Skip to main content

GOV-04: Publishing Security, Compliance & Resilience Documentation

GOV 10 — Critical Govern

Mechanisms exist to establish, maintain and disseminate policies, standards and procedures necessary for secure, compliant and resilient capabilities.

Renumbered: Formerly GOV-02 in SCF 2025.4.

Code reused: In SCF 2025.4 and earlier, GOV-04 was Assigned Cybersecurity & Data Protection Responsibilities. That control is now GOV-05.

Control Question: Does the organization establish, maintain and disseminate policies, standards and procedures necessary for secure, compliant and resilient capabilities?

General (64)
Framework Mapping Values
AICPA Privacy Management Framework (PMF) M1.0 M1.2 M1.2-POF8 D6.1-POF1
AICPA TSC 2017:2022 (used for SOC 2) (source) CC1.2-POF1 CC1.4-POF1 CC2.2-POF1 CC2.2-POF7 CC5.3 CC5.3-POF1 CC7.2-POF1 P1.1-POF5
BSI Standard 200-1 7.3
COBIT 2019 APO01.09
COSO 2013 12.0
CSA CCM 4.1.0 A&A-01 AIS-01 BCR-01 CCC-01 CEK-01 DCS-01 DSP-01 GRC-01 IAM-01 IAM-02 IPY-01 I&S-01 LOG-01 SEF-01 SEF-02 STA-01 TVM-01 TVM-02 TVM-04 UEM-01
CSA IoT SCF 2 GVN-01 GVN-02 POL-03
GovRAMP AC-01 AT-01 AU-01 CA-01 CM-01 CP-01 IA-01 IR-01 MA-01 MP-01 PE-01 PL-01 PS-01 RA-01 SA-01 SC-01 SI-01
GovRAMP Low AC-01 AT-01 AU-01 CA-01 CM-01 CP-01 IA-01 IR-01 MA-01 MP-01 PE-01 PL-01 PS-01 RA-01 SA-01 SC-01 SI-01
GovRAMP Low+ AC-01 AT-01 AU-01 CA-01 CM-01 CP-01 IA-01 IR-01 MA-01 MP-01 PE-01 PL-01 PS-01 RA-01 SA-01 SC-01 SI-01
GovRAMP Moderate AC-01 AT-01 AU-01 CA-01 CM-01 CP-01 IA-01 IR-01 MA-01 MP-01 PE-01 PL-01 PS-01 RA-01 SA-01 SC-01 SI-01
GovRAMP High AC-01 AT-01 AU-01 CA-01 CM-01 CP-01 IA-01 IR-01 MA-01 MP-01 PE-01 PL-01 PS-01 RA-01 SA-01 SC-01 SI-01
IMO Maritime Cyber Risk Management 3.5.1 3.5.3.8 3.5.3.9
ISO/SAE 21434 2021 RQ-05-01 RQ-05-01(a) RQ-05-01(b) RQ-05-02 RQ-05-02(a) RQ-05-02(b) RQ-05-03 RQ-05-04 RQ-05-05 RQ-05-05(a) RQ-05-05(b)
ISO 22301 2019 5.2.1 5.2.1(a) 5.2.1(b) 5.2.1(c) 5.2.1(d) 5.2.2 5.2.2(a) 5.2.2(b) 5.2.2(c)
ISO 27001 2022 (source) 5.1(a) 5.2 5.2(a) 5.2(b) 5.2(c) 5.2(d) 5.2(e) 5.2(f) 5.2(g) 7.5.1 7.5.1(a) 7.5.1(b) 7.5.2 7.5.2(a) 7.5.2(b) 7.5.2(c) 7.5.3 7.5.3(a) 7.5.3(b) 7.5.3(c) 7.5.3(d) 7.5.3(e) 7.5.3(f)
ISO 27002 2022 5.1 5.37
ISO 27017 2015 5.1.1 12.1.1
ISO 27018 2025 5.1 5.37
ISO 27701 2025 5.1 5.2 5.2(a) 5.2(b) 5.2(c) 5.2(d) 6.1.3(c) 7.5.1(b) 7.5.2 7.5.3
ISO 31000 2018 5.4.5 6.2
ISO 31010 2009 4.3.2
ISO 42001 2023 5.1 5.2 5.2(a) 5.2(b) 5.2(c) 5.2(d) 7.5.1 7.5.1(a) 7.5.1(b) 7.5.2 7.5.3 7.5.3(a) 7.5.3(b) A.2 A.2.2 A.2.3
MPA Content Security Program 5.3.1 OR-1.0
NIST AI 100-1 (AI RMF) 1.0 GOVERN 1.0 GOVERN 1.2 GOVERN 1.3 GOVERN 1.4 GOVERN 3.2 GOVERN 4.1 GOVERN 5.1 GOVERN 6.0 GOVERN 6.1 MAP 3.5
NIST AI 600-1 GV-1.5-002
NIST 800-37 R2 TASK P-5
NIST 800-53 R4 PM-1
NIST 800-53 R5.2 AC-01 AT-01 AU-01 CA-01 CM-01 CP-01 IA-01 IR-01 MA-01 MP-01 PE-01 PL-01 PM-01 PS-01 PT-01 RA-01 SA-01 SC-01 SI-01 SR-01
