal|superset_of (full) / intersects_with|subset_of (partial) / informs (guidance). confidence 'medium' = single-mapper, documented, not yet externally corroborated. source_version is the member framework's edition from the standard version register.","reviewDate":"2026-09-07"},"relationship":"superset_of","source_version":"2022"},"sourceDetailPath":"/data/v1/records/uc-uc-sdlc-04-ee9d76b1.json","sourceId":"uc:UC-SDLC-04","targetDetailPath":"/data/v1/records/ctrl-iso-27001-a-8-27-a4a3784c.json","targetId":"ctrl:iso-27001:A.8.27","type":"maps_to"},{"expectedCatalogRevision":"791ff2dd3a45707290badee660f185e514d15f1cf518908628f425c2f2c56ee4","id":"rel:ed31e96542f9f30cc5f593b4148416965c7b4d9c69400254d868b2673d57211b","properties":{},"sourceDetailPath":"/data/v1/records/ctrl-iso-27001-a-8-25-3cbe2191.json","sourceId":"ctrl:iso-27001:A.8.25","targetDetailPath":"/data/v1/records/std-iso-27001-656201bd.json","targetId":"std:iso-27001","type":"belongs_to"},{"expectedCatalogRevision":"791ff2dd3a45707290badee660f185e514d15f1cf518908628f425c2f2c56ee4","id":"rel:ee557c335938bdb4b1cc2ac82b518c84c9545e30e6d4dc4096e6679d034009fb","properties":{"control_id":"A.8.23","coverage":"full","delta":null,"framework":"iso-27001","provenance":{"defaultConfidence":"medium","defaultStatus":"active","direction":"canonical_to_source","mapper":"coworkcanvas-compliance-graph","note":"Each member is a documented relationship claim from the canonical unified control to a source control or guidance proposition. relationship: equal|superset_of (full) / intersects_with|subset_of (partial) / informs (guidance). confidence 'medium' = single-mapper, documented, not yet externally corroborated. source_version is the member framework's edition from the standard version register.","reviewDate":"2026-09-07"},"relationship":"superset_of","source_version":"2022"},"sourceDetailPath":"/data/v1/records/uc-uc-net-13-df790edf.json","sourceId":"uc:UC-NET-13","targetDetailPath":"/data/v1/records/ctrl-iso-27001-a-8-23-91f17a7e.json","targetId":"ctrl:iso-27001:A.8.23","type":"maps_to"},{"expectedCatalogRevision":"791ff2dd3a45707290badee660f185e514d15f1cf518908628f425c2f2c56ee4","id":"rel:f72c4c986f7ebc639fd56c06a35a787752152ccc5a7ef9964e6135a8250f5093","properties":{"control_id":"A.8.21","coverage":"full","delta":null,"framework":"iso-27001","provenance":{"defaultConfidence":"medium","defaultStatus":"active","direction":"canonical_to_source","mapper":"coworkcanvas-compliance-graph","note":"Each member is a documented relationship claim from the canonical unified control to a source control or guidance proposition. relationship: equal|superset_of (full) / intersects_with|subset_of (partial) / informs (guidance). confidence 'medium' = single-mapper, documented, not yet externally corroborated. source_version is the member framework's edition from the standard version register.","reviewDate":"2026-09-07"},"relationship":"superset_of","source_version":"2022"},"sourceDetailPath":"/data/v1/records/uc-uc-log-08-61745e12.json","sourceId":"uc:UC-LOG-08","targetDetailPath":"/data/v1/records/ctrl-iso-27001-a-8-21-5b64f0ec.json","targetId":"ctrl:iso-27001:A.8.21","type":"maps_to"},{"expectedCatalogRevision":"791ff2dd3a45707290badee660f185e514d15f1cf518908628f425c2f2c56ee4","id":"rel:fc576a933f2542e942f21141470a9d706153d23d73f1834e71c92bc1d99baecc","properties":{},"sourceDetailPath":"/data/v1/records/ctrl-iso-27001-a-8-22-be69b805.json","sourceId":"ctrl:iso-27001:A.8.22","targetDetailPath":"/data/v1/records/std-iso-27001-656201bd.json","targetId":"std:iso-27001","type":"belongs_to"},{"expectedCatalogRevision":"791ff2dd3a45707290badee660f185e514d15f1cf518908628f425c2f2c56ee4","id":"rel:fc798f57020128c2304ced9e83b5e2bc542716be475a026d320e85ef491f566a","properties":{"control_id":"P12","coverage":"partial","delta":"COSO expects policies and procedures deploying all control activities, not only CM","framework":"coso-ic","provenance":{"defaultConfidence":"medium","defaultStatus":"active","direction":"canonical_to_source","mapper":"coworkcanvas-compliance-graph","note":"Each member is a documented relationship claim from the canonical unified control to a source control or guidance proposition. relationship: equal|superset_of (full) / intersects_with|subset_of (partial) / informs (guidance). confidence 'medium' = single-mapper, documented, not yet externally corroborated. source_version is the member framework's edition from the standard version register.","reviewDate":"2026-09-07"},"relationship":"intersects_with","source_version":"2013"},"sourceDetailPath":"/data/v1/records/uc-uc-config-09-3da3afe2.json","sourceId":"uc:UC-CONFIG-09","targetDetailPath":"/data/v1/records/ctrl-coso-ic-p12-233c8710.json","targetId":"ctrl:coso-ic:P12","type":"maps_to"},{"expectedCatalogRevision":"791ff2dd3a45707290badee660f185e514d15f1cf518908628f425c2f2c56ee4","id":"rel:fe56eb4296e68785198e7c151a8fb322b26fc4012b56da65d167ea60058e3e1f","properties":{},"sourceDetailPath":"/data/v1/records/ctrl-eu-ai-act-aia-art53-fd785909.json","sourceId":"ctrl:eu-ai-act:AIA-Art53","targetDetailPath":"/data/v1/records/std-eu-ai-act-54986689.json","targetId":"std:eu-ai-act","type":"belongs_to"}],"schemaVersion":1,"scope":"topics","total":250}