--
-- Host: localhost    Database: bgrc
-- ------------------------------------------------------


--
-- Table structure for table `audit_findings`
--

CREATE TABLE `audit_findings` (
  `id` char(36) NOT NULL DEFAULT uuid(),
  `tenant_id` char(36) NOT NULL,
  `audit_id` char(36) NOT NULL,
  `finding_id` varchar(100) NOT NULL,
  `title` varchar(500) NOT NULL,
  `description` text DEFAULT NULL,
  `severity` enum('critical','high','medium','low','informational') NOT NULL DEFAULT 'medium',
  `status` enum('open','in_remediation','remediated','accepted','closed') NOT NULL DEFAULT 'open',
  `control_id` char(36) DEFAULT NULL,
  `requirement_id` char(36) DEFAULT NULL,
  `recommendation` text DEFAULT NULL,
  `management_response` text DEFAULT NULL,
  `owner_id` char(36) DEFAULT NULL,
  `due_date` date DEFAULT NULL,
  `closed_at` datetime DEFAULT NULL,
  `created_at` datetime NOT NULL DEFAULT current_timestamp(),
  `updated_at` datetime NOT NULL DEFAULT current_timestamp() ON UPDATE current_timestamp(),
  PRIMARY KEY (`id`),
  KEY `idx_tenant_severity` (`tenant_id`,`severity`),
  KEY `idx_tenant_status` (`tenant_id`,`status`),
  KEY `idx_audit` (`audit_id`),
  FULLTEXT KEY `ft_findings` (`title`,`description`),
  CONSTRAINT `fk_af_audit` FOREIGN KEY (`audit_id`) REFERENCES `audits` (`id`) ON DELETE CASCADE,
  CONSTRAINT `fk_af_tenant` FOREIGN KEY (`tenant_id`) REFERENCES `tenants` (`id`) ON DELETE CASCADE
) ENGINE=InnoDB DEFAULT CHARSET=utf8mb4 COLLATE=utf8mb4_unicode_ci;

--
-- Dumping data for table `audit_findings`
--


--
-- Table structure for table `audit_logs`
--

CREATE TABLE `audit_logs` (
  `id` bigint(20) unsigned NOT NULL AUTO_INCREMENT,
  `tenant_id` char(36) NOT NULL,
  `user_id` char(36) DEFAULT NULL,
  `action` varchar(100) NOT NULL,
  `resource_type` varchar(100) DEFAULT NULL,
  `resource_id` char(36) DEFAULT NULL,
  `old_values` longtext CHARACTER SET utf8mb4 COLLATE utf8mb4_bin DEFAULT NULL,
  `new_values` longtext CHARACTER SET utf8mb4 COLLATE utf8mb4_bin DEFAULT NULL,
  `ip_address` varchar(45) DEFAULT NULL,
  `created_at` datetime NOT NULL DEFAULT current_timestamp(),
  PRIMARY KEY (`id`),
  KEY `idx_tenant_created` (`tenant_id`,`created_at`),
  KEY `idx_resource` (`resource_type`,`resource_id`),
  KEY `idx_user` (`user_id`)
) ENGINE=InnoDB AUTO_INCREMENT=43 DEFAULT CHARSET=utf8mb4 COLLATE=utf8mb4_unicode_ci;

--
-- Dumping data for table `audit_logs`
--

INSERT INTO `audit_logs` VALUES (1,'2b5beb87-5e23-40c1-baaa-182279c173a0','e831ee4d-5086-47ad-bb3e-02c9388fbc08','register','user','e831ee4d-5086-47ad-bb3e-02c9388fbc08',NULL,NULL,'75.172.84.31','2026-04-24 18:47:44'),(2,'2b5beb87-5e23-40c1-baaa-182279c173a0','e831ee4d-5086-47ad-bb3e-02c9388fbc08','logout','session',NULL,NULL,NULL,'75.172.84.31','2026-04-24 18:49:24'),(3,'9b0fb5bc-e3b5-47fe-9e2e-db3687759d0c','931dcf93-d429-4358-913c-28b47b722e44','register','user','931dcf93-d429-4358-913c-28b47b722e44',NULL,NULL,'75.172.84.31','2026-04-24 18:49:47'),(4,'9b0fb5bc-e3b5-47fe-9e2e-db3687759d0c','931dcf93-d429-4358-913c-28b47b722e44','activate_framework','framework','a1b2c3d4-e5f6-4a1b-8c3d-4e5f6a1b2c3d',NULL,NULL,'75.172.84.31','2026-04-24 18:52:57'),(5,'9b0fb5bc-e3b5-47fe-9e2e-db3687759d0c','931dcf93-d429-4358-913c-28b47b722e44','activate_framework','framework','375b1394-c9fa-449f-b9d0-d58b9769e5aa',NULL,NULL,'75.172.84.31','2026-04-24 18:53:04'),(6,'9b0fb5bc-e3b5-47fe-9e2e-db3687759d0c','931dcf93-d429-4358-913c-28b47b722e44','activate_framework','framework','eec44c85-6639-4f22-bdea-7f33976d22ab',NULL,NULL,'75.172.84.31','2026-04-24 18:53:17'),(7,'9b0fb5bc-e3b5-47fe-9e2e-db3687759d0c','931dcf93-d429-4358-913c-28b47b722e44','activate_framework','framework','666252f0-47b7-440a-82d9-cca6878f6b60',NULL,NULL,'75.172.84.31','2026-04-24 18:53:22'),(8,'9b0fb5bc-e3b5-47fe-9e2e-db3687759d0c','931dcf93-d429-4358-913c-28b47b722e44','activate_framework','framework','e5f6a1b2-c3d4-4e5f-8a1b-2c3d4e5f6a1b',NULL,NULL,'75.172.84.31','2026-04-24 18:53:32'),(9,'9b0fb5bc-e3b5-47fe-9e2e-db3687759d0c','931dcf93-d429-4358-913c-28b47b722e44','login','session',NULL,NULL,NULL,'75.172.84.31','2026-04-24 21:28:44'),(10,'9b0fb5bc-e3b5-47fe-9e2e-db3687759d0c','931dcf93-d429-4358-913c-28b47b722e44','login','session',NULL,NULL,NULL,'75.172.84.31','2026-04-25 04:48:45'),(11,'9b0fb5bc-e3b5-47fe-9e2e-db3687759d0c','931dcf93-d429-4358-913c-28b47b722e44','login','session',NULL,NULL,NULL,'75.172.84.31','2026-04-25 05:17:12'),(12,'9b0fb5bc-e3b5-47fe-9e2e-db3687759d0c','931dcf93-d429-4358-913c-28b47b722e44','login','session',NULL,NULL,NULL,'75.172.84.31','2026-04-25 17:53:49'),(13,'9b0fb5bc-e3b5-47fe-9e2e-db3687759d0c','931dcf93-d429-4358-913c-28b47b722e44','login','session',NULL,NULL,NULL,'75.172.84.31','2026-04-25 23:41:25'),(14,'9b0fb5bc-e3b5-47fe-9e2e-db3687759d0c','931dcf93-d429-4358-913c-28b47b722e44','login','session',NULL,NULL,NULL,'75.172.84.31','2026-04-26 00:01:20'),(15,'9b0fb5bc-e3b5-47fe-9e2e-db3687759d0c','931dcf93-d429-4358-913c-28b47b722e44','create','integration','e00f0062-78d1-4b02-a3a9-485b64c0eeaf',NULL,'{\"type\":\"github\",\"name\":\"moophi@gmail.com\"}','75.172.84.31','2026-04-26 00:02:47'),(16,'9b0fb5bc-e3b5-47fe-9e2e-db3687759d0c','931dcf93-d429-4358-913c-28b47b722e44','create','integration','8fb7ef87-7670-4926-97b3-6373d87583b4',NULL,'{\"type\":\"okta\",\"name\":\"thien.pham@f9networks.com\"}','75.172.84.31','2026-04-26 00:04:01'),(17,'9b0fb5bc-e3b5-47fe-9e2e-db3687759d0c','931dcf93-d429-4358-913c-28b47b722e44','login','session',NULL,NULL,NULL,'75.172.84.31','2026-04-26 04:54:34'),(18,'9b0fb5bc-e3b5-47fe-9e2e-db3687759d0c','931dcf93-d429-4358-913c-28b47b722e44','login','session',NULL,NULL,NULL,'75.172.84.31','2026-04-26 05:40:09'),(19,'9b0fb5bc-e3b5-47fe-9e2e-db3687759d0c','931dcf93-d429-4358-913c-28b47b722e44','logout','session',NULL,NULL,NULL,'75.172.84.31','2026-04-26 05:41:20'),(20,'a307de4a-b884-4459-acce-bb68d1dc59e0','b26548e8-6e6c-4a8b-88cd-fd9f49388253','register','user','b26548e8-6e6c-4a8b-88cd-fd9f49388253',NULL,NULL,'75.172.84.63','2026-05-07 18:45:10'),(21,'a307de4a-b884-4459-acce-bb68d1dc59e0','b26548e8-6e6c-4a8b-88cd-fd9f49388253','invite_user','user','636b0a52-8882-48b9-be33-7f95ff206553',NULL,'{\"email\":\"gghantarchian@gscxgroup.com\",\"role\":\"admin\"}','75.172.84.63','2026-05-07 18:46:15'),(22,'a307de4a-b884-4459-acce-bb68d1dc59e0','b26548e8-6e6c-4a8b-88cd-fd9f49388253','logout','session',NULL,NULL,NULL,'75.172.84.63','2026-05-07 18:47:30'),(23,'2b5beb87-5e23-40c1-baaa-182279c173a0','e831ee4d-5086-47ad-bb3e-02c9388fbc08','login','session',NULL,NULL,NULL,'75.172.84.63','2026-05-08 04:32:31'),(24,'9b0fb5bc-e3b5-47fe-9e2e-db3687759d0c','931dcf93-d429-4358-913c-28b47b722e44','login','session',NULL,NULL,NULL,'75.172.84.63','2026-05-08 05:00:25'),(25,'9b0fb5bc-e3b5-47fe-9e2e-db3687759d0c','931dcf93-d429-4358-913c-28b47b722e44','delete','integration','e00f0062-78d1-4b02-a3a9-485b64c0eeaf','{\"type\":\"github\",\"name\":\"moophi@gmail.com\"}',NULL,'75.172.84.63','2026-05-08 05:01:26'),(26,'9b0fb5bc-e3b5-47fe-9e2e-db3687759d0c','931dcf93-d429-4358-913c-28b47b722e44','delete','integration','8fb7ef87-7670-4926-97b3-6373d87583b4','{\"type\":\"okta\",\"name\":\"thien.pham@f9networks.com\"}',NULL,'75.172.84.63','2026-05-08 05:01:29'),(27,'9b0fb5bc-e3b5-47fe-9e2e-db3687759d0c','931dcf93-d429-4358-913c-28b47b722e44','login','session',NULL,NULL,NULL,'75.172.84.63','2026-05-08 05:23:22'),(28,'9b0fb5bc-e3b5-47fe-9e2e-db3687759d0c','931dcf93-d429-4358-913c-28b47b722e44','logout','session',NULL,NULL,NULL,'75.172.84.63','2026-05-08 05:23:25'),(29,'9b0fb5bc-e3b5-47fe-9e2e-db3687759d0c','931dcf93-d429-4358-913c-28b47b722e44','login','session',NULL,NULL,NULL,'75.172.84.63','2026-05-08 05:25:20'),(30,'9b0fb5bc-e3b5-47fe-9e2e-db3687759d0c','931dcf93-d429-4358-913c-28b47b722e44','login','session',NULL,NULL,NULL,'75.172.84.63','2026-05-08 05:40:39'),(31,'9b0fb5bc-e3b5-47fe-9e2e-db3687759d0c','931dcf93-d429-4358-913c-28b47b722e44','create','audit','7f1464a9-5cf9-403a-876f-62d4b403f796',NULL,'{\"title\":\"Everything\",\"type\":\"regulatory\",\"status\":\"planned\",\"planned_start\":\"2026-05-07\",\"planned_end\":\"2026-05-14\",\"scope\":\"Audit all access and framework\"}','75.172.84.63','2026-05-08 05:41:09'),(32,'9b0fb5bc-e3b5-47fe-9e2e-db3687759d0c','931dcf93-d429-4358-913c-28b47b722e44','upload','evidence','c7c97aff-7d07-40cb-9e44-6a741d0127c6',NULL,'{\"title\":\"abc\",\"type\":\"document\"}','75.172.84.63','2026-05-08 05:42:18'),(33,'9b0fb5bc-e3b5-47fe-9e2e-db3687759d0c','931dcf93-d429-4358-913c-28b47b722e44','login','session',NULL,NULL,NULL,'75.172.84.63','2026-05-08 05:56:00'),(34,'9b0fb5bc-e3b5-47fe-9e2e-db3687759d0c','931dcf93-d429-4358-913c-28b47b722e44','login','session',NULL,NULL,NULL,'75.172.84.63','2026-05-08 06:20:11'),(35,'9b0fb5bc-e3b5-47fe-9e2e-db3687759d0c','931dcf93-d429-4358-913c-28b47b722e44','logout','session',NULL,NULL,NULL,'75.172.84.63','2026-05-08 06:32:31'),(36,'36a24342-f58f-41fd-ae01-2b42cb7ea234','25cc5b96-08dd-4a3a-b4ad-796eefcd136a','register','user','25cc5b96-08dd-4a3a-b4ad-796eefcd136a',NULL,NULL,'75.172.84.63','2026-05-08 06:33:17'),(37,'36a24342-f58f-41fd-ae01-2b42cb7ea234','25cc5b96-08dd-4a3a-b4ad-796eefcd136a','logout','session',NULL,NULL,NULL,'75.172.84.63','2026-05-08 06:35:44'),(38,'a307de4a-b884-4459-acce-bb68d1dc59e0','b26548e8-6e6c-4a8b-88cd-fd9f49388253','login','session',NULL,NULL,NULL,'75.172.84.63','2026-05-08 06:35:57'),(39,'2b5beb87-5e23-40c1-baaa-182279c173a0','e831ee4d-5086-47ad-bb3e-02c9388fbc08','login','session',NULL,NULL,NULL,'75.172.84.63','2026-05-09 23:50:25'),(40,'2b5beb87-5e23-40c1-baaa-182279c173a0','e831ee4d-5086-47ad-bb3e-02c9388fbc08','logout','session',NULL,NULL,NULL,'75.172.84.63','2026-05-09 23:50:59'),(41,'9b0fb5bc-e3b5-47fe-9e2e-db3687759d0c','931dcf93-d429-4358-913c-28b47b722e44','login','session',NULL,NULL,NULL,'75.172.84.63','2026-05-10 21:34:23'),(42,'9b0fb5bc-e3b5-47fe-9e2e-db3687759d0c','931dcf93-d429-4358-913c-28b47b722e44','logout','session',NULL,NULL,NULL,'75.172.84.63','2026-05-10 21:44:29');

--
-- Table structure for table `auditor_links`
--

CREATE TABLE `auditor_links` (
  `id` char(36) NOT NULL DEFAULT uuid(),
  `tenant_id` char(36) NOT NULL,
  `token_hash` varchar(64) NOT NULL,
  `name` varchar(200) NOT NULL,
  `created_by` char(36) NOT NULL,
  `expires_at` datetime NOT NULL,
  `scope` longtext CHARACTER SET utf8mb4 COLLATE utf8mb4_bin DEFAULT NULL COMMENT 'e.g. {audit_ids:[], framework_ids:[], include_evidence: true}',
  `is_active` tinyint(1) NOT NULL DEFAULT 1,
  `last_accessed_at` datetime DEFAULT NULL,
  `access_count` int(11) NOT NULL DEFAULT 0,
  `created_at` datetime NOT NULL DEFAULT current_timestamp(),
  `updated_at` datetime NOT NULL DEFAULT current_timestamp() ON UPDATE current_timestamp(),
  PRIMARY KEY (`id`),
  UNIQUE KEY `token_hash` (`token_hash`),
  KEY `idx_al_tenant` (`tenant_id`),
  KEY `idx_al_token` (`token_hash`),
  KEY `fk_al_user` (`created_by`),
  CONSTRAINT `fk_al_tenant` FOREIGN KEY (`tenant_id`) REFERENCES `tenants` (`id`) ON DELETE CASCADE,
  CONSTRAINT `fk_al_user` FOREIGN KEY (`created_by`) REFERENCES `users` (`id`)
) ENGINE=InnoDB DEFAULT CHARSET=utf8mb4 COLLATE=utf8mb4_unicode_ci;

--
-- Dumping data for table `auditor_links`
--

INSERT INTO `auditor_links` VALUES ('e0932bb0-a17e-432e-8aaa-ec9be607b5e5','9b0fb5bc-e3b5-47fe-9e2e-db3687759d0c','bc1b358e2575f27e8560c1a4124078e2d6b10153f0a63eaefe5cffae1feaab9d','Everything','931dcf93-d429-4358-913c-28b47b722e44','2026-06-07 05:41:22','{\"audit_ids\":{\"0\":\"7f1464a9-5cf9-403a-876f-62d4b403f796\"},\"include_evidence\":true}',1,'2026-05-08 05:56:25',8,'2026-05-08 05:41:22','2026-05-08 05:56:25');

--
-- Table structure for table `audits`
--

CREATE TABLE `audits` (
  `id` char(36) NOT NULL DEFAULT uuid(),
  `tenant_id` char(36) NOT NULL,
  `audit_id` varchar(100) NOT NULL,
  `title` varchar(500) NOT NULL,
  `type` enum('internal','external','regulatory','certification') NOT NULL DEFAULT 'internal',
  `framework_id` char(36) DEFAULT NULL,
  `lead_auditor_id` char(36) DEFAULT NULL,
  `status` enum('planned','in_progress','review','completed','cancelled') NOT NULL DEFAULT 'planned',
  `scope` text DEFAULT NULL,
  `objectives` text DEFAULT NULL,
  `planned_start` date DEFAULT NULL,
  `planned_end` date DEFAULT NULL,
  `actual_start` date DEFAULT NULL,
  `actual_end` date DEFAULT NULL,
  `opinion` enum('clean','qualified','adverse','disclaimer') DEFAULT NULL,
  `summary` text DEFAULT NULL,
  `created_at` datetime NOT NULL DEFAULT current_timestamp(),
  `updated_at` datetime NOT NULL DEFAULT current_timestamp() ON UPDATE current_timestamp(),
  PRIMARY KEY (`id`),
  KEY `idx_tenant_status` (`tenant_id`,`status`),
  KEY `fk_audits_framework` (`framework_id`),
  CONSTRAINT `fk_audits_framework` FOREIGN KEY (`framework_id`) REFERENCES `regulatory_frameworks` (`id`) ON DELETE SET NULL,
  CONSTRAINT `fk_audits_tenant` FOREIGN KEY (`tenant_id`) REFERENCES `tenants` (`id`) ON DELETE CASCADE
) ENGINE=InnoDB DEFAULT CHARSET=utf8mb4 COLLATE=utf8mb4_unicode_ci;

--
-- Dumping data for table `audits`
--

INSERT INTO `audits` VALUES ('7f1464a9-5cf9-403a-876f-62d4b403f796','9b0fb5bc-e3b5-47fe-9e2e-db3687759d0c','AUD-1778218869562','Everything','regulatory',NULL,NULL,'planned','Audit all access and framework',NULL,'2026-05-07','2026-05-14',NULL,NULL,NULL,NULL,'2026-05-08 05:41:09','2026-05-08 05:41:09');

--
-- Table structure for table `billing_payments`
--

CREATE TABLE `billing_payments` (
  `id` char(36) NOT NULL DEFAULT uuid(),
  `tenant_id` char(36) NOT NULL,
  `user_id` char(36) DEFAULT NULL,
  `stripe_payment_intent_id` varchar(255) NOT NULL,
  `stripe_charge_id` varchar(255) DEFAULT NULL,
  `amount_cents` int(10) unsigned NOT NULL,
  `currency` char(3) NOT NULL DEFAULT 'usd',
  `months_purchased` smallint(5) unsigned NOT NULL,
  `status` enum('requires_payment_method','requires_confirmation','requires_action','processing','succeeded','canceled','failed') NOT NULL,
  `failure_reason` text DEFAULT NULL,
  `receipt_url` text DEFAULT NULL,
  `paid_until_before` datetime DEFAULT NULL,
  `paid_until_after` datetime DEFAULT NULL,
  `paid_at` datetime DEFAULT NULL,
  `created_at` datetime NOT NULL DEFAULT current_timestamp(),
  `updated_at` datetime NOT NULL DEFAULT current_timestamp() ON UPDATE current_timestamp(),
  PRIMARY KEY (`id`),
  UNIQUE KEY `uq_billing_payment_intent` (`stripe_payment_intent_id`),
  KEY `idx_billing_tenant_created` (`tenant_id`,`created_at`),
  KEY `fk_billing_payments_user` (`user_id`),
  CONSTRAINT `fk_billing_payments_tenant` FOREIGN KEY (`tenant_id`) REFERENCES `tenants` (`id`) ON DELETE CASCADE,
  CONSTRAINT `fk_billing_payments_user` FOREIGN KEY (`user_id`) REFERENCES `users` (`id`) ON DELETE SET NULL
) ENGINE=InnoDB DEFAULT CHARSET=utf8mb4 COLLATE=utf8mb4_unicode_ci;

--
-- Dumping data for table `billing_payments`
--

INSERT INTO `billing_payments` VALUES ('113f97ea-4066-11f1-8bc3-00155d012902','9b0fb5bc-e3b5-47fe-9e2e-db3687759d0c','931dcf93-d429-4358-913c-28b47b722e44','pi_3TPyawDQM89JQeuW1WwZ327n','py_3TPyawDQM89JQeuW1o0YC279',150000,'usd',3,'succeeded',NULL,'https://pay.stripe.com/receipts/payment/CAcaFwoVYWNjdF8xSTUwdjhEUU04OUpRZXVXKLudsc8GMgbYIAW9pRc6LBZ2J_NsgnlcXZ72ME7erRZ9OQl4ib6NSJtDyoEKYSh6Mc-VqA3bwZy03FU6',NULL,'2026-07-25 05:18:51','2026-04-25 05:18:51','2026-04-25 05:17:34','2026-04-25 05:18:51'),('1ff01f71-4067-11f1-8bc3-00155d012902','9b0fb5bc-e3b5-47fe-9e2e-db3687759d0c','931dcf93-d429-4358-913c-28b47b722e44','pi_3TPyiGDQM89JQeuW0zrDba3B','py_3TPyiGDQM89JQeuW0YMC05w7',150000,'usd',3,'succeeded',NULL,'https://pay.stripe.com/receipts/payment/CAcaFwoVYWNjdF8xSTUwdjhEUU04OUpRZXVXKNSgsc8GMgaw53lv-ec6LBb7K0W6jqd38eHlC73QAZL0XzxXb5IdtqVjN9lfCULqS6uqgZIl7FtxiJ4k','2027-01-25 05:18:51','2027-04-25 05:18:51','2026-04-25 05:25:40','2026-04-25 05:25:08','2026-04-25 05:25:40'),('6da16fa7-4025-11f1-8bc3-00155d012902','9b0fb5bc-e3b5-47fe-9e2e-db3687759d0c','931dcf93-d429-4358-913c-28b47b722e44','pi_3TPrNADQM89JQeuW16pk0TAf',NULL,150000,'usd',3,'requires_payment_method',NULL,NULL,NULL,NULL,NULL,'2026-04-24 21:34:52','2026-04-24 21:34:52'),('704f1c23-4025-11f1-8bc3-00155d012902','9b0fb5bc-e3b5-47fe-9e2e-db3687759d0c','931dcf93-d429-4358-913c-28b47b722e44','pi_3TPrNEDQM89JQeuW0DRQ0pSG',NULL,150000,'usd',3,'requires_payment_method',NULL,NULL,NULL,NULL,NULL,'2026-04-24 21:34:56','2026-04-24 21:34:56'),('9b61afa7-4024-11f1-8bc3-00155d012902','9b0fb5bc-e3b5-47fe-9e2e-db3687759d0c','931dcf93-d429-4358-913c-28b47b722e44','pi_3TPrHTDQM89JQeuW1rgRxUBD',NULL,150000,'usd',3,'requires_payment_method',NULL,NULL,NULL,NULL,NULL,'2026-04-24 21:28:59','2026-04-24 21:28:59'),('b0f78d5b-4066-11f1-8bc3-00155d012902','9b0fb5bc-e3b5-47fe-9e2e-db3687759d0c','931dcf93-d429-4358-913c-28b47b722e44','pi_3TPyfGDQM89JQeuW2mFYa9Yr','py_3TPyfGDQM89JQeuW2ajGzal9',300000,'usd',6,'succeeded',NULL,'https://pay.stripe.com/receipts/payment/CAcaFwoVYWNjdF8xSTUwdjhEUU04OUpRZXVXKJ-fsc8GMgblKi2mcfc6LBYCnvOXi6P6xwNTXcERLVbpQ4J_BIrkMOv1Cc-BJC_EP_n-HYZv6Ilbd3Oy','2026-07-25 05:18:51','2027-01-25 05:18:51','2026-04-25 05:22:39','2026-04-25 05:22:02','2026-04-25 05:22:39'),('ee453cfd-4025-11f1-8bc3-00155d012902','9b0fb5bc-e3b5-47fe-9e2e-db3687759d0c','931dcf93-d429-4358-913c-28b47b722e44','pi_3TPrQdDQM89JQeuW1TcF5V9y',NULL,150000,'usd',3,'requires_payment_method',NULL,NULL,NULL,NULL,NULL,'2026-04-24 21:38:28','2026-04-24 21:38:28'),('ff00af7f-4025-11f1-8bc3-00155d012902','9b0fb5bc-e3b5-47fe-9e2e-db3687759d0c','931dcf93-d429-4358-913c-28b47b722e44','pi_3TPrR6DQM89JQeuW1OGirtJ5',NULL,300000,'usd',6,'requires_payment_method',NULL,NULL,NULL,NULL,NULL,'2026-04-24 21:38:56','2026-04-24 21:38:56');

--
-- Table structure for table `control_evidence`
--

CREATE TABLE `control_evidence` (
  `control_id` char(36) NOT NULL,
  `evidence_id` char(36) NOT NULL,
  `tenant_id` char(36) NOT NULL,
  `mapped_at` datetime NOT NULL DEFAULT current_timestamp(),
  PRIMARY KEY (`control_id`,`evidence_id`),
  KEY `fk_ce_evidence` (`evidence_id`),
  CONSTRAINT `fk_ce_control` FOREIGN KEY (`control_id`) REFERENCES `controls` (`id`) ON DELETE CASCADE,
  CONSTRAINT `fk_ce_evidence` FOREIGN KEY (`evidence_id`) REFERENCES `evidence` (`id`) ON DELETE CASCADE
) ENGINE=InnoDB DEFAULT CHARSET=utf8mb4 COLLATE=utf8mb4_unicode_ci;

--
-- Dumping data for table `control_evidence`
--


--
-- Table structure for table `control_framework_mappings`
--

CREATE TABLE `control_framework_mappings` (
  `id` char(36) NOT NULL DEFAULT uuid(),
  `tenant_id` char(36) NOT NULL,
  `control_id` char(36) NOT NULL,
  `requirement_id` char(36) NOT NULL,
  `coverage` enum('full','partial','none') NOT NULL DEFAULT 'partial',
  `notes` text DEFAULT NULL,
  `mapped_at` datetime NOT NULL DEFAULT current_timestamp(),
  PRIMARY KEY (`id`),
  UNIQUE KEY `uq_control_req` (`control_id`,`requirement_id`),
  KEY `idx_tenant` (`tenant_id`),
  KEY `fk_cfm_req` (`requirement_id`),
  CONSTRAINT `fk_cfm_control` FOREIGN KEY (`control_id`) REFERENCES `controls` (`id`) ON DELETE CASCADE,
  CONSTRAINT `fk_cfm_req` FOREIGN KEY (`requirement_id`) REFERENCES `framework_requirements` (`id`) ON DELETE CASCADE
) ENGINE=InnoDB DEFAULT CHARSET=utf8mb4 COLLATE=utf8mb4_unicode_ci;

--
-- Dumping data for table `control_framework_mappings`
--


--
-- Table structure for table `controls`
--

CREATE TABLE `controls` (
  `id` char(36) NOT NULL DEFAULT uuid(),
  `tenant_id` char(36) NOT NULL,
  `control_id` varchar(100) NOT NULL,
  `title` varchar(500) NOT NULL,
  `description` text DEFAULT NULL,
  `type` enum('preventive','detective','corrective','deterrent','compensating') NOT NULL DEFAULT 'preventive',
  `category` varchar(255) DEFAULT NULL,
  `frequency` enum('continuous','daily','weekly','monthly','quarterly','annually','ad_hoc') DEFAULT NULL,
  `owner_id` char(36) DEFAULT NULL,
  `status` enum('active','inactive','under_review') NOT NULL DEFAULT 'active',
  `effectiveness` enum('effective','partially_effective','ineffective','not_tested') NOT NULL DEFAULT 'not_tested',
  `automation_level` enum('manual','semi_automated','automated') NOT NULL DEFAULT 'manual',
  `last_tested_at` datetime DEFAULT NULL,
  `tags` longtext CHARACTER SET utf8mb4 COLLATE utf8mb4_bin DEFAULT NULL,
  `created_at` datetime NOT NULL DEFAULT current_timestamp(),
  `updated_at` datetime NOT NULL DEFAULT current_timestamp() ON UPDATE current_timestamp(),
  PRIMARY KEY (`id`),
  KEY `idx_tenant_status` (`tenant_id`,`status`),
  KEY `idx_tenant_control_id` (`tenant_id`,`control_id`),
  FULLTEXT KEY `ft_controls` (`title`,`description`),
  CONSTRAINT `fk_controls_tenant` FOREIGN KEY (`tenant_id`) REFERENCES `tenants` (`id`) ON DELETE CASCADE
) ENGINE=InnoDB DEFAULT CHARSET=utf8mb4 COLLATE=utf8mb4_unicode_ci;

--
-- Dumping data for table `controls`
--


--
-- Table structure for table `evidence`
--

CREATE TABLE `evidence` (
  `id` char(36) NOT NULL DEFAULT uuid(),
  `tenant_id` char(36) NOT NULL,
  `title` varchar(500) NOT NULL,
  `description` text DEFAULT NULL,
  `type` varchar(50) NOT NULL DEFAULT 'document',
  `file_name` varchar(500) DEFAULT NULL,
  `file_path` text DEFAULT NULL,
  `file_size` bigint(20) unsigned DEFAULT NULL,
  `mime_type` varchar(100) DEFAULT NULL,
  `hash_sha256` varchar(64) DEFAULT NULL,
  `uploaded_by` char(36) DEFAULT NULL,
  `valid_from` date DEFAULT NULL,
  `valid_until` date DEFAULT NULL,
  `tags` longtext CHARACTER SET utf8mb4 COLLATE utf8mb4_bin DEFAULT NULL,
  `source` enum('manual','integration') NOT NULL DEFAULT 'manual',
  `source_integration_id` char(36) DEFAULT NULL,
  `source_ref` varchar(500) DEFAULT NULL,
  `created_at` datetime NOT NULL DEFAULT current_timestamp(),
  PRIMARY KEY (`id`),
  KEY `idx_tenant_valid_until` (`tenant_id`,`valid_until`),
  KEY `fk_evidence_integration` (`source_integration_id`),
  CONSTRAINT `fk_evidence_integration` FOREIGN KEY (`source_integration_id`) REFERENCES `integrations` (`id`) ON DELETE SET NULL,
  CONSTRAINT `fk_evidence_tenant` FOREIGN KEY (`tenant_id`) REFERENCES `tenants` (`id`) ON DELETE CASCADE
) ENGINE=InnoDB DEFAULT CHARSET=utf8mb4 COLLATE=utf8mb4_unicode_ci;

--
-- Dumping data for table `evidence`
--

INSERT INTO `evidence` VALUES ('c7c97aff-7d07-40cb-9e44-6a741d0127c6','9b0fb5bc-e3b5-47fe-9e2e-db3687759d0c','abc','sfsdfs','document','logo.png','uploads/9b0fb5bc-e3b5-47fe-9e2e-db3687759d0c/2026/05/1778218938276_logo.png',118403,'image/png','8b2620b03a52ebbb741a0f1dce8ac8b017d4f463a30dd7f388eb893922905d79','931dcf93-d429-4358-913c-28b47b722e44','2026-05-08','2026-05-21',NULL,'manual',NULL,NULL,'2026-05-08 05:42:18');

--
-- Table structure for table `express_sessions`
--

CREATE TABLE `express_sessions` (
  `sid` varchar(128) NOT NULL,
  `data` text NOT NULL,
  `expires` datetime NOT NULL,
  PRIMARY KEY (`sid`),
  KEY `idx_expires` (`expires`)
) ENGINE=InnoDB DEFAULT CHARSET=utf8mb4 COLLATE=utf8mb4_unicode_ci;

--
-- Dumping data for table `express_sessions`
--


--
-- Table structure for table `framework_requirements`
--

CREATE TABLE `framework_requirements` (
  `id` char(36) NOT NULL DEFAULT uuid(),
  `framework_id` char(36) NOT NULL,
  `parent_id` char(36) DEFAULT NULL,
  `reference_code` varchar(100) NOT NULL,
  `title` varchar(500) NOT NULL,
  `description` text DEFAULT NULL,
  `guidance` text DEFAULT NULL,
  `requirement_type` enum('mandatory','recommended','optional') NOT NULL DEFAULT 'mandatory',
  `category` varchar(255) DEFAULT NULL,
  `tags` longtext CHARACTER SET utf8mb4 COLLATE utf8mb4_bin DEFAULT NULL,
  `sort_order` int(11) NOT NULL DEFAULT 0,
  `created_at` datetime NOT NULL DEFAULT current_timestamp(),
  PRIMARY KEY (`id`),
  KEY `idx_framework` (`framework_id`),
  KEY `idx_parent` (`parent_id`),
  CONSTRAINT `fk_req_framework` FOREIGN KEY (`framework_id`) REFERENCES `regulatory_frameworks` (`id`) ON DELETE CASCADE,
  CONSTRAINT `fk_req_parent` FOREIGN KEY (`parent_id`) REFERENCES `framework_requirements` (`id`) ON DELETE SET NULL
) ENGINE=InnoDB DEFAULT CHARSET=utf8mb4 COLLATE=utf8mb4_unicode_ci;