NIST 800-53B R5 (low) (source) AC-01 AT-01 AU-01 CA-01 CM-01 CP-01 IA-01 IR-01 MA-01 MP-01 PE-01 PL-01 PS-01 RA-01 SA-01 SC-01 SI-01 SR-01
NIST 800-53B R5 (moderate) (source) AC-01 AT-01 AU-01 CA-01 CM-01 CP-01 IA-01 IR-01 MA-01 MP-01 PE-01 PL-01 PS-01 RA-01 SA-01 SC-01 SI-01 SR-01
NIST 800-53B R5 (high) (source) AC-01 AT-01 AU-01 CA-01 CM-01 CP-01 IA-01 IR-01 MA-01 MP-01 PL-01 PS-01 RA-01 SA-01 SC-01 SI-01 SR-01
NIST 800-53B R5 (privacy) (source) AC-01 AT-01 AU-01 CA-01 CM-01 IR-01 MP-01 PL-01 PT-01 RA-01 SA-01 SI-01
NIST SP 800-66 R2 164.308(a)(1) 164.308(a)(3) 164.308(a)(4) 164.308(a)(6) 164.308(a)(7) 164.310(a) 164.310(b) 164.310(d) 164.312(a) 164.312(c) 164.316(a) 164.316(b)
NIST 800-82 R3 AC-01 AT-01 AU-01 CA-01 CM-01 CP-01 IA-01 IR-01 MA-01 MP-01 PE-01 PL-01 PM-01 PS-01 PT-01 RA-01 SA-01 SC-01 SI-01 SR-01
NIST 800-82 R3 LOW OT Overlay AC-01 AT-01 AU-01 CA-01 CM-01 CP-01 IA-01 IR-01 MA-01 MP-01 PE-01 PL-01 PM-01 PS-01 RA-01 SA-01 SC-01 SI-01 SR-01
NIST 800-82 R3 MODERATE OT Overlay AC-01 AT-01 AU-01 CA-01 CM-01 CP-01 IA-01 IR-01 MA-01 MP-01 PE-01 PL-01 PM-01 PS-01 RA-01 SA-01 SC-01 SI-01 SR-01
NIST 800-82 R3 HIGH OT Overlay AC-01 AT-01 AU-01 CA-01 CM-01 CP-01 IA-01 IR-01 MA-01 MP-01 PE-01 PL-01 PM-01 PS-01 RA-01 SA-01 SC-01 SI-01 SR-01
NIST 800-161 R1 AC-1 AT-1 AU-1 CA-1 CM-1 CP-1 IA-1 IR-1 MA-1 MP-1 PE-1 PL-1 PS-1 PT-1 RA-1 SA-1 SC-1 SI-1 SR-1
NIST 800-161 R1 C-SCRM Baseline AC-1 AT-1 AU-1 CA-1 CM-1 CP-1 IA-1 IR-1 MA-1 MP-1 PE-1 PL-1 PS-1 RA-1 SA-1 SC-1 SI-1 SR-1
NIST 800-161 R1 Flow Down AC-1 IR-1 MA-1 PS-1 PT-1
NIST 800-161 R1 Level 1 AC-1 AT-1 AU-1 CA-1 CM-1 CP-1 IA-1 IR-1 MA-1 MP-1 PE-1 PS-1 PT-1 RA-1 SA-1 SC-1 SI-1 SR-1
NIST 800-161 R1 Level 2 AC-1 AT-1 AU-1 CA-1 CM-1 CP-1 IA-1 IR-1 MA-1 MP-1 PE-1 PL-1 PS-1 PT-1 RA-1 SA-1 SC-1 SI-1 SR-1
NIST 800-161 R1 Level 3 AC-1 AU-1 CA-1 CM-1 CP-1 IA-1 IR-1 MA-1 PE-1 PS-1 PT-1 RA-1 SA-1 SC-1 SI-1 SR-1
NIST 800-171 R3 (source) 03.15.01.a
NIST 800-171A (source) 3.4.9[a] 3.9.2[a]
NIST 800-171A R3 (source) A.03.15.01.a[01] A.03.15.01.a[02] A.03.15.01.a[03] A.03.15.01.a[04]
NIST 800-172 R3 03.01.17E 03.05.07E 03.17.03E
NIST 800-172A R3 A.03.01.17E.ODP[02] A.03.05.07E.ODP[01] DS-A.03.17.03E.a[01] DS-A.03.17.03E.a[02] DS-A.03.17.03E.a[03] DS-A.03.17.03E.a[04]
NIST CSF 2.0 (source) GV.PO GV.PO-01 GV.SC-01 GV.SC-03 ID.RA
NIST Privacy Framework 1.0 ID.DE-P1 GV.PO-P GV.PO-P1 GV.PO-P6 GV.MT-P GV.MT-P4 GV.MT-P5 GV.MT-P6 GV.MT-P7 CT.PO-P CT.PO-P1 CT.PO-P2 CT.PO-P3 CM.PO-P1 PR.PO-P PR.PO-P4
PCI DSS 4.0.1 (source) 1.1.1 2.1.1 3.1.1 3.7.1 3.7.2 3.7.3 3.7.5 3.7.6 3.7.7 3.7.8 4.1.1 5.1.1 6.1.1 7.1.1 8.1.1 8.3.8 9.1.1 10.1.1 11.1.1 12.1 12.1.1 12.1.2 12.1.3
PCI DSS 4.0.1 SAQ A (source) 3.1.1
PCI DSS 4.0.1 SAQ A-EP (source) 1.1.1 2.1.1 3.1.1 4.1.1 5.1.1 6.1.1 8.1.1 8.3.8 12.1.1 12.1.2 12.1.3
PCI DSS 4.0.1 SAQ B (source) 3.1.1 12.1.1 12.1.2 12.1.3
