Browse the Controls Map catalog

Choose a domain or source to read connected controls, risks and workflows. Browse the record indexes to find every catalog entry, including unmapped workflows.

JSON catalog · Data retrieval guide · Provenance and limitations

Catalog revision: f368a6cce277037e4b1e1ff46004e3acd295f96c9ac63a411a0e45775a7f468e. Mappings may provide partial coverage. Check residual requirements and source notes.

Topics

• AI Governance

  428 records · First JSON page

• Access Control & Identity Management

  294 records · First JSON page

• Asset Management & Inventory

  193 records · First JSON page

• Awareness & Training

  139 records · First JSON page

• Business Continuity & Disaster Recovery

  336 records · First JSON page

• Compliance, Audit & Assurance

  801 records · First JSON page

• Cryptography & Key Management

  83 records · First JSON page

• Data Protection & Privacy

  702 records · First JSON page

• Financial Reporting Controls (SOX)

  331 records · First JSON page

• Governance, Policy & Oversight

  731 records · First JSON page

• Human Resources / Personnel Security

  197 records · First JSON page

• Incident Management & Response

  239 records · First JSON page

• Logging, Monitoring & Detection

  377 records · First JSON page

• Network & Communications Security

  380 records · First JSON page

• Physical & Environmental Security

  173 records · First JSON page

• Risk Assessment & Management

  673 records · First JSON page

• Secure Configuration & Change Management

  271 records · First JSON page

• Secure Development (SDLC) & Application Security

  423 records · First JSON page

• Third-Party / Supply-Chain Risk

  275 records · First JSON page

• Vulnerability & Patch Management

  250 records · First JSON page

Sources

• AIUC-1 (Jul 2026)

  179 records · First JSON page

• CCPA/CPRA

  53 records · First JSON page

• COBIT 2019

  208 records · First JSON page

• COSO ERM 2017

  101 records · First JSON page

• COSO IC 2013

  124 records · First JSON page

• EU DORA

  44 records · First JSON page

• EU AI Act

  90 records · First JSON page

• EU GDPR

  87 records · First JSON page

• HIPAA

  105 records · First JSON page

• IIA 2024 Standards

  147 records · First JSON page

• The Role of the Internal Audit Function in Enterprise Risk Management

  23 records · First JSON page

• Three Lines Model: Assurance and Advice in Support of Effective Governance

  26 records · First JSON page

• ISO/IEC 27001:2022

  380 records · First JSON page

• ISO 31000:2018

  85 records · First JSON page

• ISO/IEC 42001:2023 (AI)

  91 records · First JSON page

• EU NIS2

  60 records · First JSON page

• NIST SP 800-53 Rev5

  720 records · First JSON page

• NIST Agent Identity (draft, Feb 2026)

  82 records · First JSON page

• NIST TEVV-Athlon (draft, Aug 2026)

  50 records · First JSON page

• NIST CSF 2.0

  385 records · First JSON page

• NYDFS Part 500

  128 records · First JSON page

• PCI DSS v4.0.1

  84 records · First JSON page

• SOC 1

  80 records · First JSON page

• SOC 2 (TSC)

  319 records · First JSON page

• SOX / PCAOB (ICFR)

  131 records · First JSON page

Record indexes

• all

  1677 records · First JSON page

• standard

  25 records · First JSON page

• control

  979 records · First JSON page

• unified

  289 records · First JSON page

• risk

  172 records · First JSON page

• workflow

  212 records · First JSON page