--
-- Dumping data for table `framework_requirements`
--

INSERT INTO `framework_requirements` VALUES ('014220e4-b899-4db6-8dc6-1cd0fcda29a4','a2a4e62d-4113-11f1-8bc3-00155d012902','deed7b79-3495-43a3-bef6-364e72cbc7e6','CC2.3','COSO Principle 15: Communicates Externally','The entity communicates with external parties regarding matters affecting internal control.',NULL,'mandatory',NULL,NULL,2,'2026-04-26 02:00:01'),('0150df3e-fae7-4486-a453-7feef34846d6','a25c0c03-4113-11f1-8bc3-00155d012902',NULL,'6','Planning',NULL,NULL,'mandatory','Risk Planning',NULL,2,'2026-04-26 02:00:00'),('01a95c6d-336d-48e3-9103-9fc39d0d1903','a25c0c03-4113-11f1-8bc3-00155d012902','b5d335e2-66ea-4a33-b65f-e52f9b7ce7d6','7.2','Competence','Determine the necessary competence of persons doing work under the organization\'s control.',NULL,'mandatory',NULL,NULL,1,'2026-04-26 02:00:00'),('027f0ae9-f18e-4e27-8220-f26fd61315bd','a25c0c03-4113-11f1-8bc3-00155d012902',NULL,'9','Performance Evaluation',NULL,NULL,'mandatory','Monitoring & Review',NULL,5,'2026-04-26 02:00:01'),('03476466-a10e-4af7-8873-264b2d6c9052','a23072ef-4113-11f1-8bc3-00155d012902',NULL,'1798.100','Right to know about personal information collected, disclosed or sold','A consumer shall have the right to request that a business disclose the categories and specific pieces of personal information it collects about the consumer.',NULL,'mandatory','Consumer Rights',NULL,0,'2026-04-26 02:00:00'),('0369ac11-9c5a-4701-8803-64306fb829e3','a28c08f1-4113-11f1-8bc3-00155d012902',NULL,'9','Restrict Physical Access to Cardholder Data',NULL,NULL,'mandatory','Physical Security',NULL,8,'2026-04-26 02:00:01'),('03a6535f-9a7d-4334-a094-533485880eef','a25c0c03-4113-11f1-8bc3-00155d012902','0af8380e-b045-444d-90d8-9845e51354d9','6.1.2','Information security risk assessment','Define and apply an information security risk assessment process.',NULL,'mandatory',NULL,NULL,1,'2026-04-26 02:00:00'),('0466ace6-fc8c-4b73-96ec-8989272940b1','a2a4e62d-4113-11f1-8bc3-00155d012902','4117244c-a7d4-4faf-a1cb-1a2cacf4d760','CC7.4','Incident response program','The entity responds to identified security incidents by executing a defined incident response program.',NULL,'mandatory',NULL,NULL,3,'2026-04-26 02:00:01'),('047923e9-a424-40cd-a753-82e0fc67aa77','a25c0c03-4113-11f1-8bc3-00155d012902','a1bcbd48-afea-4e16-b19e-d810727b604c','5.1','Leadership and commitment','Top management shall demonstrate leadership and commitment with respect to the ISMS.',NULL,'mandatory',NULL,NULL,0,'2026-04-26 02:00:00'),('049f3763-5471-4ea3-b9ac-f50611c35ad8','a27eef01-4113-11f1-8bc3-00155d012902','5e916319-60b9-433a-a62a-797dab76c0cf','PR.DS','Data Security','Data are managed consistent with the organization\'s risk strategy to protect the confidentiality, integrity, and availability.',NULL,'mandatory',NULL,NULL,2,'2026-04-26 02:00:01'),('05a5d2db-19b7-45f2-8dfe-1b1c91e01e26','d4e5f6a1-b2c3-4d4e-8f6a-1b2c3d4e5f6a','c3e1fe9d-9bbc-4d3c-973e-82b4b38c3900','164.310(c)','Workstation Security','Implement physical safeguards for all workstations that access ePHI.',NULL,'mandatory',NULL,NULL,2,'2026-04-26 02:00:00'),('06732754-5d85-4cb4-b9a4-1c450a501e2a','a271e304-4113-11f1-8bc3-00155d012902','125438cc-2b59-4663-9189-c7e2ac4abc07','7.2','System testing','Conduct rigorous testing before implementing new or changed systems.',NULL,'mandatory',NULL,NULL,1,'2026-04-26 02:00:01'),('09316565-9b2d-4644-8737-b13fa45b3cdc','a23072ef-4113-11f1-8bc3-00155d012902',NULL,'1798.110','Right to know categories of personal information',NULL,NULL,'mandatory','Disclosure',NULL,2,'2026-04-26 02:00:00'),('0adb44ca-db58-43c5-af5f-0f176b3091c4','161ca661-dcfc-41d6-ae04-4d515194f119','b99360c4-400e-11f1-8bc3-00155d012902','Art.28.3','Data Processing Agreement','Processing by a processor shall be governed by a contract or other legal act.',NULL,'mandatory',NULL,NULL,0,'2026-04-26 02:00:00'),('0af8380e-b045-444d-90d8-9845e51354d9','a25c0c03-4113-11f1-8bc3-00155d012902','0150df3e-fae7-4486-a453-7feef34846d6','6.1','Actions to address risks and opportunities','Determine risks and opportunities that need to be addressed.',NULL,'mandatory',NULL,NULL,0,'2026-04-26 02:00:00'),('0b1d6c3c-710b-4097-a62c-8c00c9a23c9f','a27eef01-4113-11f1-8bc3-00155d012902',NULL,'DE','DETECT','Possible cybersecurity attacks and compromises are found and analyzed.',NULL,'mandatory','Detect',NULL,3,'2026-04-26 02:00:01'),('0ba5f7b0-e002-4c2d-9815-b5f872a05cc8','a29cdc11-4113-11f1-8bc3-00155d012902',NULL,'S27','Consent Requirements','Consent must be freely given, specific, informed and unambiguous. Consent requests must be clearly distinguishable.',NULL,'mandatory','Consent Management',NULL,3,'2026-04-26 02:00:01'),('0caaab79-0896-4807-824d-e108deabd590','a23897c7-4113-11f1-8bc3-00155d012902',NULL,'SYSC.5','Employees, agents and other relevant persons',NULL,NULL,'mandatory','Human Resources',NULL,2,'2026-04-26 02:00:00'),('0cc716e4-d5ed-4104-9882-383c162f9435','a25c0c03-4113-11f1-8bc3-00155d012902','8d8d7b39-e895-412e-9408-3d9f68885819','8.1','Operational planning and control','Plan, implement, control, monitor and review processes needed to meet requirements.',NULL,'mandatory',NULL,NULL,0,'2026-04-26 02:00:01'),('0e40534a-6d36-4c4e-ba78-ac4923112953','a271e304-4113-11f1-8bc3-00155d012902','57005d4f-844e-4b48-bdab-6a8d38faee31','3.1','Board oversight of technology risk','The board is responsible for setting the tone and oversight of the FI\'s technology risk management.',NULL,'mandatory',NULL,NULL,0,'2026-04-26 02:00:01'),('0ee3afda-7d9a-4c8e-b402-48eecc096685','a23072ef-4113-11f1-8bc3-00155d012902',NULL,'1798.135','Opt-out notice requirements','A business that sells consumers\' personal information to third parties shall provide notice to consumers and provide a clear and conspicuous link on the business\'s internet homepage titled \'Do Not Sell My Personal Information\'.',NULL,'mandatory','Notice & Disclosure',NULL,7,'2026-04-26 02:00:00'),('0f1cbaab-721b-41e7-8306-600ad5b2f5f5','a2a4e62d-4113-11f1-8bc3-00155d012902','34e539d9-3e70-4253-9e88-27714276f81b','CC6.8','Malicious software prevention','The entity implements controls to prevent or detect and act upon the introduction of unauthorized software.',NULL,'mandatory',NULL,NULL,5,'2026-04-26 02:00:01'),('0f567879-f49c-4810-8b8a-ac8b661d138b','a25c0c03-4113-11f1-8bc3-00155d012902','8d8d7b39-e895-412e-9408-3d9f68885819','8.3','Information security risk treatment','Implement the information security risk treatment plan.',NULL,'mandatory',NULL,NULL,2,'2026-04-26 02:00:01'),('0fcd9c77-c7fe-4bce-b376-12f728ad5ae7','a2a4e62d-4113-11f1-8bc3-00155d012902','d469fe64-f77c-46ea-a29d-81908bdd28d7','A1.3','Recovery plan','The entity tests recovery plan procedures supporting system availability.',NULL,'recommended',NULL,NULL,2,'2026-04-26 02:00:01'),('103982f3-cc15-46ae-a4ae-27c15767415e','a23897c7-4113-11f1-8bc3-00155d012902','e030f67e-22f0-4eb1-9cad-aa0e5f55af8f','SYSC.4.2','Compliance oversight','Establish, implement and maintain compliance policies and procedures.',NULL,'mandatory',NULL,NULL,1,'2026-04-26 02:00:00'),('105f68cb-a60e-4118-a9c2-cf75d1e5f1f1','a28c08f1-4113-11f1-8bc3-00155d012902','16c485ec-bd2a-4996-b6b2-86a6ce224819','12.10','Suspected and confirmed security incidents that could impact the CDE are responded to immediately',NULL,NULL,'mandatory',NULL,NULL,2,'2026-04-26 02:00:01'),('111982b6-4a98-11f1-8bc3-00155d012902','e5f6a7b8-0018-0001-0001-000000000001',NULL,'SOX-302','Section 302: Corporate Responsibility for Financial Reports','Requires CEO and CFO to certify the accuracy of financial reports and the effectiveness of internal disclosure controls and procedures.',NULL,'mandatory','SOX Sections',NULL,10,'2026-05-08 04:40:40'),('111987a5-4a98-11f1-8bc3-00155d012902','e5f6a7b8-0018-0001-0001-000000000001',NULL,'SOX-404','Section 404: Management Assessment of Internal Controls','Requires management to assess and report on the effectiveness of internal control over financial reporting; auditors must attest to management\'s assessment.',NULL,'mandatory','SOX Sections',NULL,20,'2026-05-08 04:40:40'),('1119c8c3-4a98-11f1-8bc3-00155d012902','e5f6a7b8-0018-0001-0001-000000000001',NULL,'SOX-409','Section 409: Real-Time Issuer Disclosures','Requires public companies to disclose material changes in financial condition or operations rapidly (4 business days for material cybersecurity events under SEC 2023 rules).',NULL,'mandatory','SOX Sections',NULL,30,'2026-05-08 04:40:40'),('1119cc93-4a98-11f1-8bc3-00155d012902','e5f6a7b8-0018-0001-0001-000000000001',NULL,'SOX-802','Section 802: Criminal Penalties for Altering Documents','Establishes criminal penalties for knowingly altering, destroying, or falsifying records in federal investigations or in connection with bankruptcy proceedings.',NULL,'mandatory','SOX Sections',NULL,40,'2026-05-08 04:40:40'),('1119ce53-4a98-11f1-8bc3-00155d012902','e5f6a7b8-0018-0001-0001-000000000001',NULL,'SOX-906','Section 906: Corporate Responsibility for Financial Reports (Criminal)','Imposes criminal penalties on CEOs and CFOs who knowingly certify materially false financial reports (up to $5M fine and 20 years imprisonment).',NULL,'mandatory','SOX Sections',NULL,50,'2026-05-08 04:40:40'),('112b7b8d-4a98-11f1-8bc3-00155d012902','e5f6a7b8-0018-0002-0001-000000000001',NULL,'B3-P1','Pillar 1: Minimum Capital Requirements','Banks must hold minimum capital equal to 8% of risk-weighted assets, with a Common Equity Tier 1 (CET1) ratio of at least 4.5% and Tier 1 capital of 6%.',NULL,'mandatory','Basel III Pillars',NULL,10,'2026-05-08 04:40:40'),('112b8151-4a98-11f1-8bc3-00155d012902','e5f6a7b8-0018-0002-0001-000000000001',NULL,'B3-P2','Pillar 2: Supervisory Review Process','Banks must have internal processes for assessing capital adequacy relative to their risk profiles; supervisors review and may require additional capital buffers.',NULL,'mandatory','Basel III Pillars',NULL,20,'2026-05-08 04:40:40'),('112b8307-4a98-11f1-8bc3-00155d012902','e5f6a7b8-0018-0002-0001-000000000001',NULL,'B3-P3','Pillar 3: Market Discipline','Banks must disclose their capital structure, risk exposures, capital adequacy assessments, and risk management approaches to enable market participants to assess their soundness.',NULL,'mandatory','Basel III Pillars',NULL,30,'2026-05-08 04:40:40'),('112b8505-4a98-11f1-8bc3-00155d012902','e5f6a7b8-0018-0002-0001-000000000001',NULL,'B3-LCR','Liquidity Coverage Ratio (LCR)','Banks must hold sufficient high-quality liquid assets to cover total net cash outflows over a 30-day stress scenario; minimum ratio is 100%.',NULL,'mandatory','Basel III Pillars',NULL,40,'2026-05-08 04:40:40'),('112b86ef-4a98-11f1-8bc3-00155d012902','e5f6a7b8-0018-0002-0001-000000000001',NULL,'B3-NSFR','Net Stable Funding Ratio (NSFR)','Banks must maintain a stable funding profile relative to their assets and off-balance-sheet activities; available stable funding must exceed required stable funding.',NULL,'mandatory','Basel III Pillars',NULL,50,'2026-05-08 04:40:40'),('112b8890-4a98-11f1-8bc3-00155d012902','e5f6a7b8-0018-0002-0001-000000000001',NULL,'B3-LR','Leverage Ratio','Banks must maintain a minimum leverage ratio of 3% (Tier 1 capital as a percentage of total exposure), serving as a backstop to risk-weighted capital requirements.',NULL,'mandatory','Basel III Pillars',NULL,60,'2026-05-08 04:40:40'),('11369b34-4a98-11f1-8bc3-00155d012902','e5f6a7b8-0018-0003-0001-000000000001',NULL,'CAT-1','Domain 1: Cyber Risk Management and Oversight','Board and management oversight, policies and procedures, IT asset management, risk management, and audit functions for cybersecurity.',NULL,'mandatory','FFIEC CAT Domains',NULL,10,'2026-05-08 04:40:40'),('1136a09e-4a98-11f1-8bc3-00155d012902','e5f6a7b8-0018-0003-0001-000000000001',NULL,'CAT-2','Domain 2: Threat Intelligence and Collaboration','Gathering, analyzing, and sharing cyber threat information; participation in information sharing forums; monitoring of emerging threats.',NULL,'mandatory','FFIEC CAT Domains',NULL,20,'2026-05-08 04:40:40'),('1136a252-4a98-11f1-8bc3-00155d012902','e5f6a7b8-0018-0003-0001-000000000001',NULL,'CAT-3','Domain 3: Cybersecurity Controls','Preventive, detective, and corrective controls covering infrastructure management, access management, device/end-point security, secure coding, and patch management.',NULL,'mandatory','FFIEC CAT Domains',NULL,30,'2026-05-08 04:40:40'),('1136a457-4a98-11f1-8bc3-00155d012902','e5f6a7b8-0018-0003-0001-000000000001',NULL,'CAT-4','Domain 4: External Dependency Management','Management of third-party and vendor relationships including due diligence, contracts, ongoing monitoring, and termination procedures.',NULL,'mandatory','FFIEC CAT Domains',NULL,40,'2026-05-08 04:40:40'),('1136a5f0-4a98-11f1-8bc3-00155d012902','e5f6a7b8-0018-0003-0001-000000000001',NULL,'CAT-5','Domain 5: Cyber Incident Management and Resilience','Incident response planning, detection, response, mitigation, escalation, and recovery capabilities; testing and lessons learned.',NULL,'mandatory','FFIEC CAT Domains',NULL,50,'2026-05-08 04:40:40'),('1153cac2-4a98-11f1-8bc3-00155d012902','e5f6a7b8-0018-0004-0001-000000000001',NULL,'§500.02','Cybersecurity Program','Covered entities must maintain a cybersecurity program based on risk assessment and designed to protect the confidentiality, integrity, and availability of information systems.',NULL,'mandatory','NYDFS 500 Sections',NULL,10,'2026-05-08 04:40:41'),('1153d136-4a98-11f1-8bc3-00155d012902','e5f6a7b8-0018-0004-0001-000000000001',NULL,'§500.03','Cybersecurity Policy','Covered entities must implement and maintain written cybersecurity policies covering data governance, asset inventory, access controls, and other specified areas.',NULL,'mandatory','NYDFS 500 Sections',NULL,20,'2026-05-08 04:40:41'),('1153d331-4a98-11f1-8bc3-00155d012902','e5f6a7b8-0018-0004-0001-000000000001',NULL,'§500.05','Penetration Testing and Vulnerability Assessments','Annual penetration testing and bi-annual vulnerability assessments are required; results must be remediated on a risk-based schedule.',NULL,'mandatory','NYDFS 500 Sections',NULL,30,'2026-05-08 04:40:41'),('1153d4ec-4a98-11f1-8bc3-00155d012902','e5f6a7b8-0018-0004-0001-000000000001',NULL,'§500.06','Audit Trail','Covered entities must maintain audit trails designed to detect and respond to cybersecurity events; records must be retained for at least 3 years.',NULL,'mandatory','NYDFS 500 Sections',NULL,40,'2026-05-08 04:40:41'),('1153d654-4a98-11f1-8bc3-00155d012902','e5f6a7b8-0018-0004-0001-000000000001',NULL,'§500.07','Access Privileges and Management','Covered entities must limit access privileges to information systems providing access only based on need; review access privileges at least annually.',NULL,'mandatory','NYDFS 500 Sections',NULL,50,'2026-05-08 04:40:41'),('1153d7c6-4a98-11f1-8bc3-00155d012902','e5f6a7b8-0018-0004-0001-000000000001',NULL,'§500.11','Third-Party Service Provider Security Policy','Covered entities must maintain policies and procedures for the security of information systems accessible by third-party service providers.',NULL,'mandatory','NYDFS 500 Sections',NULL,60,'2026-05-08 04:40:41'),('1153d9b7-4a98-11f1-8bc3-00155d012902','e5f6a7b8-0018-0004-0001-000000000001',NULL,'§500.12','Multi-Factor Authentication (MFA)','MFA is required for remote access, privileged accounts, and web applications that provide access to nonpublic information.',NULL,'mandatory','NYDFS 500 Sections',NULL,70,'2026-05-08 04:40:41'),('1153db2b-4a98-11f1-8bc3-00155d012902','e5f6a7b8-0018-0004-0001-000000000001',NULL,'§500.13','Limitations on Data Retention','Covered entities must establish policies for secure disposal of nonpublic information that is no longer necessary for business operations.',NULL,'mandatory','NYDFS 500 Sections',NULL,80,'2026-05-08 04:40:41'),('1153dc89-4a98-11f1-8bc3-00155d012902','e5f6a7b8-0018-0004-0001-000000000001',NULL,'§500.14','Training and Monitoring','Covered entities must provide regular cybersecurity awareness training and monitor authorized users\' activities on information systems.',NULL,'mandatory','NYDFS 500 Sections',NULL,90,'2026-05-08 04:40:41'),('1153de06-4a98-11f1-8bc3-00155d012902','e5f6a7b8-0018-0004-0001-000000000001',NULL,'§500.15','Encryption of Nonpublic Information','Covered entities must encrypt nonpublic information in transit over external networks and at rest, using compensating controls where encryption is not feasible.',NULL,'mandatory','NYDFS 500 Sections',NULL,100,'2026-05-08 04:40:41'),('1153dfec-4a98-11f1-8bc3-00155d012902','e5f6a7b8-0018-0004-0001-000000000001',NULL,'§500.16','Business Continuity and Disaster Recovery','Covered entities must establish business continuity and disaster recovery plans ensuring availability of critical information systems in a cybersecurity event.',NULL,'mandatory','NYDFS 500 Sections',NULL,110,'2026-05-08 04:40:41'),('1153e14e-4a98-11f1-8bc3-00155d012902','e5f6a7b8-0018-0004-0001-000000000001',NULL,'§500.17','Incident Notification','Covered entities must notify NYDFS within 72 hours of determining a material cybersecurity event has occurred; notify consumers and regulators per applicable law.',NULL,'mandatory','NYDFS 500 Sections',NULL,120,'2026-05-08 04:40:41'),('115420db-4a98-11f1-8bc3-00155d012902','e5f6a7b8-0018-0004-0001-000000000001',NULL,'§500.19','Limitations and Exemptions','Limited exemptions apply to covered entities with fewer than 10 employees, limited NY gross revenue under $5M, or fewer than $10M total assets.',NULL,'mandatory','NYDFS 500 Sections',NULL,130,'2026-05-08 04:40:41'),('115422a0-4a98-11f1-8bc3-00155d012902','e5f6a7b8-0018-0004-0001-000000000001',NULL,'§500.20','Enforcement and Penalties','NYDFS may impose civil monetary penalties for violations; criminal penalties may apply for knowingly submitting false certifications.',NULL,'mandatory','NYDFS 500 Sections',NULL,140,'2026-05-08 04:40:41'),('116a4179-4a98-11f1-8bc3-00155d012902','e5f6a7b8-0018-0006-0001-000000000001',NULL,'MRM-DEV','Model Development, Implementation, and Use','Models must be developed with sound conceptual basis, rigorous implementation, and used appropriately within their intended scope and limitations.',NULL,'mandatory','Model Risk Management',NULL,10,'2026-05-08 04:40:41'),('116a4bcc-4a98-11f1-8bc3-00155d012902','e5f6a7b8-0018-0006-0001-000000000001',NULL,'MRM-VAL','Model Validation','Effective model validation includes evaluation of conceptual soundness, ongoing monitoring, outcomes analysis, and benchmarking against alternative approaches.',NULL,'mandatory','Model Risk Management',NULL,20,'2026-05-08 04:40:41'),('116a4fd2-4a98-11f1-8bc3-00155d012902','e5f6a7b8-0018-0006-0001-000000000001',NULL,'MRM-GOV','Governance, Policies, and Controls','Board and senior management must establish and maintain a sound model risk management framework including an inventory, tiered risk-based review schedule, and model ownership.',NULL,'mandatory','Model Risk Management',NULL,30,'2026-05-08 04:40:41'),('116a517f-4a98-11f1-8bc3-00155d012902','e5f6a7b8-0018-0006-0001-000000000001',NULL,'MRM-MON','Ongoing Monitoring and Reporting','Models must be monitored continuously for performance degradation, changes in operating context, and data quality; results reported to senior management.',NULL,'mandatory','Model Risk Management',NULL,40,'2026-05-08 04:40:41'),('1176164a-4a98-11f1-8bc3-00155d012902','e5f6a7b8-0018-0007-0001-000000000001',NULL,'MIFID-PG','Product Governance','Manufacturers and distributors must ensure financial products are designed and distributed appropriately for defined target markets.',NULL,'mandatory','MiFID II Requirements',NULL,10,'2026-05-08 04:40:41'),('11761c99-4a98-11f1-8bc3-00155d012902','e5f6a7b8-0018-0007-0001-000000000001',NULL,'MIFID-CC','Client Categorization','Clients must be classified as retail, professional, or eligible counterparty; different protections and obligations apply to each category.',NULL,'mandatory','MiFID II Requirements',NULL,20,'2026-05-08 04:40:41'),('11761e71-4a98-11f1-8bc3-00155d012902','e5f6a7b8-0018-0007-0001-000000000001',NULL,'MIFID-BE','Best Execution','Investment firms must take all sufficient steps to obtain the best possible result for clients when executing orders.',NULL,'mandatory','MiFID II Requirements',NULL,30,'2026-05-08 04:40:41'),('1176201d-4a98-11f1-8bc3-00155d012902','e5f6a7b8-0018-0007-0001-000000000001',NULL,'MIFID-TR','Transaction Reporting','Investment firms must report details of transactions in financial instruments to national regulators within one working day.',NULL,'mandatory','MiFID II Requirements',NULL,40,'2026-05-08 04:40:41'),('117621a5-4a98-11f1-8bc3-00155d012902','e5f6a7b8-0018-0007-0001-000000000001',NULL,'MIFID-MS','Market Structure and Trading Venues','Establishes requirements for regulated markets, multilateral trading facilities, organized trading facilities, and systematic internalisers.',NULL,'mandatory','MiFID II Requirements',NULL,50,'2026-05-08 04:40:41'),('11762327-4a98-11f1-8bc3-00155d012902','e5f6a7b8-0018-0007-0001-000000000001',NULL,'MIFID-TP','Pre- and Post-Trade Transparency','Trading venues and systematic internalisers must make pre- and post-trade information publicly available on a reasonable commercial basis.',NULL,'mandatory','MiFID II Requirements',NULL,60,'2026-05-08 04:40:41'),('1181efa2-4a98-11f1-8bc3-00155d012902','e5f6a7b8-0018-0008-0001-000000000001',NULL,'PSD2-SCA','Strong Customer Authentication (SCA)','Payment service providers must apply SCA using at least two independent authentication factors from knowledge, possession, and inherence categories.',NULL,'mandatory','PSD2 Requirements',NULL,10,'2026-05-08 04:40:41'),('1181f49f-4a98-11f1-8bc3-00155d012902','e5f6a7b8-0018-0008-0001-000000000001',NULL,'PSD2-OBA','Open Banking APIs','Account servicing payment service providers must provide access to payment accounts via standardized, secure APIs for authorized third-party providers.',NULL,'mandatory','PSD2 Requirements',NULL,20,'2026-05-08 04:40:41'),('1181f6ce-4a98-11f1-8bc3-00155d012902','e5f6a7b8-0018-0008-0001-000000000001',NULL,'PSD2-TPP','Third-Party Provider (TPP) Access','Account information service providers (AISP) and payment initiation service providers (PISP) must be authorized and may access accounts with customer consent.',NULL,'mandatory','PSD2 Requirements',NULL,30,'2026-05-08 04:40:41'),('1181f8f6-4a98-11f1-8bc3-00155d012902','e5f6a7b8-0018-0008-0001-000000000001',NULL,'PSD2-SEC','Security Measures','Payment service providers must implement incident reporting to competent authorities and EBA, maintain transaction monitoring, and establish fraud detection mechanisms.',NULL,'mandatory','PSD2 Requirements',NULL,40,'2026-05-08 04:40:41'),('118acb3c-4a98-11f1-8bc3-00155d012902','e5f6a7b8-0018-0009-0001-000000000001',NULL,'SEC-ID','Incident Disclosure (4-Business-Day Rule)','Public companies must disclose material cybersecurity incidents on Form 8-K within four business days of determining materiality.',NULL,'mandatory','SEC Cyber Rules',NULL,10,'2026-05-08 04:40:41'),('118ad0fc-4a98-11f1-8bc3-00155d012902','e5f6a7b8-0018-0009-0001-000000000001',NULL,'SEC-ARD','Annual Risk Disclosure','Public companies must provide annual disclosures on 10-K of cybersecurity risk management processes, strategy, and governance.',NULL,'mandatory','SEC Cyber Rules',NULL,20,'2026-05-08 04:40:41'),('118ad2c9-4a98-11f1-8bc3-00155d012902','e5f6a7b8-0018-0009-0001-000000000001',NULL,'SEC-BO','Board Oversight','Annual disclosures must describe board oversight of cybersecurity risks and management\'s role in assessing and managing material cybersecurity risks.',NULL,'mandatory','SEC Cyber Rules',NULL,30,'2026-05-08 04:40:41'),('11965f56-4a98-11f1-8bc3-00155d012902','e5f6a7b8-0018-0010-0001-000000000001',NULL,'FINRA-4370','Rule 4370: Business Continuity Planning','Broker-dealers must create and maintain written BCPs identifying procedures to follow in the event of an emergency or significant business disruption.',NULL,'mandatory','FINRA Rules',NULL,10,'2026-05-08 04:40:41'),('119663f1-4a98-11f1-8bc3-00155d012902','e5f6a7b8-0018-0010-0001-000000000001',NULL,'FINRA-4511','Rule 4511: General Requirements for Books and Records','Broker-dealers must make and preserve books and records in a form and manner required by FINRA rules and Exchange Act regulations.',NULL,'mandatory','FINRA Rules',NULL,20,'2026-05-08 04:40:41'),('119665b0-4a98-11f1-8bc3-00155d012902','e5f6a7b8-0018-0010-0001-000000000001',NULL,'FINRA-4530','Rule 4530: Reporting Requirements','Broker-dealers must report specified events including regulatory actions, customer complaints, and internal conclusions of violations to FINRA.',NULL,'mandatory','FINRA Rules',NULL,30,'2026-05-08 04:40:41'),('11966744-4a98-11f1-8bc3-00155d012902','e5f6a7b8-0018-0010-0001-000000000001',NULL,'FINRA-3110','Rule 3110: Supervision','Broker-dealers must establish and maintain a system to supervise the activities of each associated person that is reasonably designed to achieve compliance.',NULL,'mandatory','FINRA Rules',NULL,40,'2026-05-08 04:40:41'),('119f6913-4a98-11f1-8bc3-00155d012902','e5f6a7b8-0018-0011-0001-000000000001',NULL,'NACHA-PAN','Protect Account Numbers','Originators must use commercially reasonable methods to protect account numbers used in ACH transactions from unauthorized access.',NULL,'mandatory','NACHA ACH Security',NULL,10,'2026-05-08 04:40:41'),('119f6cad-4a98-11f1-8bc3-00155d012902','e5f6a7b8-0018-0011-0001-000000000001',NULL,'NACHA-RA','Risk Assessments','Third-party senders and originators must conduct risk assessments of their ACH activities and implement controls commensurate with risk.',NULL,'mandatory','NACHA ACH Security',NULL,20,'2026-05-08 04:40:41'),('119f6e68-4a98-11f1-8bc3-00155d012902','e5f6a7b8-0018-0011-0001-000000000001',NULL,'NACHA-OO','Originator Obligations','Originators are responsible for ensuring their originators and third-party senders comply with NACHA rules, including proper authorization and fraud monitoring.',NULL,'mandatory','NACHA ACH Security',NULL,30,'2026-05-08 04:40:41'),('11a8a406-4a98-11f1-8bc3-00155d012902','e5f6a7b8-0018-0012-0001-000000000001',NULL,'OCC-GV','Governance','Covered institutions must have an appropriate governance structure including board-level risk committee, independent risk management, and internal audit functions.',NULL,'mandatory','OCC Heightened Standards',NULL,10,'2026-05-08 04:40:41'),('11a8a89c-4a98-11f1-8bc3-00155d012902','e5f6a7b8-0018-0012-0001-000000000001',NULL,'OCC-RA','Risk Appetite','Covered institutions must articulate a risk appetite statement that aligns with strategic and financial plans, serves as a communication tool, and drives risk culture.',NULL,'mandatory','OCC Heightened Standards',NULL,20,'2026-05-08 04:40:41'),('11a8aa61-4a98-11f1-8bc3-00155d012902','e5f6a7b8-0018-0012-0001-000000000001',NULL,'OCC-RM','Risk Management','Covered institutions must have effective risk management covering credit, market, operational, liquidity, and strategic risk with front-line units, risk management functions, and internal audit.',NULL,'mandatory','OCC Heightened Standards',NULL,30,'2026-05-08 04:40:41'),('11a8ac13-4a98-11f1-8bc3-00155d012902','e5f6a7b8-0018-0012-0001-000000000001',NULL,'OCC-TM','Talent Management','Covered institutions must have compensation structures for senior officers in risk management and internal audit that are commensurate with their responsibilities.',NULL,'mandatory','OCC Heightened Standards',NULL,40,'2026-05-08 04:40:41'),('11bb8843-4a98-11f1-8bc3-00155d012902','e5f6a7b8-0018-0014-0001-000000000001',NULL,'CMMC1-L1','Level 1: Basic Cyber Hygiene','17 practices covering basic safeguarding of FCI; corresponds to FAR 52.204-21 requirements.',NULL,'mandatory','CMMC 1.0 Levels',NULL,10,'2026-05-08 04:40:41'),('11bb8d06-4a98-11f1-8bc3-00155d012902','e5f6a7b8-0018-0014-0001-000000000001',NULL,'CMMC1-L2','Level 2: Intermediate Cyber Hygiene','72 practices serving as a transition step toward Level 3; covers a subset of NIST SP 800-171 controls.',NULL,'mandatory','CMMC 1.0 Levels',NULL,20,'2026-05-08 04:40:41'),('11bb8edd-4a98-11f1-8bc3-00155d012902','e5f6a7b8-0018-0014-0001-000000000001',NULL,'CMMC1-L3','Level 3: Good Cyber Hygiene','130 practices covering all 110 NIST SP 800-171 requirements plus additional practices to protect CUI.',NULL,'mandatory','CMMC 1.0 Levels',NULL,30,'2026-05-08 04:40:41'),('11bb9097-4a98-11f1-8bc3-00155d012902','e5f6a7b8-0018-0014-0001-000000000001',NULL,'CMMC1-L4','Level 4: Proactive','156 practices addressing advanced persistent threats; adds practices from NIST SP 800-172 and other sources.',NULL,'mandatory','CMMC 1.0 Levels',NULL,40,'2026-05-08 04:40:41'),('11bb9241-4a98-11f1-8bc3-00155d012902','e5f6a7b8-0018-0014-0001-000000000001',NULL,'CMMC1-L5','Level 5: Advanced/Progressive','171 practices providing the highest level of cyber protection for DoD\'s most sensitive programs; proactive threat detection and response.',NULL,'mandatory','CMMC 1.0 Levels',NULL,50,'2026-05-08 04:40:41'),('11c65f78-4a98-11f1-8bc3-00155d012902','e5f6a7b8-0018-0015-0001-000000000001',NULL,'7012-AS','Adequate Security','Contractors must implement NIST SP 800-171 security requirements to provide adequate security for all covered defense information on contractor information systems.',NULL,'mandatory','DFARS 7012 Requirements',NULL,10,'2026-05-08 04:40:41'),('11c664fa-4a98-11f1-8bc3-00155d012902','e5f6a7b8-0018-0015-0001-000000000001',NULL,'7012-CIR','Cyber Incident Reporting','Contractors must report cyber incidents that affect covered defense information or the contractor\'s ability to perform requirements within 72 hours to DoD.',NULL,'mandatory','DFARS 7012 Requirements',NULL,20,'2026-05-08 04:40:41'),('11c66719-4a98-11f1-8bc3-00155d012902','e5f6a7b8-0018-0015-0001-000000000001',NULL,'7012-MS','Malicious Software','Contractors must submit malicious software discovered and isolated in connection with a reported cyber incident to the DoD Cyber Crime Center.',NULL,'mandatory','DFARS 7012 Requirements',NULL,30,'2026-05-08 04:40:41'),('11c66905-4a98-11f1-8bc3-00155d012902','e5f6a7b8-0018-0015-0001-000000000001',NULL,'7012-MP','Media Preservation and Protection','Contractors must preserve images of compromised systems and all data for 90 days following a cyber incident report to support DoD damage assessment.',NULL,'mandatory','DFARS 7012 Requirements',NULL,40,'2026-05-08 04:40:41'),('11c66acf-4a98-11f1-8bc3-00155d012902','e5f6a7b8-0018-0015-0001-000000000001',NULL,'7012-AI','Access to Additional Information','Contractors must provide DoD access to contractor\'s systems and any other information needed to conduct a forensic analysis of a cyber incident.',NULL,'mandatory','DFARS 7012 Requirements',NULL,50,'2026-05-08 04:40:41'),('11cdb94d-4a98-11f1-8bc3-00155d012902','e5f6a7b8-0018-0016-0001-000000000001',NULL,'7020-BA','Basic Assessment','Contractors must conduct a self-assessment of their implementation of NIST SP 800-171 and post the summary score to SPRS at least every 3 years.',NULL,'mandatory','DFARS 7020 Requirements',NULL,10,'2026-05-08 04:40:41'),('11cdbebd-4a98-11f1-8bc3-00155d012902','e5f6a7b8-0018-0016-0001-000000000001',NULL,'7020-MA','Medium Assessment','A Government assessment that includes review of the contractor\'s Basic Assessment plus a medium-level review of supporting evidence.',NULL,'mandatory','DFARS 7020 Requirements',NULL,20,'2026-05-08 04:40:41'),('11cdc08c-4a98-11f1-8bc3-00155d012902','e5f6a7b8-0018-0016-0001-000000000001',NULL,'7020-HA','High Assessment','A Government assessment that includes review of the contractor\'s system security plan and examination of policies, procedures, practices, and system configurations.',NULL,'mandatory','DFARS 7020 Requirements',NULL,30,'2026-05-08 04:40:41'),('11d8d1a3-4a98-11f1-8bc3-00155d012902','e5f6a7b8-0018-0017-0001-000000000001',NULL,'ITAR-JU','Jurisdiction Determination','Determine whether articles are subject to ITAR (USML) or EAR (CCL); jurisdiction is determined by commodity jurisdiction procedures administered by the State Department.',NULL,'mandatory','ITAR Categories',NULL,10,'2026-05-08 04:40:42'),('11d8d79d-4a98-11f1-8bc3-00155d012902','e5f6a7b8-0018-0017-0001-000000000001',NULL,'ITAR-CL','Classification on the USML','Classify defense articles against the 21 categories of the US Munitions List (USML) to determine applicable export licensing requirements.',NULL,'mandatory','ITAR Categories',NULL,20,'2026-05-08 04:40:42'),('11d8d971-4a98-11f1-8bc3-00155d012902','e5f6a7b8-0018-0017-0001-000000000001',NULL,'ITAR-LR','License Requirements','Obtain required export licenses or agreements (DSP-5, DSP-73, MLA, TAA) from the State Department DDTC before exporting defense articles or technical data.',NULL,'mandatory','ITAR Categories',NULL,30,'2026-05-08 04:40:42'),('11d8db1f-4a98-11f1-8bc3-00155d012902','e5f6a7b8-0018-0017-0001-000000000001',NULL,'ITAR-EX','Exemptions','Identify and properly apply applicable ITAR exemptions (e.g., Canada exemption, government-to-government exemptions) with required documentation.',NULL,'mandatory','ITAR Categories',NULL,40,'2026-05-08 04:40:42'),('11d8dcb4-4a98-11f1-8bc3-00155d012902','e5f6a7b8-0018-0017-0001-000000000001',NULL,'ITAR-CP','Compliance Program','Maintain a Technology Control Plan (TCP) and ITAR compliance program including training, recordkeeping, access controls, and self-disclosure procedures.',NULL,'mandatory','ITAR Categories',NULL,50,'2026-05-08 04:40:42'),('11d8de4b-4a98-11f1-8bc3-00155d012902','e5f6a7b8-0018-0017-0001-000000000001',NULL,'ITAR-VL','Violations and Voluntary Disclosure','Proactively disclose potential violations to DDTC through the voluntary disclosure process to mitigate penalties; cooperate with any investigations.',NULL,'mandatory','ITAR Categories',NULL,60,'2026-05-08 04:40:42'),('11e211d4-4a98-11f1-8bc3-00155d012902','e5f6a7b8-0018-0018-0001-000000000001',NULL,'EAR-CCL','CCL Classification','Classify items against the Commerce Control List (CCL) using Export Control Classification Numbers (ECCNs) to determine applicable controls.',NULL,'mandatory','EAR Sections',NULL,10,'2026-05-08 04:40:42'),('11e217bf-4a98-11f1-8bc3-00155d012902','e5f6a7b8-0018-0018-0001-000000000001',NULL,'EAR-LD','License Determination','Determine whether an export license is required by checking the item\'s ECCN, destination country, end-user, and end-use; apply for license or use license exception.',NULL,'mandatory','EAR Sections',NULL,20,'2026-05-08 04:40:42'),('11e21c0a-4a98-11f1-8bc3-00155d012902','e5f6a7b8-0018-0018-0001-000000000001',NULL,'EAR-PP','Prohibited Parties Screening','Screen all parties in transactions against denied persons, entities, and unverified lists; do not export to embargoed destinations (OFAC).',NULL,'mandatory','EAR Sections',NULL,30,'2026-05-08 04:40:42'),('11e21dbb-4a98-11f1-8bc3-00155d012902','e5f6a7b8-0018-0018-0001-000000000001',NULL,'EAR-DE','Deemed Export Controls','Control the release of controlled technology to foreign nationals within the US (deemed export); obtain license if required by the item\'s ECCN.',NULL,'mandatory','EAR Sections',NULL,40,'2026-05-08 04:40:42'),('11e21f6b-4a98-11f1-8bc3-00155d012902','e5f6a7b8-0018-0018-0001-000000000001',NULL,'EAR-RK','Recordkeeping','Maintain export records for 5 years from the date of export, re-export, or transfer; records must be available for inspection by BIS.',NULL,'mandatory','EAR Sections',NULL,50,'2026-05-08 04:40:42'),('11f4e5ef-4a98-11f1-8bc3-00155d012902','e5f6a7b8-0018-0019-0001-000000000001',NULL,'CJIS-IEA','Information Exchange Agreements','All agencies accessing CJI must have a signed CJIS Security Addendum establishing roles, responsibilities, and security commitments.',NULL,'mandatory','CJIS Policy Areas',NULL,10,'2026-05-08 04:40:42'),('11f56346-4a98-11f1-8bc3-00155d012902','e5f6a7b8-0018-0019-0001-000000000001',NULL,'CJIS-SAT','Security Awareness Training','All personnel with access to CJI must complete security awareness training within 6 months of assignment and biennially thereafter.',NULL,'mandatory','CJIS Policy Areas',NULL,20,'2026-05-08 04:40:42'),('11f56654-4a98-11f1-8bc3-00155d012902','e5f6a7b8-0018-0019-0001-000000000001',NULL,'CJIS-IR','Incident Response','Agencies must have an incident response plan for CJI-related incidents and report breaches to the FBI CJIS Division within 24 hours.',NULL,'mandatory','CJIS Policy Areas',NULL,30,'2026-05-08 04:40:42'),('11f5687f-4a98-11f1-8bc3-00155d012902','e5f6a7b8-0018-0019-0001-000000000001',NULL,'CJIS-AA','Auditing and Accountability','Agencies must log and audit all access to CJI and retain audit logs for a minimum period; logs must be available for review.',NULL,'mandatory','CJIS Policy Areas',NULL,40,'2026-05-08 04:40:42'),('11f56afb-4a98-11f1-8bc3-00155d012902','e5f6a7b8-0018-0019-0001-000000000001',NULL,'CJIS-AC','Access Control','Access to CJI must be restricted to authorized personnel on a need-to-know basis; implement least privilege and separation of duties.',NULL,'mandatory','CJIS Policy Areas',NULL,50,'2026-05-08 04:40:42'),('11f56cf8-4a98-11f1-8bc3-00155d012902','e5f6a7b8-0018-0019-0001-000000000001',NULL,'CJIS-IA','Identification and Authentication','Multi-factor authentication is required for all remote access to CJI; strong password requirements apply for local access.',NULL,'mandatory','CJIS Policy Areas',NULL,60,'2026-05-08 04:40:42'),('11f56e9d-4a98-11f1-8bc3-00155d012902','e5f6a7b8-0018-0019-0001-000000000001',NULL,'CJIS-CM','Configuration Management','Agencies must maintain baseline configurations for systems processing CJI and document authorized software, hardware, and firmware.',NULL,'mandatory','CJIS Policy Areas',NULL,70,'2026-05-08 04:40:42'),('11f5721c-4a98-11f1-8bc3-00155d012902','e5f6a7b8-0018-0019-0001-000000000001',NULL,'CJIS-MP','Media Protection','Physical and digital media containing CJI must be securely stored, transported, and sanitized or destroyed when no longer needed.',NULL,'mandatory','CJIS Policy Areas',NULL,80,'2026-05-08 04:40:42'),('11f57446-4a98-11f1-8bc3-00155d012902','e5f6a7b8-0018-0019-0001-000000000001',NULL,'CJIS-PE','Physical Protection','Access to facilities housing CJI must be controlled; visitor logs must be maintained; equipment must be protected from theft and tampering.',NULL,'mandatory','CJIS Policy Areas',NULL,90,'2026-05-08 04:40:42'),('11f57766-4a98-11f1-8bc3-00155d012902','e5f6a7b8-0018-0019-0001-000000000001',NULL,'CJIS-SC','Systems and Communications Protection','CJI must be encrypted in transit using FIPS 140-2 validated encryption; network boundary protections must be implemented.',NULL,'mandatory','CJIS Policy Areas',NULL,100,'2026-05-08 04:40:42'),('11f578fc-4a98-11f1-8bc3-00155d012902','e5f6a7b8-0018-0019-0001-000000000001',NULL,'CJIS-FA','Formal Audits','The FBI CJIS Division conducts triennial compliance audits of all CSAs; CSAs must conduct annual self-assessments of local agencies.',NULL,'mandatory','CJIS Policy Areas',NULL,110,'2026-05-08 04:40:42'),('11f57a88-4a98-11f1-8bc3-00155d012902','e5f6a7b8-0018-0019-0001-000000000001',NULL,'CJIS-PS','Personnel Security','Personnel with access to CJI must undergo fingerprint-based background checks before access is granted.',NULL,'mandatory','CJIS Policy Areas',NULL,120,'2026-05-08 04:40:42'),('11f57c03-4a98-11f1-8bc3-00155d012902','e5f6a7b8-0018-0019-0001-000000000001',NULL,'CJIS-MD','Mobile Devices','Mobile