PCI DSS 4.0.1 SAQ B-IP (source) 3.1.1 8.1.1 9.1.1 12.1.1 12.1.2 12.1.3
PCI DSS 4.0.1 SAQ C (source) 2.1.1 3.1.1 5.1.1 8.1.1 8.3.8 9.1.1 10.1.1 12.1.1 12.1.2 12.1.3
PCI DSS 4.0.1 SAQ C-VT (source) 2.1.1 3.1.1 8.1.1 9.1.1 12.1.1 12.1.2
PCI DSS 4.0.1 SAQ D Merchant (source) 1.1.1 2.1.1 3.1.1 3.7.1 3.7.2 3.7.3 3.7.5 3.7.6 3.7.7 3.7.8 4.1.1 5.1.1 6.1.1 7.1.1 8.1.1 8.3.8 9.1.1 10.1.1 11.1.1 12.1.1 12.1.2 12.1.3
PCI DSS 4.0.1 SAQ D Service Provider (source) 1.1.1 2.1.1 3.1.1 3.7.1 3.7.2 3.7.3 3.7.5 3.7.6 3.7.7 3.7.8 4.1.1 5.1.1 6.1.1 7.1.1 8.1.1 8.3.8 9.1.1 10.1.1 11.1.1 12.1.1 12.1.2 12.1.3
PCI DSS 4.0.1 SAQ P2PE (source) 3.1.1 9.1.1 12.1.1 12.1.2 12.1.3
SCF DPMP 2026 11.2
SPARTA 4.0 CM0088
TISAX ISA 6.0.3 1.1.1 1.5.1 7.1.1 9.1.1
US (36)
Framework Mapping Values
USA Federal CMS MARS-E 2.0 AC-1 AC-1.a AT-1 AT-1.a AT-1.c AT-1.d AU-1 AU-1.a CA-1 CA-1.a CA-1.c CM-1 CM-1.a CP-1 CP-1.a IA-1 IA-1.a IR-1 IR-1.a MA-1 MA-1.a MP-1 MP-1.a PE-1 PE-1.a PL-1 PL-1.a PS-1 PS-1.a RA-1 SA-1 SA-1.a SC-1 SC-1.a SI-1 SI-1.a PM-1
USA Federal DHS CISA TIC 3.0 3.PEP.WE.ACONT 3.UNI.IDMRP 3.UNI.PEPAR 3.UNL.GPAUD
USA Federal C2M2 2.1 ASSET-5c THREAT-3c RISK-5c ACCESS-4c SITUATION-4c RESPONSE-5c THIRD-PARTIES-3c WORKFORCE-5c ARCHITECTURE-6c PROGRAM-3c
USA Federal DFARS 252.204-7012 252.204-7012(b)
USA Federal NNPI (unclass) 2010 13-2.b(2)
USA Federal DoD Zero Trust Execution Roadmap v1.1 6.1.1
USA Federal FAR 52.204-21 52.204-21(b)(1)
USA Federal CJIS Security Policy 6.0 AC-1 AT-1 AU-1 CA-1 CM-1 CP-1 IA-1 IR-1 MA-1 MP-1 PE-1 PL-1 PS-1 RA-1 SA-1 SC-1 SI-1 SR-1
USA Federal 21 CFR Part 11 2025 11.10
USA Federal FFIEC ITEH 2016 I.B II.C.1
USA Federal FedRAMP R5 (low) AC-01 AT-01 AU-01 CA-01 CM-01 CP-01 IA-01 IR-01 MA-01 MP-01 PE-01 PL-01 PS-01 RA-01 SA-01 SC-01 SI-01 SR-01
USA Federal FedRAMP R5 (moderate) AC-01 AT-01 AU-01 CA-01 CM-01 CP-01 IA-01 IR-01 MA-01 MP-01 PE-01 PL-01 PS-01 RA-01 SA-01 SC-01 SI-01 SR-01
USA Federal FedRAMP R5 (high) AC-01 AT-01 AU-01 CA-01 CM-01 CP-01 IA-01 IR-01 MA-01 MP-01 PE-01 PL-01 PS-01 RA-01 SA-01 SC-01 SI-01 SR-01
USA Federal FedRAMP R5 (LI-SaaS) AC-01 AT-01 AU-01 CA-01 CM-01 CP-01 IA-01 IR-01 MA-01 MP-01 PE-01 PL-01 PS-01 RA-01 SA-01 SC-01 SI-01 SR-01
USA Federal 45 CFR 155.260 155.260(d) 155.260(d)(1) 155.260(d)(2)
USA Federal IRS 1075 2021 2.C.2 2.C.2-1 2.C.2-2 2.C.2-3 2.C.2-4 2.C.2-5 2.C.2-6 2.C.2-7 2.C.2-8 2.C.2-9 2.C.2-10 2.C.2-11 2.C.2-12 2.C.2-13 2.C.2-14 2.C.2-15 2.C.2-16 2.C.2-17 2.C.2-18 AC-1 AT-1 AU-1 CA-1 CM-1 CP-1 IA-1 IR-1 MA-1 MP-1 PE-1 PL-1 PM-1 PS-1 PT-1 RA-1 SA-1 SC-1 SI-1 SR-1
USA Federal 33 CFR Part 101 Subpart F 101.625(d)(5)
USA Federal GLBA CFR 314 2023 314.4(c) 314.4(c)(8) 314.4(e)
USA Federal HIPAA Security Rule NIST SP 800-66 R2 § 164.308(a)(1)(i) § 164.308(a)(3)(i) § 164.308(a)(4)(i) § 164.308(a)(4)(ii)(A) § 164.308(a)(6)(i) § 164.308(a)(7)(i) § 164.310(a)(1) § 164.310(a)(2)(ii) § 164.310(a)(2)(iv) § 164.310(b) § 164.310(d)(1) § 164.310(d)(2)(i) § 164.312(a)(1) § 164.312(c)(1) § 164.316(a) § 164.316(b)(1)(i)
