COR-2 - Regulatory Compliance Mapping
Comprehensive management control for legal, regulatory and contractual obligations
Control Definition
All legal, regulatory and contractual obligations applicable to the organization must be mapped and documented, classified and assigned a compliance owner, and regulatory changes must be monitored to keep the inventory up to date. A matrix must be built that links each obligation to the implemented cybersecurity controls, and any compliance gaps detected must be identified and closed.
Requirements
Requirement 1
We map and document, in the legal context, all obligations applicable to the organization in the countries where we operate.
Requirement 2
We map and document, in the regulatory context, all obligations applicable to the organization in the countries where we operate.
Requirement 3
We map and document, in the contractual context, all applicable obligations based on our customers' terms and conditions.
Requirement 4
We classify legal, regulatory and contractual obligations by jurisdiction and type of obligation.
Requirement 5
We assign a compliance owner for each regulation identified in the inventory.
Requirement 6
We define the review frequency and record the current compliance status of each obligation in the inventory.
Requirement 7
We build a compliance matrix that maps each legal, regulatory and contractual requirement to the implemented cybersecurity controls.
Requirement 8
We monitor legal, regulatory and contractual changes on a scheduled basis and update the inventory.
Requirement 9
We identify legal, regulatory and contractual compliance gaps and create action plans to close them.