devices used to access CJI must meet encryption, authentication, and remote wipe requirements as defined in the CJIS Security Policy.',NULL,'mandatory','CJIS Policy Areas',NULL,130,'2026-05-08 04:40:42'),('12013533-4a98-11f1-8bc3-00155d012902','e5f6a7b8-0018-0020-0001-000000000001',NULL,'CAT-I','CAT I — Critical Findings','Vulnerabilities whose exploitation will directly and immediately result in loss of confidentiality, availability, or integrity; must be mitigated immediately.',NULL,'mandatory','STIG Severity Categories',NULL,10,'2026-05-08 04:40:42'),('120139cd-4a98-11f1-8bc3-00155d012902','e5f6a7b8-0018-0020-0001-000000000001',NULL,'CAT-II','CAT II — High Findings','Vulnerabilities that have potential to result in loss of CIA with significant vulnerability exploitation; must be mitigated within 30 days.',NULL,'mandatory','STIG Severity Categories',NULL,20,'2026-05-08 04:40:42'),('12013bb8-4a98-11f1-8bc3-00155d012902','e5f6a7b8-0018-0020-0001-000000000001',NULL,'CAT-III','CAT III — Medium Findings','Vulnerabilities that degrade measures to protect against loss of CIA; should be mitigated within 90 days.',NULL,'mandatory','STIG Severity Categories',NULL,30,'2026-05-08 04:40:42'),('12013d5a-4a98-11f1-8bc3-00155d012902','e5f6a7b8-0018-0020-0001-000000000001',NULL,'DOM-OS','Domain: Operating System STIGs','Configuration requirements for Windows, Linux/Unix, macOS, and other operating systems used in DoD environments.',NULL,'mandatory','STIG Domains',NULL,40,'2026-05-08 04:40:42'),('12013ee5-4a98-11f1-8bc3-00155d012902','e5f6a7b8-0018-0020-0001-000000000001',NULL,'DOM-NET','Domain: Network Device STIGs','Configuration requirements for routers, switches, firewalls, and other network infrastructure components.',NULL,'mandatory','STIG Domains',NULL,50,'2026-05-08 04:40:42'),('1201406a-4a98-11f1-8bc3-00155d012902','e5f6a7b8-0018-0020-0001-000000000001',NULL,'DOM-APP','Domain: Application STIGs','Configuration requirements for enterprise applications, cloud services, and general-purpose application software.',NULL,'mandatory','STIG Domains',NULL,60,'2026-05-08 04:40:42'),('120141f3-4a98-11f1-8bc3-00155d012902','e5f6a7b8-0018-0020-0001-000000000001',NULL,'DOM-DB','Domain: Database STIGs','Configuration requirements for relational databases including Oracle, MS SQL Server, PostgreSQL, and other DBMS platforms.',NULL,'mandatory','STIG Domains',NULL,70,'2026-05-08 04:40:42'),('1201439c-4a98-11f1-8bc3-00155d012902','e5f6a7b8-0018-0020-0001-000000000001',NULL,'DOM-WEB','Domain: Web Server STIGs','Configuration requirements for web servers, web application firewalls, and web-based application hosting platforms.',NULL,'mandatory','STIG Domains',NULL,80,'2026-05-08 04:40:42'),('12084a13-4a98-11f1-8bc3-00155d012902','e5f6a7b8-0018-0021-0001-000000000001',NULL,'IL2','Impact Level 2 (IL2)','Non-CUI public data with no individual, organizational, or national security concerns; equivalent to FedRAMP Low.',NULL,'mandatory','DoD Impact Levels',NULL,10,'2026-05-08 04:40:42'),('12084ee2-4a98-11f1-8bc3-00155d012902','e5f6a7b8-0018-0021-0001-000000000001',NULL,'IL4','Impact Level 4 (IL4)','Controlled Unclassified Information (CUI); equivalent to FedRAMP Moderate with additional DoD-specific controls.',NULL,'mandatory','DoD Impact Levels',NULL,20,'2026-05-08 04:40:42'),('120850c7-4a98-11f1-8bc3-00155d012902','e5f6a7b8-0018-0021-0001-000000000001',NULL,'IL5','Impact Level 5 (IL5)','CUI requiring higher protection levels and National Security Systems (NSS) in unclassified form; stricter access and boundary controls.',NULL,'mandatory','DoD Impact Levels',NULL,30,'2026-05-08 04:40:42'),('12085275-4a98-11f1-8bc3-00155d012902','e5f6a7b8-0018-0021-0001-000000000001',NULL,'IL6','Impact Level 6 (IL6)','Classified information up to SECRET; requires cloud environments specifically authorized for classified processing.',NULL,'mandatory','DoD Impact Levels',NULL,40,'2026-05-08 04:40:42'),('1211536b-4a98-11f1-8bc3-00155d012902','e5f6a7b8-0018-0022-0001-000000000001',NULL,'TIC-TRAD','Traditional TIC Use Case','Agencies routing traffic through TIC access points for traditional on-premises network environments with centralized security capabilities.',NULL,'mandatory','TIC 3.0 Use Cases',NULL,10,'2026-05-08 04:40:42'),('12115910-4a98-11f1-8bc3-00155d012902','e5f6a7b8-0018-0022-0001-000000000001',NULL,'TIC-REM','Remote User Use Case','Security capabilities required when agency users access resources from remote locations outside agency-controlled facilities.',NULL,'mandatory','TIC 3.0 Use Cases',NULL,20,'2026-05-08 04:40:42'),('12115afc-4a98-11f1-8bc3-00155d012902','e5f6a7b8-0018-0022-0001-000000000001',NULL,'TIC-CLOUD','Cloud Use Case','Security capabilities for agencies using cloud services, including SaaS, PaaS, and IaaS, with appropriate telemetry and security controls.',NULL,'mandatory','TIC 3.0 Use Cases',NULL,30,'2026-05-08 04:40:42'),('12115db3-4a98-11f1-8bc3-00155d012902','e5f6a7b8-0018-0022-0001-000000000001',NULL,'TIC-CAMP','Campus Branch Use Case','Security capabilities for agency branch offices and campus networks connecting to enterprise resources and the internet.',NULL,'mandatory','TIC 3.0 Use Cases',NULL,40,'2026-05-08 04:40:42'),('12115f60-4a98-11f1-8bc3-00155d012902','e5f6a7b8-0018-0022-0001-000000000001',NULL,'TIC-BYOD','BYOD Use Case','Security capabilities for Bring Your Own Device scenarios where personally owned devices access agency resources.',NULL,'recommended','TIC 3.0 Use Cases',NULL,50,'2026-05-08 04:40:42'),('1218c435-4a98-11f1-8bc3-00155d012902','e5f6a7b8-0018-0023-0001-000000000001',NULL,'GR-LISAAS','LI-SaaS Authorization','Low-impact Software as a Service authorization for cloud services with limited functionality and low risk data; streamlined assessment process.',NULL,'mandatory','GovRAMP Authorization Levels',NULL,10,'2026-05-08 04:40:42'),('1218c94d-4a98-11f1-8bc3-00155d012902','e5f6a7b8-0018-0023-0001-000000000001',NULL,'GR-LOW','Low Authorization','Authorization for cloud services processing low-impact data; based on NIST SP 800-53 Low baseline controls.',NULL,'mandatory','GovRAMP Authorization Levels',NULL,20,'2026-05-08 04:40:42'),('1218cb35-4a98-11f1-8bc3-00155d012902','e5f6a7b8-0018-0023-0001-000000000001',NULL,'GR-MOD','Moderate Authorization','Authorization for cloud services processing Controlled Unclassified Information; based on NIST SP 800-53 Moderate baseline controls.',NULL,'mandatory','GovRAMP Authorization Levels',NULL,30,'2026-05-08 04:40:42'),('12194e2c-4a98-11f1-8bc3-00155d012902','e5f6a7b8-0018-0023-0001-000000000001',NULL,'GR-HIGH','High Authorization','Authorization for cloud services processing highly sensitive state/local government data; based on NIST SP 800-53 High baseline controls.',NULL,'mandatory','GovRAMP Authorization Levels',NULL,40,'2026-05-08 04:40:42'),('1221857b-4a98-11f1-8bc3-00155d012902','e5f6a7b8-0018-0024-0001-000000000001',NULL,'IRAP-PROT','Protected Classification Tier','Assessment of systems processing information up to and including the PROTECTED classification level against Australian Government ISM controls.',NULL,'mandatory','IRAP Assessment Tiers',NULL,10,'2026-05-08 04:40:42'),('12218a91-4a98-11f1-8bc3-00155d012902','e5f6a7b8-0018-0024-0001-000000000001',NULL,'IRAP-SEC','Secret Classification Tier','Assessment of systems processing SECRET classified information against enhanced ISM controls and additional ASD requirements.',NULL,'mandatory','IRAP Assessment Tiers',NULL,20,'2026-05-08 04:40:42'),('12218ccb-4a98-11f1-8bc3-00155d012902','e5f6a7b8-0018-0024-0001-000000000001',NULL,'IRAP-TS','Top Secret Classification Tier','Assessment of systems processing TOP SECRET classified information; requires ASD direct involvement and the highest level of security controls.',NULL,'mandatory','IRAP Assessment Tiers',NULL,30,'2026-05-08 04:40:42'),('12218ed5-4a98-11f1-8bc3-00155d012902','e5f6a7b8-0018-0024-0001-000000000001',NULL,'IRAP-PHASE','Assessment Process Phases','IRAP assessments follow defined phases: scoping, documentation review, technical testing, report preparation, and ASD endorsement.',NULL,'mandatory','IRAP Assessment Tiers',NULL,40,'2026-05-08 04:40:42'),('122e9e11-4a98-11f1-8bc3-00155d012902','e5f6a7b8-0018-0025-0001-000000000001',NULL,'ENS-CON','Dimension: Confidentiality','Requirements ensuring that information is accessible only to authorized persons and preventing unauthorized disclosure.',NULL,'mandatory','ENS Dimensions',NULL,10,'2026-05-08 04:40:42'),('122ea379-4a98-11f1-8bc3-00155d012902','e5f6a7b8-0018-0025-0001-000000000001',NULL,'ENS-INT','Dimension: Integrity','Requirements ensuring that information and systems are not altered or destroyed in an unauthorized manner.',NULL,'mandatory','ENS Dimensions',NULL,20,'2026-05-08 04:40:42'),('122ea52e-4a98-11f1-8bc3-00155d012902','e5f6a7b8-0018-0025-0001-000000000001',NULL,'ENS-AVA','Dimension: Availability','Requirements ensuring that information and systems are accessible and usable on demand by authorized users.',NULL,'mandatory','ENS Dimensions',NULL,30,'2026-05-08 04:40:42'),('122ea6b3-4a98-11f1-8bc3-00155d012902','e5f6a7b8-0018-0025-0001-000000000001',NULL,'ENS-AUT','Dimension: Authenticity','Requirements for verifying the identity of users, processes, and systems to prevent impersonation.',NULL,'mandatory','ENS Dimensions',NULL,40,'2026-05-08 04:40:42'),('122ea81f-4a98-11f1-8bc3-00155d012902','e5f6a7b8-0018-0025-0001-000000000001',NULL,'ENS-TRA','Dimension: Traceability','Requirements ensuring that actions of entities can be traced back to those entities to support accountability and forensic investigation.',NULL,'mandatory','ENS Dimensions',NULL,50,'2026-05-08 04:40:42'),('122ea99d-4a98-11f1-8bc3-00155d012902','e5f6a7b8-0018-0025-0001-000000000001',NULL,'ENS-BAS','Security Level: Basic','Baseline security level for systems where breach would cause limited damage; applies fundamental organizational and technical security measures.',NULL,'mandatory','ENS Security Levels',NULL,60,'2026-05-08 04:40:42'),('122eab14-4a98-11f1-8bc3-00155d012902','e5f6a7b8-0018-0025-0001-000000000001',NULL,'ENS-MED','Security Level: Medium','Intermediate security level for systems where breach would cause significant damage; requires additional technical controls and formal risk management.',NULL,'mandatory','ENS Security Levels',NULL,70,'2026-05-08 04:40:42'),('122eac7d-4a98-11f1-8bc3-00155d012902','e5f6a7b8-0018-0025-0001-000000000001',NULL,'ENS-HIG','Security Level: High','Highest security level for systems where breach would cause very serious or catastrophic damage; requires comprehensive security measures and formal certification.',NULL,'mandatory','ENS Security Levels',NULL,80,'2026-05-08 04:40:42'),('124295b5-8001-433b-84ae-544e915c6a78','a2a4e62d-4113-11f1-8bc3-00155d012902','4117244c-a7d4-4faf-a1cb-1a2cacf4d760','CC7.3','Incident response','The entity evaluates security events to determine whether they could or have resulted in a failure of the entity.',NULL,'mandatory',NULL,NULL,2,'2026-04-26 02:00:01'),('125438cc-2b59-4663-9189-c7e2ac4abc07','a271e304-4113-11f1-8bc3-00155d012902',NULL,'7','IT Project Management',NULL,NULL,'mandatory','Change Management',NULL,4,'2026-04-26 02:00:01'),('1340bbe7-5e9f-4a76-be48-ee5bb358d857','a27eef01-4113-11f1-8bc3-00155d012902','aeb68f9b-1470-4a0d-b475-d07416b4629c','RC.RP','Incident Recovery Plan Execution','Restoration activities are performed to ensure operational availability of systems and services affected by cybersecurity incidents.',NULL,'mandatory',NULL,NULL,0,'2026-04-26 02:00:01'),('151a76c6-41e7-4938-8883-30fa75322713','a23072ef-4113-11f1-8bc3-00155d012902',NULL,'1798.115','Right to know about personal information sold or disclosed',NULL,NULL,'mandatory','Consumer Rights',NULL,3,'2026-04-26 02:00:00'),('161b422d-ab87-4ef8-89e7-0b1deb7bf4da','a25c0c03-4113-11f1-8bc3-00155d012902','215be14c-3698-4fce-a463-7aab14e4f886','4.1','Understanding the organization and its context','Determine external and internal issues relevant to the purpose of the organization and that affect its ability to achieve the intended outcomes of its ISMS.','Consider PEST analysis, SWOT analysis, regulatory landscape.','mandatory',NULL,NULL,0,'2026-04-26 02:00:00'),('16c485ec-bd2a-4996-b6b2-86a6ce224819','a28c08f1-4113-11f1-8bc3-00155d012902',NULL,'12','Support Information Security with Organizational Policies and Programs',NULL,NULL,'mandatory','Governance',NULL,11,'2026-04-26 02:00:01'),('1709c222-cd93-4cda-95cb-61f0704fcf17','a28c08f1-4113-11f1-8bc3-00155d012902','f29f6a69-1b83-468a-99ca-41ddfff15d47','3.5','Primary account number (PAN) is secured wherever it is stored',NULL,NULL,'mandatory',NULL,NULL,4,'2026-04-26 02:00:01'),('17c1352d-1f53-421b-a919-d39422a1c0e5','a29cdc11-4113-11f1-8bc3-00155d012902','5aebac90-5ffb-42fa-b19e-8a6c8d5b1198','S19.5','Contract performance','Processing necessary for performance of a contract to which data subject is party.',NULL,'mandatory',NULL,NULL,1,'2026-04-26 02:00:01'),('18deac71-b59f-44ac-ae96-cc9aa4a0cfb6','a27eef01-4113-11f1-8bc3-00155d012902','69d65d36-46ec-431d-9f7e-3eac15afb93d','GV.SC','Cybersecurity Supply Chain Risk Management','Cyber supply chain risk management processes are identified, established, managed, monitored, and improved.',NULL,'mandatory',NULL,NULL,5,'2026-04-26 02:00:01'),('1b09e936-41f7-4221-91aa-bc5a6048b29e','a23072ef-4113-11f1-8bc3-00155d012902','09316565-9b2d-4644-8737-b13fa45b3cdc','1798.110(a)(3)','Business purpose for collection','Disclose the business or commercial purpose for collecting or selling personal information.',NULL,'mandatory',NULL,NULL,2,'2026-04-26 02:00:00'),('1b36a3ef-7271-4841-b538-a092bd5899a0','a2a4e62d-4113-11f1-8bc3-00155d012902','4117244c-a7d4-4faf-a1cb-1a2cacf4d760','CC7.2','Anomaly detection','The entity monitors system components and the operation of those components for anomalies.',NULL,'mandatory',NULL,NULL,1,'2026-04-26 02:00:01'),('1b8ecdc6-5d7e-46a9-82e2-86f1ac0b47b5','a271e304-4113-11f1-8bc3-00155d012902','57005d4f-844e-4b48-bdab-6a8d38faee31','3.2','Senior management responsibilities','Senior management is responsible for developing and implementing technology risk management framework.',NULL,'mandatory',NULL,NULL,1,'2026-04-26 02:00:01'),('1cfd34b0-1798-4ad6-b225-c815f2051dfb','a28c08f1-4113-11f1-8bc3-00155d012902','d1a72624-0ba6-4227-a659-c41bd9d8577d','6.4','Public-facing web applications are protected against attacks',NULL,NULL,'mandatory',NULL,NULL,2,'2026-04-26 02:00:01'),('1e9d557f-072c-4260-8be1-bbfcfc06f18a','a29cdc11-4113-11f1-8bc3-00155d012902','dde99a31-7141-4f43-96a5-e46655833a3f','S40.1','Appropriate technical and organisational measures','Implement appropriate technical and organisational measures to prevent unauthorized or unlawful processing, accidental loss, destruction or damage.',NULL,'mandatory',NULL,NULL,0,'2026-04-26 02:00:01'),('1eb59dc3-9881-4ffb-b385-3a2d3f63dd9e','a25c0c03-4113-11f1-8bc3-00155d012902','8d8d7b39-e895-412e-9408-3d9f68885819','8.2','Information security risk assessment','Perform information security risk assessments at planned intervals.',NULL,'mandatory',NULL,NULL,1,'2026-04-26 02:00:01'),('1ee9bf01-228e-4156-a57c-c6735d27fde2','a27eef01-4113-11f1-8bc3-00155d012902','5e916319-60b9-433a-a62a-797dab76c0cf','PR.IR','Technology Infrastructure Resilience','Security architectures are managed with the organization\'s risk strategy to protect asset confidentiality, integrity, and availability.',NULL,'mandatory',NULL,NULL,4,'2026-04-26 02:00:01'),('1f34e552-f5a0-4c1f-8d55-52531184112f','d4e5f6a1-b2c3-4d4e-8f6a-1b2c3d4e5f6a','415a8bdc-329f-4be1-9611-27b241e3cbdf','164.406(b)','Media Notification','Notify prominent media outlets following discovery of breach affecting more than 500 residents of a state.',NULL,'mandatory',NULL,NULL,1,'2026-04-26 02:00:00'),('1fb52c19-9abf-43a9-b276-892f2293e787','a271e304-4113-11f1-8bc3-00155d012902','57005d4f-844e-4b48-bdab-6a8d38faee31','3.3','Chief Information Officer responsibilities','The CIO is responsible for the overall management of technology functions and risks.',NULL,'mandatory',NULL,NULL,2,'2026-04-26 02:00:01'),('1fe89787-2a24-4056-903e-3bf04bccea18','a25c0c03-4113-11f1-8bc3-00155d012902','e925195e-a5f8-4a84-8823-6df95025e13c','A.5.1','Policies for information security','Information security policy and topic-specific policies shall be defined, approved, published, communicated, acknowledged.',NULL,'mandatory',NULL,NULL,0,'2026-04-26 02:00:01'),('20bc38f1-becd-42c1-a693-7ec5a9a5c05f','a28c08f1-4113-11f1-8bc3-00155d012902','93c9b683-2438-437b-8bc5-6db8a529ed85','8.3','User authentication for users and administrators is established and managed',NULL,NULL,'mandatory',NULL,NULL,1,'2026-04-26 02:00:01'),('20ddad14-19a0-415a-9a29-14938e68b3f6','a28c08f1-4113-11f1-8bc3-00155d012902','d1a72624-0ba6-4227-a659-c41bd9d8577d','6.2','Bespoke and custom software are developed securely',NULL,NULL,'mandatory',NULL,NULL,0,'2026-04-26 02:00:01'),('215be14c-3698-4fce-a463-7aab14e4f886','a25c0c03-4113-11f1-8bc3-00155d012902',NULL,'4','Context of the Organization',NULL,NULL,'mandatory','Organizational Context',NULL,0,'2026-04-26 02:00:00'),('21aa4ac5-e2d5-4d89-9241-a28dd35d8a3c','d4e5f6a1-b2c3-4d4e-8f6a-1b2c3d4e5f6a','c3e1fe9d-9bbc-4d3c-973e-82b4b38c3900','164.310(b)','Workstation Use','Implement policies and procedures that specify the proper functions to be performed on workstations.',NULL,'mandatory',NULL,NULL,1,'2026-04-26 02:00:00'),('21be4401-992a-4309-b9c1-e9109db981de','a25c0c03-4113-11f1-8bc3-00155d012902','fc367235-0df3-4391-b94d-7ccc4c74c1dc','10.2','Nonconformity and corrective action','React to nonconformity, take corrective actions and review effectiveness.',NULL,'mandatory',NULL,NULL,1,'2026-04-26 02:00:01'),('21d24da4-be93-4e44-b677-39c504106667','161ca661-dcfc-41d6-ae04-4d515194f119','b9936327-400e-11f1-8bc3-00155d012902','Art.32.1.c','Restoration of availability','Restore the availability and access to personal data in a timely manner in the event of a physical or technical incident.',NULL,'mandatory',NULL,NULL,2,'2026-04-26 02:00:00'),('22c4b97f-77ea-402a-a2ea-6332674aba7b','a25c0c03-4113-11f1-8bc3-00155d012902','0150df3e-fae7-4486-a453-7feef34846d6','6.2','Information security objectives and planning to achieve them','Establish information security objectives at relevant functions and levels.',NULL,'mandatory',NULL,NULL,1,'2026-04-26 02:00:00'),('238572ed-4a97-11f1-8bc3-00155d012902','c3d4e5f6-0016-0001-0001-000000000001',NULL,'CE','Control Environment','The set of standards, processes, and structures that provide the basis for carrying out internal control across the organization, including integrity, ethical values, and competence.',NULL,'mandatory','COSO Components',NULL,10,'2026-05-08 04:34:02'),('2385778d-4a97-11f1-8bc3-00155d012902','c3d4e5f6-0016-0001-0001-000000000001',NULL,'RA','Risk Assessment','The process for identifying and assessing risks to the achievement of organizational objectives, including specifying objectives clearly to enable risk identification.',NULL,'mandatory','COSO Components',NULL,20,'2026-05-08 04:34:02'),('23857984-4a97-11f1-8bc3-00155d012902','c3d4e5f6-0016-0001-0001-000000000001',NULL,'CA','Control Activities','The actions established through policies and procedures that help ensure management directives to mitigate risks are carried out.',NULL,'mandatory','COSO Components',NULL,30,'2026-05-08 04:34:02'),('23857b61-4a97-11f1-8bc3-00155d012902','c3d4e5f6-0016-0001-0001-000000000001',NULL,'IC','Information and Communication','The generation and use of relevant, quality information to support the functioning of other internal control components, both internally and externally.',NULL,'mandatory','COSO Components',NULL,40,'2026-05-08 04:34:02'),('23857d44-4a97-11f1-8bc3-00155d012902','c3d4e5f6-0016-0001-0001-000000000001',NULL,'MA','Monitoring Activities','Ongoing evaluations and separate evaluations used to ascertain whether each component of internal control is present and functioning.',NULL,'mandatory','COSO Components',NULL,50,'2026-05-08 04:34:02'),('2393174a-4a97-11f1-8bc3-00155d012902','c3d4e5f6-0016-0002-0001-000000000001',NULL,'GC','Governance and Culture','Board oversight, operating structures, ethical culture, and commitment to core values establish the tone for ERM and provide oversight of the risk management function.',NULL,'mandatory','ERM Components',NULL,10,'2026-05-08 04:34:02'),('23931c3b-4a97-11f1-8bc3-00155d012902','c3d4e5f6-0016-0002-0001-000000000001',NULL,'SS','Strategy and Objective-Setting','ERM is integrated with strategy and objective setting, including analysis of business context, risk appetite definition, and alignment of objectives with risk appetite.',NULL,'mandatory','ERM Components',NULL,20,'2026-05-08 04:34:02'),('239358ce-4a97-11f1-8bc3-00155d012902','c3d4e5f6-0016-0002-0001-000000000001',NULL,'PE','Performance','Risks are identified and assessed for impact on strategy and business objectives, prioritized by severity, and risk responses are selected and implemented.',NULL,'mandatory','ERM Components',NULL,30,'2026-05-08 04:34:02'),('23935aba-4a97-11f1-8bc3-00155d012902','c3d4e5f6-0016-0002-0001-000000000001',NULL,'RR','Review and Revision','Performance is reviewed to determine how well ERM is functioning; revisions are made based on changes in business context and risk exposure.',NULL,'mandatory','ERM Components',NULL,40,'2026-05-08 04:34:02'),('23935c5a-4a97-11f1-8bc3-00155d012902','c3d4e5f6-0016-0002-0001-000000000001',NULL,'ICR','Information, Communication, and Reporting','ERM information is leveraged from various sources; risk information is communicated to all levels of the organization to support decision-making.',NULL,'mandatory','ERM Components',NULL,50,'2026-05-08 04:34:02'),('239f466b-4a97-11f1-8bc3-00155d012902','c3d4e5f6-0016-0003-0001-000000000001',NULL,'EDM','EDM — Evaluate, Direct and Monitor','Governance domain covering stakeholder needs evaluation, setting direction for IT resources, and monitoring IT performance and compliance (5 processes: EDM01–EDM05).',NULL,'mandatory','COBIT Domains',NULL,10,'2026-05-08 04:34:02'),('239f4b33-4a97-11f1-8bc3-00155d012902','c3d4e5f6-0016-0003-0001-000000000001',NULL,'APO','APO — Align, Plan and Organise','Management domain covering strategy alignment, enterprise architecture, risk management, resource management, and stakeholder management (13 processes: APO01–APO13).',NULL,'mandatory','COBIT Domains',NULL,20,'2026-05-08 04:34:02'),('239f4dbb-4a97-11f1-8bc3-00155d012902','c3d4e5f6-0016-0003-0001-000000000001',NULL,'BAI','BAI — Build, Acquire and Implement','Management domain covering solutions delivery, change management, asset management, and knowledge management (10 processes: BAI01–BAI10).',NULL,'mandatory','COBIT Domains',NULL,30,'2026-05-08 04:34:02'),('239f4f89-4a97-11f1-8bc3-00155d012902','c3d4e5f6-0016-0003-0001-000000000001',NULL,'DSS','DSS — Deliver, Service and Support','Management domain covering service delivery, incident and problem management, business process controls, and security services (6 processes: DSS01–DSS06).',NULL,'mandatory','COBIT Domains',NULL,40,'2026-05-08 04:34:02'),('239f512f-4a97-11f1-8bc3-00155d012902','c3d4e5f6-0016-0003-0001-000000000001',NULL,'MEA','MEA — Monitor, Evaluate and Assess','Management domain covering performance and conformance monitoring, system of internal controls, and compliance with external requirements (3 processes: MEA01–MEA03).',NULL,'mandatory','COBIT Domains',NULL,50,'2026-05-08 04:34:02'),('23afeb4e-4a97-11f1-8bc3-00155d012902','c3d4e5f6-0016-0004-0001-000000000001',NULL,'FAIR-R','Risk','The probable frequency and probable magnitude of future loss, quantified in financial terms using the FAIR ontology and analytical methodology.',NULL,'mandatory','FAIR Ontology',NULL,10,'2026-05-08 04:34:02'),('23aff056-4a97-11f1-8bc3-00155d012902','c3d4e5f6-0016-0004-0001-000000000001',NULL,'FAIR-T','Threat','Anything (e.g., an adversary, nature, or internal failure) that can act against an asset in a way that could result in harm.',NULL,'mandatory','FAIR Ontology',NULL,20,'2026-05-08 04:34:02'),('23aff23a-4a97-11f1-8bc3-00155d012902','c3d4e5f6-0016-0004-0001-000000000001',NULL,'FAIR-V','Vulnerability','The probability that an asset will be unable to resist the actions of a threat agent, expressed as the ratio of threat capability to resistance strength.',NULL,'mandatory','FAIR Ontology',NULL,30,'2026-05-08 04:34:02'),('23aff3e8-4a97-11f1-8bc3-00155d012902','c3d4e5f6-0016-0004-0001-000000000001',NULL,'FAIR-L','Loss','The undesirable consequences of a threat event, quantified across six loss forms: productivity, response, replacement, competitive advantage, fines/judgments, and reputation.',NULL,'mandatory','FAIR Ontology',NULL,40,'2026-05-08 04:34:02'),('23aff587-4a97-11f1-8bc3-00155d012902','c3d4e5f6-0016-0004-0001-000000000001',NULL,'FAIR-LEF','Loss Event Frequency (LEF)','The probable frequency within a given time frame that a threat agent will inflict harm upon an asset, combining contact frequency and probability of action.',NULL,'mandatory','FAIR Ontology',NULL,50,'2026-05-08 04:34:02'),('23aff719-4a97-11f1-8bc3-00155d012902','c3d4e5f6-0016-0004-0001-000000000001',NULL,'FAIR-SLEF','Secondary Loss Event Frequency (SLEF)','The probable frequency that secondary stakeholders will react to a primary loss event in a way that results in additional loss to the organization.',NULL,'mandatory','FAIR Ontology',NULL,60,'2026-05-08 04:34:02'),('23aff8b6-4a97-11f1-8bc3-00155d012902','c3d4e5f6-0016-0004-0001-000000000001',NULL,'FAIR-TC','Threat Capability (TCap)','The probable level of force that a threat agent is capable of applying against an asset, measured relative to the strength of the asset\'s resistance.',NULL,'mandatory','FAIR Ontology',NULL,70,'2026-05-08 04:34:02'),('23affa4b-4a97-11f1-8bc3-00155d012902','c3d4e5f6-0016-0004-0001-000000000001',NULL,'FAIR-TR','Threat Resistance (TR)','The strength of a control relative to a baseline level of force; expressed as the difficulty a threat agent faces in successfully acting against an asset.',NULL,'mandatory','FAIR Ontology',NULL,80,'2026-05-08 04:34:02'),('23affbd5-4a97-11f1-8bc3-00155d012902','c3d4e5f6-0016-0004-0001-000000000001',NULL,'FAIR-C','Controls','The safeguards or countermeasures that affect the frequency or magnitude of loss, categorized as preventive or responsive controls.',NULL,'mandatory','FAIR Ontology',NULL,90,'2026-05-08 04:34:02'),('23b7fe62-4a97-11f1-8bc3-00155d012902','c3d4e5f6-0016-0005-0001-000000000001',NULL,'OCT-1','Phase 1: Build Asset-Based Threat Profiles','Identify critical assets, define security requirements for each critical asset, and identify threats to each critical asset from all threat sources.',NULL,'mandatory','OCTAVE Phases',NULL,10,'2026-05-08 04:34:02'),('23b803b5-4a97-11f1-8bc3-00155d012902','c3d4e5f6-0016-0005-0001-000000000001',NULL,'OCT-2','Phase 2: Identify Infrastructure Vulnerabilities','Identify key network components and systems, evaluate selected components for vulnerabilities and weaknesses that expose critical assets to threats.',NULL,'mandatory','OCTAVE Phases',NULL,20,'2026-05-08 04:34:02'),('23b80597-4a97-11f1-8bc3-00155d012902','c3d4e5f6-0016-0005-0001-000000000001',NULL,'OCT-3','Phase 3: Develop Security Strategy and Plans','Evaluate risks to critical assets, define protection strategy and risk mitigation plans, and develop an action plan for security improvements.',NULL,'mandatory','OCTAVE Phases',NULL,30,'2026-05-08 04:34:02'),('23c31f5e-4a97-11f1-8bc3-00155d012902','c3d4e5f6-0016-0006-0001-000000000001',NULL,'SABSA-1','Contextual (Business) Layer','Defines business context for security: assets, motivations, processes, locations, time, and people from the perspective of the business owner.',NULL,'mandatory','SABSA Layers',NULL,10,'2026-05-08 04:34:02'),('23c325d0-4a97-11f1-8bc3-00155d012902','c3d4e5f6-0016-0006-0001-000000000001',NULL,'SABSA-2','Conceptual (Architect) Layer','Translates business requirements into conceptual security policies: risk model, trust model, security domains, and security services.',NULL,'mandatory','SABSA Layers',NULL,20,'2026-05-08 04:34:02'),('23c327be-4a97-11f1-8bc3-00155d012902','c3d4e5f6-0016-0006-0001-000000000001',NULL,'SABSA-3','Logical (Designer) Layer','Defines logical security services, entity schema, security policies, and the information security model with process flows and rules.',NULL,'mandatory','SABSA Layers',NULL,30,'2026-05-08 04:34:02'),('23c32970-4a97-11f1-8bc3-00155d012902','c3d4e5f6-0016-0006-0001-000000000001',NULL,'SABSA-4','Physical (Builder) Layer','Specifies the physical mechanisms, platforms, and standards to implement logical security services, including specific technologies and protocols.',NULL,'mandatory','SABSA Layers',NULL,40,'2026-05-08 04:34:02'),('23c32b0b-4a97-11f1-8bc3-00155d012902','c3d4e5f6-0016-0006-0001-000000000001',NULL,'SABSA-5','Component (Tradesman) Layer','Defines specific products, tools, and component configurations that instantiate the physical security architecture in the operational environment.',NULL,'mandatory','SABSA Layers',NULL,50,'2026-05-08 04:34:02'),('23c32c9b-4a97-11f1-8bc3-00155d012902','c3d4e5f6-0016-0006-0001-000000000001',NULL,'SABSA-6','Operational (Facilities Manager) Layer','Addresses ongoing operational support, service management, and assurance activities needed to maintain the security architecture in production.',NULL,'mandatory','SABSA Layers',NULL,60,'2026-05-08 04:34:02'),('23ce6333-4a97-11f1-8bc3-00155d012902','c3d4e5f6-0016-0007-0001-000000000001',NULL,'TOGAF-A','Security Architecture Vision (Phase A)','Define the security scope and vision, identify security stakeholders, develop security architecture principles, and align with enterprise architecture vision.',NULL,'mandatory','TOGAF Security Phases',NULL,10,'2026-05-08 04:34:02'),('23ce6965-4a97-11f1-8bc3-00155d012902','c3d4e5f6-0016-0007-0001-000000000001',NULL,'TOGAF-B','Business Security Architecture (Phase B)','Define business security requirements, governance structures, compliance requirements, and business process security controls.',NULL,'mandatory','TOGAF Security Phases',NULL,20,'2026-05-08 04:34:02'),('23ce6b4c-4a97-11f1-8bc3-00155d012902','c3d4e5f6-0016-0007-0001-000000000001',NULL,'TOGAF-C','Information Security Architecture (Phase C)','Define data classification, information lifecycle security controls, privacy requirements, and data sovereignty considerations.',NULL,'mandatory','TOGAF Security Phases',NULL,30,'2026-05-08 04:34:02'),('23ce6d2b-4a97-11f1-8bc3-00155d012902','c3d4e5f6-0016-0007-0001-000000000001',NULL,'TOGAF-D','Application Security Architecture (Phase D)','Define application security patterns, secure SDLC requirements, API security, and authentication and authorization frameworks for applications.',NULL,'mandatory','TOGAF Security Phases',NULL,40,'2026-05-08 04:34:02'),('23ce6ec9-4a97-11f1-8bc3-00155d012902','c3d4e5f6-0016-0007-0001-000000000001',NULL,'TOGAF-E','Technology Security Architecture (Phase E)','Define technology security controls, infrastructure hardening standards, network security architecture, and cryptographic standards.',NULL,'mandatory','TOGAF Security Phases',NULL,50,'2026-05-08 04:34:02'),('23d8cb8b-4a97-11f1-8bc3-00155d012902','c3d4e5f6-0016-0008-0001-000000000001',NULL,'SVC-EN','Engage','Provide understanding of stakeholder needs, transparency, and continual engagement with all stakeholders to ensure co-creation of value.',NULL,'mandatory','Service Value Chain',NULL,10,'2026-05-08 04:34:02'),('23d8d287-4a97-11f1-8bc3-00155d012902','c3d4e5f6-0016-0008-0001-000000000001',NULL,'SVC-PL','Plan','Ensure a shared understanding of the vision, status, and improvement direction across the organization and its ecosystem.',NULL,'mandatory','Service Value Chain',NULL,20,'2026-05-08 04:34:02'),('23d8d492-4a97-11f1-8bc3-00155d012902','c3d4e5f6-0016-0008-0001-000000000001',NULL,'SVC-IM','Improve','Ensure continual improvement of products, services, and practices across all value chain activities and the four dimensions of service management.',NULL,'mandatory','Service Value Chain',NULL,30,'2026-05-08 04:34:02'),('23d8d691-4a97-11f1-8bc3-00155d012902','c3d4e5f6-0016-0008-0001-000000000001',NULL,'SVC-DT','Design and Transition','Ensure that products and services continually meet stakeholder expectations for quality, costs, and time-to-market.',NULL,'mandatory','Service Value Chain',NULL,40,'2026-05-08 04:34:02'),('23d8d878-4a97-11f1-8bc3-00155d012902','c3d4e5f6-0016-0008-0001-000000000001',NULL,'SVC-OB','Obtain/Build','Ensure that service components are available when and where they are needed and that they meet agreed specifications.',NULL,'mandatory','Service Value Chain',NULL,50,'2026-05-08 04:34:02'),('23d8da46-4a97-11f1-8bc3-00155d012902','c3d4e5f6-0016-0008-0001-000000000001',NULL,'SVC-DS','Deliver and Support','Ensure that services are delivered and supported according to agreed specifications and stakeholders\' expectations.',NULL,'mandatory','Service Value Chain',NULL,60,'2026-05-08 04:34:02'),('23e50eb7-4a97-11f1-8bc3-00155d012902','c3d4e5f6-0016-0009-0001-000000000001',NULL,'SM','Security Management','Covers information security strategy, governance, risk management, legal and regulatory compliance, and security organization.',NULL,'mandatory','SoGP Areas',NULL,10,'2026-05-08 04:34:02'),('23e513eb-4a97-11f1-8bc3-00155d012902','c3d4e5f6-0016-0009-0001-000000000001',NULL,'CBA','Critical Business Applications','Covers application security controls for critical business applications including access control, data validation, and application-specific risk management.',NULL,'mandatory','SoGP Areas',NULL,20,'2026-05-08 04:34:02'),('23e515c3-4a97-11f1-8bc3-00155d012902','c3d4e5f6-0016-0009-0001-000000000001',NULL,'CI','Computer Installations','Covers physical and environmental security, system administration, operations management, and server security for computer installations.',NULL,'mandatory','SoGP Areas',NULL,30,'2026-05-08 04:34:02'),('23e5176d-4a97-11f1-8bc3-00155d012902','c3d4e5f6-0016-0009-0001-000000000001',NULL,'NW','Networks','Covers network management, network security controls, remote access, wireless networking, and management of network infrastructure.',NULL,'mandatory','SoGP Areas',NULL,40,'2026-05-08 04:34:02'),('23e51909-4a97-11f1-8bc3-00155d012902','c3d4e5f6-0016-0009-0001-000000000001',NULL,'EU','End-User Environments','Covers security of end-user devices, mobile computing, teleworking, and user responsibilities for protecting information in distributed environments.',NULL,'mandatory','SoGP Areas',NULL,50,'2026-05-08 04:34:02'),('23ef9d76-4a97-11f1-8bc3-00155d012902','c3d4e5f6-0016-0010-0001-000000000001',NULL,'SOC1-1','Service Auditor\'s Report','Independent auditor\'s report containing the scope, opinion (Type I or Type II), and any qualifications or emphasis-of-matter paragraphs.',NULL,'mandatory','SOC 1 Sections',NULL,10,'2026-05-08 04:34:02'),('23efa45a-4a97-11f1-8bc3-00155d012902','c3d4e5f6-0016-0010-0001-000000000001',NULL,'SOC1-2','Management\'s Assertion','Management\'s written assertion that the system description is fairly presented and that controls are suitably designed and operating effectively.',NULL,'mandatory','SOC 1 Sections',NULL,20,'2026-05-08 04:34:02'),('23efa62d-4a97-11f1-8bc3-00155d012902','c3d4e5f6-0016-0010-0001-000000000001',NULL,'SOC1-3','System Description','Description of the service organization\'s system boundaries, infrastructure, software, processes, data, and people relevant to ICFR.',NULL,'mandatory','SOC 1 Sections',NULL,30,'2026-05-08 04:34:02'),('23efa7eb-4a97-11f1-8bc3-00155d012902','c3d4e5f6-0016-0010-0001-000000000001',NULL,'SOC1-4','Control Objectives and Controls','Statement of control objectives and the controls designed to achieve those objectives, with test procedures and results for Type II reports.',NULL,'mandatory','SOC 1 Sections',NULL,40,'2026-05-08 04:34:02'),('23f79c84-4a97-11f1-8bc3-00155d012902','c3d4e5f6-0016-0011-0001-000000000001',NULL,'SOC3-1','Management\'s Report','Management\'s assertion that controls were effective throughout the period and that the system met the applicable Trust Services Criteria.',NULL,'mandatory','SOC 3 Sections',NULL,10,'2026-05-08 04:34:02'),('23f7a1c1-4a97-11f1-8bc3-00155d012902','c3d4e5f6-0016-0011-0001-000000000001',NULL,'SOC3-2','Auditor\'s Report','Independent CPA\'s opinion on whether the service organization maintained effective controls over the examination period.',NULL,'mandatory','SOC 3 Sections',NULL,20,'2026-05-08 04:34:02'),('23f7a385-4a97-11f1-8bc3-00155d012902','c3d4e5f6-0016-0011-0001-000000000001',NULL,'SOC3-3','System Description','General description of the system, principal service commitments, and the nature of the services provided (less detail than SOC 2).',NULL,'mandatory','SOC 3 Sections',NULL,30,'2026-05-08 04:34:02'),('2405c1e5-4a97-11f1-8bc3-00155d012902','c3d4e5f6-0016-0012-0001-000000000001',NULL,'ATC-105','AT-C Section 105: Concepts Common to All Attestation Engagements','Defines overarching concepts for attestation engagements including the practitioner\'s responsibilities, subject matter, suitable criteria, and materiality.',NULL,'mandatory','SSAE 18 Sections',NULL,10,'2026-05-08 04:34:03'),('2405fb00-4a97-11f1-8bc3-00155d012902','c3d4e5f6-0016-0012-0001-000000000001',NULL,'ATC-205','AT-C Section 205: Examination Engagements','Provides requirements for examination engagements where the practitioner obtains sufficient evidence to express an opinion on subject matter.',NULL,'mandatory','SSAE 18 Sections',NULL,20,'2026-05-08 04:34:03'),('2405fcf4-4a97-11f1-8bc3-00155d012902','c3d4e5f6-0016-0012-0001-000000000001',NULL,'ATC-305','AT-C Section 305: Prospective Financial Information','Provides requirements for attestation engagements on prospective financial information such as financial forecasts and projections.',NULL,'mandatory','SSAE 18 Sections',NULL,30,'2026-05-08 04:34:03'),('2405fea6-4a97-11f1-8bc3-00155d012902','c3d4e5f6-0016-0012-0001-000000000001',NULL,'ATC-315','AT-C Section 315: Compliance Attestation','Provides requirements for agreed-upon procedures engagements and examinations on an entity\'s compliance with specified requirements.',NULL,'mandatory','SSAE 18 Sections',NULL,40,'2026-05-08 04:34:03'),('2406004b-4a97-11f1-8bc3-00155d012902','c3d4e5f6-0016-0012-0001-000000000001',NULL,'ATC-320','AT-C Section 320: Reporting on an Examination of Controls at a Service Organization (SOC 1)','Provides requirements specific to SOC 1 examinations on controls at a service organization relevant to user entities\' ICFR.',NULL,'mandatory','SSAE 18 Sections',NULL,50,'2026-05-08 04:34:03'),('240e43b9-4a97-11f1-8bc3-00155d012902','c3d4e5f6-0016-0013-0001-000000000001',NULL,'ISAE3-OBJ','Objective and Scope','Defines the objective of assurance engagements — to obtain sufficient appropriate evidence to express a conclusion about subject matter against suitable criteria.',NULL,'mandatory','ISAE 3000 Sections',NULL,10,'2026-05-08 04:34:03'),('240e48a0-4a97-11f1-8bc3-00155d012902','c3d4e5f6-0016-0013-0001-000000000001',NULL,'ISAE3-REQ','Requirements','Core requirements for assurance engagements including acceptance, planning, evidence gathering, using the work of others, and forming conclusions.',NULL,'mandatory','ISAE 3000 Sections',NULL,20,'2026-05-08 04:34:03'),('240e4a7e-4a97-11f1-8bc3-00155d012902','c3d4e5f6-0016-0013-0001-000000000001',NULL,'ISAE3-APP','Application