USA Federal HIPAA Administrative Simplification 2013 § 164.308(a)(1)(i) § 164.308(a)(3)(i) § 164.308(a)(4)(i) § 164.308(a)(4)(ii)(A) § 164.308(a)(6)(i) § 164.308(a)(7)(i) § 164.310(a)(1) § 164.310(a)(2)(ii) § 164.310(a)(2)(iv) § 164.310(b) § 164.310(d)(1) § 164.310(d)(2)(i) § 164.312(a)(1) § 164.312(c)(1) § 164.316(a) § 164.316(b)(1)(i) § 164.530(j)(1)(i)
USA Federal NISPOM 2020 §117.18(b)(1)
USA Federal NRC 10 CFR 73.54 2015 73.54(f)
USA Federal FCA CRM 2023 609.930(c)(5)
USA Federal FINRA 2007 248.30(a)(1) 248.30(a)(2)
USA Federal TSA SDP 2021-02F III.B III.C.1 III.D V.A.2
USA Federal TSA / DHS 1580/82-2022-01 III.B III.B.1.d III.C.1 III.C.1.a III.C.1.b III.C.3 III.D
USA California CCPA 2025 7123(b)(1)
USA Illinois IPA 2009 35(a) 37(a)
USA Massachusetts 201 CMR 17.00 2008 17.03(1) 17.03(2)(c) 17.04
USA Nevada Privacy Law 2023 603A.525.2 603A.525.2(a)
USA Nevada NOGE Reg 5 2024 5.260.6
USA New York DFS 23 NYCRR500 2023 Amd 2 500.2(b)(2) 500.3 500.3(a) 500.3(b) 500.3(c) 500.3(d) 500.3(e) 500.3(f) 500.3(g) 500.3(h) 500.3(i) 500.3(j) 500.3(k) 500.3(l) 500.3(m) 500.3(n) 500.3(o) 500.5 500.7(b) 500.8(a) 500.11(a) 500.13(a) 500.14(a)(1) 500.15(a)
USA Texas DIR SCSC 2.2 2025 AC-01 AC-18-SID AT-01 AU-01 CA-01 CM-01 CP-01 IA-01 IR-01 MA-01 MP-01 PE-01 PL-01 PM-01 PS-01 RA-01 SA-01 SC-01 SI-01 SR-01
USA Texas SB 820 2019 11.175(b) 11.175(b)(1) 11.175(b)(2)
USA Texas TX-RAMP Level 1 AC-01 AT-01 AU-01 CA-01 CM-01 CP-01 IA-01 IR-01 MA-01 MP-01 PE-01 PL-01 PS-01 RA-01 SA-01 SC-01 SI-01
USA Texas TX-RAMP Level 2 AC-01 AT-01 AU-01 CA-01 CM-01 CP-01 IA-01 IR-01 MA-01 MP-01 PE-01 PL-01 PS-01 RA-01 SA-01 SC-01 SI-01
EMEA (23)
Framework Mapping Values
EMEA Germany BAIT 2017 4.2 4.8
EMEA Germany C5 2026 OIS-01.02B OIS-02.01B OIS-02.02B OIS-02.03B OIS-02.03B.1 SP-01.01B SP-01.01B.1 SP-01.01B.2 SP-01.02B SP-01.03B SP-01.04B SP-02.02B HR-07.01B AM-05.01B OPS-04.01B OPS-10.01B OPS-19.01B OPS-27.01B OPS-30.01B OPS-32.01B OPS-34.01B IAM-01.01B IAM-08.04B CRY-01.01B COS-08.01B DEV-03.01B DEV-14.01B SSO-01.01B BCM-01.02B COM-02.02B INQ-04.03B
EMEA Spain CCN-STIC 825 org.1 org.2 org.3
EMEA Spain Royal Decree 311 2022 Article 11(3) Article 12(1) Article 12(6)
EMEA EU DORA 2023 Article 6.2 Article 9.4(a) Article 9.4(d) Article 9.4(e) Article 9.4(f)
EMEA EU DORA RTS 2024 Article 2.1 Article 2.2 Article 2.2(b) Article 2.2(f) Article 28.2(f) Article 29.1 Article 29.2
EMEA EU EBA GL/2019/04 3.4.1.28 3.4.5.38 3.5.50
EMEA EU GDPR 2016 Article 24.2
EMEA EU NIS2 2022 Article 21.1 Article 21.2(a) Article 21.2(b) Article 21.2(c) Article 21.2(d) Article 21.2(e) Article 21.2(f) Article 21.2(g) Article 21.2(h) Article 21.2(i) Article 21.2(j)
EMEA EU NIS2 Annex 2024 1.1.1(f) 1.1.1(i) 1.1.1(k) 5.1.6 7.1 9.1 11.1.1
EMEA UK CAF 4.0 A1 B1 B1.b
EMEA UK CAP 1850 2020 A1
EMEA UK DEFSTAN 05-138 2024 1100 1101 2100 2101
EMEA UK DEFSTAN 05-138 - L1 2024 1100 2100
EMEA UK DEFSTAN 05-138 - L2 2024 1100 1101 2100 2101
EMEA UK DEFSTAN 05-138 - L3 2024 1100 1101 2100 2101
EMEA LUX CCSF 20/750 2020 3.4.1-28 3.4.1-29 3.4.1-30.a 3.5-50
EMEA LUX CCSF 22/806 2022 34.d 39
EMEA Saudi Arabia IoT CGIoT-1 2024 1-2-1
EMEA Saudi Arabia ECC-1 2018 1-3-1 1-3-3 2-1-1 2-1-2 2-1-3 2-1-4 2-2-1 2-2-2
EMEA Saudi Arabia OTCC-1 2022 1-1-1 1-1-2
EMEA Saudi Arabia SACS-002 2022 VII.B.TPC-24 VII.B.TPC-25
EMEA Saudi Arabia SAMA CSF 1.0 2017 3.1.3 3.1.3.1 3.1.3.3 3.1.3.3.a 3.1.3.3.b 3.1.3.3.c 3.1.3.3.d 3.1.3.4 3.1.3.4.a 3.1.3.4.b 3.1.3.4.c 3.1.3.4.d 3.1.3.4.e 3.1.3.4.f 3.1.3.4.f.1 3.1.3.4.f.2 3.1.3.4.f.3 3.1.3.4.f.4 3.1.3.4.f.5 3.1.3.4.f.6 3.1.3.4.f.7 3.1.3.4.f.8 3.3.5.1 3.3.5.4 3.3.5.4.a 3.3.5.4.b 3.3.5.4.b.1 3.3.5.4.b.2 3.3.5.4.b.3 3.3.5.4.b.4 3.3.5.4.b.5 3.3.5.4.b.6 3.3.5.4.b.7 3.3.5.4.c 3.3.5.4.d 3.3.5.4.e 3.3.5.4.f 3.3.5.4.f.1 3.3.5.4.f.1.a 3.3.5.4.f.1.b 3.3.5.4.f.2 3.3.5.4.f.3 3.3.5.4.f.4 3.3.5.4.f.4.a 3.3.5.4.f.4.b 3.3.5.4.f.4.c 3.3.8 3.3.8.1 3.3.8.4 3.3.8.5 3.3.8.6 3.3.8.6.a 3.3.8.6.b 3.3.8.6.c 3.3.8.6.d 3.3.8.6.e 3.3.8.6.f 3.3.8.6.g 3.3.8.6.h 3.3.8.6.h.1 3.3.8.6.h.2 3.3.8.6.h.3 3.3.8.6.h.4 3.3.8.6.h.5 3.3.8.6.i 3.3.8.6.j 3.3.10 3.3.10.1
APAC (17)
Framework Mapping Values
APAC Australia ISM June 2026 ISM-0047 ISM-1478 ISM-1551 ISM-1602 ISM-1784 ISM-1785 ISM-2074 ISM-2120
APAC Australian Privacy Principles 2026 1.1.3
APAC Australia Prudential Standard CPS230 2023 12(a) 47
APAC Australia Prudential Standard CPS234 2019 18.0
APAC India RBI PA 2025 III.9.b IV.14.a Annex 1.1.6
APAC India RBI PPI 2025 7.9.a 11.3 17.9
APAC India SEBI CSCRF 2024 GV.PO.S1
APAC Japan ISMAP 4.4.5.1 4.4.5.3 4.5.2.1 4.8.2.1 5.0 5.1.1 5.1.1.1 5.1.1.8 5.1.1.21 6.0 6.2.1
APAC Malaysia RMiT 2025 8.6(a) 9.5(a) 10.16
APAC New Zealand HISF Microsmall 2023 HMS02
APAC New Zealand HISF MLHSP 2023 HML01 HHSP01
APAC New Zealand HISF Suppliers 2023 HSUP01
APAC New Zealand NZISM 3.9 5.1.7.C.01 5.1.14.C.01 5.1.16.C.01 5.1.16.C.02 5.1.17.C.01 5.1.18.C.01 5.1.19.C.01 5.1.20.C.01 5.1.20.C.02 5.2.3.C.01 5.2.3.C.02 11.1.15.C.01 11.1.15.C.02 11.3.5.C.01 11.4.9.C.01 11.5.13.C.01 11.8.3.C.01 16.1.24.C.01 20.2.15.C.04 21.1.6.C.01 22.1.10.C.01 22.1.22.C.01
APAC Singapore CCOP CII 2026 3.2.2(d) 3.5.1 3.5.1(b)
APAC Singapore Cyber Hygiene Practice 2019 4.3(a)
APAC Singapore MAS TRM 2021 3.1.8(c) 3.2.1 3.3.1(d) 5.3.1 6.1.3 6.4.4 11.1.1
APAC Singapore PDPA 2012 3.12(a) 3.12(c)
Americas (6)
Framework Mapping Values
Americas Bermuda BMACCC 2020 5.3 7.1
Americas Canada ITSP-10-171 2025 03.15.01.A
Americas Canada OSFI B-13 2022 1 3
Americas Canada OSFI Self-Assessment Guidance 1.3.2 2.2.1
Americas Canada PIPEDA 2000 P1-4.1.4
Americas Colombia Law 1581 2012 VI.17(k)