and Explanatory Guidance','Guidance on applying requirements including materiality, sampling, evaluating evidence, and preparing assurance reports.',NULL,'recommended','ISAE 3000 Sections',NULL,30,'2026-05-08 04:34:03'),('24179a14-4a97-11f1-8bc3-00155d012902','c3d4e5f6-0016-0014-0001-000000000001',NULL,'ISAE3402-SC','Scope and Control Objectives','Define the scope of the assurance engagement, specify control objectives and the controls designed to achieve those objectives.',NULL,'mandatory','ISAE 3402 Sections',NULL,10,'2026-05-08 04:34:03'),('24179f09-4a97-11f1-8bc3-00155d012902','c3d4e5f6-0016-0014-0001-000000000001',NULL,'ISAE3402-CO','Control Objectives and Description','Present the description of the service organization\'s system and the control objectives that have been specified by management.',NULL,'mandatory','ISAE 3402 Sections',NULL,20,'2026-05-08 04:34:03'),('2417a0e6-4a97-11f1-8bc3-00155d012902','c3d4e5f6-0016-0014-0001-000000000001',NULL,'ISAE3402-AR','Auditor\'s Report (Type I and Type II)','Independent assurance report expressing opinion on fair presentation of system description and design adequacy (Type I) or also operating effectiveness (Type II).',NULL,'mandatory','ISAE 3402 Sections',NULL,30,'2026-05-08 04:34:03'),('24233337-4a97-11f1-8bc3-00155d012902','c3d4e5f6-0016-0015-0001-000000000001',NULL,'CC','Common Criteria (CC) — Security','Controls addressing logical and physical access, change management, risk mitigation, and system operations applicable to all SOC 2 examinations.',NULL,'mandatory','Trust Services Categories',NULL,10,'2026-05-08 04:34:03'),('24233867-4a97-11f1-8bc3-00155d012902','c3d4e5f6-0016-0015-0001-000000000001',NULL,'A','Availability (A)','Controls ensuring that the system is available for operation and use as committed or agreed, including performance monitoring and incident management.',NULL,'mandatory','Trust Services Categories',NULL,20,'2026-05-08 04:34:03'),('24233a3e-4a97-11f1-8bc3-00155d012902','c3d4e5f6-0016-0015-0001-000000000001',NULL,'PI','Processing Integrity (PI)','Controls ensuring that system processing is complete, valid, accurate, timely, and authorized to meet entity objectives.',NULL,'mandatory','Trust Services Categories',NULL,30,'2026-05-08 04:34:03'),('24233be6-4a97-11f1-8bc3-00155d012902','c3d4e5f6-0016-0015-0001-000000000001',NULL,'C','Confidentiality (C)','Controls ensuring that information designated as confidential is protected as committed or agreed during collection, processing, and disposal.',NULL,'mandatory','Trust Services Categories',NULL,40,'2026-05-08 04:34:03'),('24233d7d-4a97-11f1-8bc3-00155d012902','c3d4e5f6-0016-0015-0001-000000000001',NULL,'P','Privacy (P)','Controls ensuring that personal information is collected, used, retained, disclosed, and disposed of in conformity with the entity\'s privacy notice.',NULL,'mandatory','Trust Services Categories',NULL,50,'2026-05-08 04:34:03'),('242a96e6-4a97-11f1-8bc3-00155d012902','c3d4e5f6-0016-0016-0001-000000000001',NULL,'IIA-1000','Attribute Standards (1000 Series)','Standards covering the purpose, authority, and responsibility (1000), independence and objectivity (1100), proficiency and due professional care (1200), and quality assurance (1300) of internal audit.',NULL,'mandatory','IIA Standards',NULL,10,'2026-05-08 04:34:03'),('242a9c4e-4a97-11f1-8bc3-00155d012902','c3d4e5f6-0016-0016-0001-000000000001',NULL,'IIA-2000','Performance Standards (2000 Series)','Standards covering managing internal audit activity (2000), nature of work (2100), engagement planning (2200), performing engagements (2300), communicating results (2400), and monitoring (2500/2600).',NULL,'mandatory','IIA Standards',NULL,20,'2026-05-08 04:34:03'),('2433ced7-4a97-11f1-8bc3-00155d012902','c3d4e5f6-0016-0017-0001-000000000001',NULL,'AS2201','AS 2201: Auditing Internal Control Over Financial Reporting (ICFR)','Establishes requirements for integrated audits of ICFR and financial statements, including risk-based approach to selecting controls to test.',NULL,'mandatory','PCAOB Standards',NULL,10,'2026-05-08 04:34:03'),('2433d416-4a97-11f1-8bc3-00155d012902','c3d4e5f6-0016-0017-0001-000000000001',NULL,'AS2301','AS 2301: Audit Evidence','Establishes requirements for obtaining sufficient appropriate audit evidence to support the auditor\'s opinion, including evidence evaluation procedures.',NULL,'mandatory','PCAOB Standards',NULL,20,'2026-05-08 04:34:03'),('2433d5f6-4a97-11f1-8bc3-00155d012902','c3d4e5f6-0016-0017-0001-000000000001',NULL,'AS2401','AS 2401: Consideration of Fraud in a Financial Statement Audit','Requires auditors to identify and assess risks of material misstatement due to fraud and design audit procedures responsive to those risks.',NULL,'mandatory','PCAOB Standards',NULL,30,'2026-05-08 04:34:03'),('2433d7b2-4a97-11f1-8bc3-00155d012902','c3d4e5f6-0016-0017-0001-000000000001',NULL,'AS2601','AS 2601: Consideration of a Service Auditor\'s Report','Addresses the auditor\'s consideration of a service auditor\'s report when auditing financial statements of an entity that uses a service organization.',NULL,'mandatory','PCAOB Standards',NULL,40,'2026-05-08 04:34:03'),('243e1268-4a97-11f1-8bc3-00155d012902','c3d4e5f6-0016-0018-0001-000000000001',NULL,'CE-1','Firewalls','Use firewalls to secure internet connections, ensuring all devices with an internet connection have a properly configured boundary firewall.',NULL,'mandatory','Cyber Essentials Controls',NULL,10,'2026-05-08 04:34:03'),('243e178e-4a97-11f1-8bc3-00155d012902','c3d4e5f6-0016-0018-0001-000000000001',NULL,'CE-2','Secure Configuration','Configure computers and network devices with security in mind, changing default passwords, disabling unnecessary accounts, and removing unused software.',NULL,'mandatory','Cyber Essentials Controls',NULL,20,'2026-05-08 04:34:03'),('243e1972-4a97-11f1-8bc3-00155d012902','c3d4e5f6-0016-0018-0001-000000000001',NULL,'CE-3','User Access Control','Control access to data and services through least privilege, limiting standard user accounts, and using admin accounts only when required.',NULL,'mandatory','Cyber Essentials Controls',NULL,30,'2026-05-08 04:34:03'),('243e1b3d-4a97-11f1-8bc3-00155d012902','c3d4e5f6-0016-0018-0001-000000000001',NULL,'CE-4','Malware Protection','Protect against malware using anti-malware software, application controls to prevent execution of malicious software, or both.',NULL,'mandatory','Cyber Essentials Controls',NULL,40,'2026-05-08 04:34:03'),('243e1cf6-4a97-11f1-8bc3-00155d012902','c3d4e5f6-0016-0018-0001-000000000001',NULL,'CE-5','Patch Management','Keep software up to date by applying security patches within 14 days of release and removing software no longer supported by the vendor.',NULL,'mandatory','Cyber Essentials Controls',NULL,50,'2026-05-08 04:34:03'),('244a18ad-4a97-11f1-8bc3-00155d012902','c3d4e5f6-0016-0019-0001-000000000001',NULL,'CEP-1','Firewalls (Verified)','Independent technical verification that firewall configurations are correct through vulnerability scanning and configuration review by an accredited assessor.',NULL,'mandatory','Cyber Essentials Plus Controls',NULL,10,'2026-05-08 04:34:03'),('244a1e22-4a97-11f1-8bc3-00155d012902','c3d4e5f6-0016-0019-0001-000000000001',NULL,'CEP-2','Secure Configuration (Verified)','Technical verification that devices are hardened to an appropriate baseline through hands-on testing of a sample of representative devices.',NULL,'mandatory','Cyber Essentials Plus Controls',NULL,20,'2026-05-08 04:34:03'),('244a205e-4a97-11f1-8bc3-00155d012902','c3d4e5f6-0016-0019-0001-000000000001',NULL,'CEP-3','User Access Control (Verified)','Technical verification of least-privilege implementation by attempting privilege escalation and validating account provisioning controls on sample systems.',NULL,'mandatory','Cyber Essentials Plus Controls',NULL,30,'2026-05-08 04:34:03'),('244a8905-4a97-11f1-8bc3-00155d012902','c3d4e5f6-0016-0019-0001-000000000001',NULL,'CEP-4','Malware Protection (Verified)','Technical verification of malware protection effectiveness through simulated malware execution tests to confirm that protection controls detect and block threats.',NULL,'mandatory','Cyber Essentials Plus Controls',NULL,40,'2026-05-08 04:34:03'),('244a8b72-4a97-11f1-8bc3-00155d012902','c3d4e5f6-0016-0019-0001-000000000001',NULL,'CEP-5','Patch Management (Verified)','Technical verification that operating systems and software are fully patched through vulnerability scanning and manual inspection of patch levels.',NULL,'mandatory','Cyber Essentials Plus Controls',NULL,50,'2026-05-08 04:34:03'),('25ad54c3-02aa-49e5-aa8e-d60222ac2a4a','a28c08f1-4113-11f1-8bc3-00155d012902','93c9b683-2438-437b-8bc5-6db8a529ed85','8.2','User identification and related accounts for users and administrators are strictly managed',NULL,NULL,'mandatory',NULL,NULL,0,'2026-04-26 02:00:01'),('26185d1f-57b8-45ae-8c68-c0e6acaa4afe','161ca661-dcfc-41d6-ae04-4d515194f119','b9930df0-400e-11f1-8bc3-00155d012902','Art.5.1.e','Storage limitation','Personal data shall be kept in a form which permits identification of data subjects for no longer than necessary.',NULL,'mandatory',NULL,NULL,4,'2026-04-26 02:00:00'),('26dacd6d-ccdf-493a-8a92-d1c11f841217','a27eef01-4113-11f1-8bc3-00155d012902','5e916319-60b9-433a-a62a-797dab76c0cf','PR.AA','Identity Management, Authentication, and Access Control','Access to physical and logical assets is limited to authorized users, services, and hardware.',NULL,'mandatory',NULL,NULL,0,'2026-04-26 02:00:01'),('295ddec6-3f74-4477-8e78-094625eae465','a23072ef-4113-11f1-8bc3-00155d012902',NULL,'1798.150','Security requirements and breach liability','Implement and maintain reasonable security procedures and practices appropriate to the nature of the information to protect the personal information from unauthorized access, destruction, use, modification, or disclosure.',NULL,'mandatory','Security',NULL,9,'2026-04-26 02:00:00'),('2a1b0284-07e4-4972-8821-07fb94ef9964','a23072ef-4113-11f1-8bc3-00155d012902',NULL,'1798.105','Right to delete personal information','A consumer shall have the right to request that a business delete any personal information about the consumer which the business has collected from the consumer.',NULL,'mandatory','Consumer Rights',NULL,1,'2026-04-26 02:00:00'),('2a37b7bf-37dc-4724-bf22-a1c34dbf84eb','a23897c7-4113-11f1-8bc3-00155d012902',NULL,'SYSC.1','Application and Purpose',NULL,NULL,'mandatory','General Requirements',NULL,0,'2026-04-26 02:00:00'),('2a842e28-d779-4712-a715-dca6eea3a662','d4e5f6a1-b2c3-4d4e-8f6a-1b2c3d4e5f6a','878b3435-562f-4898-89a0-ab5d654a12bc','164.312(d)','Person or Entity Authentication','Implement procedures to verify that a person seeking access to ePHI is the one claimed.',NULL,'mandatory',NULL,NULL,3,'2026-04-26 02:00:00'),('2bf71ebb-7b18-49e2-84d1-bfc63f8bb375','a28c08f1-4113-11f1-8bc3-00155d012902','16c485ec-bd2a-4996-b6b2-86a6ce224819','12.3','Risks to the cardholder data environment are formally identified, evaluated, and managed',NULL,NULL,'mandatory',NULL,NULL,1,'2026-04-26 02:00:01'),('2c4f5d63-a4d9-4335-a013-967a6ba3e2fd','a28c08f1-4113-11f1-8bc3-00155d012902','4db13685-d465-4cb7-b0a5-b2d0bb82f8ff','11.5','Network intrusions and unexpected file changes are detected and responded to',NULL,NULL,'mandatory',NULL,NULL,1,'2026-04-26 02:00:01'),('2f61d8e5-8c71-4c6b-8c1e-47ec46efeb00','a2a4e62d-4113-11f1-8bc3-00155d012902','84ccacc2-a87b-4929-8f10-ef85d16f3a34','CC1.4','COSO Principle 4: Demonstrates Commitment to Competence','The entity demonstrates a commitment to attract, develop, and retain competent individuals.',NULL,'mandatory',NULL,NULL,3,'2026-04-26 02:00:01'),('30500045-b7a2-4f1f-a2d1-49644d9b671e','a2a4e62d-4113-11f1-8bc3-00155d012902','84ccacc2-a87b-4929-8f10-ef85d16f3a34','CC1.5','COSO Principle 5: Enforces Accountability','The entity holds individuals accountable for their internal control responsibilities.',NULL,'mandatory',NULL,NULL,4,'2026-04-26 02:00:01'),('314e2243-f322-4052-a167-d7939d6eeab7','a28c08f1-4113-11f1-8bc3-00155d012902','f29f6a69-1b83-468a-99ca-41ddfff15d47','3.1','Processes and mechanisms for protecting stored account data are defined and understood',NULL,NULL,'mandatory',NULL,NULL,0,'2026-04-26 02:00:01'),('32e14f3a-450a-45b9-83e7-4e7416821ad9','a28c08f1-4113-11f1-8bc3-00155d012902','855a22a9-6c60-4ae6-a21a-c27f6206e634','10.2','Audit logs capture all individual user access to cardholder data',NULL,NULL,'mandatory',NULL,NULL,0,'2026-04-26 02:00:01'),('32f7c0ae-7408-4a38-abe7-4d156187a61c','a25c0c03-4113-11f1-8bc3-00155d012902','a1bcbd48-afea-4e16-b19e-d810727b604c','5.3','Organizational roles, responsibilities and authorities','Ensure roles, responsibilities and authorities relevant to information security are assigned and communicated.',NULL,'mandatory',NULL,NULL,2,'2026-04-26 02:00:00'),('343a705f-889e-48af-8f4e-03d344b01c0c','a27eef01-4113-11f1-8bc3-00155d012902',NULL,'RS','RESPOND','Actions regarding a detected cybersecurity incident are taken.',NULL,'mandatory','Respond',NULL,4,'2026-04-26 02:00:01'),('34e539d9-3e70-4253-9e88-27714276f81b','a2a4e62d-4113-11f1-8bc3-00155d012902',NULL,'CC6','Logical and Physical Access Controls',NULL,NULL,'mandatory','Common Criteria',NULL,2,'2026-04-26 02:00:01'),('35f1dd40-f7cc-43ae-ba7f-3006b4233500','a27eef01-4113-11f1-8bc3-00155d012902',NULL,'ID','IDENTIFY','The organization\'s current cybersecurity risks are understood.',NULL,'mandatory','Identify',NULL,1,'2026-04-26 02:00:01'),('37e74239-fda5-4e7d-b32d-ec2c2ee256ff','a28c08f1-4113-11f1-8bc3-00155d012902',NULL,'5','Protect All Systems and Networks from Malicious Software',NULL,NULL,'mandatory','Malware Protection',NULL,4,'2026-04-26 02:00:01'),('39f106cc-389b-43d4-8dc0-5601228a045f','a2a4e62d-4113-11f1-8bc3-00155d012902','deed7b79-3495-43a3-bef6-364e72cbc7e6','CC2.2','COSO Principle 14: Communicates Internally','The entity internally communicates information necessary to support the functioning of internal control.',NULL,'mandatory',NULL,NULL,1,'2026-04-26 02:00:01'),('3a3ccd70-589f-4c74-a916-05aef6a7caf4','d4e5f6a1-b2c3-4d4e-8f6a-1b2c3d4e5f6a','ab51c460-1e0d-42dc-ab75-814c52efcbd1','164.308(a)(8)','Evaluation','Perform a periodic technical and non-technical evaluation of security policies.',NULL,'mandatory',NULL,NULL,7,'2026-04-26 02:00:00'),('3c03de92-87f4-4aef-bcbc-dbacad55a2d7','a23072ef-4113-11f1-8bc3-00155d012902',NULL,'1798.130','Methods for submitting requests','Provide at least two designated methods for submitting requests for information required to be disclosed, including, at a minimum, a toll-free telephone number.',NULL,'mandatory','Request Handling',NULL,6,'2026-04-26 02:00:00'),('3ef69282-3eca-42dd-9f77-796e36feeb5e','d4e5f6a1-b2c3-4d4e-8f6a-1b2c3d4e5f6a','af078ea2-400e-11f1-8bc3-00155d012902','164.308(a)(1)(ii)(B)','Risk Management','Implement security measures sufficient to reduce risks and vulnerabilities to a reasonable and appropriate level.',NULL,'mandatory',NULL,NULL,1,'2026-04-26 02:00:00'),('4117244c-a7d4-4faf-a1cb-1a2cacf4d760','a2a4e62d-4113-11f1-8bc3-00155d012902',NULL,'CC7','System Operations',NULL,NULL,'mandatory','Common Criteria',NULL,3,'2026-04-26 02:00:01'),('415a8bdc-329f-4be1-9611-27b241e3cbdf','d4e5f6a1-b2c3-4d4e-8f6a-1b2c3d4e5f6a',NULL,'164.406','Breach Notification Rule',NULL,NULL,'mandatory','Breach Notification',NULL,3,'2026-04-26 02:00:00'),('4269dd55-20ad-4847-a87c-382e99c032f0','a29cdc11-4113-11f1-8bc3-00155d012902',NULL,'S32','Right of access','Data subject has right to access and obtain copies of their personal data.',NULL,'mandatory','Data Subject Rights',NULL,5,'2026-04-26 02:00:01'),('4310db25-6fef-4260-b5b2-fdea384d2842','a29cdc11-4113-11f1-8bc3-00155d012902',NULL,'S46','Cross-border transfer restrictions','Transfer of personal data to a foreign country shall only occur if such country has adequate data protection standards.',NULL,'mandatory','Data Transfers',NULL,11,'2026-04-26 02:00:01'),('432f316a-5d67-4839-998f-e4de25763f43','a23897c7-4113-11f1-8bc3-00155d012902','4bea2820-363a-4da1-84a9-1205ff209b73','SYSC.8.2','Contingency plans','Ensure business continuity exists in case service provision from third parties is disrupted.',NULL,'mandatory',NULL,NULL,1,'2026-04-26 02:00:00'),('44fa2be4-6427-45d9-ab33-88b5a1412f8b','a271e304-4113-11f1-8bc3-00155d012902',NULL,'5','Cyber Resilience',NULL,NULL,'mandatory','Cyber Security',NULL,2,'2026-04-26 02:00:01'),('46edc7ec-e055-4eaf-aa2a-806bee405664','a27eef01-4113-11f1-8bc3-00155d012902','343a705f-889e-48af-8f4e-03d344b01c0c','RS.CO','Incident Response Reporting and Communication','Response activities are coordinated with internal and external stakeholders.',NULL,'mandatory',NULL,NULL,2,'2026-04-26 02:00:01'),('484b41a8-428b-4045-a928-85906c0ef46f','a29cdc11-4113-11f1-8bc3-00155d012902','5aebac90-5ffb-42fa-b19e-8a6c8d5b1198','S19.1','Explicit consent','Obtain explicit consent from the data subject prior to collection.',NULL,'mandatory',NULL,NULL,0,'2026-04-26 02:00:01'),('48bf6256-4ea6-4b5f-afcd-779c48e80fe3','a23897c7-4113-11f1-8bc3-00155d012902','e030f67e-22f0-4eb1-9cad-aa0e5f55af8f','SYSC.4.3','Risk management','Implement risk management policies and procedures, and consider risks from operations and potential obligation.',NULL,'mandatory',NULL,NULL,2,'2026-04-26 02:00:00'),('4b230cb6-1bf3-48fe-8060-0bd2f2c5bf2d','161ca661-dcfc-41d6-ae04-4d515194f119','b9930df0-400e-11f1-8bc3-00155d012902','Art.5.1.b','Purpose limitation','Personal data shall be collected for specified, explicit and legitimate purposes and not further processed in incompatible manner.',NULL,'mandatory',NULL,NULL,1,'2026-04-26 02:00:00'),('4bea2820-363a-4da1-84a9-1205ff209b73','a23897c7-4113-11f1-8bc3-00155d012902',NULL,'SYSC.8','Outsourcing',NULL,NULL,'mandatory','Third-party Management',NULL,5,'2026-04-26 02:00:00'),('4bfc01b6-0d21-464d-97a6-277b3466950d','a28c08f1-4113-11f1-8bc3-00155d012902',NULL,'2','Apply Secure Configurations to All System Components','Malicious individuals often use vendor default passwords and other vendor default settings to compromise systems.',NULL,'mandatory','Configuration Management',NULL,1,'2026-04-26 02:00:01'),('4db13685-d465-4cb7-b0a5-b2d0bb82f8ff','a28c08f1-4113-11f1-8bc3-00155d012902',NULL,'11','Test Security of Systems and Networks Regularly',NULL,NULL,'mandatory','Security Testing',NULL,10,'2026-04-26 02:00:01'),('4e100aa3-2596-469f-b205-82f7a0b7bd02','a2a4e62d-4113-11f1-8bc3-00155d012902','84ccacc2-a87b-4929-8f10-ef85d16f3a34','CC1.1','COSO Principle 1: Demonstrates Commitment to Integrity and Ethical Values','The entity demonstrates a commitment to integrity and ethical values.',NULL,'mandatory',NULL,NULL,0,'2026-04-26 02:00:01'),('52e39bba-8641-4f45-9f76-1af4e3fe4681','a23897c7-4113-11f1-8bc3-00155d012902','a7f201f5-2f9a-4e67-a7ca-5740d5f67f03','SYSC.13.2','Business continuity planning','Establish and maintain contingency arrangements and business continuity plans.',NULL,'mandatory',NULL,NULL,1,'2026-04-26 02:00:00'),('55c15cbe-1f04-495a-ba30-baac219241b6','a28c08f1-4113-11f1-8bc3-00155d012902','d1a72624-0ba6-4227-a659-c41bd9d8577d','6.3','Security vulnerabilities are identified and addressed',NULL,NULL,'mandatory',NULL,NULL,1,'2026-04-26 02:00:01'),('55d1b074-bc85-4aaf-9d23-e308ca5ab07a','d4e5f6a1-b2c3-4d4e-8f6a-1b2c3d4e5f6a','af078ea2-400e-11f1-8bc3-00155d012902','164.308(a)(1)(ii)(A)','Risk Analysis','Conduct an accurate and thorough assessment of the potential risks and vulnerabilities to the confidentiality, integrity, and availability of ePHI.',NULL,'mandatory',NULL,NULL,0,'2026-04-26 02:00:00'),('57005d4f-844e-4b48-bdab-6a8d38faee31','a271e304-4113-11f1-8bc3-00155d012902',NULL,'3','Board and Senior Management Responsibilities',NULL,NULL,'mandatory','Governance',NULL,0,'2026-04-26 02:00:01'),('575b61e0-8a9e-4177-a071-193b4ad3c819','a23897c7-4113-11f1-8bc3-00155d012902','e030f67e-22f0-4eb1-9cad-aa0e5f55af8f','SYSC.4.4','Internal audit','Maintain an internal audit function to establish, implement and maintain an audit plan.',NULL,'mandatory',NULL,NULL,3,'2026-04-26 02:00:00'),('59679a53-e0a5-43fd-aa5d-bde8d90beb19','a27eef01-4113-11f1-8bc3-00155d012902','35f1dd40-f7cc-43ae-ba7f-3006b4233500','ID.RA','Risk Assessment','The cybersecurity risk to the organization, assets, and individuals is identified and understood.',NULL,'mandatory',NULL,NULL,1,'2026-04-26 02:00:01'),('5a694d75-c49e-45ec-bae7-4d7f65793a49','a2a4e62d-4113-11f1-8bc3-00155d012902','dd797d48-8b9e-4e29-b966-37875790779f','C1.2','Confidential information disposal','The entity disposes of confidential information to meet the entity\'s objectives.',NULL,'recommended',NULL,NULL,1,'2026-04-26 02:00:01'),('5aa98c56-2749-4234-9766-dc768db679a1','a23897c7-4113-11f1-8bc3-00155d012902','a7f201f5-2f9a-4e67-a7ca-5740d5f67f03','SYSC.13.1','Identification and assessment','Take reasonable steps to identify and assess all operational risks.',NULL,'mandatory',NULL,NULL,0,'2026-04-26 02:00:00'),('5aebac90-5ffb-42fa-b19e-8a6c8d5b1198','a29cdc11-4113-11f1-8bc3-00155d012902',NULL,'S19','Lawful Basis for Collection',NULL,NULL,'mandatory','Legal Basis',NULL,1,'2026-04-26 02:00:01'),('5ba41ba1-bd4a-4a45-a230-51152b47826e','a29cdc11-4113-11f1-8bc3-00155d012902',NULL,'S36','Right to erasure','Data subject has right to request deletion of personal data.',NULL,'mandatory','Data Subject Rights',NULL,7,'2026-04-26 02:00:01'),('5c476a23-b203-4ad3-b82d-6ad8d4aae003','d4e5f6a1-b2c3-4d4e-8f6a-1b2c3d4e5f6a','af078ea2-400e-11f1-8bc3-00155d012902','164.308(a)(1)(ii)(C)','Sanction Policy','Apply appropriate sanctions against workforce members who fail to comply with security policies.',NULL,'mandatory',NULL,NULL,2,'2026-04-26 02:00:00'),('5c7c8c4b-79ce-4488-880a-88e88bcb5c59','a23072ef-4113-11f1-8bc3-00155d012902',NULL,'1798.120','Right to opt-out of sale of personal information','A consumer shall have the right, at any time, to direct a business that sells personal information about the consumer to third parties not to sell the consumer\'s personal information.',NULL,'mandatory','Consumer Rights',NULL,4,'2026-04-26 02:00:00'),('5ca57a9c-78f9-4694-96d3-6c82c459378e','a271e304-4113-11f1-8bc3-00155d012902','db05c0b8-be4a-4f54-babe-37b10db09d18','8.1','Access controls','Implement robust access control policies and procedures.',NULL,'mandatory',NULL,NULL,0,'2026-04-26 02:00:01'),('5dced23a-78fb-466d-84e3-76aa81fb9ee0','a28c08f1-4113-11f1-8bc3-00155d012902','855a22a9-6c60-4ae6-a21a-c27f6206e634','10.3','Audit logs are protected from destruction and unauthorized modifications',NULL,NULL,'mandatory',NULL,NULL,1,'2026-04-26 02:00:01'),('5e916319-60b9-433a-a62a-797dab76c0cf','a27eef01-4113-11f1-8bc3-00155d012902',NULL,'PR','PROTECT','Safeguards to manage the organization\'s cybersecurity risks are used.',NULL,'mandatory','Protect',NULL,2,'2026-04-26 02:00:01'),('5fbbe657-9b0d-453f-9ed8-d9047e425c17','a28c08f1-4113-11f1-8bc3-00155d012902','f29f6a69-1b83-468a-99ca-41ddfff15d47','3.3','Sensitive authentication data (SAD) is not retained after authorization',NULL,NULL,'mandatory',NULL,NULL,2,'2026-04-26 02:00:01'),('62f325e0-9aee-4d0e-8ddc-ad6e1faab7f2','a23897c7-4113-11f1-8bc3-00155d012902','4bea2820-363a-4da1-84a9-1205ff209b73','SYSC.8.1','Outsourcing requirements','Conduct due diligence on third-party service providers and maintain oversight of outsourced functions.',NULL,'mandatory',NULL,NULL,0,'2026-04-26 02:00:00'),('676a71a1-f94c-4b45-bf96-844893dcc589','161ca661-dcfc-41d6-ae04-4d515194f119','b9930df0-400e-11f1-8bc3-00155d012902','Art.5.1.f','Integrity and confidentiality','Personal data shall be processed in a manner that ensures appropriate security.',NULL,'mandatory',NULL,NULL,5,'2026-04-26 02:00:00'),('68c09ddc-db16-40a1-b5a9-3237e16a5c46','a271e304-4113-11f1-8bc3-00155d012902','db05c0b8-be4a-4f54-babe-37b10db09d18','8.3','Data leakage prevention','Implement data leakage prevention controls.',NULL,'mandatory',NULL,NULL,2,'2026-04-26 02:00:01'),('69365e9e-06ee-4e46-9409-aa6864bb00d7','a29cdc11-4113-11f1-8bc3-00155d012902',NULL,'S37','Right to restriction','Data subject has right to request restriction of processing of personal data.',NULL,'mandatory','Data Subject Rights',NULL,8,'2026-04-26 02:00:01'),('69d65d36-46ec-431d-9f7e-3eac15afb93d','a27eef01-4113-11f1-8bc3-00155d012902',NULL,'GV','GOVERN','The organization\'s cybersecurity risk management strategy, expectations, and policy are established, communicated, and monitored.',NULL,'mandatory','Govern',NULL,0,'2026-04-26 02:00:01'),('6a0bbbc3-fbc7-44d5-b3b0-ca8a0deb2ab2','a23897c7-4113-11f1-8bc3-00155d012902',NULL,'SYSC.6','Compliance, internal audit and financial crime',NULL,NULL,'mandatory','Compliance',NULL,3,'2026-04-26 02:00:00'),('6b1c1b39-2d3b-40ad-a5bc-b458eff99c47','a2a4e62d-4113-11f1-8bc3-00155d012902','4117244c-a7d4-4faf-a1cb-1a2cacf4d760','CC7.5','Incident recovery','The entity identifies, develops, and implements activities to recover from identified security incidents.',NULL,'mandatory',NULL,NULL,4,'2026-04-26 02:00:01'),('6b1f024d-f8ac-4132-9789-f701aef9c373','a25c0c03-4113-11f1-8bc3-00155d012902','e925195e-a5f8-4a84-8823-6df95025e13c','A.5.7','Threat intelligence','Information relating to information security threats shall be collected and analysed.',NULL,'mandatory',NULL,NULL,2,'2026-04-26 02:00:01'),('6ef5cc85-ccec-4b7b-b06a-32064ae8a0b6','a28c08f1-4113-11f1-8bc3-00155d012902','16c485ec-bd2a-4996-b6b2-86a6ce224819','12.1','Comprehensive information security policy is known and current',NULL,NULL,'mandatory',NULL,NULL,0,'2026-04-26 02:00:01'),('6f2e38df-0725-4986-812d-0b9ce0b47149','a271e304-4113-11f1-8bc3-00155d012902','8fca5036-9288-42d0-96ef-9d5041d5859e','6.2','IT infrastructure maintenance','Maintain IT infrastructure components in a secured and resilient manner.',NULL,'mandatory',NULL,NULL,1,'2026-04-26 02:00:01'),('70c5341a-f6dd-451b-b95f-c5c470aa59f6','a2a4e62d-4113-11f1-8bc3-00155d012902',NULL,'CC8','Change Management',NULL,NULL,'mandatory','Common Criteria',NULL,4,'2026-04-26 02:00:01'),('712939e4-f831-4593-8c61-741aea0bfd8a','a23897c7-4113-11f1-8bc3-00155d012902','6a0bbbc3-fbc7-44d5-b3b0-ca8a0deb2ab2','SYSC.6.3','Financial crime','Establish and maintain effective systems and controls for countering the risk that the firm might be used to further financial crime.',NULL,'mandatory',NULL,NULL,2,'2026-04-26 02:00:00'),('76612709-0a01-4c41-a72a-4d129d03a682','161ca661-dcfc-41d6-ae04-4d515194f119','b9931234-400e-11f1-8bc3-00155d012902','Art.6.1','Legal basis for processing','Processing shall be lawful only if and to the extent one of the listed conditions applies.',NULL,'mandatory',NULL,NULL,0,'2026-04-26 02:00:00'),('773c8a9c-5751-4010-854b-2d70b33a16f8','a271e304-4113-11f1-8bc3-00155d012902','b2390b23-4231-4a58-92e2-ca248bc259bf','4.1','Technology risk appetite','Establish a technology risk appetite that is aligned with business strategies.',NULL,'mandatory',NULL,NULL,0,'2026-04-26 02:00:01'),('78c6688e-bd0f-4a69-822e-da11a1482b0e','a27eef01-4113-11f1-8bc3-00155d012902','69d65d36-46ec-431d-9f7e-3eac15afb93d','GV.OC','Organizational Context','The circumstances surrounding the organization\'s cybersecurity risk management decisions are understood.',NULL,'mandatory',NULL,NULL,0,'2026-04-26 02:00:01'),('78e98a5a-a832-4173-b41a-202dbee5a7dc','a27eef01-4113-11f1-8bc3-00155d012902','69d65d36-46ec-431d-9f7e-3eac15afb93d','GV.RR','Roles, Responsibilities, and Authorities','Cybersecurity roles, responsibilities, and authorities to foster accountability, performance assessment, and continuous improvement.',NULL,'mandatory',NULL,NULL,2,'2026-04-26 02:00:01'),('797b7d4b-40d2-4fe9-8e42-69c4f55c34ef','a28c08f1-4113-11f1-8bc3-00155d012902',NULL,'1','Install and Maintain Network Security Controls','Network security controls (NSCs) are network security controls are policies and procedures that define how an entity manages access to networks.',NULL,'mandatory','Network Security',NULL,0,'2026-04-26 02:00:01'),('79d59591-ef22-430e-adce-02c65ec9eb88','a25c0c03-4113-11f1-8bc3-00155d012902','027f0ae9-f18e-4e27-8220-f26fd61315bd','9.2','Internal audit','Conduct internal audits at planned intervals.',NULL,'mandatory',NULL,NULL,1,'2026-04-26 02:00:01'),('7a3aa940-f4f1-4c67-afb0-ebe294d2b6e2','a25c0c03-4113-11f1-8bc3-00155d012902','fc367235-0df3-4391-b94d-7ccc4c74c1dc','10.1','Continual improvement','Continually improve the suitability, adequacy and effectiveness of the ISMS.',NULL,'mandatory',NULL,NULL,0,'2026-04-26 02:00:01'),('7c327052-ecf8-4fa1-977f-4c0d2002b06d','a23897c7-4113-11f1-8bc3-00155d012902','6a0bbbc3-fbc7-44d5-b3b0-ca8a0deb2ab2','SYSC.6.1','Compliance function','Establish, implement and maintain adequate policies and procedures designed to detect risk of failure to comply with obligations.',NULL,'mandatory',NULL,NULL,0,'2026-04-26 02:00:00'),('7c3a9e2b-29fd-422c-86ab-ed01a3388d88','a2a4e62d-4113-11f1-8bc3-00155d012902','84ccacc2-a87b-4929-8f10-ef85d16f3a34','CC1.3','COSO Principle 3: Establishes Structure, Authority, and Responsibility','Management establishes organizational structures, reporting lines, and authorities.',NULL,'mandatory',NULL,NULL,2,'2026-04-26 02:00:01'),('7f9f14b3-ef9f-4f0a-8503-6d5930619e3c','a23897c7-4113-11f1-8bc3-00155d012902','f5d7e387-e22f-4800-93f7-ff6aac980759','SYSC.7.1','Risk management systems','Establish, implement and maintain adequate risk management policies and procedures that identify the risks relating to the firm\'s activities.',NULL,'mandatory',NULL,NULL,0,'2026-04-26 02:00:00'),('81306a77-2a1d-4bc4-a3c9-c681e8498d8b','d4e5f6a1-b2c3-4d4e-8f6a-1b2c3d4e5f6a','af078ea2-400e-11f1-8bc3-00155d012902','164.308(a)(1)(ii)(D)','Information System Activity Review','Implement procedures to regularly review records of information system activity.',NULL,'mandatory',NULL,NULL,3,'2026-04-26 02:00:00'),('82fd71f3-4c61-4c26-a5ec-c3e0e5e095be','a27eef01-4113-11f1-8bc3-00155d012902','0b1d6c3c-710b-4097-a62c-8c00c9a23c9f','DE.AE','Adverse Event Analysis','Anomalies, indicators of compromise, and other potentially adverse events are analyzed to characterize the events.',NULL,'mandatory',NULL,NULL,1,'2026-04-26 02:00:01'),('836e3f35-0111-422f-8709-9d3abc757b28','a271e304-4113-11f1-8bc3-00155d012902','125438cc-2b59-4663-9189-c7e2ac4abc07','7.1','Project governance','Establish a project governance framework for IT projects.',NULL,'mandatory',NULL,NULL,0,'2026-04-26 02:00:01'),('83dd2f29-3797-4624-9d98-948f6f9b2d4b','a28c08f1-4113-11f1-8bc3-00155d012902','f29f6a69-1b83-468a-99ca-41ddfff15d47','3.4','Access to displays of full PAN and ability to copy PAN are restricted',NULL,NULL,'mandatory',NULL,NULL,3,'2026-04-26 02:00:01'),('84ccacc2-a87b-4929-8f10-ef85d16f3a34','a2a4e62d-4113-11f1-8bc3-00155d012902',NULL,'CC1','Control Environment',NULL,NULL,'mandatory','Common Criteria',NULL,0,'2026-04-26 02:00:01'),('855a22a9-6c60-4ae6-a21a-c27f6206e634','a28c08f1-4113-11f1-8bc3-00155d012902',NULL,'10','Log and Monitor All Access to System Components and Cardholder Data',NULL,NULL,'mandatory','Logging & Monitoring',NULL,9,'2026-04-26 02:00:01'),('8630eb6b-40a0-4df3-b92d-18e53831c2a9','a25c0c03-4113-11f1-8bc3-00155d012902','215be14c-3698-4fce-a463-7aab14e4f886','4.4','Information security management system','Establish, implement, maintain and continually improve an ISMS.',NULL,'mandatory',NULL,NULL,3,'2026-04-26 02:00:00'),('878b3435-562f-4898-89a0-ab5d654a12bc','d4e5f6a1-b2c3-4d4e-8f6a-1b2c3d4e5f6a',NULL,'164.312','Technical Safeguards',NULL,NULL,'mandatory','Security Rule - Technical',NULL,2,'2026-04-26 02:00:00'),('888cc7ef-e70a-4298-889b-de3343796957','a2a4e62d-4113-11f1-8bc3-00155d012902','34e539d9-3e70-4253-9e88-27714276f81b','CC6.6','Security boundary threat protection','The entity implements controls to prevent or detect and act upon the introduction of unauthorized or malicious software.',NULL,'mandatory',NULL,NULL,3,'2026-04-26 02:00:01'),('89e6c547-086d-489f-8ebc-60a658df521e','a27eef01-4113-11f1-8bc3-00155d012902','5e916319-60b9-433a-a62a-797dab76c0cf','PR.PS','Platform Security','The hardware, software (including firmware and operating systems), and services of physical and virtual platforms are managed.',NULL,'mandatory',NULL,NULL,3,'2026-04-26 02:00:01'),('8a2641a4-2fea-4207-a5af-6036abfa5572','a2a4e62d-4113-11f1-8bc3-00155d012902','deed7b79-3495-43a3-bef6-364e72cbc7e6','CC2.1','COSO Principle 13: Uses Relevant Information','The entity obtains or generates and uses relevant, quality information.',NULL,'mandatory',NULL,NULL,0,'2026-04-26 02:00:01'),('8ac8ddb1-ce0e-4cf5-8385-45ac509eecbf','a2a4e62d-4113-11f1-8bc3-00155d012902','d469fe64-f77c-46ea-a29d-81908bdd28d7','A1.1','Availability commitments','The entity maintains, monitors, and evaluates current processing capacity and use of system components.',NULL,'recommended',NULL,NULL,0,'2026-04-26 02:00:01'),('8d8d7b39-e895-412e-9408-3d9f68885819','a25c0c03-4113-11f1-8bc3-00155d012902',NULL,'8','Operation',NULL,NULL,'mandatory','Operational Controls',NULL,4,'2026-04-26 02:00:01'),('8fca5036-9288-42d0-96ef-9d5041d5859e','a271e304-4113-11f1-8bc3-00155d012902',NULL,'6','IT Infrastructure Management',NULL,NULL,'mandatory','Infrastructure',NULL,3,'2026-04-26 02:00:01'),('903da893-cf45-4987-b342-57f04f5e0fc6','a271e304-4113-11f1-8bc3-00155d012902','8fca5036-9288-42d0-96ef-9d5041d5859e','6.1','IT infrastructure planning','Plan IT infrastructure capacity based on business requirements and projected growth.',NULL,'mandatory',NULL,NULL,0,'2026-04-26 02:00:01'),('90d81e74-fc82-4ea2-8fe7-82ec63fda718','a23072ef-4113-11f1-8bc3-00155d012902','09316565-9b2d-4644-8737-b13fa45b3cdc','1798.110(a)(2)','Sources of personal information','Disclose the categories of sources from which the personal information is collected.',NULL,'mandatory',NULL,NULL,1,'2026-04-26 02:00:00'),('914d6180-649d-4097-9c82-ad9e960e7b29','a27eef01-4113-11f1-8bc3-00155d012902','343a705f-889e-48af-8f4e-03d344b01c0c','RS.MI','Incident Mitigation','Activities are performed to prevent expansion of an event and mitigate its effects.',NULL,'mandatory',NULL,NULL,3,'2026-04-26 02:00:01'),('91a21fda-0ae0-444b-a92d-c1824bd4ceb1','a271e304-4113-11f1-8bc3-00155d012902','44fa2be4-6427-45d9-ab33-88b5a1412f8b','5.4','Cyber incident management','Establish processes for effective management of cyber incidents.',NULL,'mandatory',NULL,NULL,3,'2026-04-26 02:00:01'),('91cf5d81-4a98-11f1-8bc3-00155d012902','f6a7b8c9-0019-0001-0001-000000000001',NULL,'A01:2021','A01: Broken Access Control','Access control enforces policy such that users cannot act outside of their intended permissions; failures typically lead to unauthorized information disclosure, modification, or destruction.',NULL,'mandatory','OWASP Top 10 Risks',NULL,10,'2026-05-08 04:44:16'),('91cf63e0-4a98-11f1-8bc3-00155d012902','f6a7b8c9-0019-0001-0001-000000000001',NULL,'A02:2021','A02: Cryptographic Failures','Failures related to cryptography (or lack thereof) often lead to exposure of sensitive data including passwords, credit card numbers, health records, and personal information.',NULL,'mandatory','OWASP Top 10 Risks',NULL,20,'2026-05-08 04:44:16'),('91cf66ae-4a98-11f1-8bc3-00155d012902','f6a7b8c9-0019-0001-0001-000000000001',NULL,'A03:2021','A03: Injection','Injection flaws occur when untrusted data is sent to an interpreter as part of a command or query; SQL, NoSQL, OS, and LDAP injection can result in data loss or corruption.',NULL,'mandatory','OWASP Top 10 Risks',NULL,30,'2026-05-08 04:44:16'),('91cf6986-4a98-11f1-8bc3-00155d012902','f6a7b8c9-0019-0001-0001-000000000001',NULL,'A04:2021','A04: Insecure Design','Risks related to design and architectural flaws, requiring a shift toward threat modeling, secure design patterns, and reference architectures.',NULL,'mandatory','OWASP Top 10 Risks',NULL,40,'2026-05-08 04:44:16'),('91cf6c1c-4a98-11f1-8bc3-00155d012902','f6a7b8c9-0019-0001-0001-000000000001',NULL,'A05:2021','A05: Security Misconfiguration','The most common security issue due to insecure default configurations, incomplete configurations, open cloud storage, and verbose error messages.',NULL,'mandatory','OWASP Top 10 Risks',NULL,50,'2026-05-08 04:44:16'),('91cf6ee9-4a98-11f1-8bc3-00155d012902','f6a7b8c9-0019-0001-0001-000000000001',NULL,'A06:2021','A06: Vulnerable and Outdated Components','Using components with known vulnerabilities such as libraries, frameworks, and software modules can undermine application defenses and enable attacks.',NULL,'mandatory','OWASP Top 10 Risks',NULL,60,'2026-05-08 04:44:16'),('91cf7130-4a98-11f1-8bc3-00155d012902','f6a7b8c9-0019-0001-0001-000000000001',NULL,'A07:2021','A07: Identification and Authentication Failures','Confirmation of user identity, authentication, and session management are critical to protect against authentication-related attacks.',NULL,'mandatory','OWASP Top 10 Risks',NULL,70,'2026-05-08 04:44:16'),('91cf7362-4a98-11f1-8bc3-00155d012902','f6a7b8c9-0019-0001-0001-000000000001',NULL,'A08:2021','A08: Software and Data Integrity Failures','Code and infrastructure that does not protect against integrity violations including insecure deserialization and untrusted software updates.',NULL,'mandatory','OWASP Top 10 Risks',NULL,80,'2026-05-08 04:44:16'),('91cf7584-4a98-11f1-8bc3-00155d012902','f6a7b8c9-0019-0001-0001-000000000001',NULL,'A09:2021','A09: Security Logging and Monitoring Failures','Insufficient logging and monitoring, including missing detection of breaches, results in attackers achieving their goals without detection.',NULL,'mandatory','OWASP Top 10 Risks',NULL,90,'2026-05-08 04:44:16'),('91cf77bd-4a98-11f1-8bc3-00155d012902','f6a7b8c9-0019-0001-0001-000000000001',NULL,'A10:2021','A10: Server-Side Request Forgery (SSRF)','SSRF flaws occur when a web application fetches a remote resource without validating the user-supplied URL, allowing attackers to send crafted requests from the vulnerable server.',NULL,'mandatory','OWASP Top 10 Risks',NULL,100,'2026-05-08 04:44:16'),('91e54c85-4a98-11f1-8bc3-00155d012902','f6a7b8c9-0019-0002-0001-000000000001',NULL,'V1','V1: Architecture, Design, and Threat Modeling','Security architecture requirements for all applications; threat modeling and security design principles to prevent security issues from architectural flaws.',NULL,'mandatory','ASVS Chapters',NULL,10,'2026-05-08 04:44:16'),('91e5526d-4a98-11f1-8bc3-00155d012902','f6a7b8c9-0019-0002-0001-000000000001',NULL,'V2','V2: Authentication','Controls ensuring that users are who they claim to be, covering passwords, credential management, multi-factor authentication, and lookup secrets.',NULL,'mandatory','ASVS Chapters',NULL,20,'2026-05-08 04:44:16'),('91e55412-4a98-11f1-8bc3-00155d012902','f6a7b8c9-0019-0002-0001-000000000001',NULL,'V3','V3: Session Management','Controls for creating, managing, and terminating user sessions securely, including session token properties and cookie security.',NULL,'mandatory','ASVS Chapters',NULL,30,'2026-05-08 04:44:16'),('91e555a2-4a98-11f1-8bc3-00155d012902','f6a7b8c9-0019-0002-0001-000000000001',NULL,'V4','V4: Access Control','Controls ensuring that users can only access functions, data files, URLs, controllers, and services for which they have specific authorization.',NULL,'mandatory','ASVS Chapters',NULL,40,'2026-05-08 04:44:16'),('91e55712-4a98-11f1-8bc3-00155d012902','f6a7b8c9-0019-0002-0001-000000000001',NULL,'V5','V5: Validation, Sanitization, and Encoding','Controls ensuring all input is validated and sanitized; all