Capability Maturity Model

Level 0 — Not Performed

Practices are non-existent, based on the inability to demonstrate an implemented and operational capability. A reasonable person would conclude the control is not being performed.

Level 1 — Performed Informally

Cybersecurity & Data Protection Governance (GOV) domain capabilities are ad hoc and inconsistent. Capability criteria associated with this control may include: ▪ Policies, standards & procedures associated with GOV domain capabilities provide limited coverage due to the depth and breadth of the existing documentation. ▪ Governance-related activities are decentralized (e.g., a localized/regionalized function) and uses non-standardized methods to implement secure, resilient and compliant practices. ▪ No formal Governance, Risk & Compliance (GRC) team exists. GRC roles are assigned to existing IT/cybersecurity personnel. ▪ Cybersecurity and data protection governance is informally assigned as an additional duty to existing IT/cybersecurity personnel. ▪ Basic procedures are established for important tasks, but are ad hoc and not formally documented. ▪ No formal cybersecurity and/or data protection principles are identified for the organization. ▪ Informal recommendations are leveraged to update existing policies and standards. ▪ The responsibility for developing and operating cybersecurity and data privacy procedures are up to the business process owner(s) to determine, including the definition and enforcement of roles and responsibilities. ▪ Governance documentation is made available to internal personnel (e.g., policies, standards and procedures). ▪ People affected by documentation changes are provided notification of the policy and standard changes.

Level 2 — Planned & Tracked

Cybersecurity & Data Protection Governance (GOV) capabilities are requirements-driven, but are not standardized across the entity (e.g., local/regional level consistency). Capability criteria associated with this control reasonably expect the following criteria to exist: ▪ Policies and standards associated with GOV domain capabilities are formally documented and centrally-managed by the entity. ▪ Standardized Operating Procedures (SOP) associated with GOV domain capabilities are documented and maintained by process owners. ▪ IT and/or cybersecurity personnel work with business stakeholders and process owners to appropriately scope and reasonably implement cybersecurity and data protection controls associated with GOV domain capabilities to address applicable statutory, regulatory and/or contractual requirements for Technology Assets, Applications, Services and/or Data (TAASD). ▪ Governance-related controls are primarily administrative and preventative in nature (e.g., policies, standards and procedures & guidelines). ▪ No formal Governance, Risk & Compliance (GRC) team exists. GRC roles are assigned to existing IT and/or cybersecurity personnel. ▪ IT and/or cybersecurity personnel ensure cybersecurity policies and standards are aligned with a leading cybersecurity framework (e.g., SCF, NIST 800-53, NIST 800-171, ISO 27002 or NIST Cybersecurity Framework). ▪ The organization's cybersecurity policies and standards are made available to internal personnel. ▪ Documented procedures exist for requesting a deviation from approved standards. ▪ The responsibility for enforcing cybersecurity and data protection control implementation is assigned to business / process owners and asset custodians.

Level 3 — Well Defined

Cybersecurity & Data Protection Governance (GOV) capabilities are standardized across the entity for applicability to People, Processes, Technologies, Data and/or Facilities (PPTDF) to ensure consistency for Technology Assets, Applications, Services and/or Data (TAASD). Capability criteria associated with this control reasonably expect the following criteria to exist: ▪ Policies and standards associated with GOV domain capabilities are formally documented and centrally-managed by the entity's Governance, Risk & Compliance (GRC) team, or similar function. ▪ Standardized Operating Procedures (SOP) associated with GOV domain capabilities are well-documented and kept current by process owners. ▪ The entity's Governance, Risk & Compliance (GRC) team, or similar function, is appropriately staffed and supported to implement and maintain GOV domain capabilities to address Minimum Compliance Requirements (MCR) (e.g., applicable statutory, regulatory and/or contractual requirements) and Discretionary Security Requirements (DSR) (e.g., entity-required controls). ▪ Technology is leveraged to enhance the efficiency and accuracy of governance, risk management and compliance operations (e.g., GRC platform). ▪ An implemented and operational capability exists to establish, maintain and disseminate policies, standards and procedures necessary for secure, compliant and resilient capabilities.

Level 4 — Quantitatively Controlled

Cybersecurity & Data Protection Governance (GOV) capabilities, in addition to being standardized across the entity and centrally managed to ensure consistency across Technology Assets, Applications, Services and/or Data (TAASD), efforts are metrics driven to provide sufficient insight for decision makers to predict optimal performance, ensure continued operations and/or identify areas for improvement. Capability criteria associated with this control reasonably expect the following criteria to exist: ▪ Applicable SCR-CMM Level 3 (Well Defined) capabilities are implemented and operational. ▪ Metrics reporting includes quantitative analysis of Key Performance Indicators (KPIs). ▪ Metrics reporting includes quantitative analysis of Key Risk Indicators (KRIs). ▪ Scope of metrics, KPIs and KRIs covers organization-wide cybersecurity and data protection controls, including functions performed by third-parties. ▪ Organizational leadership maintains a formal process to objectively review and respond to metrics, KPIs and KRIs (e.g., monthly or quarterly review). ▪ Based on metrics analysis, process improvement recommendations are submitted for review and are handled in accordance with change control processes. ▪ Business and technical stakeholders are involved in reviewing and approving proposed changes to evolve capabilities.

Level 5 — Continuously Improving

Utilize SCR-CMM Level 3 or Level 4 (if available) criteria definitions: ▪ There are no defined Level 5 criteria, since it is reasonable to assume a continuously-improving process is not necessary to operationalize this control. ▪ Level 5 capabilities should be considered “world-class” where the control builds on Level 4 capabilities, but are continuously improving through Artificial Intelligence (AI) and/or Machine Learning (ML) technologies. ▪ While it may be possible to develop responsive capabilities for this control through the use of AI and/or ML technologies, the criteria would be organization-specific to define.

Assessment Objectives

  1. GOV-04_A01 cybersecurity / data privacy policies are developed and documented.
  2. GOV-04_A02 policies needed to satisfy the security requirements for the protection of sensitive / regulated data are developed and documented.
  3. GOV-04_A03 policies needed to satisfy the security requirements for the protection of sensitive / regulated data are disseminated to organizational personnel or roles.
  4. GOV-04_A04 procedures needed to satisfy the security requirements for the protection of sensitive / regulated data are developed and documented.
  5. GOV-04_A05 procedures needed to satisfy the security requirements for the protection of sensitive / regulated data are disseminated to organizational personnel or roles.
  6. GOV-04_A06 the cybersecurity / data privacy policies address purpose.
  7. GOV-04_A07 the cybersecurity / data privacy policies address scope.
  8. GOV-04_A08 the cybersecurity / data privacy policies address roles.
  9. GOV-04_A09 the cybersecurity / data privacy policies address responsibilities.
  10. GOV-04_A10 the cybersecurity / data privacy policies address management commitment.
  11. GOV-04_A11 the cybersecurity / data privacy policies address coordination among organizational entities.
  12. GOV-04_A12 the cybersecurity / data privacy policies address compliance.
  13. GOV-04_A13 the cybersecurity / data privacy policies are consistent with applicable laws, regulations and contractual obligations.
  14. GOV-04_A14 personnel or roles to whom the cybersecurity / data privacy policies are to be disseminated is/are defined.
  15. GOV-04_A15 the cybersecurity / data privacy policies are disseminated to personnel or roles.
  16. GOV-04_A16 the official is designated to manage the development, documentation and dissemination of the cybersecurity / data privacy policies and procedures.
  17. GOV-04_A17 an official to manage the governance of cybersecurity / data privacy policies and procedures is defined.
  18. GOV-04_A18 policies needed to satisfy the security requirements for the protection of CUI are developed and documented.
  19. GOV-04_A19 policies needed to satisfy the security requirements for the protection of CUI are disseminated to organizational personnel or roles.
  20. GOV-04_A20 procedures needed to satisfy the security requirements for the protection of CUI are developed and documented.
  21. GOV-04_A21 procedures needed to satisfy the security requirements for the protection of CUI are disseminated to organizational personnel or roles.

Evidence Requirements

E-GOV-01 Security, Compliance & Resilience Policies

Documented evidence of an appropriately-scoped security, compliance and resilience-focused policies. Policies are high-level statements of management intent from an organization's executive leadership that are designed to influence decisions and guide the organization to achieve the desired outcomes. Policies are enforced by standards and further implemented by procedures to establish actionable and accountable requirements.

Security, Compliance & Resilience Governance
E-GOV-01.1 Security, Compliance & Resilience Governance Policy

Documented evidence of a security, compliance and resilience governance policy.

Security, Compliance & Resilience Governance
E-GOV-01.2 Artificial Intelligence & Autonomous Technologies Policy

Documented evidence of a Artificial Intelligence and Autonomous Technologies (AAT) policy.

Security, Compliance & Resilience Governance
E-GOV-01.3 Asset Management Policy

Documented evidence of a asset management policy.

Security, Compliance & Resilience Governance
E-GOV-01.4 Business Continuity & Disaster Recovery Policy

Documented evidence of a Business Continuity and Disaster Recovery (BC/DR) policy.

Security, Compliance & Resilience Governance
E-GOV-01.5 Capacity & Performance Planning Policy

Documented evidence of a capacity and performance planning policy.

Security, Compliance & Resilience Governance
E-GOV-01.6 Change Management Policy

Documented evidence of a change management policy.

Security, Compliance & Resilience Governance
E-GOV-01.7 Cloud Security Policy

Documented evidence of a cloud security policy.

Security, Compliance & Resilience Governance
E-GOV-01.8 Compliance Policy

Documented evidence of a compliance policy.

Security, Compliance & Resilience Governance
E-GOV-01.9 Configuration Management Policy

Documented evidence of a configuration management policy.

Security, Compliance & Resilience Governance
E-GOV-01.10 Continuous Monitoring Policy

Documented evidence of a continuous monitoring policy.

Security, Compliance & Resilience Governance
E-GOV-01.11 Cryptographic Protections Policy

Documented evidence of a cryptographic protections policy.

Security, Compliance & Resilience Governance
E-GOV-01.12 Data Classification & Handling Policy

Documented evidence of a data classification and handling policy.

Security, Compliance & Resilience Governance
E-GOV-01.13 Embedded Technology Policy

Documented evidence of a embedded technology policy.