output is encoded to prevent injection and XSS vulnerabilities.',NULL,'mandatory','ASVS Chapters',NULL,50,'2026-05-08 04:44:16'),('91e55877-4a98-11f1-8bc3-00155d012902','f6a7b8c9-0019-0002-0001-000000000001',NULL,'V6','V6: Stored Cryptography','Controls ensuring cryptographic modules are used correctly, keys are managed securely, and algorithms are appropriate for the data they protect.',NULL,'mandatory','ASVS Chapters',NULL,60,'2026-05-08 04:44:16'),('91e559de-4a98-11f1-8bc3-00155d012902','f6a7b8c9-0019-0002-0001-000000000001',NULL,'V7','V7: Error Handling and Logging','Controls ensuring that errors are handled securely without exposing sensitive information and that security events are logged appropriately.',NULL,'mandatory','ASVS Chapters',NULL,70,'2026-05-08 04:44:16'),('91e55b66-4a98-11f1-8bc3-00155d012902','f6a7b8c9-0019-0002-0001-000000000001',NULL,'V8','V8: Data Protection','Controls ensuring that sensitive data is protected in transit, at rest, and during processing; data minimization and lifecycle controls.',NULL,'mandatory','ASVS Chapters',NULL,80,'2026-05-08 04:44:16'),('91e55cdb-4a98-11f1-8bc3-00155d012902','f6a7b8c9-0019-0002-0001-000000000001',NULL,'V9','V9: Communication','Controls ensuring that communications are secure using TLS with appropriate cipher suites and certificate validation.',NULL,'mandatory','ASVS Chapters',NULL,90,'2026-05-08 04:44:16'),('91e55e60-4a98-11f1-8bc3-00155d012902','f6a7b8c9-0019-0002-0001-000000000001',NULL,'V10','V10: Malicious Code','Controls ensuring the application does not contain backdoors, Easter eggs, or logic bombs; defenses against timing attacks and side channels.',NULL,'mandatory','ASVS Chapters',NULL,100,'2026-05-08 04:44:16'),('91e55fcb-4a98-11f1-8bc3-00155d012902','f6a7b8c9-0019-0002-0001-000000000001',NULL,'V11','V11: Business Logic','Controls ensuring that business logic flows cannot be abused or circumvented, enforcing business rules and preventing fraud.',NULL,'mandatory','ASVS Chapters',NULL,110,'2026-05-08 04:44:16'),('91e56136-4a98-11f1-8bc3-00155d012902','f6a7b8c9-0019-0002-0001-000000000001',NULL,'V12','V12: Files and Resources','Controls ensuring that file uploads are validated and safely processed; protection against path traversal and file inclusion attacks.',NULL,'mandatory','ASVS Chapters',NULL,120,'2026-05-08 04:44:16'),('91e56296-4a98-11f1-8bc3-00155d012902','f6a7b8c9-0019-0002-0001-000000000001',NULL,'V13','V13: API and Web Service','Controls ensuring that web services and APIs are protected against common attacks including parameter pollution, mass assignment, and excessive data exposure.',NULL,'mandatory','ASVS Chapters',NULL,130,'2026-05-08 04:44:16'),('91e56547-4a98-11f1-8bc3-00155d012902','f6a7b8c9-0019-0002-0001-000000000001',NULL,'V14','V14: Configuration','Controls ensuring that application configuration is secure, components are up-to-date, and unneeded features are removed.',NULL,'mandatory','ASVS Chapters',NULL,140,'2026-05-08 04:44:16'),('91ee8eaa-4a98-11f1-8bc3-00155d012902','f6a7b8c9-0019-0003-0001-000000000001',NULL,'SAMM-G','Governance','Establishes security practices at the organizational level covering Strategy & Metrics, Policy & Compliance, and Education & Guidance practices.',NULL,'mandatory','SAMM Business Functions',NULL,10,'2026-05-08 04:44:16'),('91ee93a3-4a98-11f1-8bc3-00155d012902','f6a7b8c9-0019-0003-0001-000000000001',NULL,'SAMM-D','Design','Addresses software security from a design perspective covering Threat Assessment, Security Requirements, and Security Architecture practices.',NULL,'mandatory','SAMM Business Functions',NULL,20,'2026-05-08 04:44:16'),('91ee953f-4a98-11f1-8bc3-00155d012902','f6a7b8c9-0019-0003-0001-000000000001',NULL,'SAMM-I','Implementation','Covers secure coding practices including Secure Build, Secure Deployment, and Defect Management security practices.',NULL,'mandatory','SAMM Business Functions',NULL,30,'2026-05-08 04:44:16'),('91ee96c3-4a98-11f1-8bc3-00155d012902','f6a7b8c9-0019-0003-0001-000000000001',NULL,'SAMM-V','Verification','Covers security testing and review activities including Architecture Assessment, Requirements-driven Testing, and Security Testing practices.',NULL,'mandatory','SAMM Business Functions',NULL,40,'2026-05-08 04:44:16'),('91ee983c-4a98-11f1-8bc3-00155d012902','f6a7b8c9-0019-0003-0001-000000000001',NULL,'SAMM-O','Operations','Addresses security in production operations covering Incident Management, Environment Management, and Operational Management practices.',NULL,'mandatory','SAMM Business Functions',NULL,50,'2026-05-08 04:44:16'),('91fd9e96-4a98-11f1-8bc3-00155d012902','f6a7b8c9-0019-0004-0001-000000000001',NULL,'MASVS-STORAGE','MASVS-STORAGE: Storage','Requirements for securely storing sensitive data on mobile devices, covering encryption, key storage, and avoiding insecure storage locations.',NULL,'mandatory','MASVS Categories',NULL,10,'2026-05-08 04:44:16'),('91fda565-4a98-11f1-8bc3-00155d012902','f6a7b8c9-0019-0004-0001-000000000001',NULL,'MASVS-CRYPTO','MASVS-CRYPTO: Cryptography','Requirements for implementing cryptography correctly in mobile apps, covering algorithm selection, key management, and random number generation.',NULL,'mandatory','MASVS Categories',NULL,20,'2026-05-08 04:44:16'),('91fdea89-4a98-11f1-8bc3-00155d012902','f6a7b8c9-0019-0004-0001-000000000001',NULL,'MASVS-AUTH','MASVS-AUTH: Authentication and Authorization','Requirements for secure authentication and authorization in mobile applications, including local authentication and session management.',NULL,'mandatory','MASVS Categories',NULL,30,'2026-05-08 04:44:16'),('91fded09-4a98-11f1-8bc3-00155d012902','f6a7b8c9-0019-0004-0001-000000000001',NULL,'MASVS-NETWORK','MASVS-NETWORK: Network Communication','Requirements for securing network communications in mobile apps including TLS configuration, certificate validation, and traffic security.',NULL,'mandatory','MASVS Categories',NULL,40,'2026-05-08 04:44:16'),('91fdef43-4a98-11f1-8bc3-00155d012902','f6a7b8c9-0019-0004-0001-000000000001',NULL,'MASVS-PLATFORM','MASVS-PLATFORM: Platform Interaction','Requirements for secure interaction with the mobile platform APIs, IPC mechanisms, WebViews, and platform-provided security features.',NULL,'mandatory','MASVS Categories',NULL,50,'2026-05-08 04:44:16'),('91fdf193-4a98-11f1-8bc3-00155d012902','f6a7b8c9-0019-0004-0001-000000000001',NULL,'MASVS-CODE','MASVS-CODE: Code Quality','Requirements for secure coding practices, including input validation, memory management, and avoiding known insecure coding patterns.',NULL,'mandatory','MASVS Categories',NULL,60,'2026-05-08 04:44:16'),('91fdf487-4a98-11f1-8bc3-00155d012902','f6a7b8c9-0019-0004-0001-000000000001',NULL,'MASVS-RESILIENCE','MASVS-RESILIENCE: Resilience Against Reverse Engineering','Requirements for mobile app protections against reverse engineering and tampering, including anti-debugging, obfuscation, and integrity checks.',NULL,'recommended','MASVS Categories',NULL,70,'2026-05-08 04:44:16'),('91fe2217-4a98-11f1-8bc3-00155d012902','f6a7b8c9-0019-0004-0001-000000000001',NULL,'MASVS-PRIVACY','MASVS-PRIVACY: Privacy','Requirements for protecting user privacy in mobile applications, covering data minimization, consent, and transparency of data practices.',NULL,'mandatory','MASVS Categories',NULL,80,'2026-05-08 04:44:16'),('92197a7e-4a98-11f1-8bc3-00155d012902','f6a7b8c9-0019-0005-0001-000000000001',NULL,'TA0043','Reconnaissance','Adversary is trying to gather information to plan future operations; techniques include active scanning, phishing for information, and gathering victim identity information.',NULL,'mandatory','ATT&CK Tactics',NULL,10,'2026-05-08 04:44:17'),('92198041-4a98-11f1-8bc3-00155d012902','f6a7b8c9-0019-0005-0001-000000000001',NULL,'TA0042','Resource Development','Adversary is trying to establish resources to support operations; techniques include acquiring infrastructure, compromising accounts, and developing capabilities.',NULL,'mandatory','ATT&CK Tactics',NULL,20,'2026-05-08 04:44:17'),('921981e0-4a98-11f1-8bc3-00155d012902','f6a7b8c9-0019-0005-0001-000000000001',NULL,'TA0001','Initial Access','Adversary is trying to get into the network; techniques include phishing, exploiting public-facing applications, supply chain compromise, and drive-by compromise.',NULL,'mandatory','ATT&CK Tactics',NULL,30,'2026-05-08 04:44:17'),('9219836f-4a98-11f1-8bc3-00155d012902','f6a7b8c9-0019-0005-0001-000000000001',NULL,'TA0002','Execution','Adversary is trying to run malicious code; techniques include command and scripting interpreters, scheduled tasks, and exploitation for code execution.',NULL,'mandatory','ATT&CK Tactics',NULL,40,'2026-05-08 04:44:17'),('921984ee-4a98-11f1-8bc3-00155d012902','f6a7b8c9-0019-0005-0001-000000000001',NULL,'TA0003','Persistence','Adversary is trying to maintain their foothold; techniques include creating accounts, boot/logon autostart execution, and modifying authentication processes.',NULL,'mandatory','ATT&CK Tactics',NULL,50,'2026-05-08 04:44:17'),('9219865e-4a98-11f1-8bc3-00155d012902','f6a7b8c9-0019-0005-0001-000000000001',NULL,'TA0004','Privilege Escalation','Adversary is trying to gain higher-level permissions; techniques include access token manipulation, exploitation, and abuse of elevation control mechanisms.',NULL,'mandatory','ATT&CK Tactics',NULL,60,'2026-05-08 04:44:17'),('921987c3-4a98-11f1-8bc3-00155d012902','f6a7b8c9-0019-0005-0001-000000000001',NULL,'TA0005','Defense Evasion','Adversary is trying to avoid being detected; techniques include obfuscating code, disabling security tools, masquerading, and indicator removal.',NULL,'mandatory','ATT&CK Tactics',NULL,70,'2026-05-08 04:44:17'),('9219892c-4a98-11f1-8bc3-00155d012902','f6a7b8c9-0019-0005-0001-000000000001',NULL,'TA0006','Credential Access','Adversary is trying to steal account names and passwords; techniques include brute force, credential dumping, and keylogging.',NULL,'mandatory','ATT&CK Tactics',NULL,80,'2026-05-08 04:44:17'),('92198a96-4a98-11f1-8bc3-00155d012902','f6a7b8c9-0019-0005-0001-000000000001',NULL,'TA0007','Discovery','Adversary is trying to figure out the environment; techniques include account discovery, network scanning, and system information gathering.',NULL,'mandatory','ATT&CK Tactics',NULL,90,'2026-05-08 04:44:17'),('92198bfd-4a98-11f1-8bc3-00155d012902','f6a7b8c9-0019-0005-0001-000000000001',NULL,'TA0008','Lateral Movement','Adversary is trying to move through the environment; techniques include exploitation of remote services, pass-the-hash, and remote desktop hijacking.',NULL,'mandatory','ATT&CK Tactics',NULL,100,'2026-05-08 04:44:17'),('92198d5b-4a98-11f1-8bc3-00155d012902','f6a7b8c9-0019-0005-0001-000000000001',NULL,'TA0009','Collection','Adversary is trying to gather data of interest; techniques include accessing local files, email collection, screen capture, and keylogging.',NULL,'mandatory','ATT&CK Tactics',NULL,110,'2026-05-08 04:44:17'),('92198ec2-4a98-11f1-8bc3-00155d012902','f6a7b8c9-0019-0005-0001-000000000001',NULL,'TA0011','Command and Control (C2)','Adversary is trying to communicate with compromised systems; techniques include application layer protocols, encrypted channels, and web service abuse.',NULL,'mandatory','ATT&CK Tactics',NULL,120,'2026-05-08 04:44:17'),('9219902d-4a98-11f1-8bc3-00155d012902','f6a7b8c9-0019-0005-0001-000000000001',NULL,'TA0010','Exfiltration','Adversary is trying to steal data; techniques include automated exfiltration, data compression, transfer size limits, and alternative protocols.',NULL,'mandatory','ATT&CK Tactics',NULL,130,'2026-05-08 04:44:17'),('92199194-4a98-11f1-8bc3-00155d012902','f6a7b8c9-0019-0005-0001-000000000001',NULL,'TA0040','Impact','Adversary is trying to manipulate, interrupt, or destroy systems and data; techniques include data encryption (ransomware), defacement, and denial of service.',NULL,'mandatory','ATT&CK Tactics',NULL,140,'2026-05-08 04:44:17'),('92270e06-4a98-11f1-8bc3-00155d012902','f6a7b8c9-0019-0006-0001-000000000001',NULL,'D3-HD','Harden','Increase the difficulty of adversary exploitation by reducing attack surface through hardening techniques like credential hardening and message hardening.',NULL,'mandatory','D3FEND Tactics',NULL,10,'2026-05-08 04:44:17'),('922715a7-4a98-11f1-8bc3-00155d012902','f6a7b8c9-0019-0006-0001-000000000001',NULL,'D3-DT','Detect','Identify adversary presence or actions through detection techniques including file analysis, identifier analysis, network traffic analysis, and user behavior analysis.',NULL,'mandatory','D3FEND Tactics',NULL,20,'2026-05-08 04:44:17'),('92271828-4a98-11f1-8bc3-00155d012902','f6a7b8c9-0019-0006-0001-000000000001',NULL,'D3-IS','Isolate','Create logical or physical barriers between compromised components and the rest of the network using network isolation, execution isolation, and enclave creation.',NULL,'mandatory','D3FEND Tactics',NULL,30,'2026-05-08 04:44:17'),('922719e1-4a98-11f1-8bc3-00155d012902','f6a7b8c9-0019-0006-0001-000000000001',NULL,'D3-DC','Deceive','Mislead or misdirect adversaries using decoy techniques such as honeypots, decoy files, and lure credentials to detect and study attacker activity.',NULL,'recommended','D3FEND Tactics',NULL,40,'2026-05-08 04:44:17'),('92271b6c-4a98-11f1-8bc3-00155d012902','f6a7b8c9-0019-0006-0001-000000000001',NULL,'D3-EV','Evict','Remove adversaries from networks and systems through restoration and eviction techniques including file restoration, credential eviction, and process termination.',NULL,'mandatory','D3FEND Tactics',NULL,50,'2026-05-08 04:44:17'),('92319f6e-4a98-11f1-8bc3-00155d012902','f6a7b8c9-0019-0007-0001-000000000001',NULL,'BSIMM-GV','Governance (Strategy, Metrics, Compliance & Policy, Training)','Practices for organizing, managing, and measuring a software security program including executive support, metrics, compliance gates, and security training.',NULL,'mandatory','BSIMM Domains',NULL,10,'2026-05-08 04:44:17'),('9231a6fb-4a98-11f1-8bc3-00155d012902','f6a7b8c9-0019-0007-0001-000000000001',NULL,'BSIMM-IN','Intelligence (Attack Models, Security Features & Design, Standards & Requirements)','Practices for creating and using proactive security intelligence including threat modeling, security feature libraries, and regulatory requirements gathering.',NULL,'mandatory','BSIMM Domains',NULL,20,'2026-05-08 04:44:17'),('9231a8b2-4a98-11f1-8bc3-00155d012902','f6a7b8c9-0019-0007-0001-000000000001',NULL,'BSIMM-ST','SSDL Touchpoints (Architecture Analysis, Code Review, Security Testing, Penetration Testing)','Practices that are applied to software artifacts and carry out analysis and testing throughout the software development lifecycle.',NULL,'mandatory','BSIMM Domains',NULL,30,'2026-05-08 04:44:17'),('9231aa42-4a98-11f1-8bc3-00155d012902','f6a7b8c9-0019-0007-0001-000000000001',NULL,'BSIMM-DP','Deployment (Vulnerability Management, Environment Hardening, Configuration Management & Vulnerability Response)','Practices that govern software configuration, patch management, vulnerability disclosure handling, and operational security monitoring.',NULL,'mandatory','BSIMM Domains',NULL,40,'2026-05-08 04:44:17'),('923c83e6-4a98-11f1-8bc3-00155d012902','f6a7b8c9-0019-0008-0001-000000000001',NULL,'CIS-OS','Operating System Benchmarks','Configuration hardening guidelines for Windows Server/Desktop, Linux distributions (Ubuntu, RHEL, Debian), and macOS.',NULL,'mandatory','CIS Benchmark Categories',NULL,10,'2026-05-08 04:44:17'),('923c88db-4a98-11f1-8bc3-00155d012902','f6a7b8c9-0019-0008-0001-000000000001',NULL,'CIS-CLOUD','Cloud Provider Benchmarks','Security configuration baselines for AWS, Microsoft Azure, and Google Cloud Platform, covering identity, storage, networking, and monitoring.',NULL,'mandatory','CIS Benchmark Categories',NULL,20,'2026-05-08 04:44:17'),('923c8a8c-4a98-11f1-8bc3-00155d012902','f6a7b8c9-0019-0008-0001-000000000001',NULL,'CIS-NET','Network Device Benchmarks','Hardening guidelines for network devices including Cisco IOS, Juniper, Palo Alto, and F5 devices.',NULL,'mandatory','CIS Benchmark Categories',NULL,30,'2026-05-08 04:44:17'),('923c8c17-4a98-11f1-8bc3-00155d012902','f6a7b8c9-0019-0008-0001-000000000001',NULL,'CIS-SRV','Server Software Benchmarks','Configuration guidelines for web servers (Apache, Nginx, IIS), database servers (MySQL, PostgreSQL, MSSQL, Oracle), and middleware.',NULL,'mandatory','CIS Benchmark Categories',NULL,40,'2026-05-08 04:44:17'),('923c8db9-4a98-11f1-8bc3-00155d012902','f6a7b8c9-0019-0008-0001-000000000001',NULL,'CIS-DESK','Desktop Software Benchmarks','Hardening guidelines for desktop applications including web browsers (Chrome, Edge, Firefox), Microsoft Office, and productivity tools.',NULL,'recommended','CIS Benchmark Categories',NULL,50,'2026-05-08 04:44:17'),('923c8f34-4a98-11f1-8bc3-00155d012902','f6a7b8c9-0019-0008-0001-000000000001',NULL,'CIS-MOB','Mobile Device Benchmarks','Configuration guidelines for iOS and Android devices including device management settings, app permissions, and enterprise enrollment.',NULL,'recommended','CIS Benchmark Categories',NULL,60,'2026-05-08 04:44:17'),('92441606-4a98-11f1-8bc3-00155d012902','f6a7b8c9-0019-0009-0001-000000000001',NULL,'STAR-L1','Level 1: STAR Self-Assessment','CSPs self-assess their security controls against the CCM or CAIQ and publish results to the CSA STAR Registry; free and open to all CSPs.',NULL,'recommended','CSA STAR Levels',NULL,10,'2026-05-08 04:44:17'),('92441bbe-4a98-11f1-8bc3-00155d012902','f6a7b8c9-0019-0009-0001-000000000001',NULL,'STAR-L2','Level 2: STAR Certification and Attestation','CSPs undergo independent third-party assessment resulting in STAR Certification (based on ISO 27001) or STAR Attestation (based on SOC 2).',NULL,'mandatory','CSA STAR Levels',NULL,20,'2026-05-08 04:44:17'),('92441d6c-4a98-11f1-8bc3-00155d012902','f6a7b8c9-0019-0009-0001-000000000001',NULL,'STAR-L3','Level 3: STAR Continuous Monitoring','Advanced STAR program providing real-time security posture monitoring against CCM controls with automated, continuous assurance reporting.',NULL,'recommended','CSA STAR Levels',NULL,30,'2026-05-08 04:44:17'),('92526504-4a98-11f1-8bc3-00155d012902','f6a7b8c9-0019-0010-0001-000000000001',NULL,'ZT-ID','Pillar: Identity','Establish a dynamic and contextual identity verification for all users, service accounts, and non-person entities before granting access to resources.',NULL,'mandatory','CISA ZT Pillars',NULL,10,'2026-05-08 04:44:17'),('92526b42-4a98-11f1-8bc3-00155d012902','f6a7b8c9-0019-0010-0001-000000000001',NULL,'ZT-DEV','Pillar: Devices','Ensure all endpoints (managed, unmanaged, IoT) are known, validated, monitored, and compliant before being granted access to enterprise resources.',NULL,'mandatory','CISA ZT Pillars',NULL,20,'2026-05-08 04:44:17'),('92526cf1-4a98-11f1-8bc3-00155d012902','f6a7b8c9-0019-0010-0001-000000000001',NULL,'ZT-NET','Pillar: Networks','Segment networks to limit lateral movement, encrypt all traffic, and implement software-defined perimeters and microsegmentation.',NULL,'mandatory','CISA ZT Pillars',NULL,30,'2026-05-08 04:44:17'),('92526e75-4a98-11f1-8bc3-00155d012902','f6a7b8c9-0019-0010-0001-000000000001',NULL,'ZT-APP','Pillar: Applications and Workloads','Protect applications and workloads across on-premises, hybrid, and multi-cloud environments with continuous authorization and runtime protection.',NULL,'mandatory','CISA ZT Pillars',NULL,40,'2026-05-08 04:44:17'),('92526ff2-4a98-11f1-8bc3-00155d012902','f6a7b8c9-0019-0010-0001-000000000001',NULL,'ZT-DAT','Pillar: Data','Categorize, label, and protect all data at rest, in transit, and in use using encryption, rights management, and data loss prevention controls.',NULL,'mandatory','CISA ZT Pillars',NULL,50,'2026-05-08 04:44:17'),('92527153-4a98-11f1-8bc3-00155d012902','f6a7b8c9-0019-0010-0001-000000000001',NULL,'ZT-VIS','Cross-Cutting: Visibility and Analytics','Maintain comprehensive visibility into all activities across the environment to detect anomalies, measure ZT effectiveness, and enable data-driven decisions.',NULL,'mandatory','CISA ZT Cross-Cutting',NULL,60,'2026-05-08 04:44:17'),('925272c5-4a98-11f1-8bc3-00155d012902','f6a7b8c9-0019-0010-0001-000000000001',NULL,'ZT-AUT','Cross-Cutting: Automation and Orchestration','Automate security responses and orchestrate workflows across all ZT pillars to reduce human latency and improve consistency of policy enforcement.',NULL,'mandatory','CISA ZT Cross-Cutting',NULL,70,'2026-05-08 04:44:17'),('92527430-4a98-11f1-8bc3-00155d012902','f6a7b8c9-0019-0010-0001-000000000001',NULL,'ZT-GOV','Cross-Cutting: Governance','Establish ZT governance including policies, standards, roles, and accountability structures to guide the ZT transformation program.',NULL,'mandatory','CISA ZT Cross-Cutting',NULL,80,'2026-05-08 04:44:17'),('925b6b74-4a98-11f1-8bc3-00155d012902','f6a7b8c9-0019-0011-0001-000000000001',NULL,'NSA-ZT-U','User Pillar','Continuously validate users through multi-factor authentication, behavioral analytics, and dynamic access decisions based on user context and risk.',NULL,'mandatory','NSA ZT Pillars',NULL,10,'2026-05-08 04:44:17'),('925b706a-4a98-11f1-8bc3-00155d012902','f6a7b8c9-0019-0011-0001-000000000001',NULL,'NSA-ZT-D','Device Pillar','Ensure all devices accessing resources are inventoried, authenticated, and comply with health requirements before access is granted.',NULL,'mandatory','NSA ZT Pillars',NULL,20,'2026-05-08 04:44:17'),('925b7207-4a98-11f1-8bc3-00155d012902','f6a7b8c9-0019-0011-0001-000000000001',NULL,'NSA-ZT-NE','Network/Environment Pillar','Segment and isolate network environments, encrypt all traffic, and restrict lateral movement through dynamic access controls.',NULL,'mandatory','NSA ZT Pillars',NULL,30,'2026-05-08 04:44:17'),('925b738e-4a98-11f1-8bc3-00155d012902','f6a7b8c9-0019-0011-0001-000000000001',NULL,'NSA-ZT-AW','Application and Workload Pillar','Apply secure access controls to all applications and workloads, validate app integrity, and implement runtime protection.',NULL,'mandatory','NSA ZT Pillars',NULL,40,'2026-05-08 04:44:17'),('925b7505-4a98-11f1-8bc3-00155d012902','f6a7b8c9-0019-0011-0001-000000000001',NULL,'NSA-ZT-DA','Data Pillar','Classify, label, and protect all data assets; enforce data-centric security policies regardless of data location.',NULL,'mandatory','NSA ZT Pillars',NULL,50,'2026-05-08 04:44:17'),('9267aee3-4a98-11f1-8bc3-00155d012902','f6a7b8c9-0019-0012-0001-000000000001',NULL,'ZTA-1','All data sources and computing services are resources','All enterprise resources must be treated as resources, regardless of physical location or whether they are on or off the enterprise-owned network.',NULL,'mandatory','ZTA Tenets',NULL,10,'2026-05-08 04:44:17'),('9267b34d-4a98-11f1-8bc3-00155d012902','f6a7b8c9-0019-0012-0001-000000000001',NULL,'ZTA-2','All communication is secured regardless of network location','Network location alone does not imply trust; all communication must be secured with the goal of securing the data in motion.',NULL,'mandatory','ZTA Tenets',NULL,20,'2026-05-08 04:44:17'),('9267b501-4a98-11f1-8bc3-00155d012902','f6a7b8c9-0019-0012-0001-000000000001',NULL,'ZTA-3','Access to individual enterprise resources is granted per-session with least privilege','Access is granted on a per-request basis with least privilege; requestors must justify the access they need for each session.',NULL,'mandatory','ZTA Tenets',NULL,30,'2026-05-08 04:44:17'),('92692798-4a98-11f1-8bc3-00155d012902','f6a7b8c9-0019-0012-0001-000000000001',NULL,'ZTA-4','Access to resources is determined by dynamic policy','Access policy is based on client identity, application, requesting asset state, and behavioral/environmental attributes gathered and measured.',NULL,'mandatory','ZTA Tenets',NULL,40,'2026-05-08 04:44:17'),('92692bf2-4a98-11f1-8bc3-00155d012902','f6a7b8c9-0019-0012-0001-000000000001',NULL,'ZTA-5','The enterprise monitors and measures the integrity and security posture of all assets','All owned and associated assets are continuously monitored and measured for security posture, which informs access decisions.',NULL,'mandatory','ZTA Tenets',NULL,50,'2026-05-08 04:44:17'),('92692ee0-4a98-11f1-8bc3-00155d012902','f6a7b8c9-0019-0012-0001-000000000001',NULL,'ZTA-6','All resource authentication and authorization are dynamic and strictly enforced before access is allowed','Authentication and authorization are continuous processes that re-evaluate before each access request is granted; no standing trust.',NULL,'mandatory','ZTA Tenets',NULL,60,'2026-05-08 04:44:17'),('927d84c2-4a98-11f1-8bc3-00155d012902','f6a7b8c9-0019-0013-0001-000000000001',NULL,'SCF-PRI','Privacy (PRI)','Controls addressing privacy program governance, data subject rights, consent management, and privacy by design principles.',NULL,'mandatory','SCF Domains',NULL,10,'2026-05-08 04:44:17'),('927d8aaa-4a98-11f1-8bc3-00155d012902','f6a7b8c9-0019-0013-0001-000000000001',NULL,'SCF-GOV','Security & Privacy Governance (GOV)','Controls establishing security and privacy governance structures, policies, standards, and executive accountability.',NULL,'mandatory','SCF Domains',NULL,20,'2026-05-08 04:44:17'),('927d8c44-4a98-11f1-8bc3-00155d012902','f6a7b8c9-0019-0013-0001-000000000001',NULL,'SCF-OPS','Security Operations (OPS)','Controls governing day-to-day security operations including change management, patch management, and operational procedures.',NULL,'mandatory','SCF Domains',NULL,30,'2026-05-08 04:44:17'),('927d8dc4-4a98-11f1-8bc3-00155d012902','f6a7b8c9-0019-0013-0001-000000000001',NULL,'SCF-IAM','Identity & Access Management (IAM)','Controls for managing digital identities, authentication, authorization, and privileged access across the enterprise.',NULL,'mandatory','SCF Domains',NULL,40,'2026-05-08 04:44:17'),('927d8f3e-4a98-11f1-8bc3-00155d012902','f6a7b8c9-0019-0013-0001-000000000001',NULL,'SCF-AST','Asset Management (AST)','Controls for identifying, classifying, and managing hardware and software assets throughout their lifecycle.',NULL,'mandatory','SCF Domains',NULL,50,'2026-05-08 04:44:17'),('927d90ac-4a98-11f1-8bc3-00155d012902','f6a7b8c9-0019-0013-0001-000000000001',NULL,'SCF-CFG','Configuration Management (CFG)','Controls for establishing secure baselines and managing configuration changes to systems and applications.',NULL,'mandatory','SCF Domains',NULL,60,'2026-05-08 04:44:17'),('927d9210-4a98-11f1-8bc3-00155d012902','f6a7b8c9-0019-0013-0001-000000000001',NULL,'SCF-VPM','Vulnerability & Patch Management (VPM)','Controls for identifying vulnerabilities, tracking remediation, and managing the patching lifecycle.',NULL,'mandatory','SCF Domains',NULL,70,'2026-05-08 04:44:17'),('927d9377-4a98-11f1-8bc3-00155d012902','f6a7b8c9-0019-0013-0001-000000000001',NULL,'SCF-DCH','Data Classification & Handling (DCH)','Controls for classifying, labeling, and handling data based on sensitivity throughout its lifecycle.',NULL,'mandatory','SCF Domains',NULL,80,'2026-05-08 04:44:17'),('927d94d9-4a98-11f1-8bc3-00155d012902','f6a7b8c9-0019-0013-0001-000000000001',NULL,'SCF-CRY','Cryptographic Protections (CRY)','Controls for using cryptographic algorithms, key management, and certificate management to protect data.',NULL,'mandatory','SCF Domains',NULL,90,'2026-05-08 04:44:17'),('927d963a-4a98-11f1-8bc3-00155d012902','f6a7b8c9-0019-0013-0001-000000000001',NULL,'SCF-NET','Network Security (NET)','Controls for securing network infrastructure including segmentation, monitoring, filtering, and boundary protection.',NULL,'mandatory','SCF Domains',NULL,100,'2026-05-08 04:44:17'),('927d9796-4a98-11f1-8bc3-00155d012902','f6a7b8c9-0019-0013-0001-000000000001',NULL,'SCF-END','Endpoint Security (END)','Controls for securing end-user devices including workstations, laptops, mobile devices, and IoT endpoints.',NULL,'mandatory','SCF Domains',NULL,110,'2026-05-08 04:44:17'),('927d9928-4a98-11f1-8bc3-00155d012902','f6a7b8c9-0019-0013-0001-000000000001',NULL,'SCF-IRO','Incident Response (IRO)','Controls for preparing for, detecting, responding to, and recovering from security incidents.',NULL,'mandatory','SCF Domains',NULL,120,'2026-05-08 04:44:17'),('927d9a8b-4a98-11f1-8bc3-00155d012902','f6a7b8c9-0019-0013-0001-000000000001',NULL,'SCF-BCR','Business Continuity & Disaster Recovery (BCR)','Controls for ensuring business continuity and the ability to recover from disruptive events.',NULL,'mandatory','SCF Domains',NULL,130,'2026-05-08 04:44:17'),('927d9bf2-4a98-11f1-8bc3-00155d012902','f6a7b8c9-0019-0013-0001-000000000001',NULL,'SCF-TPM','Third-Party Management (TPM)','Controls for assessing and managing cybersecurity risks associated with third-party vendors and service providers.',NULL,'mandatory','SCF Domains',NULL,140,'2026-05-08 04:44:17'),('927d9d4e-4a98-11f1-8bc3-00155d012902','f6a7b8c9-0019-0013-0001-000000000001',NULL,'SCF-HRS','Human Resources Security (HRS)','Controls for managing personnel security including screening, onboarding, role-based training, and termination procedures.',NULL,'mandatory','SCF Domains',NULL,150,'2026-05-08 04:44:17'),('92854816-4a98-11f1-8bc3-00155d012902','f6a7b8c9-0019-0014-0001-000000000001',NULL,'UCF-AD','Authority Documents','Catalog and map all applicable laws, regulations, standards, and contractual requirements (authority documents) relevant to the organization.',NULL,'mandatory','UCF Components',NULL,10,'2026-05-08 04:44:17'),('92854ddd-4a98-11f1-8bc3-00155d012902','f6a7b8c9-0019-0014-0001-000000000001',NULL,'UCF-CC','Common Controls','Identify the harmonized set of common controls derived from mapping across all authority documents to eliminate redundancy in compliance activities.',NULL,'mandatory','UCF Components',NULL,20,'2026-05-08 04:44:17'),('92854f97-4a98-11f1-8bc3-00155d012902','f6a7b8c9-0019-0014-0001-000000000001',NULL,'UCF-CM','Compliance Mandates Mapping','Map organizational controls and evidence to multiple compliance mandates simultaneously using the UCF\'s unified control hierarchy.',NULL,'mandatory','UCF Components',NULL,30,'2026-05-08 04:44:17'),('93c9b683-2438-437b-8bc5-6db8a529ed85','a28c08f1-4113-11f1-8bc3-00155d012902',NULL,'8','Identify Users and Authenticate Access to System Components',NULL,NULL,'mandatory','Identity & Authentication',NULL,7,'2026-04-26 02:00:01'),('94b1c811-d3d6-457b-861b-a5d8974b821c','a23072ef-4113-11f1-8bc3-00155d012902',NULL,'1798.155','Privacy notice requirements','A business shall provide a clear and conspicuous privacy notice in its privacy policy listing all categories of personal information it has collected, used, disclosed, and sold.',NULL,'mandatory','Notice & Disclosure',NULL,10,'2026-04-26 02:00:00'),('96a1e3cc-6d81-4141-8b1a-85c3e098ecbb','a23897c7-4113-11f1-8bc3-00155d012902','0caaab79-0896-4807-824d-e108deabd590','SYSC.5.2','Competence','Ensure that relevant persons are competent for the functions they perform on behalf of the firm.',NULL,'mandatory',NULL,NULL,1,'2026-04-26 02:00:00'),('96db172b-02b2-4e11-a035-4d6220a89391','a25c0c03-4113-11f1-8bc3-00155d012902','e925195e-a5f8-4a84-8823-6df95025e13c','A.5.30','ICT readiness for business continuity','ICT readiness shall be planned, implemented, maintained and tested.',NULL,'mandatory',NULL,NULL,5,'2026-04-26 02:00:01'),('976cefa2-e53a-4640-a134-5ba86bbb9cc4','a2a4e62d-4113-11f1-8bc3-00155d012902','70c5341a-f6dd-451b-b95f-c5c470aa59f6','CC8.1','Infrastructure changes','The entity authorizes, designs, develops or acquires, configures, documents, tests, approves, and implements changes.',NULL,'mandatory',NULL,NULL,0,'2026-04-26 02:00:01'),('98cda75f-a0f8-413c-8ed3-9803da10936a','a25c0c03-4113-11f1-8bc3-00155d012902','215be14c-3698-4fce-a463-7aab14e4f886','4.3','Determining the scope of the ISMS','Determine the boundaries and applicability of the ISMS.',NULL,'mandatory',NULL,NULL,2,'2026-04-26 02:00:00'),('98f57a32-5bff-4d0c-b351-f92133d0aebf','a23072ef-4113-11f1-8bc3-00155d012902',NULL,'1798.140','Definitions and Scope','Applies to for-profit businesses that collect consumers\' personal information and meet one of the thresholds: gross annual revenue over $25M, buy/sell/receive/share personal information of 50,000+ consumers annually, or derive 50%+ of annual revenues from selling consumers\' personal information.',NULL,'mandatory','Scope',NULL,8,'2026-04-26 02:00:00'),('9a066afd-5f17-4954-94d8-b0d697d32a1c','a25c0c03-4113-11f1-8bc3-00155d012902','b5d335e2-66ea-4a33-b65f-e52f9b7ce7d6','7.1','Resources','Determine and provide the resources needed for the establishment, implementation, maintenance and improvement of the ISMS.',NULL,'mandatory',NULL,NULL,0,'2026-04-26 02:00:00'),('9a6ad900-f313-4361-81f2-e213dee85f8f','a25c0c03-4113-11f1-8bc3-00155d012902','027f0ae9-f18e-4e27-8220-f26fd61315bd','9.1','Monitoring, measurement, analysis and evaluation','Evaluate the performance and effectiveness of the ISMS.',NULL,'mandatory',NULL,NULL,0,'2026-04-26 02:00:01'),('9b795395-49b7-4119-ab26-ce886c54c756','a25c0c03-4113-11f1-8bc3-00155d012902','0150df3e-fae7-4486-a453-7feef34846d6','6.3','Planning of changes','Changes to the ISMS shall be carried out in a planned manner.',NULL,'mandatory',NULL,NULL,2,'2026-04-26 02:00:00'),('9beb5fb3-7b12-4817-8c24-ca66ab9e0771','a25c0c03-4113-11f1-8bc3-00155d012902','e925195e-a5f8-4a84-8823-6df95025e13c','A.5.2','Information security roles and responsibilities','Roles and responsibilities for information security shall be defined and allocated.',NULL,'mandatory',NULL,NULL,1,'2026-04-26 02:00:01'),('9c40f088-0a1b-44a5-9ecc-54aa14e5b34f','a29cdc11-4113-11f1-8bc3-00155d012902','5aebac90-5ffb-42fa-b19e-8a6c8d5b1198','S19.7','Legitimate interest','Processing necessary for legitimate interests of the controller or third party.',NULL,'mandatory',NULL,NULL,2,'2026-04-26 02:00:01'),('9f0782aa-7fca-41d5-9cb8-b20475d79d40','a2a4e62d-4113-11f1-8bc3-00155d012902','34e539d9-3e70-4253-9e88-27714276f81b','CC6.3','Access roles and responsibilities','The entity authorizes, modifies, or removes access to data, software, functions, and other protected information assets based on roles.',NULL,'mandatory',NULL,NULL,2,'2026-04-26 02:00:01'),('a1bcbd48-afea-4e16-b19e-d810727b604c','a25c0c03-4113-11f1-8bc3-00155d012902',NULL,'5','Leadership',NULL,NULL,'mandatory','Leadership & Commitment',NULL,1,'2026-04-26 02:00:00'),('a46cf7bf-5a2d-4e50-b0c5-6355a7981650','a271e304-4113-11f1-8bc3-00155d012902','b2390b23-4231-4a58-92e2-ca248bc259bf','4.2','Technology risk management policies and procedures','Maintain comprehensive and robust technology risk management policies and procedures.',NULL,'mandatory',NULL,NULL,1,'2026-04-26 02:00:01'),('a58eda05-4e9b-4dfd-a278-5b9a7c876e25','a25c0c03-4113-11f1-8bc3-00155d012902','027f0ae9-f18e-4e27-8220-f26fd61315bd','9.3','Management review','Top management shall review the organization\'s ISMS at planned intervals.',NULL,'mandatory',NULL,NULL,2,'2026-04-26 02:00:01'),('a61c8c56-19d2-4d87-a9eb-d852e13dd463','a28c08f1-4113-11f1-8bc3-00155d012902','f29f6a69-1b83-468a-99ca-41ddfff15d47','3.2','Storage of account data is kept to a minimum',NULL,NULL,'mandatory',NULL,NULL,1,'2026-04-26 02:00:01'),('a71048de-fa12-4938-96e1-3863c7c35cb9','a271e304-4113-11f1-8bc3-00155d012902','57005d4f-844e-4b48-bdab-6a8d38faee31','3.4','Chief Information Security Officer responsibilities','The CISO is responsible for the overall management of information security risks.',NULL,'mandatory',NULL,NULL,3,'2026-04-26 02:00:01'),('a7f201f5-2f9a-4e67-a7ca-5740d5f67f03','a23897c7-4113-11f1-8bc3-00155d012902',NULL,'SYSC.13','Operational risk',NULL,NULL,'mandatory','Operational Risk',NULL,6,'2026-04-26 02:00:00'),('a832c8b1-ee93-4fbf-a1b6-f031f5de741e','a27eef01-4113-11f1-8bc3-00155d012902','69d65d36-46ec-431d-9f7e-3eac15afb93d','GV.OV','Oversight','Results of organization-wide cybersecurity risk management activities and performance are used to inform, improve, and adjust.',NULL,'mandatory',NULL,NULL,4,'2026-04-26 02:00:01'),('a913aa05-0e41-451b-aff7-b308eec5c898','a28c08f1-4113-11f1-8bc3-00155d012902','855a22a9-6c60-4ae6-a21a-c27f6206e634','10.5','Retain audit log history for at least 12 months',NULL,NULL,'mandatory',NULL,NULL,2,'2026-04-26 02:00:01'),('a9280d23-a417-480c-8b0f-c9a31f67367f','a29cdc11-4113-11f1-8bc3-00155d012902','dde99a31-7141-4f43-96a5-e46655833a3f','S40.3','Data breach notification','Notify the PDPC of a personal data breach without delay, and not later than 72 hours after becoming aware.',NULL,'mandatory',NULL,NULL,1,'2026-04-26 02:00:01'),('aa10b27d-d4f1-4659-8d3c-2c5694708411','a27eef01-4113-11f1-8bc3-00155d012902','69d65d36-46ec-431d-9f7e-3eac15afb93d','GV.RM','Risk Management Strategy','The organization\'s priorities, constraints, risk tolerance and appetite statements, and assumptions are established, communicated, and used.',NULL,'mandatory',NULL,NULL,1,'2026-04-26 02:00:01'),('ab51c460-1e0d-42dc-ab75-814c52efcbd1','d4e5f6a1-b2c3-4d4e-8f6a-1b2c3d4e5f6a',NULL,'164.308','Administrative Safeguards',NULL,NULL,'mandatory','Security Rule - Administrative',NULL,0,'2026-04-26 02:00:00'),('aeb68f9b-1470-4a0d-b475-d07416b4629c','a27eef01-4113-11f1-8bc3-00155d012902',NULL,'RC','RECOVER','Assets and operations affected by a cybersecurity incident are restored.',NULL,'mandatory','Recover',NULL,5,'2026-04-26 02:00:01'),('aecb9072-400e-11f1-8bc3-00155d012902','a1b2c3d4-e5f6-4a1b-8c3d-4e5f6a1b2c3d',NULL,'CC1','Control Environment','The entity demonstrates a commitment to integrity and ethical values.',NULL,'mandatory','Common Criteria',NULL,10,'2026-04-24 18:52:03'),('aecb96d7-400e-11f1-8bc3-00155d012902','a1b2c3d4-e5f6-4a1b-8c3d-4e5f6a1b2c3d',NULL,'CC2','Communication and Information','The entity obtains or generates and uses relevant, quality information to support the functioning of internal control.',NULL,'mandatory','Common Criteria',NULL,20,'2026-04-24 18:52:03'),('aecb9ce0-400e-11f1-8bc3-00155d012902','a1b2c3d4-e5f6-4a1b-8c3d-4e5f6a1b2c3d',NULL,'CC3','Risk Assessment','The entity specifies objectives with sufficient clarity to enable the identification and assessment of risks.',NULL,'mandatory','Common Criteria',NULL,30,'2026-04-24 18:52:03'),('aecba2df-400e-11f1-8bc3-00155d012902','a1b2c3d4-e5f6-4a1b-8c3d-4e5f6a1b2c3d',NULL,'CC4','Monitoring Activities','The entity selects, develops, and performs ongoing evaluations to ascertain whether the components of internal control are present and functioning.',NULL,'mandatory','Common Criteria',NULL,40,'2026-04-24 18:52:03'),('aecc11c7-400e-11f1-8bc3-00155d012902','a1b2c3d4-e5f6-4a1b-8c3d-4e5f6a1b2c3d',NULL,'CC5','Control Activities','The entity selects and develops control activities that contribute to the mitigation of risks.',NULL,'mandatory','Common Criteria',NULL,50,'2026-04-24 18:52:03'),('aecc1819-400e-11f1-8bc3-00155d012902','a1b2c3d4-e5f6-4a1b-8c3d-4e5f6a1b2c3d',NULL,'CC6','Logical and Physical Access Controls','The entity implements logical access security software, infrastructure, and architectures.',NULL,'mandatory','Common Criteria',NULL,60,'2026-04-24 18:52:03'),('aecc1dc8-400e-11f1-8bc3-00155d012902','a1b2c3d4-e5f6-4a1b-8c3d-4e5f6a1b2c3d',NULL,'CC7','System Operations','The entity detects and monitors for system events and uses detection tools in a timely manner.',NULL,'mandatory','Common Criteria',NULL,70,'2026-04-24 18:52:03'),('aecc2377-400e-11f1-8bc3-00155d012902','a1b2c3d4-e5f6-4a1b-8c3d-4e5f6a1b2c3d',NULL,'CC8','Change Management','The entity authorizes, designs, develops, tests, approves, and implements