Security, Compliance & Resilience Governance
E-GOV-01.14 Endpoint Security Policy

Documented evidence of a endpoint security policy.

Security, Compliance & Resilience Governance
E-GOV-01.15 Human Resources Security Policy

Documented evidence of a human resources security policy.

Security, Compliance & Resilience Governance
E-GOV-01.16 Identification & Authentication Policy

Documented evidence of a identification and authentication policy.

Security, Compliance & Resilience Governance
E-GOV-01.17 Incident Response Policy

Documented evidence of a incident response policy.

Security, Compliance & Resilience Governance
E-GOV-01.18 Information Assurance Policy

Documented evidence of a information assurance policy.

Security, Compliance & Resilience Governance
E-GOV-01.19 Maintenance Policy

Documented evidence of a maintenance policy.

Security, Compliance & Resilience Governance
E-GOV-01.20 Mobile Device Management Policy

Documented evidence of a mobile device management policy.

Security, Compliance & Resilience Governance
E-GOV-01.21 Network Security Policy

Documented evidence of a network security policy.

Security, Compliance & Resilience Governance
E-GOV-01.22 Physical & Environmental Security Policy

Documented evidence of a physical and environmental security policy.

Security, Compliance & Resilience Governance
E-GOV-01.23 Data Privacy Policy

Documented evidence of a data privacy policy.

Security, Compliance & Resilience Governance
E-GOV-01.24 Project & Resource Management Policy

Documented evidence of a project and resource management policy.

Security, Compliance & Resilience Governance
E-GOV-01.25 Quantum Security Policy

Documented evidence of a quantum security policy.

Security, Compliance & Resilience Governance
E-GOV-01.26 Risk Management Policy

Documented evidence of a risk management policy.

Security, Compliance & Resilience Governance
E-GOV-01.27 Secure Engineering & Architecture Policy

Documented evidence of a secure engineering and architecture policy.

Security, Compliance & Resilience Governance
E-GOV-01.28 Security Operations Policy

Documented evidence of a security operations policy.

Security, Compliance & Resilience Governance
E-GOV-01.29 Security Awareness & Training Policy

Documented evidence of a security awareness and training policy.

Security, Compliance & Resilience Governance
E-GOV-01.30 Technology Development & Acquisition Policy

Documented evidence of a technology development and acquisition policy.

Security, Compliance & Resilience Governance
E-GOV-01.31 Third-Party Management Policy

Documented evidence of a third-party management policy.

Security, Compliance & Resilience Governance
E-GOV-01.32 Threat Management Policy

Documented evidence of a threat management policy.

Security, Compliance & Resilience Governance
E-GOV-01.33 Vulnerability & Patch Management Policy

Documented evidence of a vulnerability and patch management policy.

Security, Compliance & Resilience Governance
E-GOV-01.34 Web Security Policy

Documented evidence of a web security policy.

Security, Compliance & Resilience Governance
E-GOV-02 Cybersecurity & Data Protection Standards

Documented evidence of an appropriately-scoped cybersecurity & data protection standards. Standards are mandatory requirements regarding processes, actions and configurations. Standards are intended to be granular and prescriptive to ensure Technology Assets, Applications and/or Services (TAAS) are designed and operated to include appropriate cybersecurity & data protection protections

Security, Compliance & Resilience Governance
E-GOV-04 Cybersecurity & Data Protection Procedures

Documented evidence of an appropriate appropriately-scoped cybersecurity & data protection procedures. Procedures are a documented set of steps necessary to perform a specific task or process in conformance with an applicable standard. Procedures help address the question of how the organization actually operationalizes a policy, standard or control. The result of a procedure is intended to satisfy a specific control. Procedures are also commonly referred to as “control activities.”

Security, Compliance & Resilience Governance

Technology Recommendations

Micro/Small

  • ComplianceForge - Cybersecurity & Data Protection Program (CDPP) (https://complianceforge.com)
  • SCFConnect (https://scfconnect.com)
  • Shared drive or intranet for policy distribution (e.g., Google Drive, SharePoint Online)

Small

  • ComplianceForge - Cybersecurity & Data Protection Program (CDPP) (https://complianceforge.com)
  • SCFConnect (https://scfconnect.com)
  • Document management system (e.g., SharePoint, Confluence, Notion)

Medium

  • ComplianceForge - Security, Compliance & Resilience Program (SCRP) (https://complianceforge.com)
  • ComplianceForge - Cybersecurity & Data Protection Program (CDPP) (https://complianceforge.com)
  • Document management / intranet portal (e.g., SharePoint, Confluence)
  • Policy acknowledgement tracking (e.g., KnowBe4, Absorb LMS)

Large

  • ComplianceForge - Security, Compliance & Resilience Program (SCRP) (https://complianceforge.com)
  • Policy management platform
  • Version-controlled policy repository with access controls
  • Automated policy attestation and acknowledgement tracking

Enterprise

  • ComplianceForge - Security, Compliance & Resilience Program (SCRP) (https://complianceforge.com)
  • Enterprise policy management platform
  • Integrated GRC policy module with automated review workflows
  • Enterprise-wide policy acknowledgement and training integration

The Secure Controls Framework (SCF) is maintained by SCF Council. Use of SCF content is subject to the SCF Terms & Conditions.

Manage this control in SCF Connect

Track implementation status, collect evidence, and map controls to your compliance frameworks automatically.

Get Started Free