changes to infrastructure.',NULL,'mandatory','Common Criteria',NULL,80,'2026-04-24 18:52:03'),('aecc91d8-400e-11f1-8bc3-00155d012902','a1b2c3d4-e5f6-4a1b-8c3d-4e5f6a1b2c3d',NULL,'CC9','Risk Mitigation','The entity identifies, selects, and develops risk mitigation activities for risks.',NULL,'mandatory','Common Criteria',NULL,90,'2026-04-24 18:52:03'),('aecc9844-400e-11f1-8bc3-00155d012902','a1b2c3d4-e5f6-4a1b-8c3d-4e5f6a1b2c3d',NULL,'A1','Availability','The entity maintains, monitors, and evaluates current processing capacity and use.',NULL,'mandatory','Availability',NULL,100,'2026-04-24 18:52:03'),('aecc9eaa-400e-11f1-8bc3-00155d012902','a1b2c3d4-e5f6-4a1b-8c3d-4e5f6a1b2c3d',NULL,'PI1','Processing Integrity','The entity obtains or generates, uses, and communicates relevant, quality information.',NULL,'mandatory','Processing Integrity',NULL,110,'2026-04-24 18:52:03'),('aecca54d-400e-11f1-8bc3-00155d012902','a1b2c3d4-e5f6-4a1b-8c3d-4e5f6a1b2c3d',NULL,'C1','Confidentiality','The entity identifies and maintains confidential information to meet the entity\'s objectives.',NULL,'mandatory','Confidentiality',NULL,120,'2026-04-24 18:52:03'),('aeccc30f-400e-11f1-8bc3-00155d012902','a1b2c3d4-e5f6-4a1b-8c3d-4e5f6a1b2c3d',NULL,'P1','Privacy','The entity provides notice to data subjects about its privacy practices.',NULL,'mandatory','Privacy',NULL,130,'2026-04-24 18:52:03'),('aee4c20f-400e-11f1-8bc3-00155d012902','b2c3d4e5-f6a1-4b2c-8d4e-5f6a1b2c3d4e',NULL,'A.5','Organizational Controls','Policies, roles, responsibilities, segregation of duties, and contact with authorities.',NULL,'mandatory','Organization',NULL,10,'2026-04-24 18:52:03'),('aee4c741-400e-11f1-8bc3-00155d012902','b2c3d4e5-f6a1-4b2c-8d4e-5f6a1b2c3d4e',NULL,'A.6','People Controls','Screening, terms of employment, information security awareness, and disciplinary process.',NULL,'mandatory','People',NULL,20,'2026-04-24 18:52:03'),('aee4c88c-400e-11f1-8bc3-00155d012902','b2c3d4e5-f6a1-4b2c-8d4e-5f6a1b2c3d4e',NULL,'A.7','Physical Controls','Physical security perimeters, entry controls, securing offices and equipment.',NULL,'mandatory','Physical',NULL,30,'2026-04-24 18:52:03'),('aee4c9eb-400e-11f1-8bc3-00155d012902','b2c3d4e5-f6a1-4b2c-8d4e-5f6a1b2c3d4e',NULL,'A.8','Technological Controls','User endpoint devices, privileged access, information access restriction, secure authentication.',NULL,'mandatory','Technology',NULL,40,'2026-04-24 18:52:03'),('aee4cb28-400e-11f1-8bc3-00155d012902','b2c3d4e5-f6a1-4b2c-8d4e-5f6a1b2c3d4e',NULL,'A.8.2','Privileged Access Rights','Allocation and use of privileged access rights shall be restricted and managed.',NULL,'mandatory','Access Control',NULL,41,'2026-04-24 18:52:03'),('aee4cc48-400e-11f1-8bc3-00155d012902','b2c3d4e5-f6a1-4b2c-8d4e-5f6a1b2c3d4e',NULL,'A.8.3','Information Access Restriction','Access to information and application system functions shall be restricted in accordance with policy.',NULL,'mandatory','Access Control',NULL,42,'2026-04-24 18:52:03'),('aee4cd63-400e-11f1-8bc3-00155d012902','b2c3d4e5-f6a1-4b2c-8d4e-5f6a1b2c3d4e',NULL,'A.8.7','Protection Against Malware','Protection against malware shall be implemented and supported by user awareness.',NULL,'mandatory','Technology',NULL,50,'2026-04-24 18:52:03'),('aee4ce85-400e-11f1-8bc3-00155d012902','b2c3d4e5-f6a1-4b2c-8d4e-5f6a1b2c3d4e',NULL,'A.8.8','Management of Technical Vulnerabilities','Information about technical vulnerabilities shall be obtained and mitigated in a timely fashion.',NULL,'mandatory','Technology',NULL,51,'2026-04-24 18:52:03'),('aee4cfa7-400e-11f1-8bc3-00155d012902','b2c3d4e5-f6a1-4b2c-8d4e-5f6a1b2c3d4e',NULL,'A.8.16','Monitoring Activities','Networks, systems and applications shall be monitored for anomalous behaviour.',NULL,'mandatory','Technology',NULL,60,'2026-04-24 18:52:03'),('aee4d0b4-400e-11f1-8bc3-00155d012902','b2c3d4e5-f6a1-4b2c-8d4e-5f6a1b2c3d4e',NULL,'A.8.24','Use of Cryptography','Rules for effective use of cryptography shall be defined and implemented.',NULL,'mandatory','Technology',NULL,70,'2026-04-24 18:52:03'),('aee4d1c0-400e-11f1-8bc3-00155d012902','b2c3d4e5-f6a1-4b2c-8d4e-5f6a1b2c3d4e',NULL,'A.8.28','Secure Coding','Secure coding principles shall be applied to software development.',NULL,'mandatory','Technology',NULL,80,'2026-04-24 18:52:03'),('aee4d2d1-400e-11f1-8bc3-00155d012902','b2c3d4e5-f6a1-4b2c-8d4e-5f6a1b2c3d4e',NULL,'Clause 6','Risk Assessment and Treatment','The organization shall define and apply an information security risk assessment process.',NULL,'mandatory','Risk Management',NULL,90,'2026-04-24 18:52:03'),('aee4d3e1-400e-11f1-8bc3-00155d012902','b2c3d4e5-f6a1-4b2c-8d4e-5f6a1b2c3d4e',NULL,'Clause 9','Performance Evaluation','Monitoring, measurement, analysis, evaluation, internal audit, and management review.',NULL,'mandatory','Governance',NULL,100,'2026-04-24 18:52:03'),('aee4d4ee-400e-11f1-8bc3-00155d012902','b2c3d4e5-f6a1-4b2c-8d4e-5f6a1b2c3d4e',NULL,'Clause 10','Improvement','Nonconformity, corrective action, and continual improvement.',NULL,'mandatory','Governance',NULL,110,'2026-04-24 18:52:03'),('aef8928e-400e-11f1-8bc3-00155d012902','c3d4e5f6-a1b2-4c3d-8e5f-6a1b2c3d4e5f',NULL,'GV','Govern','Establish and monitor the organization\'s cybersecurity risk management strategy, expectations, and policy.',NULL,'mandatory','Govern',NULL,5,'2026-04-24 18:52:03'),('aef8973c-400e-11f1-8bc3-00155d012902','c3d4e5f6-a1b2-4c3d-8e5f-6a1b2c3d4e5f',NULL,'ID','Identify','Develop an organizational understanding to manage cybersecurity risk to systems, assets, data, and capabilities.',NULL,'mandatory','Identify',NULL,10,'2026-04-24 18:52:03'),('aef8988c-400e-11f1-8bc3-00155d012902','c3d4e5f6-a1b2-4c3d-8e5f-6a1b2c3d4e5f',NULL,'ID.AM','Asset Management','The data, personnel, devices, systems, and facilities that enable the organization to achieve business purposes are identified.',NULL,'mandatory','Identify',NULL,11,'2026-04-24 18:52:03'),('aef899b5-400e-11f1-8bc3-00155d012902','c3d4e5f6-a1b2-4c3d-8e5f-6a1b2c3d4e5f',NULL,'ID.RA','Risk Assessment','The organization understands the cybersecurity risk to organizational operations, assets, and individuals.',NULL,'mandatory','Identify',NULL,12,'2026-04-24 18:52:03'),('aef89ad7-400e-11f1-8bc3-00155d012902','c3d4e5f6-a1b2-4c3d-8e5f-6a1b2c3d4e5f',NULL,'PR','Protect','Develop and implement appropriate safeguards to ensure delivery of critical services.',NULL,'mandatory','Protect',NULL,20,'2026-04-24 18:52:03'),('aef89bf5-400e-11f1-8bc3-00155d012902','c3d4e5f6-a1b2-4c3d-8e5f-6a1b2c3d4e5f',NULL,'PR.AC','Identity Management and Access Control','Access to physical and logical assets and associated facilities is limited to authorized users.',NULL,'mandatory','Protect',NULL,21,'2026-04-24 18:52:03'),('aef89d11-400e-11f1-8bc3-00155d012902','c3d4e5f6-a1b2-4c3d-8e5f-6a1b2c3d4e5f',NULL,'PR.AT','Awareness and Training','The organization\'s personnel and partners are provided cybersecurity awareness education.',NULL,'mandatory','Protect',NULL,22,'2026-04-24 18:52:03'),('aef89e27-400e-11f1-8bc3-00155d012902','c3d4e5f6-a1b2-4c3d-8e5f-6a1b2c3d4e5f',NULL,'PR.DS','Data Security','Information and records are managed consistent with the organization\'s risk strategy.',NULL,'mandatory','Protect',NULL,23,'2026-04-24 18:52:03'),('aef89f42-400e-11f1-8bc3-00155d012902','c3d4e5f6-a1b2-4c3d-8e5f-6a1b2c3d4e5f',NULL,'PR.IP','Information Protection Processes','Security policies, processes, and procedures are maintained and used to manage protection of information systems.',NULL,'mandatory','Protect',NULL,24,'2026-04-24 18:52:03'),('aef8a062-400e-11f1-8bc3-00155d012902','c3d4e5f6-a1b2-4c3d-8e5f-6a1b2c3d4e5f',NULL,'DE','Detect','Develop and implement appropriate activities to identify the occurrence of a cybersecurity event.',NULL,'mandatory','Detect',NULL,30,'2026-04-24 18:52:03'),('aef8a174-400e-11f1-8bc3-00155d012902','c3d4e5f6-a1b2-4c3d-8e5f-6a1b2c3d4e5f',NULL,'DE.CM','Continuous Monitoring','The information system and assets are monitored at discrete intervals to identify cybersecurity events.',NULL,'mandatory','Detect',NULL,31,'2026-04-24 18:52:03'),('aef8a285-400e-11f1-8bc3-00155d012902','c3d4e5f6-a1b2-4c3d-8e5f-6a1b2c3d4e5f',NULL,'DE.AE','Anomalies and Events','Anomalous activity is detected in a timely manner and the potential impact of events is understood.',NULL,'mandatory','Detect',NULL,32,'2026-04-24 18:52:03'),('aef8a399-400e-11f1-8bc3-00155d012902','c3d4e5f6-a1b2-4c3d-8e5f-6a1b2c3d4e5f',NULL,'RS','Respond','Develop and implement appropriate activities to take action regarding a detected cybersecurity event.',NULL,'mandatory','Respond',NULL,40,'2026-04-24 18:52:03'),('aef8a4ae-400e-11f1-8bc3-00155d012902','c3d4e5f6-a1b2-4c3d-8e5f-6a1b2c3d4e5f',NULL,'RS.RP','Response Planning','Response processes and procedures are executed and maintained.',NULL,'mandatory','Respond',NULL,41,'2026-04-24 18:52:03'),('aef8a5c3-400e-11f1-8bc3-00155d012902','c3d4e5f6-a1b2-4c3d-8e5f-6a1b2c3d4e5f',NULL,'RS.CO','Communications','Response activities are coordinated with internal and external stakeholders.',NULL,'mandatory','Respond',NULL,42,'2026-04-24 18:52:03'),('aef8a6d1-400e-11f1-8bc3-00155d012902','c3d4e5f6-a1b2-4c3d-8e5f-6a1b2c3d4e5f',NULL,'RC','Recover','Develop and implement appropriate activities to maintain plans for resilience and restore any capabilities or services impaired due to a cybersecurity event.',NULL,'mandatory','Recover',NULL,50,'2026-04-24 18:52:03'),('aef8a800-400e-11f1-8bc3-00155d012902','c3d4e5f6-a1b2-4c3d-8e5f-6a1b2c3d4e5f',NULL,'RC.RP','Recovery Planning','Recovery processes and procedures are executed and maintained to ensure timely restoration.',NULL,'mandatory','Recover',NULL,51,'2026-04-24 18:52:03'),('af078ea2-400e-11f1-8bc3-00155d012902','d4e5f6a1-b2c3-4d4e-8f6a-1b2c3d4e5f6a','ab51c460-1e0d-42dc-ab75-814c52efcbd1','164.308(a)(1)','Security Management Process','Implement policies and procedures to prevent, detect, contain, and correct security violations.',NULL,'mandatory',NULL,NULL,0,'2026-04-24 18:52:03'),('af079294-400e-11f1-8bc3-00155d012902','d4e5f6a1-b2c3-4d4e-8f6a-1b2c3d4e5f6a','ab51c460-1e0d-42dc-ab75-814c52efcbd1','164.308(a)(2)','Assigned Security Responsibility','Identify the security official responsible for development and implementation of security policies.',NULL,'mandatory',NULL,NULL,1,'2026-04-24 18:52:03'),('af0793d3-400e-11f1-8bc3-00155d012902','d4e5f6a1-b2c3-4d4e-8f6a-1b2c3d4e5f6a','ab51c460-1e0d-42dc-ab75-814c52efcbd1','164.308(a)(3)','Workforce Security','Implement policies and procedures to ensure appropriate access by workforce members.',NULL,'mandatory',NULL,NULL,2,'2026-04-24 18:52:03'),('af0794f4-400e-11f1-8bc3-00155d012902','d4e5f6a1-b2c3-4d4e-8f6a-1b2c3d4e5f6a','ab51c460-1e0d-42dc-ab75-814c52efcbd1','164.308(a)(4)','Information Access Management','Implement policies and procedures for authorizing access to ePHI.',NULL,'mandatory',NULL,NULL,3,'2026-04-24 18:52:03'),('af079624-400e-11f1-8bc3-00155d012902','d4e5f6a1-b2c3-4d4e-8f6a-1b2c3d4e5f6a','ab51c460-1e0d-42dc-ab75-814c52efcbd1','164.308(a)(5)','Security Awareness and Training','Implement a security awareness and training program for all workforce members.',NULL,'mandatory',NULL,NULL,4,'2026-04-24 18:52:03'),('af07973c-400e-11f1-8bc3-00155d012902','d4e5f6a1-b2c3-4d4e-8f6a-1b2c3d4e5f6a','ab51c460-1e0d-42dc-ab75-814c52efcbd1','164.308(a)(6)','Security Incident Procedures','Implement policies and procedures to address security incidents.',NULL,'mandatory',NULL,NULL,5,'2026-04-24 18:52:03'),('af079b0b-400e-11f1-8bc3-00155d012902','d4e5f6a1-b2c3-4d4e-8f6a-1b2c3d4e5f6a','ab51c460-1e0d-42dc-ab75-814c52efcbd1','164.308(a)(7)','Contingency Plan','Establish and implement policies and procedures for responding to an emergency.',NULL,'mandatory',NULL,NULL,6,'2026-04-24 18:52:03'),('af079c5e-400e-11f1-8bc3-00155d012902','d4e5f6a1-b2c3-4d4e-8f6a-1b2c3d4e5f6a','c3e1fe9d-9bbc-4d3c-973e-82b4b38c3900','164.310(a)(1)','Facility Access Controls','Implement policies and procedures to limit physical access to electronic information systems.',NULL,'mandatory',NULL,NULL,0,'2026-04-24 18:52:03'),('af079db4-400e-11f1-8bc3-00155d012902','d4e5f6a1-b2c3-4d4e-8f6a-1b2c3d4e5f6a','c3e1fe9d-9bbc-4d3c-973e-82b4b38c3900','164.310(d)(1)','Device and Media Controls','Implement policies and procedures that govern the receipt and removal of hardware and electronic media.',NULL,'mandatory',NULL,NULL,3,'2026-04-24 18:52:03'),('af079ec8-400e-11f1-8bc3-00155d012902','d4e5f6a1-b2c3-4d4e-8f6a-1b2c3d4e5f6a','878b3435-562f-4898-89a0-ab5d654a12bc','164.312(a)(1)','Access Control','Implement technical policies and procedures for electronic information systems that maintain ePHI.',NULL,'mandatory',NULL,NULL,0,'2026-04-24 18:52:03'),('af079fd4-400e-11f1-8bc3-00155d012902','d4e5f6a1-b2c3-4d4e-8f6a-1b2c3d4e5f6a','878b3435-562f-4898-89a0-ab5d654a12bc','164.312(b)','Audit Controls','Implement hardware, software, and/or procedural mechanisms to record and examine activity.',NULL,'mandatory',NULL,NULL,1,'2026-04-24 18:52:03'),('af07a0e3-400e-11f1-8bc3-00155d012902','d4e5f6a1-b2c3-4d4e-8f6a-1b2c3d4e5f6a','878b3435-562f-4898-89a0-ab5d654a12bc','164.312(c)(1)','Integrity','Implement policies and procedures to protect ePHI from improper alteration or destruction.',NULL,'mandatory',NULL,NULL,2,'2026-04-24 18:52:03'),('af07a1f5-400e-11f1-8bc3-00155d012902','d4e5f6a1-b2c3-4d4e-8f6a-1b2c3d4e5f6a','878b3435-562f-4898-89a0-ab5d654a12bc','164.312(e)(1)','Transmission Security','Implement technical security measures to guard against unauthorized access to ePHI transmitted over an electronic communications network.',NULL,'mandatory',NULL,NULL,4,'2026-04-24 18:52:03'),('af11cde4-400e-11f1-8bc3-00155d012902','e5f6a1b2-c3d4-4e5f-8a1b-2c3d4e5f6a1b',NULL,'Req 1','Network Security Controls','Install and maintain network security controls to protect the cardholder data environment.',NULL,'mandatory','Network Security',NULL,10,'2026-04-24 18:52:03'),('af11d4c2-400e-11f1-8bc3-00155d012902','e5f6a1b2-c3d4-4e5f-8a1b-2c3d4e5f6a1b',NULL,'Req 2','Secure Configurations','Apply secure configurations to all system components.',NULL,'mandatory','System Hardening',NULL,20,'2026-04-24 18:52:03'),('af11d613-400e-11f1-8bc3-00155d012902','e5f6a1b2-c3d4-4e5f-8a1b-2c3d4e5f6a1b',NULL,'Req 3','Protect Stored Account Data','Protect stored account data using strong cryptography.',NULL,'mandatory','Data Protection',NULL,30,'2026-04-24 18:52:03'),('af11d75c-400e-11f1-8bc3-00155d012902','e5f6a1b2-c3d4-4e5f-8a1b-2c3d4e5f6a1b',NULL,'Req 4','Protect Data in Transit','Protect cardholder data with strong cryptography during transmission over open, public networks.',NULL,'mandatory','Data Protection',NULL,40,'2026-04-24 18:52:03'),('af11d885-400e-11f1-8bc3-00155d012902','e5f6a1b2-c3d4-4e5f-8a1b-2c3d4e5f6a1b',NULL,'Req 5','Protect Against Malicious Software','Protect all systems and networks from malicious software.',NULL,'mandatory','Endpoint Security',NULL,50,'2026-04-24 18:52:03'),('af11d9a7-400e-11f1-8bc3-00155d012902','e5f6a1b2-c3d4-4e5f-8a1b-2c3d4e5f6a1b',NULL,'Req 6','Develop and Maintain Secure Systems','Develop and maintain secure systems and software.',NULL,'mandatory','Secure Development',NULL,60,'2026-04-24 18:52:03'),('af11dac6-400e-11f1-8bc3-00155d012902','e5f6a1b2-c3d4-4e5f-8a1b-2c3d4e5f6a1b',NULL,'Req 7','Restrict Access to System Components','Restrict access to system components and cardholder data by business need to know.',NULL,'mandatory','Access Control',NULL,70,'2026-04-24 18:52:03'),('af11dbe5-400e-11f1-8bc3-00155d012902','e5f6a1b2-c3d4-4e5f-8a1b-2c3d4e5f6a1b',NULL,'Req 8','Identify Users and Authenticate Access','Identify users and authenticate access to system components.',NULL,'mandatory','Access Control',NULL,80,'2026-04-24 18:52:03'),('af11dcfe-400e-11f1-8bc3-00155d012902','e5f6a1b2-c3d4-4e5f-8a1b-2c3d4e5f6a1b',NULL,'Req 9','Restrict Physical Access','Restrict physical access to cardholder data.',NULL,'mandatory','Physical Security',NULL,90,'2026-04-24 18:52:03'),('af121c44-400e-11f1-8bc3-00155d012902','e5f6a1b2-c3d4-4e5f-8a1b-2c3d4e5f6a1b',NULL,'Req 10','Log and Monitor All Access','Log and monitor all access to system components and cardholder data.',NULL,'mandatory','Logging',NULL,100,'2026-04-24 18:52:03'),('af121df1-400e-11f1-8bc3-00155d012902','e5f6a1b2-c3d4-4e5f-8a1b-2c3d4e5f6a1b',NULL,'Req 11','Test Security of Systems and Networks','Test security of systems and networks regularly.',NULL,'mandatory','Security Testing',NULL,110,'2026-04-24 18:52:03'),('af121f43-400e-11f1-8bc3-00155d012902','e5f6a1b2-c3d4-4e5f-8a1b-2c3d4e5f6a1b',NULL,'Req 12','Support Information Security with Policies','Support information security with organizational policies and programs.',NULL,'mandatory','Governance',NULL,120,'2026-04-24 18:52:03'),('af8ed1a4-40cf-11f1-8bc3-00155d012902','f1a2b3c4-d5e6-4f1a-9b2c-3d4e5f6a7b8c',NULL,'CLD.6.3','Relationship Between Cloud Service Customer and Provider','Define and document the shared responsibilities between cloud service customer and cloud service provider for each control.',NULL,'mandatory','Governance',NULL,10,'2026-04-25 17:53:37'),('af8ed7b3-40cf-11f1-8bc3-00155d012902','f1a2b3c4-d5e6-4f1a-9b2c-3d4e5f6a7b8c',NULL,'CLD.8.1','Asset Inventory for Cloud Services','Maintain an inventory of all assets used in cloud services and ensure ownership is clearly assigned.',NULL,'mandatory','Asset Management',NULL,20,'2026-04-25 17:53:37'),('af8f0e0a-40cf-11f1-8bc3-00155d012902','f1a2b3c4-d5e6-4f1a-9b2c-3d4e5f6a7b8c',NULL,'CLD.9.5','Segregation in Virtual Computing Environments','Virtual machines in a cloud computing environment shall be kept separate from other virtual machines and management functions.',NULL,'mandatory','Infrastructure Security',NULL,30,'2026-04-25 17:53:37'),('af8f0fb9-40cf-11f1-8bc3-00155d012902','f1a2b3c4-d5e6-4f1a-9b2c-3d4e5f6a7b8c',NULL,'CLD.12.1','Administrator Operational Security','Procedures for cloud service administration operations shall be documented and implemented.',NULL,'mandatory','Operations',NULL,40,'2026-04-25 17:53:37'),('af8f115d-40cf-11f1-8bc3-00155d012902','f1a2b3c4-d5e6-4f1a-9b2c-3d4e5f6a7b8c',NULL,'CLD.12.4','Monitoring of Cloud Services','Cloud service providers shall maintain audit logs and make them available to cloud service customers as agreed.',NULL,'mandatory','Logging & Monitoring',NULL,50,'2026-04-25 17:53:37'),('af8f12e4-40cf-11f1-8bc3-00155d012902','f1a2b3c4-d5e6-4f1a-9b2c-3d4e5f6a7b8c',NULL,'CLD.13.1','Network Security in Cloud Environments','Implement network controls to protect cloud service networks from unauthorized access and attack.',NULL,'mandatory','Network Security',NULL,60,'2026-04-25 17:53:37'),('af8f1578-40cf-11f1-8bc3-00155d012902','f1a2b3c4-d5e6-4f1a-9b2c-3d4e5f6a7b8c',NULL,'CLD.16.1','Notification of Security Incidents','Cloud service providers shall notify cloud service customers of security incidents affecting their data without undue delay.',NULL,'mandatory','Incident Response',NULL,70,'2026-04-25 17:53:37'),('af8f16da-40cf-11f1-8bc3-00155d012902','f1a2b3c4-d5e6-4f1a-9b2c-3d4e5f6a7b8c',NULL,'CLD.17.2','ICT Continuity for Cloud Services','Establish, maintain, and test ICT continuity plans for cloud services to support customer business continuity.',NULL,'mandatory','Business Continuity',NULL,80,'2026-04-25 17:53:37'),('af8f1838-40cf-11f1-8bc3-00155d012902','f1a2b3c4-d5e6-4f1a-9b2c-3d4e5f6a7b8c',NULL,'CLD.18.1','Compliance with Legal and Contractual Requirements','Identify and document all relevant legal, regulatory, and contractual requirements for cloud services.',NULL,'mandatory','Compliance',NULL,90,'2026-04-25 17:53:37'),('af9b48bd-40cf-11f1-8bc3-00155d012902','a2b3c4d5-e6f7-4a2b-9c3d-4e5f6a7b8c9d',NULL,'A.1','Consent and Choice','Process PII only under instructions from the cloud service customer (controller); do not use PII for marketing without explicit consent.',NULL,'mandatory','Privacy Principles',NULL,10,'2026-04-25 17:53:37'),('af9b4ed8-40cf-11f1-8bc3-00155d012902','a2b3c4d5-e6f7-4a2b-9c3d-4e5f6a7b8c9d',NULL,'A.2','Purpose Legitimacy and Specification','Process PII for the specified, explicit, and legitimate purposes defined in the contract with the customer.',NULL,'mandatory','Privacy Principles',NULL,20,'2026-04-25 17:53:37'),('af9b506a-40cf-11f1-8bc3-00155d012902','a2b3c4d5-e6f7-4a2b-9c3d-4e5f6a7b8c9d',NULL,'A.3','Collection Limitation','Collect only the minimum PII necessary for the specified purpose; avoid excess collection.',NULL,'mandatory','Privacy Principles',NULL,30,'2026-04-25 17:53:37'),('af9b51f5-40cf-11f1-8bc3-00155d012902','a2b3c4d5-e6f7-4a2b-9c3d-4e5f6a7b8c9d',NULL,'A.5','Use, Retention and Disclosure Limitation','Use, retain, and disclose PII only as necessary for the contracted purpose; delete PII when no longer required.',NULL,'mandatory','Data Lifecycle',NULL,40,'2026-04-25 17:53:37'),('af9b5385-40cf-11f1-8bc3-00155d012902','a2b3c4d5-e6f7-4a2b-9c3d-4e5f6a7b8c9d',NULL,'A.9','Accountability','Cloud service provider shall designate a point of contact for privacy matters and maintain accountability records.',NULL,'mandatory','Governance',NULL,50,'2026-04-25 17:53:37'),('af9b5515-40cf-11f1-8bc3-00155d012902','a2b3c4d5-e6f7-4a2b-9c3d-4e5f6a7b8c9d',NULL,'A.10','Information Security','Implement technical and organizational security measures to protect PII against accidental or unlawful destruction, alteration, or unauthorized disclosure.',NULL,'mandatory','Security Controls',NULL,60,'2026-04-25 17:53:37'),('af9b569a-40cf-11f1-8bc3-00155d012902','a2b3c4d5-e6f7-4a2b-9c3d-4e5f6a7b8c9d',NULL,'A.11','Privacy Compliance','Identify and comply with applicable laws and regulations relating to the processing of PII.',NULL,'mandatory','Compliance',NULL,70,'2026-04-25 17:53:37'),('af9b57e6-40cf-11f1-8bc3-00155d012902','a2b3c4d5-e6f7-4a2b-9c3d-4e5f6a7b8c9d',NULL,'B.1','Temporary Files Containing PII','Temporary files and data created during cloud processing of PII shall be documented and securely deleted.',NULL,'mandatory','Data Management',NULL,80,'2026-04-25 17:53:37'),('af9b5936-40cf-11f1-8bc3-00155d012902','a2b3c4d5-e6f7-4a2b-9c3d-4e5f6a7b8c9d',NULL,'B.2','Disclosure of Sub-processors','Cloud service providers shall inform customers of sub-processors used to process PII and obtain approval before engaging new sub-processors.',NULL,'mandatory','Third-party Risk',NULL,90,'2026-04-25 17:53:37'),('af9b5a86-40cf-11f1-8bc3-00155d012902','a2b3c4d5-e6f7-4a2b-9c3d-4e5f6a7b8c9d',NULL,'B.3','Data Return and Deletion','On contract termination, return all PII to the customer and securely delete all copies within an agreed timeframe.',NULL,'mandatory','Data Lifecycle',NULL,100,'2026-04-25 17:53:37'),('af9b5bc8-40cf-11f1-8bc3-00155d012902','a2b3c4d5-e6f7-4a2b-9c3d-4e5f6a7b8c9d',NULL,'B.4','PII Breach Notification','Notify the cloud service customer of any personal data breach without undue delay and provide sufficient detail for the customer to meet regulatory reporting obligations.',NULL,'mandatory','Incident Response',NULL,110,'2026-04-25 17:53:37'),('af9b5d10-40cf-11f1-8bc3-00155d012902','a2b3c4d5-e6f7-4a2b-9c3d-4e5f6a7b8c9d',NULL,'B.5','Lawful Disclosure of PII','Disclose PII to law enforcement only when legally required; inform the customer unless prohibited by law.',NULL,'mandatory','Legal',NULL,120,'2026-04-25 17:53:37'),('afa7d2e1-40cf-11f1-8bc3-00155d012902','b3c4d5e6-f7a8-4b3c-9d4e-5f6a7b8c9d0e',NULL,'Cl.4','Context of the Organization','Understand the organization, its context, stakeholder needs, and determine the scope of the AI management system.',NULL,'mandatory','Foundation',NULL,10,'2026-04-25 17:53:37'),('afa7d97b-40cf-11f1-8bc3-00155d012902','b3c4d5e6-f7a8-4b3c-9d4e-5f6a7b8c9d0e',NULL,'Cl.5','Leadership and AI Policy','Top management shall demonstrate commitment to the AIMS, establish an AI policy, and assign roles and responsibilities.',NULL,'mandatory','Governance',NULL,20,'2026-04-25 17:53:37'),('afa7db0f-40cf-11f1-8bc3-00155d012902','b3c4d5e6-f7a8-4b3c-9d4e-5f6a7b8c9d0e',NULL,'Cl.6','AI Risk and Impact Planning','Identify AI-related risks and opportunities; plan actions to address them; define AI objectives.',NULL,'mandatory','Risk Management',NULL,30,'2026-04-25 17:53:37'),('afa8126a-40cf-11f1-8bc3-00155d012902','b3c4d5e6-f7a8-4b3c-9d4e-5f6a7b8c9d0e',NULL,'Cl.8','AI System Lifecycle Operations','Plan, implement, and control processes for the AI system lifecycle including design, development, deployment, and decommissioning.',NULL,'mandatory','AI Operations',NULL,40,'2026-04-25 17:53:37'),('afa8145b-40cf-11f1-8bc3-00155d012902','b3c4d5e6-f7a8-4b3c-9d4e-5f6a7b8c9d0e',NULL,'A.2','AI Policy','Establish, implement, maintain, and communicate an AI policy that sets out principles for responsible AI use.',NULL,'mandatory','Governance',NULL,50,'2026-04-25 17:53:37'),('afa815f3-40cf-11f1-8bc3-00155d012902','b3c4d5e6-f7a8-4b3c-9d4e-5f6a7b8c9d0e',NULL,'A.3','Internal Organization for AI','Define roles, responsibilities, and authorities for AI governance including an AI officer or equivalent function.',NULL,'mandatory','Governance',NULL,60,'2026-04-25 17:53:37'),('afa84672-40cf-11f1-8bc3-00155d012902','b3c4d5e6-f7a8-4b3c-9d4e-5f6a7b8c9d0e',NULL,'A.4','Resources for AI Systems','Identify and provide resources required for AI systems including data, compute, tools, and human expertise.',NULL,'mandatory','AI Operations',NULL,70,'2026-04-25 17:53:37'),('afa84898-40cf-11f1-8bc3-00155d012902','b3c4d5e6-f7a8-4b3c-9d4e-5f6a7b8c9d0e',NULL,'A.5','Assessing Impacts of AI Systems','Conduct AI impact assessments prior to deployment, including assessment of human rights, fairness, safety, and societal impacts.',NULL,'mandatory','Risk Management',NULL,80,'2026-04-25 17:53:37'),('afa84a18-40cf-11f1-8bc3-00155d012902','b3c4d5e6-f7a8-4b3c-9d4e-5f6a7b8c9d0e',NULL,'A.6','AI System Lifecycle','Manage the full lifecycle of AI systems from initial concept through decommissioning with defined gates and documentation.',NULL,'mandatory','AI Operations',NULL,90,'2026-04-25 17:53:37'),('afa84b8e-40cf-11f1-8bc3-00155d012902','b3c4d5e6-f7a8-4b3c-9d4e-5f6a7b8c9d0e',NULL,'A.7','Data for AI Systems','Govern data used in AI systems including data quality, provenance, bias assessment, and data rights.',NULL,'mandatory','Data Governance',NULL,100,'2026-04-25 17:53:37'),('afa84cfe-40cf-11f1-8bc3-00155d012902','b3c4d5e6-f7a8-4b3c-9d4e-5f6a7b8c9d0e',NULL,'A.8','Information for Interested Parties','Provide appropriate information to users and affected parties about AI systems, their capabilities, limitations, and intended use.',NULL,'mandatory','Transparency',NULL,110,'2026-04-25 17:53:37'),('afa84e55-40cf-11f1-8bc3-00155d012902','b3c4d5e6-f7a8-4b3c-9d4e-5f6a7b8c9d0e',NULL,'A.9','Use of AI Systems','Ensure AI systems are used only for their intended purpose and that users are appropriately trained.',NULL,'mandatory','AI Operations',NULL,120,'2026-04-25 17:53:37'),('afa84f9f-40cf-11f1-8bc3-00155d012902','b3c4d5e6-f7a8-4b3c-9d4e-5f6a7b8c9d0e',NULL,'A.10','Third-Party and Customer Relationships','Manage risks arising from AI systems developed or provided by third parties or deployed to customers.',NULL,'mandatory','Third-party Risk',NULL,130,'2026-04-25 17:53:37'),('afb7eca6-40cf-11f1-8bc3-00155d012902','c4d5e6f7-a8b9-4c4d-9e5f-6a7b8c9d0e1f',NULL,'GOVERN','Govern','Establish policies, processes, procedures, and practices for AI risk management across the organization. AI risk and trustworthiness are prioritized in organization-wide decisions.',NULL,'mandatory','Core Function',NULL,10,'2026-04-25 17:53:37'),('afb82ad1-40cf-11f1-8bc3-00155d012902','c4d5e6f7-a8b9-4c4d-9e5f-6a7b8c9d0e1f',NULL,'GOV.1','Policies and Accountability','Establish, communicate, and enforce organizational policies covering AI risk management responsibilities, accountability, and culture.',NULL,'mandatory','Governance',NULL,20,'2026-04-25 17:53:37'),('afb82c9d-40cf-11f1-8bc3-00155d012902','c4d5e6f7-a8b9-4c4d-9e5f-6a7b8c9d0e1f',NULL,'GOV.2','Roles and Responsibilities','Designate AI roles (e.g., AI risk officer) and establish clear responsibilities for AI risk management across teams.',NULL,'mandatory','Governance',NULL,30,'2026-04-25 17:53:37'),('afb82e27-40cf-11f1-8bc3-00155d012902','c4d5e6f7-a8b9-4c4d-9e5f-6a7b8c9d0e1f',NULL,'GOV.3','Organizational Teams','Engage cross-functional teams including legal, privacy, security, and domain experts in AI risk governance.',NULL,'mandatory','Governance',NULL,40,'2026-04-25 17:53:37'),('afb82fae-40cf-11f1-8bc3-00155d012902','c4d5e6f7-a8b9-4c4d-9e5f-6a7b8c9d0e1f',NULL,'MAP','Map','Identify the context in which AI systems operate and categorize AI risks including impacts to individuals and society.',NULL,'mandatory','Core Function',NULL,50,'2026-04-25 17:53:37'),('afb8313f-40cf-11f1-8bc3-00155d012902','c4d5e6f7-a8b9-4c4d-9e5f-6a7b8c9d0e1f',NULL,'MAP.1','AI Context Identification','Identify and document the intended use, deployment context, user population, and potential impacts of each AI system.',NULL,'mandatory','Risk Identification',NULL,60,'2026-04-25 17:53:37'),('afb83374-40cf-11f1-8bc3-00155d012902','c4d5e6f7-a8b9-4c4d-9e5f-6a7b8c9d0e1f',NULL,'MAP.2','Scientific and Technical Risks','Identify and document risks arising from AI system design, data quality, model performance, and technical limitations.',NULL,'mandatory','Risk Identification',NULL,70,'2026-04-25 17:53:37'),('afb834d3-40cf-11f1-8bc3-00155d012902','c4d5e6f7-a8b9-4c4d-9e5f-6a7b8c9d0e1f',NULL,'MAP.3','AI Risk Categorization','Categorize AI risks according to likelihood and impact considering harms to individuals, groups, organizations, and society.',NULL,'mandatory','Risk Assessment',NULL,80,'2026-04-25 17:53:37'),('afb83697-40cf-11f1-8bc3-00155d012902','c4d5e6f7-a8b9-4c4d-9e5f-6a7b8c9d0e1f',NULL,'MEASURE','Measure','Analyze and assess identified AI risks using quantitative and qualitative methods to support informed decision-making.',NULL,'mandatory','Core Function',NULL,90,'2026-04-25 17:53:37'),('afb837f2-40cf-11f1-8bc3-00155d012902','c4d5e6f7-a8b9-4c4d-9e5f-6a7b8c9d0e1f',NULL,'MEASURE.1','AI Risk Measurement Methods','Implement methods and metrics to measure identified AI risks including accuracy, bias, robustness, and explainability.',NULL,'mandatory','Risk Measurement',NULL,100,'2026-04-25 17:53:37'),('afb83958-40cf-11f1-8bc3-00155d012902','c4d5e6f7-a8b9-4c4d-9e5f-6a7b8c9d0e1f',NULL,'MEASURE.2','Trustworthiness Characteristics','Evaluate AI systems against trustworthiness characteristics: valid, reliable, safe, secure, explainable, fair, privacy-enhanced.',NULL,'mandatory','Risk Measurement',NULL,110,'2026-04-25 17:53:37'),('afb83ba1-40cf-11f1-8bc3-00155d012902','c4d5e6f7-a8b9-4c4d-9e5f-6a7b8c9d0e1f',NULL,'MEASURE.3','Bias and Fairness Assessment','Assess AI systems for bias and fairness issues using representative test datasets and disaggregated metrics.',NULL,'mandatory','Risk Measurement',NULL,120,'2026-04-25 17:53:37'),('afb83d22-40cf-11f1-8bc3-00155d012902','c4d5e6f7-a8b9-4c4d-9e5f-6a7b8c9d0e1f',NULL,'MANAGE','Manage','Prioritize and address AI risks based on measurement outputs; implement mitigations and monitor effectiveness.',NULL,'mandatory','Core Function',NULL,130,'2026-04-25 17:53:37'),('afb83e88-40cf-11f1-8bc3-00155d012902','c4d5e6f7-a8b9-4c4d-9e5f-6a7b8c9d0e1f',NULL,'MANAGE.1','Risk Treatment','Prioritize AI risks based on likelihood and impact; implement mitigations, transfer, accept, or avoid identified risks.',NULL,'mandatory','Risk Treatment',NULL,140,'2026-04-25 17:53:37'),('afb843d3-40cf-11f1-8bc3-00155d012902','c4d5e6f7-a8b9-4c4d-9e5f-6a7b8c9d0e1f',NULL,'MANAGE.2','AI Incident Response','Establish and maintain incident response plans specifically for AI system failures, harmful outputs, or misuse.',NULL,'mandatory','Incident Response',NULL,150,'2026-04-25 17:53:37'),('afb8452f-40cf-11f1-8bc3-00155d012902','c4d5e6f7-a8b9-4c4d-9e5f-6a7b8c9d0e1f',NULL,'MANAGE.3','Residual Risk Monitoring','Monitor residual AI risks continuously and update risk assessments based on new information or changed conditions.',NULL,'mandatory','Risk Monitoring',NULL,160,'2026-04-25 17:53:37'),('afca0e62-40cf-11f1-8bc3-00155d012902','d5e6f7a8-b9c0-4d5e-9f6a-7b8c9d0e1f2a',NULL,'Art.5','Prohibited AI Practices','AI systems using subliminal manipulation, exploiting vulnerabilities, social scoring, or real-time biometric surveillance in public spaces are prohibited.',NULL,'mandatory','Prohibited Practices',NULL,10,'2026-04-25 17:53:37'),('afca16a0-40cf-11f1-8bc3-00155d012902','d5e6f7a8-b9c0-4d5e-9f6a-7b8c9d0e1f2a',NULL,'Art.6','High-Risk AI Classification','Classify AI systems as high-risk based on Annex III use cases including critical infrastructure, education, employment, essential services, law enforcement, and biometrics.',NULL,'mandatory','Risk Classification',NULL,20,'2026-04-25 17:53:37'),('afca185a-40cf-11f1-8bc3-00155d012902','d5e6f7a8-b9c0-4d5e-9f6a-7b8c9d0e1f2a',NULL,'Art.9','Risk Management System','Establish, implement, document, and maintain a risk management system for high-risk AI systems throughout the entire lifecycle.',NULL,'mandatory','High-Risk AI',NULL,30,'2026-04-25 17:53:37'),('afca19ec-40cf-11f1-8bc3-00155d012902','d5e6f7a8-b9c0-4d5e-9f6a-7b8c9d0e1f2a',NULL,'Art.10','Data and Data Governance','Training, validation, and testing data for high-risk AI must meet quality criteria: relevant, representative, free of errors, and complete.',NULL,'mandatory','High-Risk AI',NULL,40,'2026-04-25 17:53:37'),('afca1b7c-40cf-11f1-8bc3-00155d012902','d5e6f7a8-b9c0-4d5e-9f6a-7b8c9d0e1f2a',NULL,'Art.11','Technical Documentation','Providers of high-risk AI systems must maintain technical documentation demonstrating compliance before placing on the market.',NULL,'mandatory','High-Risk AI',NULL,50,'2026-04-25 17:53:37'),('afca1d17-40cf-11f1-8bc3-00155d012902','d5e6f7a8-b9c0-4d5e-9f6a-7b8c9d0e1f2a',NULL,'Art.12','Record-Keeping and Logging','High-risk AI systems shall be designed with automatic logging capabilities to enable post-deployment monitoring.',NULL,'mandatory','High-Risk AI',NULL,60,'2026-04-25 17:53:37'),('afca1e6d-40cf-11f1-8bc3-00155d012902','d5e6f7a8-b9c0-4d5e-9f6a-7b8c9d0e1f2a',NULL,'Art.13','Transparency and Information Provision','High-risk AI systems shall be designed to be sufficiently transparent for users to interpret outputs and use them appropriately.',NULL,'mandatory','Transparency',NULL,70,'2026-04-25 17:53:37'),('afca1fca-40cf-11f1-8bc3-00155d012902','d5e6f7a8-b9c0-4d5e-9f6a-7b8c9d0e1f2a',NULL,'Art.14','Human Oversight','High-risk AI systems shall be designed to allow effective human oversight, including the ability to override or stop the system.',NULL,'mandatory','Human Oversight',NULL,80,'2026-04-25 17:53:37'),('afca2121-40cf-11f1-8bc3-00155d012902','d5e6f7a8-b9c0-4d5e-9f6a-7b8c9d0e1f2a',NULL,'Art.15','Accuracy, Robustness and Cybersecurity','High-risk AI systems shall achieve appropriate accuracy and be resilient against errors, faults, and adversarial attacks.',NULL,'mandatory','Technical Requirements',NULL,90,'2026-04-25 17:53:37'),('afca2277-40cf-11f1-8bc3-00155d012902','d5e6f7a8-b9c0-4d5e-9f6a-7b8c9d0e1f2a',NULL,'Art.16','Obligations of Providers','AI providers must implement quality management systems, register high-risk AI, affix CE marking, and cooperate with authorities.',NULL,'mandatory','Provider Obligations',NULL,100,'2026-04-25 17:53:37'),('afca23c8-40cf-11f1-8bc3-00155d012902','d5e6f7a8-b9c0-4d5e-9f6a-7b8c9d0e1f2a',NULL,'Art.26','Obligations of Deployers','Deployers of high-risk AI must conduct fundamental rights impact assessments, maintain logs, ensure human oversight, and inform affected individuals.',NULL,'mandatory','Deployer Obligations',NULL,110,'2026-04-25 17:53:37'),('afca251f-40cf-11f1-8bc3-00155d012902','d5e6f7a8-b9c0-4d5e-9f6a-7b8c9d0e1f2a',NULL,'Art.50','Transparency Obligations for GPAI','General purpose AI systems must disclose when content is AI-generated (deepfakes); GPAI providers must publish summaries of training data.',NULL,'mandatory','General Purpose AI',NULL,120,'2026-04-25 17:53:37'),('afca2678-40cf-11f1-8bc3-00155d012902','d5e6f7a8-b9c0-4d5e-9f6a-7b8c9d0e1f2a',NULL,'Art.53','Obligations for GPAI Model Providers','Providers of general purpose AI models must maintain technical documentation, comply with copyright law, and publish model capability summaries.',NULL,'mandatory','General Purpose AI',NULL,130,'2026-04-25 17:53:37'),('afca27d1-40cf-11f1-8bc3-00155d012902','d5e6f7a8-b9c0-4d5e-9f6a-7b8c9d0e1f2a',NULL,'Art.55','Systemic Risk for GPAI','Providers of GPAI models with systemic risk must perform adversarial testing, report serious incidents, and implement cybersecurity measures.',NULL,'mandatory','General Purpose AI',NULL,140,'2026-04-25 17:53:37'),('afda3107-40cf-11f1-8bc3-00155d012902','e6f7a8b9-c0d1-4e6f-9a7b-8c9d0e1f2a3b',NULL,'SR-AUTH','StateRAMP Authorization','Cloud service providers must achieve StateRAMP authorization (Ready, Provisional, or Authorized status) to offer services to participating state and local governments.',NULL,'mandatory','Authorization',NULL,10,'2026-04-25 17:53:37'),('afda3991-40cf-11f1-8bc3-00155d012902','e6f7a8b9-c0d1-4e6f-9a7b-8c9d0e1f2a3b',NULL,'SR-LOW','Low Impact Baseline','Implement NIST 800-53 Rev 5 Low baseline controls for systems where loss of CIA would have limited adverse effect on government operations.',NULL,'mandatory','Security Baseline',NULL,20,'2026-04-25 17:53:37'),('afda3b47-40cf-11f1-8bc3-00155d012902','e6f7a8b9-c0d1-4e6f-9a7b-8c9d0e1f2a3b',NULL,'SR-MOD','Moderate Impact Baseline','Implement NIST 800-53 Rev 5 Moderate baseline controls for systems where loss of CIA could have serious adverse effect on government operations.',NULL,'mandatory','Security Baseline',NULL,30,'2026-04-25 17:53:37'),('afda3cdc-40cf-11f1-8bc3-00155d012902','e6f7a8b9-c0d1-4e6f-9a7b-8c9d0e1f2a3b',NULL,'SR-HIGH','High Impact Baseline','Implement NIST 800-53 Rev 5 High baseline controls for systems where loss of CIA could have severe or catastrophic adverse effect.',NULL,'mandatory','Security Baseline',NULL,40,'2026-04-25 17:53:37'),('afda3e6c-40cf-11f1-8bc3-00155d012902','e6f7a8b9-c0d1-4e6f-9a7b-8c9d0e1f2a3b',NULL,'SR-3PAO','Third-Party Assessment','Engage a StateRAMP-approved third-party assessment organization (3PAO) for initial and annual security assessments.',NULL,'mandatory','Assessment',NULL,50,'2026-04-25 17:53:37'),('afda4004-40cf-11f1-8bc3-00155d012902','e6f7a8b9-c0d1-4e6f-9a7b-8c9d0e1f2a3b',NULL,'SR-CM','Continuous Monitoring','Implement a continuous monitoring program reporting monthly to StateRAMP PMO covering vulnerability scanning, log review, and POA&M management.',NULL,'mandatory','Continuous Monitoring',NULL,60,'2026-04-25 17:53:37'),('afda415f-40cf-11f1-8bc3-00155d012902','e6f7a8b9-c0d1-4e6f-9a7b-8c9d0e1f2a3b',NULL,'SR-IR','Incident Reporting','Report significant security incidents to StateRAMP PMO and affected state governments within defined timeframes.',NULL,'mandatory','Incident Response',NULL,70,'2026-04-25 17:53:37'),('afda42b1-40cf-11f1-8bc3-00155d012902','e6f7a8b9-c0d1-4e6f-9a7b-8c9d0e1f2a3b',NULL,'SR-POAM','Plan of Action and Milestones','Maintain a current POA&M documenting all identified security weaknesses and planned remediation activities.',NULL,'mandatory','Remediation',NULL,80,'2026-04-25 17:53:37'),('afda43ff-40cf-11f1-8bc3-00155d012902','e6f7a8b9-c0d1-4e6f-9a7b-8c9d0e1f2a3b',NULL,'SR-SSP','System Security Plan','Develop and maintain a comprehensive system security plan describing the system boundary, controls implemented, and control implementation details.',NULL,'mandatory','Documentation',NULL,90,'2026-04-25 17:53:37'),('afda4554-40cf-11f1-8bc3-00155d012902','e6f7a8b9-c0d1-4e6f-9a7b-8c9d0e1f2a3b',NULL,'SR-DATA','Data Residency and Sovereignty','Ensure government data is stored within the United States and subject to US law; document data flows and storage locations.',NULL,'mandatory','Data Governance',NULL,100,'2026-04-25 17:53:37'),('afda46a6-40cf-11f1-8bc3-00155d012902','e6f7a8b9-c0d1-4e6f-9a7b-8c9d0e1f2a3b',NULL,'SR-SUPPLY','Supply Chain Risk Management','Identify and manage risks from software and hardware supply chain components used in the cloud service.',NULL,'mandatory','Third-party Risk',NULL,110,'2026-04-25 17:53:37'),('afda47f2-40cf-11f1-8bc3-00155d012902','e6f7a8b9-c0d1-4e6f-9a7b-8c9d0e1f2a3b',NULL,'SR-FIPS','Cryptographic Standards','Use FIPS 140-2 or FIPS 140-3 validated cryptographic modules for all data at rest and in transit.',NULL,'mandatory','Technical Controls',NULL,120,'2026-04-25 17:53:37'),('b00cff96-c3df-4a52-9a0d-92da58d457b7','161ca661-dcfc-41d6-ae04-4d515194f119','b9936327-400e-11f1-8bc3-00155d012902','Art.32.1.d','Testing effectiveness','A process for regularly testing, assessing and evaluating the effectiveness of technical and organisational measures.',NULL,'mandatory',NULL,NULL,3,'2026-04-26 02:00:00'),('b1af04b7-5161-41e1-8d12-13ddcdcf9ab8','a28c08f1-4113-11f1-8bc3-00155d012902',NULL,'7','Restrict Access to System Components and Cardholder Data by Business Need to Know',NULL,NULL,'mandatory','Access Control',NULL,6,'2026-04-26 02:00:01'),('b2390b23-4231-4a58-92e2-ca248bc259bf','a271e304-4113-11f1-8bc3-00155d012902',NULL,'4','Technology Risk Management Framework',NULL,NULL,'mandatory','Risk Management',NULL,1,'2026-04-26 02:00:01'),('b24c251f-3180-4e4e-915c-141124b7987f','a271e304-4113-11f1-8bc3-00155d012902','8fca5036-9288-42d0-96ef-9d5041d5859e','6.3','Network management','Implement proper network segmentation and access controls.',NULL,'mandatory',NULL,NULL,2,'2026-04-26 02:00:01'),('b2b96000-2cf9-4291-8eab-8dd686344b57','a27eef01-4113-11f1-8bc3-00155d012902','0b1d6c3c-710b-4097-a62c-8c00c9a23c9f','DE.CM','Continuous Monitoring','Assets are monitored to find anomalies, indicators of compromise, and other potentially adverse events.',NULL,'mandatory',NULL,NULL,0,'2026-04-26 02:00:01'),('b31349bd-4a98-11f1-8bc3-00155d012902','a7b8c9d0-0020-0001-0001-000000000001',NULL,'11.10','Closed System Controls','Persons using closed systems to create, modify, maintain, or transmit electronic records shall employ validated systems, accurate and complete copies, record protection, and computer-generated audit trails.',NULL,'mandatory','Part 11 Requirements',NULL,10,'2026-05-08 04:45:12'),('b3134f11-4a98-11f1-8bc3-00155d012902','a7b8c9d0-0020-0001-0001-000000000001',NULL,'11.30','Open System Controls','Persons using open systems to create, modify, maintain, or transmit electronic records shall employ additional measures to ensure record authenticity and integrity.',NULL,'mandatory','Part 11 Requirements',NULL,20,'2026-05-08 04:45:12'),('b313520d-4a98-11f1-8bc3-00155d012902','a7b8c9d0-0020-0001-0001-000000000001',NULL,'11.50','Electronic Signature Requirements','Electronic signatures shall include the printed name of the signer, date and time, and the meaning associated with the signature; must be linked to respective electronic records.',NULL,'mandatory','Part 11 Requirements',NULL,30,'2026-05-08 04:45:12'),('b3135524-4a98-11f1-8bc3-00155d012902','a7b8c9d0-0020-0001-0001-000000000001',NULL,'11.100','General Electronic Signature Provisions','Each electronic signature must be unique to one individual and must not be reused or reassigned; organizations must verify identity before assigning signatures.',NULL,'mandatory','Part 11 Requirements',NULL,40,'2026-05-08 04:45:12'),('b313582d-4a98-11f1-8bc3-00155d012902','a7b8c9d0-0020-0001-0001-000000000001',NULL,'11.200','Electronic Signature Components and Controls','Electronic signatures must employ at least two distinct identification components (e.g., ID code and password); non-biometric signatures require periodic re-authentication.',NULL,'mandatory','Part 11 Requirements',NULL,50,'2026-05-08 04:45:12'),('b320edc8-4a98-11f1-8bc3-00155d012902','a7b8c9d0-0020-0002-0001-000000000001',NULL,'GMP','Good Manufacturing Practice (GMP)','Quality standards governing the manufacture of pharmaceuticals, biologics, and medical devices to ensure products are consistently produced and controlled to quality standards.',NULL,'mandatory','GxP Types',NULL,10,'2026-05-08 04:45:12'),('b320f2d0-4a98-11f1-8bc3-00155d012902','a7b8c9d0-0020-0002-0001-000000000001',NULL,'GLP','Good Laboratory Practice (GLP)','Quality system for non-clinical laboratory studies, ensuring systematic, well-documented, and reproducible results for safety studies submitted to regulatory authorities.',NULL,'mandatory','GxP Types',NULL,20,'2026-05-08 04:45:12'),('b320f494-4a98-11f1-8bc3-00155d012902','a7b8c9d0-0020-0002-0001-000000000001',NULL,'GCP','Good Clinical Practice (GCP)','International ethical and scientific quality standard for designing, conducting, recording, and reporting clinical trials involving human subjects.',NULL,'mandatory','GxP Types',NULL,30,'2026-05-08 04:45:12'),('b320f62f-4a98-11f1-8bc3-00155d012902','a7b8c9d0-0020-0002-0001-000000000001',NULL,'GDP','Good Distribution Practice (GDP)','Quality framework ensuring that medicinal products are consistently stored, transported, and handled under suitable conditions as required by marketing authorization.',NULL,'mandatory','GxP Types',NULL,40,'2026-05-08 04:45:12'),('b320f7d1-4a98-11f1-8bc3-00155d012902','a7b8c9d0-0020-0002-0001-000000000001',NULL,'GVP','Good Pharmacovigilance Practice (GVP)','Guidelines for post-marketing surveillance of medicinal products, covering safety monitoring, signal detection, risk management, and regulatory reporting.',NULL,'mandatory','GxP Types',NULL,50,'2026-05-08 04:45:12'),('b33139cd-4a98-11f1-8bc3-00155d012902','a7b8c9d0-0020-0003-0001-000000000001',NULL,'MDR-I','Chapter I: General Provisions and Definitions','Defines scope, definitions, and purpose of the EU MDR including what constitutes a medical device and accessories for the regulation.',NULL,'mandatory','EU MDR Chapters',NULL,10,'2026-05-08 04:45:12'),('b3313f6a-4a98-11f1-8bc3-00155d012902','a7b8c9d0-0020-0003-0001-000000000001',NULL,'MDR-II','Chapter II: Making Available on the Market and Putting into Service','Requirements for economic operators (manufacturers, importers, distributors), registration in EUDAMED, and UDI system implementation.',NULL,'mandatory','EU MDR Chapters',NULL,20,'2026-05-08 04:45:12'),('b331412a-4a98-11f1-8bc3-00155d012902','a7b8c9d0-0020-0003-0001-000000000001',NULL,'MDR-III','Chapter III: Device Identification and Traceability','Unique Device Identification (UDI) system requirements, EUDAMED registration, and implant card requirements for traceability throughout the supply chain.',NULL,'mandatory','EU MDR Chapters',NULL,30,'2026-05-08 04:45:12'),('b33142da-4a98-11f1-8bc3-00155d012902','a7b8c9d0-0020-0003-0001-000000000001',NULL,'MDR-IV','Chapter IV: Notified Bodies','Requirements for designation, monitoring, and operational standards for notified bodies conducting conformity assessments.',NULL,'mandatory','EU MDR Chapters',NULL,40,'2026-05-08 04:45:12'),('b331446c-4a98-11f1-8bc3-00155d012902','a7b8c9d0-0020-0003-0001-000000000001',NULL,'MDR-V','Chapter V: Classification and Conformity Assessment','Classification rules (Class I, IIa, IIb, III) and applicable conformity assessment routes for demonstrating compliance with General Safety and Performance Requirements.',NULL,'mandatory','EU MDR Chapters',NULL,50,'2026-05-08 04:45:12'),('b33145f5-4a98-11f1-8bc3-00155d012902','a7b8c9d0-0020-0003-0001-000000000001',NULL,'MDR-VI','Chapter VI: Clinical Evidence and Investigations','Requirements for clinical evaluation, clinical investigations, post-market clinical follow-up, and PMCF to demonstrate clinical benefit and safety.',NULL,'mandatory','EU MDR Chapters',NULL,60,'2026-05-08 04:45:12'),('b3314779-4a98-11f1-8bc3-00155d012902','a7b8c9d0-0020-0003-0001-000000000001',NULL,'MDR-VII','Chapter VII: Post-Market Surveillance','Proactive PMS system requirements including PMS plan, PSUR, periodic safety update reports, and serious incident reporting.',NULL,'mandatory','EU MDR Chapters',NULL,70,'2026-05-08 04:45:12'),('b33148f6-4a98-11f1-8bc3-00155d012902','a7b8c9d0-0020-0003-0001-000000000001',NULL,'MDR-VIII','Chapter VIII: Vigilance and Market Surveillance','Serious incident and field safety corrective action reporting to competent authorities; market surveillance by authorities.',NULL,'mandatory','EU MDR Chapters',NULL,80,'2026-05-08 04:45:12'),('b3314a72-4a98-11f1-8bc3-00155d012902','a7b8c9d0-0020-0003-0001-000000000001',NULL,'MDR-IX','Chapter IX: Confidentiality, Data Protection, Funding and Penalties','Provisions on confidentiality of information, GDPR applicability to personal data processed under MDR, and member state penalties.',NULL,'mandatory','EU MDR Chapters',NULL,90,'2026-05-08 04:45:12'),('b34db290-4a98-11f1-8bc3-00155d012902','a7b8c9d0-0020-0005-0001-000000000001',NULL,'TISAX-IS','Information Security Assessment','Assessment of information security controls based on the VDA ISA catalogue covering organizational measures, technical controls, and supplier management.',NULL,'mandatory','TISAX Assessment Objectives',NULL,10,'2026-05-08 04:45:12'),('b34db753-4a98-11f1-8bc3-00155d012902','a7b8c9d0-0020-0005-0001-000000000001',NULL,'TISAX-PP','Prototype Protection Assessment','Enhanced assessment for organizations handling vehicle prototypes or test vehicles, requiring additional physical security measures.',NULL,'mandatory','TISAX Assessment Objectives',NULL,20,'2026-05-08 04:45:12'),('b34db932-4a98-11f1-8bc3-00155d012902','a7b8c9d0-0020-0005-0001-000000000001',NULL,'TISAX-DP','Data Protection Assessment','Assessment of compliance with GDPR and automotive industry data protection requirements for handling personal data of employees and customers.',NULL,'mandatory','TISAX Assessment Objectives',NULL,30,'2026-05-08 04:45:12'),('b35437d4-4a98-11f1-8bc3-00155d012902','a7b8c9d0-0020-0006-0001-000000000001',NULL,'NESAS-DLC','Development and Lifecycle Management','Security requirements and audit criteria for vendor development processes covering SDLC security, vulnerability management, patch processes, and end-of-life management.',NULL,'mandatory','NESAS Domains',NULL,10,'2026-05-08 04:45:12'),('b3543bd5-4a98-11f1-8bc3-00155d012902','a7b8c9d0-0020-0006-0001-000000000001',NULL,'NESAS-NPC','Network Product Class Requirements','Security evaluation requirements for specific network product classes covering 5G, LTE, IMS, and other mobile network equipment configurations.',NULL,'mandatory','NESAS Domains',NULL,20,'2026-05-08 04:45:12'),('b3645113-4a98-11f1-8bc3-00155d012902','a7b8c9d0-0020-0007-0001-000000000001',NULL,'C2M2-ACM','Asset, Change, and Configuration Management (ACM)','Manage IT and OT assets and changes to those assets, including configurations and their impact on cybersecurity risk.',NULL,'mandatory','C2M2 Domains',NULL,10,'2026-05-08 04:45:13'),('b3645650-4a98-11f1-8bc3-00155d012902','a7b8c9d0-0020-0007-0001-000000000001',NULL,'C2M2-IAM','Identity and Access Management (IAM)','Create and manage identities, authenticate users and non-user entities, and authorize access to assets commensurate with risk.',NULL,'mandatory','C2M2 Domains',NULL,20,'2026-05-08 04:45:13'),('b364581f-4a98-11f1-8bc3-00155d012902','a7b8c9d0-0020-0007-0001-000000000001',NULL,'C2M2-TVM','Threat and Vulnerability Management (TVM)','Establish and maintain plans, procedures, and technologies to detect, identify, analyze, manage, and respond to threats and vulnerabilities.',NULL,'mandatory','C2M2 Domains',NULL,30,'2026-05-08 04:45:13'),('b36459b6-4a98-11f1-8bc3-00155d012902','a7b8c9d0-0020-0007-0001-000000000001',NULL,'C2M2-SA','Situational Awareness (SA)','Establish and maintain activities and technologies to collect, analyze, and report cybersecurity information for an operating picture.',NULL,'mandatory','C2M2 Domains',NULL,40,'2026-05-08 04:45:13'),('b3645b8c-4a98-11f1-8bc3-00155d012902','a7b8c9d0-0020-0007-0001-000000000001',NULL,'C2M2-ISC','Information Sharing and Communications (ISC)','Establish and maintain relationships with internal and external entities to collect and provide cybersecurity information.',NULL,'mandatory','C2M2 Domains',NULL,50,'2026-05-08 04:45:13'),('b3645e52-4a98-11f1-8bc3-00155d012902','a7b8c9d0-0020-0007-0001-000000000001',NULL,'C2M2-EIR','Event and Incident Response, Continuity of Operations (EIR)','Establish and maintain plans, procedures, and technologies to detect, analyze, mitigate, and recover from cybersecurity events and incidents.',NULL,'mandatory','C2M2 Domains',NULL,60,'2026-05-08 04:45:13'),('b3645fd4-4a98-11f1-8bc3-00155d012902','a7b8c9d0-0020-0007-0001-000000000001',NULL,'C2M2-SCM','Supply Chain and External Dependencies Management (SCM)','Establish and maintain controls to manage cybersecurity risks associated with services and assets that are dependent on external entities.',NULL,'mandatory','C2M2 Domains',NULL,70,'2026-05-08 04:45:13'),('b3646148-4a98-11f1-8bc3-00155d012902','a7b8c9d0-0020-0007-0001-000000000001',NULL,'C2M2-WM','Workforce Management (WM)','Establish and maintain plans, procedures, technologies, and controls to create a cybersecurity workforce and culture.',NULL,'mandatory','C2M2 Domains',NULL,80,'2026-05-08 04:45:13'),('b36462b6-4a98-11f1-8bc3-00155d012902','a7b8c9d0-0020-0007-0001-000000000001',NULL,'C2M2-CPM','Cybersecurity Program Management (CPM)','Establish and maintain an enterprise cybersecurity program that provides governance, strategic planning, and sponsorship for the organization\'s program.',NULL,'mandatory','C2M2 Domains',NULL,90,'2026-05-08 04:45:13'),('b3646432-4a98-11f1-8bc3-00155d012902','a7b8c9d0-0020-0007-0001-000000000001',NULL,'C2M2-PM','Program Management (PROG)','Establish and manage cybersecurity program activities, including funding, budgeting, and reporting to organizational leadership.',NULL,'mandatory','C2M2 Domains',NULL,100,'2026-05-08 04:45:13'),('b36dc9da-4a98-11f1-8bc3-00155d012902','a7b8c9d0-0020-0008-0001-000000000001',NULL,'PIN-KM','Key Management Control Objectives','Cryptographic key management covering key generation, distribution, injection, storage, use, destruction, and key compromise recovery procedures.',NULL,'mandatory','PCI PIN Objectives',NULL,10,'2026-05-08 04:45:13'),('b36dd093-4a98-11f1-8bc3-00155d012902','a7b8c9d0-0020-0008-0001-000000000001',NULL,'PIN-DM','Device Management Control Objectives','Physical and logical security requirements for PIN entry devices including approval, inventory, installation, maintenance, and decommissioning.',NULL,'mandatory','PCI PIN Objectives',NULL,20,'2026-05-08 04:45:13'),('b36dd25f-4a98-11f1-8bc3-00155d012902','a7b8c9d0-0020-0008-0001-000000000001',NULL,'PIN-EA','Encryption Algorithms and Key Lengths','Approved encryption algorithms and minimum key lengths for PIN protection in compliance with current cryptographic standards.',NULL,'mandatory','PCI PIN Objectives',NULL,30,'2026-05-08 04:45:13'),('b36dd424-4a98-11f1-8bc3-00155d012902','a7b8c9d0-0020-0008-0001-000000000001',NULL,'PIN-PB','PIN Block Formats','Requirements for PIN block formats (ISO 9564) used to securely encode PINs for transmission and processing.',NULL,'mandatory','PCI PIN Objectives',NULL,40,'2026-05-08 04:45:13'),('b3793ac5-4a98-11f1-8bc3-00155d012902','a7b8c9d0-0020-0009-0001-000000000001',NULL,'P2PE-1','P2PE Solution Components and Security','Requirements for P2PE solution architecture ensuring that account data is encrypted at the point of interaction and never exposed in the merchant environment.',NULL,'mandatory','P2PE Domains',NULL,10,'2026-05-08 04:45:13'),('b379446f-4a98-11f1-8bc3-00155d012902','a7b8c9d0-0020-0009-0001-000000000001',NULL,'P2PE-2','Encryption at the Point of Interaction','Hardware, software, and procedural requirements for encrypting cardholder data at the point-of-interaction device before transmission.',NULL,'mandatory','P2PE Domains',NULL,20,'2026-05-08 04:45:13'),('b3794643-4a98-11f1-8bc3-00155d012902','a7b8c9d0-0020-0009-0001-000000000001',NULL,'P2PE-3','Decryption and Decryption Environments','Security requirements for the decryption environment, ensuring it is PCI DSS compliant and that decrypted data is protected.',NULL,'mandatory','P2PE Domains',NULL,30,'2026-05-08 04:45:13'),('b3794802-4a98-11f1-8bc3-00155d012902','a7b8c9d0-0020-0009-0001-000000000001',NULL,'P2PE-4','P2PE Solution Key Management','Cryptographic key management procedures for P2PE solutions covering key generation, injection, distribution, and destruction.',NULL,'mandatory','P2PE Domains',NULL,40,'2026-05-08 04:45:13'),('b3794b18-4a98-11f1-8bc3-00155d012902','a7b8c9d0-0020-0009-0001-000000000001',NULL,'P2PE-5','Application Security in P2PE Solutions','Security requirements for payment applications that are part of a P2PE solution, covering secure coding and application integrity.',NULL,'mandatory','P2PE Domains',NULL,50,'2026-05-08 04:45:13'),('b3794cbe-4a98-11f1-8bc3-00155d012902','a7b8c9d0-0020-0009-0001-000000000001',NULL,'P2PE-6','P2PE Monitoring and Response','Monitoring, logging, and incident response requirements for P2PE solutions to detect and respond to tampering and compromise.',NULL,'mandatory','P2PE Domains',NULL,60,'2026-05-08 04:45:13'),('b3801478-4a98-11f1-8bc3-00155d012902','a7b8c9d0-0020-0010-0001-000000000001',NULL,'SSF-SLC','Secure SLC Standard — Software Lifecycle Security','Requirements for software vendors to demonstrate their software lifecycle management processes are secure, covering SSDLC, threat modeling, and vulnerability management.',NULL,'mandatory','PCI SSF Standards',NULL,10,'2026-05-08 04:45:13'),('b38019ab-4a98-11f1-8bc3-00155d012902','a7b8c9d0-0020-0010-0001-000000000001',NULL,'SSF-SS','Secure Software Standard — Payment Software Security','Requirements for payment software to be designed and developed securely, covering critical security controls for protecting account data during processing.',NULL,'mandatory','PCI SSF Standards',NULL,20,'2026-05-08 04:45:13'),('b3894e0b-4a98-11f1-8bc3-00155d012902','a7b8c9d0-0020-0011-0001-000000000001',NULL,'IMO-ID','Identify','Identify risks to OT and IT systems, define roles and responsibilities for cyber risk management, and establish a cyber risk baseline for shipboard systems.',NULL,'mandatory','IMO Functional Elements',NULL,10,'2026-05-08 04:45:13'),('b38953f3-4a98-11f1-8bc3-00155d012902','a7b8c9d0-0020-0011-0001-000000000001',NULL,'IMO-PR','Protect','Implement risk control processes and measures to protect against identified cyber risks affecting shipboard systems and networks.',NULL,'mandatory','IMO Functional Elements',NULL,20,'2026-05-08 04:45:13'),('b38955f2-4a98-11f1-8bc3-00155d012902','a7b8c9d0-0020-0011-0001-000000000001',NULL,'IMO-DT','Detect','Develop and implement activities to detect cyber threats and vulnerabilities affecting shipboard systems on a timely basis.',NULL,'mandatory','IMO Functional Elements',NULL,30,'2026-05-08 04:45:13'),('b38957ae-4a98-11f1-8bc3-00155d012902','a7b8c9d0-0020-0011-0001-000000000001',NULL,'IMO-RS','Respond','Develop and implement contingency plans for responding to cyber incidents affecting shipboard systems and operations.',NULL,'mandatory','IMO Functional Elements',NULL,40,'2026-05-08 04:45:13'),('b3895937-4a98-11f1-8bc3-00155d012902','a7b8c9d0-0020-0011-0001-000000000001',NULL,'IMO-RC','Recover','Identify measures to back up and restore systems affected by a cyber incident and return to safe operations.',NULL,'mandatory','IMO Functional Elements',NULL,50,'2026-05-08 04:45:13'),('b391e294-4a98-11f1-8bc3-00155d012902','a7b8c9d0-0020-0012-0001-000000000001',NULL,'DA-SRA','Airworthiness Security Risk Assessment','Identify and assess security threats and vulnerabilities for aircraft functions to determine security risk and the need for security controls.',NULL,'mandatory','DO-326A Processes',NULL,10,'2026-05-08 04:45:13'),('b391e787-4a98-11f1-8bc3-00155d012902','a7b8c9d0-0020-0012-0001-000000000001',NULL,'DA-SR','Security Requirements Development','Derive security requirements from the risk assessment to achieve acceptable security risk for aircraft airworthiness certification.',NULL,'mandatory','DO-326A Processes',NULL,20,'2026-05-08 04:45:13'),('b391e96e-4a98-11f1-8bc3-00155d012902','a7b8c9d0-0020-0012-0001-000000000001',NULL,'DA-AS','Security Assurance','Provide evidence that security requirements are correctly implemented and effective through verification, testing, and documentation.',NULL,'mandatory','DO-326A Processes',NULL,30,'2026-05-08 04:45:13'),('b391eb6b-4a98-11f1-8bc3-00155d012902','a7b8c9d0-0020-0012-0001-000000000001',NULL,'DA-CERT','Airworthiness Security Certification','Demonstrate to certification authorities (FAA/EASA) that security risks to aircraft safety are adequately addressed to achieve airworthiness approval.',NULL,'mandatory','DO-326A Processes',NULL,40,'2026-05-08 04:45:13'),('b39d4ba7-4a98-11f1-8bc3-00155d012902','a7b8c9d0-0020-0013-0001-000000000001',NULL,'ICS-ID','Identify (ICS Context)','Develop organizational understanding of cybersecurity risk to ICS/SCADA systems, including OT asset inventory, control system architecture, and ICS-specific risk assessment.',NULL,'mandatory','ICS Core Functions',NULL,10,'2026-05-08 04:45:13'),('b39d5170-4a98-11f1-8bc3-00155d012902','a7b8c9d0-0020-0013-0001-000000000001',NULL,'ICS-PR','Protect (ICS Context)','Implement safeguards for ICS/SCADA systems including network segmentation, secure remote access, patch management with operational safety considerations, and supply chain security.',NULL,'mandatory','ICS Core Functions',NULL,20,'2026-05-08 04:45:13'),('b39d539e-4a98-11f1-8bc3-00155d012902','a7b8c9d0-0020-0013-0001-000000000001',NULL,'ICS-DT','Detect (ICS Context)','Implement monitoring capabilities for ICS environments using OT-aware security monitoring tools, anomaly detection, and event logging without impacting operational availability.',NULL,'mandatory','ICS Core Functions',NULL,30,'2026-05-08 04:45:13'),('b39d5589-4a98-11f1-8bc3-00155d012902','a7b8c9d0-0020-0013-0001-000000000001',NULL,'ICS-RS','Respond (ICS Context)','Develop and implement ICS-specific incident response plans that account for operational safety, process integrity, and coordination between IT and OT teams.',NULL,'mandatory','ICS Core Functions',NULL,40,'2026-05-08 04:45:13'),('b39d5785-4a98-11f1-8bc3-00155d012902','a7b8c9d0-0020-0013-0001-000000000001',NULL,'ICS-RC','Recover (ICS Context)','Develop resilient ICS/SCADA systems with backup configurations, recovery procedures that prioritize operational safety, and post-incident lessons learned.',NULL,'mandatory','ICS Core Functions',NULL,50,'2026-05-08 04:45:13'),('b3a7d386-4a98-11f1-8bc3-00155d012902','a7b8c9d0-0020-0014-0001-000000000001',NULL,'K8S-CP','Control Plane Components','Configuration requirements for the Kubernetes API server, controller manager, scheduler, and etcd to ensure a hardened control plane.',NULL,'mandatory','Kubernetes Benchmark Sections',NULL,10,'2026-05-08 04:45:13'),('b3a7d8a1-4a98-11f1-8bc3-00155d012902','a7b8c9d0-0020-0014-0001-000000000001',NULL,'K8S-WN','Worker Node Security','Hardening requirements for Kubernetes worker nodes including kubelet configuration, node OS hardening, and container runtime security settings.',NULL,'mandatory','Kubernetes Benchmark Sections',NULL,20,'2026-05-08 04:45:13'),('b3a7da69-4a98-11f1-8bc3-00155d012902','a7b8c9d0-0020-0014-0001-000000000001',NULL,'K8S-POL','Policies','Kubernetes policy configuration including Pod Security Admission, network policies, RBAC configuration, and namespace isolation.',NULL,'mandatory','Kubernetes Benchmark Sections',NULL,30,'2026-05-08 04:45:13'),('b3a7dc0c-4a98-11f1-8bc3-00155d012902','a7b8c9d0-0020-0014-0001-000000000001',NULL,'K8S-ETC','etcd Security','Security configuration for the etcd key-value store including encryption at rest, TLS peer and client communication, and access control.',NULL,'mandatory','Kubernetes Benchmark Sections',NULL,40,'2026-05-08 04:45:13'),('b3a7dd8c-4a98-11f1-8bc3-00155d012902','a7b8c9d0-0020-0014-0001-000000000001',NULL,'K8S-NET','Network Policies and Segmentation','Network policy requirements for restricting pod-to-pod communication, enforcing namespace isolation, and controlling egress traffic.',NULL,'mandatory','Kubernetes Benchmark Sections',NULL,50,'2026-05-08 04:45:13'),('b3b24ee5-4a98-11f1-8bc3-00155d012902','a7b8c9d0-0020-0015-0001-000000000001',NULL,'AWS-SEC-1','Identity and Access Management','Implement strong identity foundation using least privilege, enable identity federation, and eliminate long-term static credentials using IAM roles and identity policies.',NULL,'mandatory','AWS Security Best Practices',NULL,10,'2026-05-08 04:45:13'),('b3b253d7-4a98-11f1-8bc3-00155d012902','a7b8c9d0-0020-0015-0001-000000000001',NULL,'AWS-SEC-2','Detection','Configure service-level logging (CloudTrail, VPC Flow Logs, Config), enable GuardDuty, and implement automated alerting and response for security events.',NULL,'mandatory','AWS Security Best Practices',NULL,20,'2026-05-08 04:45:13'),('b3b25590-4a98-11f1-8bc3-00155d012902','a7b8c9d0-0020-0015-0001-000000000001',NULL,'AWS-SEC-3','Infrastructure Protection','Protect compute resources using security groups, NACLs, WAF, Shield, and ensure resources are deployed in private subnets with minimal public exposure.',NULL,'mandatory','AWS Security Best Practices',NULL,30,'2026-05-08 04:45:13'),('b3b25730-4a98-11f1-8bc3-00155d012902','a7b8c9d0-0020-0015-0001-000000000001',NULL,'AWS-SEC-4','Data Protection','Classify data, encrypt data at rest and in transit, manage encryption keys using KMS, and implement fine-grained data access controls.',NULL,'mandatory','AWS Security Best Practices',NULL,40,'2026-05-08 04:45:13'),('b3b258cd-4a98-11f1-8bc3-00155d012902','a7b8c9d0-0020-0015-0001-000000000001',NULL,'AWS-SEC-5','Incident Response','Prepare for security incidents using pre-provisioned access, forensic tools, and run books; conduct Game Days to test incident response capabilities.',NULL,'mandatory','AWS Security Best Practices',NULL,50,'2026-05-08 04:45:13'),('b3c66f75-4a98-11f1-8bc3-00155d012902','a7b8c9d0-0020-0016-0001-000000000001',NULL,'ASB-NS','Network Security','Requirements for securing Azure virtual networks, network segmentation, DDoS protection, network filtering, and secure remote access.',NULL,'mandatory','Azure Security Benchmark Domains',NULL,10,'2026-05-08 04:45:13'),('b3c6745f-4a98-11f1-8bc3-00155d012902','a7b8c9d0-0020-0016-0001-000000000001',NULL,'ASB-IM','Identity Management','Requirements for using Microsoft Entra ID for authentication, implementing MFA, configuring privileged identity management, and monitoring identity-related risks.',NULL,'mandatory','Azure Security Benchmark Domains',NULL,20,'2026-05-08 04:45:13'),('b3c67627-4a98-11f1-8bc3-00155d012902','a7b8c9d0-0020-0016-0001-000000000001',NULL,'ASB-PA','Privileged Access','Requirements for protecting privileged access to Azure management plane and control plane through PIM, PAW, and just-in-time access.',NULL,'mandatory','Azure Security Benchmark Domains',NULL,30,'2026-05-08 04:45:13'),('b3c677fc-4a98-11f1-8bc3-00155d012902','a7b8c9d0-0020-0016-0001-000000000001',NULL,'ASB-DP','Data Protection','Requirements for data discovery, classification, encryption at rest, encryption in transit, and key management using Azure Key Vault.',NULL,'mandatory','Azure Security Benchmark Domains',NULL,40,'2026-05-08 04:45:13'),('b3c67998-4a98-11f1-8bc3-00155d012902','a7b8c9d0-0020-0016-0001-000000000001',NULL,'ASB-AM','Asset Management','Requirements for maintaining inventory of Azure resources, enforcing resource policies, and managing the security posture of cloud assets.',NULL,'mandatory','Azure Security Benchmark Domains',NULL,50,'2026-05-08 04:45:13'),('b3c67b26-4a98-11f1-8bc3-00155d012902','a7b8c9d0-0020-0016-0001-000000000001',NULL,'ASB-LT','Logging and Threat Detection','Requirements for enabling Defender for Cloud, configuring Microsoft Sentinel, collecting audit logs, and implementing threat detection rules.',NULL,'mandatory','Azure Security Benchmark Domains',NULL,60,'2026-05-08 04:45:13'),('b3c67cad-4a98-11f1-8bc3-00155d012902','a7b8c9d0-0020-0016-0001-000000000001',NULL,'ASB-IR','Incident Response','Requirements for incident response preparation, detection, containment, eradication, and recovery in Azure environments.',NULL,'mandatory','Azure Security Benchmark Domains',NULL,70,'2026-05-08 04:45:13'),('b3c67e36-4a98-11f1-8bc3-00155d012902','a7b8c9d0-0020-0016-0001-000000000001',NULL,'ASB-PV','Posture and Vulnerability Management','Requirements for vulnerability scanning, security posture assessment using Microsoft Defender for Cloud Secure Score, and rapid remediation.',NULL,'mandatory','Azure Security Benchmark Domains',NULL,80,'2026-05-08 04:45:13'),('b3c68031-4a98-11f1-8bc3-00155d012902','a7b8c9d0-0020-0016-0001-000000000001',NULL,'ASB-ES','Endpoint Security','Requirements for using Microsoft Defender for Endpoint, enabling threat and vulnerability management, and protecting servers and virtual machines.',NULL,'mandatory','Azure Security Benchmark Domains',NULL,90,'2026-05-08 04:45:13'),('b3c6822a-4a98-11f1-8bc3-00155d012902','a7b8c9d0-0020-0016-0001-000000000001',NULL,'ASB-BR','Backup and Recovery','Requirements for using Azure Backup, testing recovery, and ensuring business continuity for critical Azure workloads.',NULL,'mandatory','Azure Security Benchmark Domains',NULL,100,'2026-05-08 04:45:13'),('b3c68400-4a98-11f1-8bc3-00155d012902','a7b8c9d0-0020-0016-0001-000000000001',NULL,'ASB-DS','DevOps Security','Requirements for integrating security into DevOps pipelines using Defender for DevOps, secret scanning, and infrastructure as code security checks.',NULL,'mandatory','Azure Security Benchmark Domains',NULL,110,'2026-05-08 04:45:13'),('b3c685de-4a98-11f1-8bc3-00155d012902','a7b8c9d0-0020-0016-0001-000000000001',NULL,'ASB-GS','Governance and Strategy','Requirements for defining cloud security governance, establishing a cloud security strategy, and defining roles and responsibilities.',NULL,'mandatory','Azure Security Benchmark Domains',NULL,120,'2026-05-08 04:45:13'),('b3d61ae9-4a98-11f1-8bc3-00155d012902','a7b8c9d0-0020-0017-0001-000000000001',NULL,'GCP-ORG','Organization Policy and Resource Hierarchy','Configure GCP organization policies, resource hierarchy, and project structure to enforce security guardrails and governance at scale.',NULL,'mandatory','GCP Security Pillars',NULL,10,'2026-05-08 04:45:13'),('b3d620ea-4a98-11f1-8bc3-00155d012902','a7b8c9d0-0020-0017-0001-000000000001',NULL,'GCP-IAM','Identity and Access Management','Implement least-privilege IAM using predefined and custom roles, enable Workload Identity Federation, and audit IAM configurations regularly.',NULL,'mandatory','GCP Security Pillars',NULL,20,'2026-05-08 04:45:13'),('b3d62314-4a98-11f1-8bc3-00155d012902','a7b8c9d0-0020-0017-0001-000000000001',NULL,'GCP-NET','Networking and Network Security','Design and implement secure VPC architecture, configure Cloud Armor WAF, enable Private Google Access, and restrict external IP addresses.',NULL,'mandatory','GCP Security Pillars',NULL,30,'2026-05-08 04:45:13'),('b3d6274c-4a98-11f1-8bc3-00155d012902','a7b8c9d0-0020-0017-0001-000000000001',NULL,'GCP-MON','Logging, Monitoring, and Audit','Enable Cloud Audit Logs, configure Security Command Center, deploy Chronicle SIEM, and implement log sinks for security event correlation.',NULL,'mandatory','GCP Security Pillars',NULL,40,'2026-05-08 04:45:13'),('b3d62915-4a98-11f1-8bc3-00155d012902','a7b8c9d0-0020-0017-0001-000000000001',NULL,'GCP-DATA','Data Security and Encryption','Encrypt data using Cloud KMS, implement Cloud DLP for sensitive data discovery, enforce data residency policies, and manage customer-managed keys.',NULL,'mandatory','GCP Security Pillars',NULL,50,'2026-05-08 04:45:13'),('b3d62ac4-4a98-11f1-8bc3-00155d012902','a7b8c9d0-0020-0017-0001-000000000001',NULL,'GCP-IR','Incident Response','Establish GCP-specific incident response runbooks, use Assured Workloads for sensitive data, and configure automated responses using Security Command Center findings.',NULL,'mandatory','GCP Security Pillars',NULL,60,'2026-05-08 04:45:13'),('b582df02-c101-4b9a-8642-19c473eba551','a23072ef-4113-11f1-8bc3-00155d012902','09316565-9b2d-4644-8737-b13fa45b3cdc','1798.110(a)(1)','Categories of personal information collected','Disclose the categories of personal information it has collected about that consumer.',NULL,'mandatory',NULL,NULL,0,'2026-04-26 02:00:00'),('b5d335e2-66ea-4a33-b65f-e52f9b7ce7d6','a25c0c03-4113-11f1-8bc3-00155d012902',NULL,'7','Support',NULL,NULL,'mandatory','Resources & Support',NULL,3,'2026-04-26 02:00:00'),('b5df04d1-c829-4e76-905d-c2ce1a533693','a25c0c03-4113-11f1-8bc3-00155d012902','b5d335e2-66ea-4a33-b65f-e52f9b7ce7d6','7.4','Communication','Determine the need for internal and external communications relevant to the ISMS.',NULL,'mandatory',NULL,NULL,3,'2026-04-26 02:00:01'),('b71187b4-c5b1-41a4-9662-92c38e530742','d4e5f6a1-b2c3-4d4e-8f6a-1b2c3d4e5f6a','415a8bdc-329f-4be1-9611-27b241e3cbdf','164.406(c)','Secretary Notification','Notify the Secretary of HHS following discovery of a breach.',NULL,'mandatory',NULL,NULL,2,'2026-04-26 02:00:00'),('b7c7e46c-3b8f-466e-bc73-a9bbec4b32b7','a25c0c03-4113-11f1-8bc3-00155d012902','a1bcbd48-afea-4e16-b19e-d810727b604c','5.2','Policy','Top management shall establish an information security policy.',NULL,'mandatory',NULL,NULL,1,'2026-04-26 02:00:00'),('b8835c3a-edc7-4c59-a927-ef9beb1d87e0','a25c0c03-4113-11f1-8bc3-00155d012902','e925195e-a5f8-4a84-8823-6df95025e13c','A.5.23','Information security for use of cloud services','Processes for acquisition, use, management and exit from cloud services shall be established.',NULL,'mandatory',NULL,NULL,4,'2026-04-26 02:00:01'),('b8c31e88-40d1-41aa-bf64-ce544aad9e40','a27eef01-4113-11f1-8bc3-00155d012902','35f1dd40-f7cc-43ae-ba7f-3006b4233500','ID.IM','Improvement','Improvements to organizational cybersecurity risk management processes are identified.',NULL,'mandatory',NULL,NULL,2,'2026-04-26 02:00:01'),('b93be0d4-400e-11f1-8bc3-00155d012902','d4a9ebef-b1ab-489b-baa4-274cc840171e',NULL,'CIS-1','Inventory and Control of Enterprise Assets','Actively manage all enterprise assets connected to the infrastructure to know what to defend.',NULL,'mandatory','Basic Hygiene',NULL,10,'2026-04-24 18:52:20'),('b93be785-400e-11f1-8bc3-00155d012902','d4a9ebef-b1ab-489b-baa4-274cc840171e',NULL,'CIS-2','Inventory and Control of Software Assets','Actively manage all software on the network to prevent unauthorized software from being installed.',NULL,'mandatory','Basic Hygiene',NULL,20,'2026-04-24 18:52:20'),('b93be98d-400e-11f1-8bc3-00155d012902','d4a9ebef-b1ab-489b-baa4-274cc840171e',NULL,'CIS-3','Data Protection','Develop processes and technical controls to identify, classify, securely handle, retain, and dispose of data.',NULL,'mandatory','Basic Hygiene',NULL,30,'2026-04-24 18:52:20'),('b93bebaa-400e-11f1-8bc3-00155d012902','d4a9ebef-b1ab-489b-baa4-274cc840171e',NULL,'CIS-4','Secure Configuration of Enterprise Assets and Software','Establish and maintain the secure configuration of enterprise assets and software.',NULL,'mandatory','Basic Hygiene',NULL,40,'2026-04-24 18:52:20'),('b93bedc5-400e-11f1-8bc3-00155d012902','d4a9ebef-b1ab-489b-baa4-274cc840171e',NULL,'CIS-5','Account Management','Use processes and tools to assign and manage authorization to credentials for user accounts.',NULL,'mandatory','Basic Hygiene',NULL,50,'2026-04-24 18:52:20'),('b93befd3-400e-11f1-8bc3-00155d012902','d4a9ebef-b1ab-489b-baa4-274cc840171e',NULL,'CIS-6','Access Control Management','Use processes and tools to create, assign, manage, and revoke access credentials and privileges.',NULL,'mandatory','Basic Hygiene',NULL,60,'2026-04-24 18:52:20'),('b93bf1a3-400e-11f1-8bc3-00155d012902','d4a9ebef-b1ab-489b-baa4-274cc840171e',NULL,'CIS-7','Continuous Vulnerability Management','Develop a plan to continuously assess and track vulnerabilities on all enterprise assets.',NULL,'mandatory','Foundational',NULL,70,'2026-04-24 18:52:20'),('b93bf35b-400e-11f1-8bc3-00155d012902','d4a9ebef-b1ab-489b-baa4-274cc840171e',NULL,'CIS-8','Audit Log Management','Collect, alert, review, and retain audit logs of events that could help detect or recover from an attack.',NULL,'mandatory','Foundational',NULL,80,'2026-04-24 18:52:20'),('b93bf511-400e-11f1-8bc3-00155d012902','d4a9ebef-b1ab-489b-baa4-274cc840171e',NULL,'CIS-9','Email and Web Browser Protections','Improve protections and detections of threats from email and web vectors.',NULL,'mandatory','Foundational',NULL,90,'2026-04-24 18:52:20'),('b93bf810-400e-11f1-8bc3-00155d012902','d4a9ebef-b1ab-489b-baa4-274cc840171e',NULL,'CIS-10','Malware Defenses','Prevent or control the installation, spread, and execution of malicious applications.',NULL,'mandatory','Foundational',NULL,100,'2026-04-24 18:52:20'),('b93bfa0c-400e-11f1-8bc3-00155d012902','d4a9ebef-b1ab-489b-baa4-274cc840171e',NULL,'CIS-11','Data Recovery','Establish and maintain data recovery practices to restore in-scope assets to a pre-incident state.',NULL,'mandatory','Foundational',NULL,110,'2026-04-24 18:52:20'),('b93bfbd0-400e-11f1-8bc3-00155d012902','d4a9ebef-b1ab-489b-baa4-274cc840171e',NULL,'CIS-12','Network Infrastructure Management','Establish, implement, and actively manage network devices to prevent attackers from exploiting services.',NULL,'mandatory','Foundational',NULL,120,'2026-04-24 18:52:20'),('b93bfd8a-400e-11f1-8bc3-00155d012902','d4a9ebef-b1ab-489b-baa4-274cc840171e',NULL,'CIS-13','Network Monitoring and Defense','Operate processes and tooling to establish and maintain comprehensive network monitoring.',NULL,'mandatory','Foundational',NULL,130,'2026-04-24 18:52:20'),('b93bff45-400e-11f1-8bc3-00155d012902','d4a9ebef-b1ab-489b-baa4-274cc840171e',NULL,'CIS-14','Security Awareness and Skills Training','Establish and maintain a security awareness program to influence behavior among the workforce.',NULL,'mandatory','Foundational',NULL,140,'2026-04-24 18:52:20'),('b93c010b-400e-11f1-8bc3-00155d012902','d4a9ebef-b1ab-489b-baa4-274cc840171e',NULL,'CIS-15','Service Provider Management','Develop a process to evaluate service providers who hold sensitive data or are responsible for IT platforms.',NULL,'mandatory','Organizational',NULL,150,'2026-04-24 18:52:20'),('b93c02dd-400e-11f1-8bc3-00155d012902','d4a9ebef-b1ab-489b-baa4-274cc840171e',NULL,'CIS-16','Application Software Security','Manage the security life cycle of in-house developed, hosted, or acquired software.',NULL,'mandatory','Organizational',NULL,160,'2026-04-24 18:52:20'),('b93c048a-400e-11f1-8bc3-00155d012902','d4a9ebef-b1ab-489b-baa4-274cc840171e',NULL,'CIS-17','Incident Response Management','Establish a program to develop and maintain an incident response capability.',NULL,'mandatory','Organizational',NULL,170,'2026-04-24 18:52:20'),('b93c065b-400e-11f1-8bc3-00155d012902','d4a9ebef-b1ab-489b-baa4-274cc840171e',NULL,'CIS-18','Penetration Testing','Test the effectiveness and resiliency of enterprise assets through identifying and exploiting weaknesses.',NULL,'mandatory','Organizational',NULL,180,'2026-04-24 18:52:20'),('b9523959-400e-11f1-8bc3-00155d012902','873f7da5-f3c7-4c43-8888-ed277d15a204',NULL,'EDM01','Ensured Governance Framework Setting and Maintenance','Analyze and articulate the requirements for governance of enterprise IT and establish and maintain effective governance.',NULL,'mandatory','Governance',NULL,10,'2026-04-24 18:52:20'),('b9523e34-400e-11f1-8bc3-00155d012902','873f7da5-f3c7-4c43-8888-ed277d15a204',NULL,'EDM02','Ensured Benefits Delivery','Secure optimal value from IT-enabled initiatives, services and assets.',NULL,'mandatory','Governance',NULL,20,'2026-04-24 18:52:20'),('b9524030-400e-11f1-8bc3-00155d012902','873f7da5-f3c7-4c43-8888-ed277d15a204',NULL,'EDM03','Ensured Risk Optimization','Ensure that the enterprise\'s risk appetite and tolerance are understood and that IT-related enterprise risk is identified.',NULL,'mandatory','Governance',NULL,30,'2026-04-24 18:52:20'),('b952422d-400e-11f1-8bc3-00155d012902','873f7da5-f3c7-4c43-8888-ed277d15a204',NULL,'EDM04','Ensured Resource Optimization','Ensure that adequate and sufficient IT-related capabilities are available to support enterprise objectives.',NULL,'mandatory','Governance',NULL,40,'2026-04-24 18:52:20'),('b9524437-400e-11f1-8bc3-00155d012902','873f7da5-f3c7-4c43-8888-ed277d15a204',NULL,'EDM05','Ensured Stakeholder Engagement','Ensure that enterprise IT stakeholder communication and reporting is effective and timely.',NULL,'mandatory','Governance',NULL,50,'2026-04-24 18:52:20'),('b952464d-400e-11f1-8bc3-00155d012902','873f7da5-f3c7-4c43-8888-ed277d15a204',NULL,'APO01','Managed I&T Management Framework','Clarify and maintain the governance of enterprise I&T management by implementing a management framework.',NULL,'mandatory','Management',NULL,60,'2026-04-24 18:52:20'),('b9524819-400e-11f1-8bc3-00155d012902','873f7da5-f3c7-4c43-8888-ed277d15a204',NULL,'APO02','Managed Strategy','Provide a holistic view of current business and IT environment, future direction, and initiatives.',NULL,'mandatory','Management',NULL,70,'2026-04-24 18:52:20'),('b95249db-400e-11f1-8bc3-00155d012902','873f7da5-f3c7-4c43-8888-ed277d15a204',NULL,'APO03','Managed Enterprise Architecture','Represent the different building blocks that make up the enterprise and their interrelationships.',NULL,'mandatory','Management',NULL,80,'2026-04-24 18:52:20'),('b9524b8f-400e-11f1-8bc3-00155d012902','873f7da5-f3c7-4c43-8888-ed277d15a204',NULL,'APO06','Managed Budget and Costs','Manage IT-related financial activities in business and IT functions covering budget, cost, and benefit management.',NULL,'mandatory','Management',NULL,90,'2026-04-24 18:52:20'),('b95288bc-400e-11f1-8bc3-00155d012902','873f7da5-f3c7-4c43-8888-ed277d15a204',NULL,'APO07','Managed Human Resources','Provide a structured approach to ensure optimal structuring, placement, decision rights and skills of human resources.',NULL,'mandatory','Management',NULL,100,'2026-04-24 18:52:20'),('b9528ac9-400e-11f1-8bc3-00155d012902','873f7da5-f3c7-4c43-8888-ed277d15a204',NULL,'APO10','Managed Vendors','Manage IT-related services provided by all types of vendors to meet enterprise requirements.',NULL,'mandatory','Management',NULL,110,'2026-04-24 18:52:20'),('b9528c80-400e-11f1-8bc3-00155d012902','873f7da5-f3c7-4c43-8888-ed277d15a204',NULL,'APO12','Managed Risk','Continually identify, assess and reduce IT-related risk within levels of tolerance set by enterprise executive management.',NULL,'mandatory','Management',NULL,120,'2026-04-24 18:52:20'),('b9528e61-400e-11f1-8bc3-00155d012902','873f7da5-f3c7-4c43-8888-ed277d15a204',NULL,'APO14','Managed Data','Understand and manage the planning and design of data to improve quality of decision making and business agility.',NULL,'mandatory','Management',NULL,130,'2026-04-24 18:52:20'),('b9529048-400e-11f1-8bc3-00155d012902','873f7da5-f3c7-4c43-8888-ed277d15a204',NULL,'BAI01','Managed Programs','Manage all programs in investment portfolio in alignment with the enterprise strategy.',NULL,'mandatory','Build & Acquire',NULL,140,'2026-04-24 18:52:20'),('b95291f8-400e-11f1-8bc3-00155d012902','873f7da5-f3c7-4c43-8888-ed277d15a204',NULL,'BAI03','Managed Solutions Identification and Build','Establish and maintain identified solutions in line with enterprise requirements covering design, development, and integration.',NULL,'mandatory','Build & Acquire',NULL,150,'2026-04-24 18:52:20'),('b95293b4-400e-11f1-8bc3-00155d012902','873f7da5-f3c7-4c43-8888-ed277d15a204',NULL,'BAI06','Managed IT Changes','Manage all changes in a controlled manner including standard and emergency changes to business processes.',NULL,'mandatory','Build & Acquire',NULL,160,'2026-04-24 18:52:20'),('b9529569-400e-11f1-8bc3-00155d012902','873f7da5-f3c7-4c43-8888-ed277d15a204',NULL,'BAI10','Managed Configuration','Define and maintain descriptions and relationships between key resources and capabilities required to deliver IT services.',NULL,'mandatory','Build & Acquire',NULL,170,'2026-04-24 18:52:20'),('b952973f-400e-11f1-8bc3-00155d012902','873f7da5-f3c7-4c43-8888-ed277d15a204',NULL,'DSS01','Managed Operations','Coordinate and execute activities and operational procedures required to deliver internal and outsourced IT services.',NULL,'mandatory','Deliver & Support',NULL,180,'2026-04-24 18:52:20'),('b95298fb-400e-11f1-8bc3-00155d012902','873f7da5-f3c7-4c43-8888-ed277d15a204',NULL,'DSS02','Managed Service Requests and Incidents','Provide timely and effective response to user requests and resolution of all types of incidents.',NULL,'mandatory','Deliver & Support',NULL,190,'2026-04-24 18:52:20'),('b9529aa8-400e-11f1-8bc3-00155d012902','873f7da5-f3c7-4c43-8888-ed277d15a204',NULL,'DSS04','Managed Continuity','Establish and maintain a plan to enable the business and IT to respond to incidents and disruptions.',NULL,'mandatory','Deliver & Support',NULL,200,'2026-04-24 18:52:20'),('b9529c78-400e-11f1-8bc3-00155d012902','873f7da5-f3c7-4c43-8888-ed277d15a204',NULL,'DSS05','Managed Security Services','Protect enterprise information to maintain the level of information security risk acceptable to the enterprise.',NULL,'mandatory','Deliver & Support',NULL,210,'2026-04-24 18:52:20'),('b9529e2e-400e-11f1-8bc3-00155d012902','873f7da5-f3c7-4c43-8888-ed277d15a204',NULL,'MEA01','Managed Performance and Conformance Monitoring','Collect, validate and evaluate business, IT and process goals and metrics.',NULL,'mandatory','Monitor & Evaluate',NULL,220,'2026-04-24 18:52:20'),('b9529fe2-400e-11f1-8bc3-00155d012902','873f7da5-f3c7-4c43-8888-ed277d15a204',NULL,'MEA02','Managed System of Internal Control','Continuously monitor and evaluate the control environment including self-assessments and independent assurance reviews.',NULL,'mandatory','Monitor & Evaluate',NULL,230,'2026-04-24 18:52:20'),('b952a1ab-400e-11f1-8bc3-00155d012902','873f7da5-f3c7-4c43-8888-ed277d15a204',NULL,'MEA04','Managed Assurance','Obtain assurance about whether IT-related enterprise risk is within acceptable levels.',NULL,'mandatory','Monitor & Evaluate',NULL,240,'2026-04-24 18:52:20'),('b9628201-400e-11f1-8bc3-00155d012902','98ee5a53-635c-42eb-b435-8b2fa846ef2e',NULL,'5.1','PIMS-specific Requirements for ISO 27001 Context','Understand the organization and its context including data subjects and privacy obligations.',NULL,'mandatory','ISMS Extension',NULL,10,'2026-04-24 18:52:20'),('b9628626-400e-11f1-8bc3-00155d012902','98ee5a53-635c-42eb-b435-8b2fa846ef2e',NULL,'5.2','Leadership and Privacy Commitment','Top management shall demonstrate leadership and commitment with respect to the PIMS.',NULL,'mandatory','ISMS Extension',NULL,20,'2026-04-24 18:52:20'),('b962877f-400e-11f1-8bc3-00155d012902','98ee5a53-635c-42eb-b435-8b2fa846ef2e',NULL,'5.3','Privacy Policies and Objectives','Establish a privacy policy and privacy objectives consistent with legal obligations.',NULL,'mandatory','ISMS Extension',NULL,30,'2026-04-24 18:52:20'),('b96288b8-400e-11f1-8bc3-00155d012902','98ee5a53-635c-42eb-b435-8b2fa846ef2e',NULL,'6.1','Privacy Risk Assessment','Plan and implement processes for privacy impact assessments and risk treatment.',NULL,'mandatory','Privacy Planning',NULL,40,'2026-04-24 18:52:20'),('b96289ed-400e-11f1-8bc3-00155d012902','98ee5a53-635c-42eb-b435-8b2fa846ef2e',NULL,'7.1','Conditions for Collection and Processing','Determine and document the legal basis for processing personal data.',NULL,'mandatory','Controller Guidance',NULL,50,'2026-04-24 18:52:20'),('b9628b1d-400e-11f1-8bc3-00155d012902','98ee5a53-635c-42eb-b435-8b2fa846ef2e',NULL,'7.2','Obligations to PII Principals','Provide privacy notice, obtain consent, and support data subject rights requests.',NULL,'mandatory','Controller Guidance',NULL,60,'2026-04-24 18:52:20'),('b9628c46-400e-11f1-8bc3-00155d012902','98ee5a53-635c-42eb-b435-8b2fa846ef2e',NULL,'7.3','Privacy by Design and Default','Integrate privacy controls into system design and apply data minimization principles.',NULL,'mandatory','Controller Guidance',NULL,70,'2026-04-24 18:52:20'),('b9628d66-400e-11f1-8bc3-00155d012902','98ee5a53-635c-42eb-b435-8b2fa846ef2e',NULL,'7.4','PII Sharing, Transfer and Disclosure','Ensure lawful basis for transfers to third parties and cross-border data transfers.',NULL,'mandatory','Controller Guidance',NULL,80,'2026-04-24 18:52:20'),('b9628e8b-400e-11f1-8bc3-00155d012902','98ee5a53-635c-42eb-b435-8b2fa846ef2e',NULL,'8.2','Processor Conditions and Obligations','Process personal data only under documented instructions from a controller.',NULL,'mandatory','Processor Guidance',NULL,90,'2026-04-24 18:52:20'),('b9628fb4-400e-11f1-8bc3-00155d012902','98ee5a53-635c-42eb-b435-8b2fa846ef2e',NULL,'8.3','Privacy by Design for Processors','Implement technical and organizational measures to protect PII in processor systems.',NULL,'mandatory','Processor Guidance',NULL,100,'2026-04-24 18:52:20'),('b96290d5-400e-11f1-8bc3-00155d012902','98ee5a53-635c-42eb-b435-8b2fa846ef2e',NULL,'8.4','PII Principals Rights Support','Provide mechanisms for processors to support controller obligations to data subjects.',NULL,'mandatory','Processor Guidance',NULL,110,'2026-04-24 18:52:20'),('b96291f4-400e-11f1-8bc3-00155d012902','98ee5a53-635c-42eb-b435-8b2fa846ef2e',NULL,'8.5','Sub-processor Management','Ensure sub-processors meet equivalent privacy and security obligations.',NULL,'mandatory','Processor Guidance',NULL,120,'2026-04-24 18:52:20'),('b9629319-400e-11f1-8bc3-00155d012902','98ee5a53-635c-42eb-b435-8b2fa846ef2e',NULL,'A.7','Extended Guidance — ISO 27002 Privacy Controls','Apply privacy-specific guidance to ISO 27002 controls covering human resources, asset management, and access.',NULL,'recommended','Annex A',NULL,130,'2026-04-24 18:52:20'),('b962944a-400e-11f1-8bc3-00155d012902','98ee5a53-635c-42eb-b435-8b2fa846ef2e',NULL,'A.8','Extended Guidance — Technological Controls for Privacy','Technical privacy controls including pseudonymization, encryption, and privacy-preserving technologies.',NULL,'recommended','Annex A',NULL,140,'2026-04-24 18:52:20'),('b96e6887-400e-11f1-8bc3-00155d012902','666252f0-47b7-440a-82d9-cca6878f6b60',NULL,'Cl.4','Context of the Organization','Understand the organization, its stakeholders, and determine the scope of the BCMS.',NULL,'mandatory','Foundation',NULL,10,'2026-04-24 18:52:20'),('b96e6e54-400e-11f1-8bc3-00155d012902','666252f0-47b7-440a-82d9-cca6878f6b60',NULL,'Cl.5','Leadership','Top management shall demonstrate commitment to the BCMS and assign roles and responsibilities.',NULL,'mandatory','Foundation',NULL,20,'2026-04-24 18:52:20'),('b96e7060-400e-11f1-8bc3-00155d012902','666252f0-47b7-440a-82d9-cca6878f6b60',NULL,'Cl.6','Planning','Determine risks and opportunities, establish BC objectives, and plan actions to achieve them.',NULL,'mandatory','Foundation',NULL,30,'2026-04-24 18:52:20'),('b96e7276-400e-11f1-8bc3-00155d012902','666252f0-47b7-440a-82d9-cca6878f6b60',NULL,'Cl.7','Support','Determine and provide resources, competence, awareness, communication and documented information.',NULL,'mandatory','Foundation',NULL,40,'2026-04-24 18:52:20'),('b96e75a6-400e-11f1-8bc3-00155d012902','666252f0-47b7-440a-82d9-cca6878f6b60',NULL,'8.2','Business Impact Analysis','Identify functions critical to delivery of products/services and assess the impact of disruption.',NULL,'mandatory','Operations',NULL,50,'2026-04-24 18:52:20'),('b96e77bf-400e-11f1-8bc3-00155d012902','666252f0-47b7-440a-82d9-cca6878f6b60',NULL,'8.3','Business Continuity Risk Assessment','Identify, analyze, and evaluate risks of disruption to prioritized activities.',NULL,'mandatory','Operations',NULL,60,'2026-04-24 18:52:20'),('b96e7996-400e-11f1-8bc3-00155d012902','666252f0-47b7-440a-82d9-cca6878f6b60',NULL,'8.4','Business Continuity Strategy and Solutions','Determine appropriate strategies for stabilization, continuity and recovery of prioritized activities.',NULL,'mandatory','Operations',NULL,70,'2026-04-24 18:52:20'),('b96e7c0d-400e-11f1-8bc3-00155d012902','666252f0-47b7-440a-82d9-cca6878f6b60',NULL,'8.5','Business Continuity Plans and Procedures','Document plans and procedures to manage disruptions and restore business activities.',NULL,'mandatory','Operations',NULL,80,'2026-04-24 18:52:20'),('b96e7df4-400e-11f1-8bc3-00155d012902','666252f0-47b7-440a-82d9-cca6878f6b60',NULL,'8.6','Exercising and Testing','Test and exercise BCMS plans and procedures to validate their effectiveness.',NULL,'mandatory','Operations',NULL,90,'2026-04-24 18:52:20'),('b96e7fd2-400e-11f1-8bc3-00155d012902','666252f0-47b7-440a-82d9-cca6878f6b60',NULL,'Cl.9','Performance Evaluation','Monitor, measure, analyse and evaluate BCMS performance through internal audits and management review.',NULL,'mandatory','Improvement',NULL,100,'2026-04-24 18:52:20'),('b96e81b6-400e-11f1-8bc3-00155d012902','666252f0-47b7-440a-82d9-cca6878f6b60',NULL,'Cl.10','Improvement','Identify nonconformities, take corrective actions, and continually improve the BCMS.',NULL,'mandatory','Improvement',NULL,110,'2026-04-24 18:52:20'),('b96e838c-400e-11f1-8bc3-00155d012902','666252f0-47b7-440a-82d9-cca6878f6b60',NULL,'RTO','Recovery Time Objectives','Define and test RTO and RPO for all critical systems and business processes.',NULL,'mandatory','Operations',NULL,120,'2026-04-24 18:52:20'),('b96e8535-400e-11f1-8bc3-00155d012902','666252f0-47b7-440a-82d9-cca6878f6b60',NULL,'Crisis','Crisis Communication Plan','Establish internal and external communication procedures for crisis and disruption events.',NULL,'mandatory','Operations',NULL,130,'2026-04-24 18:52:20'),('b97cec37-400e-11f1-8bc3-00155d012902','3d1d4686-65fe-4478-8dcd-38f250e9c757',NULL,'A&A','Audit and Assurance','Independent reviews of cloud security controls, policies, and compliance status.',NULL,'mandatory','Governance',NULL,10,'2026-04-24 18:52:21'),('b97cf0b6-400e-11f1-8bc3-00155d012902','3d1d4686-65fe-4478-8dcd-38f250e9c757',NULL,'AIS','Application and Interface Security','Secure design, development, deployment, and testing of applications and APIs.',NULL,'mandatory','Application Security',NULL,20,'2026-04-24 18:52:21'),('b97cf230-400e-11f1-8bc3-00155d012902','3d1d4686-65fe-4478-8dcd-38f250e9c757',NULL,'BCR','Business Continuity Management and Operational Resilience','Planning, implementation and testing of business continuity and disaster recovery capabilities.',NULL,'mandatory','Resilience',NULL,30,'2026-04-24 18:52:21'),('b97cf392-400e-11f1-8bc3-00155d012902','3d1d4686-65fe-4478-8dcd-38f250e9c757',NULL,'CCC','Change Control and Configuration Management','Policies and procedures for managing changes to cloud systems and configurations.',NULL,'mandatory','Operations',NULL,40,'2026-04-24 18:52:21'),('b97cf4f4-400e-11f1-8bc3-00155d012902','3d1d4686-65fe-4478-8dcd-38f250e9c757',NULL,'CEK','Cryptography, Encryption and Key Management','Policies for the use of cryptographic controls and management of cryptographic keys.',NULL,'mandatory','Data Protection',NULL,50,'2026-04-24 18:52:21'),('b97cf668-400e-11f1-8bc3-00155d012902','3d1d4686-65fe-4478-8dcd-38f250e9c757',NULL,'DSP','Data Security and Privacy Lifecycle Management','Classification, handling, retention, and secure disposal of data throughout its lifecycle.',NULL,'mandatory','Data Protection',NULL,60,'2026-04-24 18:52:21'),('b97cf799-400e-11f1-8bc3-00155d012902','3d1d4686-65fe-4478-8dcd-38f250e9c757',NULL,'GRC','Governance, Risk and Compliance','Establish governance structures, manage risk, and maintain compliance with applicable regulations.',NULL,'mandatory','Governance',NULL,70,'2026-04-24 18:52:21'),('b97cf8c3-400e-11f1-8bc3-00155d012902','3d1d4686-65fe-4478-8dcd-38f250e9c757',NULL,'HRS','Human Resources','Security awareness, background verification, and access revocation for personnel.',NULL,'mandatory','People',NULL,80,'2026-04-24 18:52:21'),('b97cfa4b-400e-11f1-8bc3-00155d012902','3d1d4686-65fe-4478-8dcd-38f250e9c757',NULL,'IAM','Identity and Access Management','Manage user identities, credentials, and access rights using least privilege principles.',NULL,'mandatory','Access Control',NULL,90,'2026-04-24 18:52:21'),('b97cfc0a-400e-11f1-8bc3-00155d012902','3d1d4686-65fe-4478-8dcd-38f250e9c757',NULL,'IPY','Interoperability and Portability','Ensure data portability and interoperability between cloud providers and on-premises systems.',NULL,'recommended','Architecture',NULL,100,'2026-04-24 18:52:21'),('b97cfd40-400e-11f1-8bc3-00155d012902','3d1d4686-65fe-4478-8dcd-38f250e9c757',NULL,'IVS','Infrastructure and Virtualization Security','Protect hypervisors, virtual machines, containers, and cloud infrastructure components.',NULL,'mandatory','Infrastructure',NULL,110,'2026-04-24 18:52:21'),('b97cfe6b-400e-11f1-8bc3-00155d012902','3d1d4686-65fe-4478-8dcd-38f250e9c757',NULL,'LOG','Logging and Monitoring','Implement comprehensive logging, monitoring, and alerting across cloud environments.',NULL,'mandatory','Operations',NULL,120,'2026-04-24 18:52:21'),('b97cff8e-400e-11f1-8bc3-00155d012902','3d1d4686-65fe-4478-8dcd-38f250e9c757',NULL,'SEF','Security Incident Management, E-Discovery and Cloud Forensics','Detect, report, and respond to security incidents including forensic capabilities.',NULL,'mandatory','Incident Response',NULL,130,'2026-04-24 18:52:21'),('b97d00ba-400e-11f1-8bc3-00155d012902','3d1d4686-65fe-4478-8dcd-38f250e9c757',NULL,'STA','Supply Chain Management, Transparency and Accountability','Evaluate and manage cloud supply chain risk and third-party security posture.',NULL,'mandatory','Third-party Risk',NULL,140,'2026-04-24 18:52:21'),('b97d01dc-400e-11f1-8bc3-00155d012902','3d1d4686-65fe-4478-8dcd-38f250e9c757',NULL,'TVM','Threat and Vulnerability Management','Identify, prioritize, and remediate vulnerabilities and monitor threat intelligence.',NULL,'mandatory','Vulnerability Management',NULL,150,'2026-04-24 18:52:21'),('b97d0300-400e-11f1-8bc3-00155d012902','3d1d4686-65fe-4478-8dcd-38f250e9c757',NULL,'UEM','Universal Endpoint Management','Manage and secure all endpoint devices accessing cloud services including mobile and IoT.',NULL,'mandatory','Endpoint Security',NULL,160,'2026-04-24 18:52:21'),('b9930df0-400e-11f1-8bc3-00155d012902','161ca661-dcfc-41d6-ae04-4d515194f119',NULL,'Art.5','Principles relating to processing of personal data',NULL,NULL,'mandatory','Data Processing Principles',NULL,0,'2026-04-24 18:52:21'),('b9931234-400e-11f1-8bc3-00155d012902','161ca661-dcfc-41d6-ae04-4d515194f119',NULL,'Art.6','Lawfulness of processing',NULL,NULL,'mandatory','Legal Basis',NULL,1,'2026-04-24 18:52:21'),('b9931474-400e-11f1-8bc3-00155d012902','161ca661-dcfc-41d6-ae04-4d515194f119',NULL,'Art.7','Conditions for Consent','Where processing is based on consent, demonstrate that the data subject has consented; consent must be freely given, specific, informed and unambiguous.',NULL,'mandatory','Core Principles',NULL,30,'2026-04-24 18:52:21'),('b9935557-400e-11f1-8bc3-00155d012902','161ca661-dcfc-41d6-ae04-4d515194f119',NULL,'Art.12','Transparent Information and Communication','Provide information to data subjects in a concise, transparent, intelligible and accessible form.',NULL,'mandatory','Data Subject Rights',NULL,40,'2026-04-24 18:52:21'),('b99357d4-400e-11f1-8bc3-00155d012902','161ca661-dcfc-41d6-ae04-4d515194f119',NULL,'Art.13','Information to be provided where personal data are collected from the data subject','Where personal data relating to a data subject are collected from the data subject, the controller shall provide information at the time of collection.',NULL,'mandatory','Data Subject Rights',NULL,2,'2026-04-24 18:52:21'),('b993596d-400e-11f1-8bc3-00155d012902','161ca661-dcfc-41d6-ae04-4d515194f119',NULL,'Art.15','Right of Access by Data Subject','Data subjects have the right to obtain confirmation of processing and access to their personal data.',NULL,'mandatory','Data Subject Rights',NULL,60,'2026-04-24 18:52:21'),('b9935abd-400e-11f1-8bc3-00155d012902','161ca661-dcfc-41d6-ae04-4d515194f119',NULL,'Art.16','Right to Rectification','Data subjects have the right to obtain rectification of inaccurate personal data without undue delay.',NULL,'mandatory','Data Subject Rights',NULL,70,'2026-04-24 18:52:21'),('b9935bf9-400e-11f1-8bc3-00155d012902','161ca661-dcfc-41d6-ae04-4d515194f119',NULL,'Art.17','Right to erasure (\'right to be forgotten\')','The data subject shall have the right to obtain from the controller the erasure of personal data concerning him or her without undue delay.',NULL,'mandatory','Data Subject Rights',NULL,3,'2026-04-24 18:52:21'),('b9935d2a-400e-11f1-8bc3-00155d012902','161ca661-dcfc-41d6-ae04-4d515194f119',NULL,'Art.20','Right to Data Portability','Data subjects have the right to receive personal data in a structured, commonly used, machine-readable format.',NULL,'mandatory','Data Subject Rights',NULL,90,'2026-04-24 18:52:21'),('b9935e5d-400e-11f1-8bc3-00155d012902','161ca661-dcfc-41d6-ae04-4d515194f119',NULL,'Art.21','Right to Object','Data subjects have the right to object at any time to processing based on legitimate interests or direct marketing.',NULL,'mandatory','Data Subject Rights',NULL,100,'2026-04-24 18:52:21'),('b9935f92-400e-11f1-8bc3-00155d012902','161ca661-dcfc-41d6-ae04-4d515194f119',NULL,'Art.25','Data protection by design and by default','The controller shall implement appropriate technical and organisational measures for ensuring that, by default, only personal data which are necessary for each specific purpose are processed.',NULL,'mandatory','Technical Measures',NULL,4,'2026-04-24 18:52:21'),('b99360c4-400e-11f1-8bc3-00155d012902','161ca661-dcfc-41d6-ae04-4d515194f119',NULL,'Art.28','Processor','Where processing is to be carried out on behalf of a controller, the controller shall only use processors providing sufficient guarantees.',NULL,'mandatory','Vendor Management',NULL,5,'2026-04-24 18:52:21'),('b99361ef-400e-11f1-8bc3-00155d012902','161ca661-dcfc-41d6-ae04-4d515194f119',NULL,'Art.30','Records of Processing Activities','Maintain a record of all processing activities including purposes, categories of data, retention periods, and security measures.',NULL,'mandatory','Governance',NULL,130,'2026-04-24 18:52:21'),('b9936327-400e-11f1-8bc3-00155d012902','161ca661-dcfc-41d6-ae04-4d515194f119',NULL,'Art.32','Security of processing','Implement appropriate technical and organisational measures to ensure a level of security appropriate to the risk.',NULL,'mandatory','Technical Measures',NULL,6,'2026-04-24 18:52:21'),('b993645f-400e-11f1-8bc3-00155d012902','161ca661-dcfc-41d6-ae04-4d515194f119',NULL,'Art.33','Notification of a personal data breach to the supervisory authority','In the case of a personal data breach, the controller shall without undue delay and, where feasible, not later than 72 hours notify the supervisory authority.',NULL,'mandatory','Incident Response',NULL,7,'2026-04-24 18:52:21'),('b9936591-400e-11f1-8bc3-00155d012902','161ca661-dcfc-41d6-ae04-4d515194f119',NULL,'Art.34','Communication of Personal Data Breach to Data Subject','Communicate a high-risk personal data breach to affected data subjects without undue delay.',NULL,'mandatory','Incident Response',NULL,160,'2026-04-24 18:52:21'),('b99366be-400e-11f1-8bc3-00155d012902','161ca661-dcfc-41d6-ae04-4d515194f119',NULL,'Art.35','Data protection impact assessment','Where a type of processing is likely to result in a high risk to the rights and freedoms of natural persons, the controller shall carry out an assessment of the impact.',NULL,'mandatory','Risk Assessment',NULL,8,'2026-04-24 18:52:21'),('b99367f1-400e-11f1-8bc3-00155d012902','161ca661-dcfc-41d6-ae04-4d515194f119',NULL,'Art.37','Designation of the data protection officer','The controller and the processor shall designate a data protection officer in specific cases.',NULL,'recommended','Governance',NULL,9,'2026-04-24 18:52:21'),('b9936921-400e-11f1-8bc3-00155d012902','161ca661-dcfc-41d6-ae04-4d515194f119',NULL,'Art.44','General principle for transfers','Any transfer of personal data to a third country shall take place only if the conditions laid down in the GDPR are complied with.',NULL,'mandatory','Cross-border Transfers',NULL,10,'2026-04-24 18:52:21'),('b99f3104-400e-11f1-8bc3-00155d012902','375b1394-c9fa-449f-b9d0-d58b9769e5aa',NULL,'§1798.100','Right to Know About Personal Information Collected','Consumers have the right to request disclosure of personal information collected, used, disclosed, or sold.',NULL,'mandatory','Consumer Rights',NULL,10,'2026-04-24 18:52:21'),('b99f3547-400e-11f1-8bc3-00155d012902','375b1394-c9fa-449f-b9d0-d58b9769e5aa',NULL,'§1798.105','Right to Delete Personal Information','Consumers have the right to request deletion of personal information collected from them.',NULL,'mandatory','Consumer Rights',NULL,20,'2026-04-24 18:52:21'),('b99f36b4-400e-11f1-8bc3-00155d012902','375b1394-c9fa-449f-b9d0-d58b9769e5aa',NULL,'§1798.106','Right to Correct Inaccurate Personal Information','Consumers have the right to request correction of inaccurate personal information.',NULL,'mandatory','Consumer Rights',NULL,30,'2026-04-24 18:52:21'),('b99f3800-400e-11f1-8bc3-00155d012902','375b1394-c9fa-449f-b9d0-d58b9769e5aa',NULL,'§1798.110','Right to Know Categories of Personal Information','Disclose categories of personal information collected, sources, business purposes, and third parties.',NULL,'mandatory','Consumer Rights',NULL,40,'2026-04-24 18:52:21'),('b99f393f-400e-11f1-8bc3-00155d012902','375b1394-c9fa-449f-b9d0-d58b9769e5aa',NULL,'§1798.120','Right to Opt-Out of Sale or Sharing','Consumers have the right to opt-out of the sale or sharing of their personal information.',NULL,'mandatory','Consumer Rights',NULL,50,'2026-04-24 18:52:21'),('b99f3a73-400e-11f1-8bc3-00155d012902','375b1394-c9fa-449f-b9d0-d58b9769e5aa',NULL,'§1798.121','Right to Limit Use of Sensitive Personal Information','Consumers have the right to limit the use and disclosure of sensitive personal information.',NULL,'mandatory','Consumer Rights',NULL,60,'2026-04-24 18:52:21'),('b99f3bd5-400e-11f1-8bc3-00155d012902','375b1394-c9fa-449f-b9d0-d58b9769e5aa',NULL,'§1798.125','Right to Non-Discrimination','Businesses shall not discriminate against a consumer for exercising their CCPA rights.',NULL,'mandatory','Consumer Rights',NULL,70,'2026-04-24 18:52:21'),('b99f3d07-400e-11f1-8bc3-00155d012902','375b1394-c9fa-449f-b9d0-d58b9769e5aa',NULL,'§1798.130','Privacy Notice Requirements','Provide a privacy policy disclosing categories of PI collected, purposes, consumer rights, and contact information.',NULL,'mandatory','Transparency',NULL,80,'2026-04-24 18:52:21'),('b99f3e32-400e-11f1-8bc3-00155d012902','375b1394-c9fa-449f-b9d0-d58b9769e5aa',NULL,'§1798.135','Opt-Out Mechanism','Provide a clear and conspicuous \"Do Not Sell or Share My Personal Information\" link.',NULL,'mandatory','Transparency',NULL,90,'2026-04-24 18:52:21'),('b99f3f5e-400e-11f1-8bc3-00155d012902','375b1394-c9fa-449f-b9d0-d58b9769e5aa',NULL,'§1798.150','Data Security Requirements','Implement and maintain reasonable security procedures and practices appropriate to the nature of the personal information.',NULL,'mandatory','Security',NULL,100,'2026-04-24 18:52:21'),('b99f4122-400e-11f1-8bc3-00155d012902','375b1394-c9fa-449f-b9d0-d58b9769e5aa',NULL,'§1798.185','Privacy Risk Assessment','Conduct cybersecurity audits and submit privacy risk assessments for high-risk processing activities.',NULL,'mandatory','Governance',NULL,110,'2026-04-24 18:52:21'),('b99f425a-400e-11f1-8bc3-00155d012902','375b1394-c9fa-449f-b9d0-d58b9769e5aa',NULL,'CPRA-Reg','CPRA Enforcement Regulations','Comply with CPPA regulations on data minimization, purpose limitation, and retention.',NULL,'mandatory','Governance',NULL,120,'2026-04-24 18:52:21'),('b9ab6085-400e-11f1-8bc3-00155d012902','0872b646-3c71-4b1d-96fd-c577f5e02943',NULL,'Art.20','Cybersecurity Governance','Management bodies of essential and important entities must approve, oversee, and be trained on cybersecurity risk-management measures.',NULL,'mandatory','Governance',NULL,10,'2026-04-24 18:52:21'),('b9ab6643-400e-11f1-8bc3-00155d012902','0872b646-3c71-4b1d-96fd-c577f5e02943',NULL,'Art.21a','Policies on Risk Analysis and Information System Security','Adopt policies on risk analysis and information security covering all assets and processes.',NULL,'mandatory','Risk Management',NULL,20,'2026-04-24 18:52:21'),('b9ab67c0-400e-11f1-8bc3-00155d012902','0872b646-3c71-4b1d-96fd-c577f5e02943',NULL,'Art.21b','Incident Handling','Implement incident handling procedures including detection, analysis, containment, and recovery.',NULL,'mandatory','Incident Response',NULL,30,'2026-04-24 18:52:21'),('b9ab692f-400e-11f1-8bc3-00155d012902','0872b646-3c71-4b1d-96fd-c577f5e02943',NULL,'Art.21c','Business Continuity','Maintain business continuity including backup management, disaster recovery, and crisis management.',NULL,'mandatory','Resilience',NULL,40,'2026-04-24 18:52:21'),('b9ab6a80-400e-11f1-8bc3-00155d012902','0872b646-3c71-4b1d-96fd-c577f5e02943',NULL,'Art.21d','Supply Chain Security','Manage security of the supply chain including relationships with direct suppliers and service providers.',NULL,'mandatory','Third-party Risk',NULL,50,'2026-04-24 18:52:21'),('b9ab6be4-400e-11f1-8bc3-00155d012902','0872b646-3c71-4b1d-96fd-c577f5e02943',NULL,'Art.21e','Secure Acquisition, Development and Maintenance','Apply security in development including vulnerability handling and disclosure policies.',NULL,'mandatory','Secure Development',NULL,60,'2026-04-24 18:52:21'),('b9ab6d11-400e-11f1-8bc3-00155d012902','0872b646-3c71-4b1d-96fd-c577f5e02943',NULL,'Art.21f','Cybersecurity Risk Management Effectiveness','Implement policies and procedures to assess the effectiveness of cybersecurity measures.',NULL,'mandatory','Governance',NULL,70,'2026-04-24 18:52:21'),('b9ab6e5f-400e-11f1-8bc3-00155d012902','0872b646-3c71-4b1d-96fd-c577f5e02943',NULL,'Art.21g','Cyber Hygiene and Training','Establish basic cyber hygiene practices and provide cybersecurity training.',NULL,'mandatory','Awareness',NULL,80,'2026-04-24 18:52:21'),('b9ab6f81-400e-11f1-8bc3-00155d012902','0872b646-3c71-4b1d-96fd-c577f5e02943',NULL,'Art.21h','Cryptography and Encryption','Implement policies on the use of cryptography and, where appropriate, encryption.',NULL,'mandatory','Technical Controls',NULL,90,'2026-04-24 18:52:21'),('b9ab70a7-400e-11f1-8bc3-00155d012902','0872b646-3c71-4b1d-96fd-c577f5e02943',NULL,'Art.21i','Human Resources Security and Access Control','Implement human resources security measures and access control policies including MFA.',NULL,'mandatory','Access Control',NULL,100,'2026-04-24 18:52:21'),('b9ab71c4-400e-11f1-8bc3-00155d012902','0872b646-3c71-4b1d-96fd-c577f5e02943',NULL,'Art.21j','Asset Management','Maintain an asset management framework covering hardware, software, and data assets.',NULL,'mandatory','Asset Management',NULL,110,'2026-04-24 18:52:21'),('b9ab72e3-400e-11f1-8bc3-00155d012902','0872b646-3c71-4b1d-96fd-c577f5e02943',NULL,'Art.23','Reporting Obligations','Report significant incidents to national CSIRT or competent authority within 24 hours (early warning) and 72 hours (notification).',NULL,'mandatory','Incident Reporting',NULL,120,'2026-04-24 18:52:21'),('b9ab7403-400e-11f1-8bc3-00155d012902','0872b646-3c71-4b1d-96fd-c577f5e02943',NULL,'Art.32','Supervisory Measures for Essential Entities','Cooperate with competent authorities on audits, inspections, and security scans.',NULL,'mandatory','Compliance',NULL,130,'2026-04-24 18:52:21'),('b9b9f4ce-400e-11f1-8bc3-00155d012902','c504c77f-bddc-4dea-8403-aa2ea3dcf9df',NULL,'Art.5','ICT Risk Management Framework','Establish and maintain a sound, comprehensive, and well-documented ICT risk management framework.',NULL,'mandatory','ICT Risk Management',NULL,10,'2026-04-24 18:52:21'),('b9b9fb82-400e-11f1-8bc3-00155d012902','c504c77f-bddc-4dea-8403-aa2ea3dcf9df',NULL,'Art.6','ICT Risk Management Systems and Controls','Identify, classify, and document ICT assets; protect against ICT risks using appropriate controls.',NULL,'mandatory','ICT Risk Management',NULL,20,'2026-04-24 18:52:21'),('b9b9fdac-400e-11f1-8bc3-00155d012902','c504c77f-bddc-4dea-8403-aa2ea3dcf9df',NULL,'Art.7','ICT Systems, Protocols and Tools','Use and maintain updated ICT systems, protocols, and tools that minimize ICT risk impact.',NULL,'mandatory','ICT Risk Management',NULL,30,'2026-04-24 18:52:21'),('b9b9ff86-400e-11f1-8bc3-00155d012902','c504c77f-bddc-4dea-8403-aa2ea3dcf9df',NULL,'Art.8','Identification of ICT Risk','Continuously identify all sources of ICT risk and assess cyber threats and ICT vulnerabilities.',NULL,'mandatory','ICT Risk Management',NULL,40,'2026-04-24 18:52:21'),('b9ba0191-400e-11f1-8bc3-00155d012902','c504c77f-bddc-4dea-8403-aa2ea3dcf9df',NULL,'Art.9','Protection and Prevention','Implement ICT security policies, procedures, and controls to protect confidentiality, integrity, and availability.',NULL,'mandatory','ICT Risk Management',NULL,50,'2026-04-24 18:52:21'),('b9ba03b9-400e-11f1-8bc3-00155d012902','c504c77f-bddc-4dea-8403-aa2ea3dcf9df',NULL,'Art.10','Detection','Implement mechanisms to promptly detect anomalous activities including ICT network performance issues.',NULL,'mandatory','ICT Risk Management',NULL,60,'2026-04-24 18:52:21'),('b9ba0589-400e-11f1-8bc3-00155d012902','c504c77f-bddc-4dea-8403-aa2ea3dcf9df',NULL,'Art.11','Response and Recovery','Establish dedicated management policies for ICT-related incidents and implement response and recovery plans.',NULL,'mandatory','ICT Risk Management',NULL,70,'2026-04-24 18:52:21'),('b9ba4fb4-400e-11f1-8bc3-00155d012902','c504c77f-bddc-4dea-8403-aa2ea3dcf9df',NULL,'Art.12','Backup Policies and Recovery Procedures','Implement backup policies and recovery procedures with specific RTO and RPO for critical functions.',NULL,'mandatory','ICT Risk Management',NULL,80,'2026-04-24 18:52:21'),('b9ba523a-400e-11f1-8bc3-00155d012902','c504c77f-bddc-4dea-8403-aa2ea3dcf9df',NULL,'Art.17','ICT-related Incident Management Process','Define, establish, and implement an ICT-related incident management process.',NULL,'mandatory','Incident Management',NULL,90,'2026-04-24 18:52:21'),('b9ba547f-400e-11f1-8bc3-00155d012902','c504c77f-bddc-4dea-8403-aa2ea3dcf9df',NULL,'Art.19','Reporting of Major ICT-related Incidents','Report major ICT-related incidents to competent authorities within prescribed timeframes.',NULL,'mandatory','Incident Reporting',NULL,100,'2026-04-24 18:52:21'),('b9ba56cd-400e-11f1-8bc3-00155d012902','c504c77f-bddc-4dea-8403-aa2ea3dcf9df',NULL,'Art.24','Digital Operational Resilience Testing Programme','Establish, maintain, and review a digital operational resilience testing programme.',NULL,'mandatory','TLPT',NULL,110,'2026-04-24 18:52:21'),('b9ba597a-400e-11f1-8bc3-00155d012902','c504c77f-bddc-4dea-8403-aa2ea3dcf9df',NULL,'Art.25','Testing of ICT Tools and Systems','Conduct threat-led penetration testing (TLPT) at least every 3 years for critical functions.',NULL,'mandatory','TLPT',NULL,120,'2026-04-24 18:52:21'),('b9ba5b59-400e-11f1-8bc3-00155d012902','c504c77f-bddc-4dea-8403-aa2ea3dcf9df',NULL,'Art.28','General Principles of ICT Third-party Risk','Manage ICT third-party risk as integral component of the ICT risk management framework.',NULL,'mandatory','Third-party Risk',NULL,130,'2026-04-24 18:52:21'),('b9ba5d0e-400e-11f1-8bc3-00155d012902','c504c77f-bddc-4dea-8403-aa2ea3dcf9df',NULL,'Art.29','ICT Third-party Risk Management Policy','Adopt a strategy on ICT third-party risk and maintain a register of all ICT third-party service providers.',NULL,'mandatory','Third-party Risk',NULL,140,'2026-04-24 18:52:21'),('b9ba5ed7-400e-11f1-8bc3-00155d012902','c504c77f-bddc-4dea-8403-aa2ea3dcf9df',NULL,'Art.45','Information Sharing Arrangements','May exchange cyber threat information and intelligence in trusted communities of financial entities.',NULL,'optional','Information Sharing',NULL,150,'2026-04-24 18:52:21'),('b9cb9f7c-400e-11f1-8bc3-00155d012902','0b2dd67e-d51c-4158-8a54-e8a7df801f33',NULL,'AC','Access Control','Limit information system access to authorized users, processes acting on behalf of users, and devices. Enforce least privilege and separation of duties.',NULL,'mandatory','Technical Controls',NULL,10,'2026-04-24 18:52:21'),('b9cbdab1-400e-11f1-8bc3-00155d012902','0b2dd67e-d51c-4158-8a54-e8a7df801f33',NULL,'AT','Awareness and Training','Ensure that personnel are aware of security risks and trained to carry out their responsibilities.',NULL,'mandatory','People',NULL,20,'2026-04-24 18:52:21'),('b9cbdc5d-400e-11f1-8bc3-00155d012902','0b2dd67e-d51c-4158-8a54-e8a7df801f33',NULL,'AU','Audit and Accountability','Create, protect, and retain system audit records to enable monitoring, analysis, investigation, and reporting of unlawful, unauthorized activity.',NULL,'mandatory','Technical Controls',NULL,30,'2026-04-24 18:52:21'),('b9cbddd2-400e-11f1-8bc3-00155d012902','0b2dd67e-d51c-4158-8a54-e8a7df801f33',NULL,'CA','Assessment, Authorization and Monitoring','Periodically assess security controls; ensure risks from system operation are acceptable; monitor controls on an ongoing basis.',NULL,'mandatory','Governance',NULL,40,'2026-04-24 18:52:21'),('b9cbdf43-400e-11f1-8bc3-00155d012902','0b2dd67e-d51c-4158-8a54-e8a7df801f33',NULL,'CM','Configuration Management','Establish and maintain baseline configurations; document and control changes; enforce security configuration settings.',NULL,'mandatory','Technical Controls',NULL,50,'2026-04-24 18:52:21'),('b9cbe0be-400e-11f1-8bc3-00155d012902','0b2dd67e-d51c-4158-8a54-e8a7df801f33',NULL,'CP','Contingency Planning','Establish, maintain, and effectively implement plans for emergency response, backup operations, and post-disaster recovery.',NULL,'mandatory','Resilience',NULL,60,'2026-04-24 18:52:21'),('b9cbe1f0-400e-11f1-8bc3-00155d012902','0b2dd67e-d51c-4158-8a54-e8a7df801f33',NULL,'IA','Identification and Authentication','Identify and authenticate users, processes, and devices before allowing access to organizational systems.',NULL,'mandatory','Technical Controls',NULL,70,'2026-04-24 18:52:21'),('b9cbe31c-400e-11f1-8bc3-00155d012902','0b2dd67e-d51c-4158-8a54-e8a7df801f33',NULL,'IR','Incident Response','Establish operational incident-handling capability including preparation, detection, analysis, containment, recovery, and reporting.',NULL,'mandatory','Incident Response',NULL,80,'2026-04-24 18:52:21'),('b9cbe44b-400e-11f1-8bc3-00155d012902','0b2dd67e-d51c-4158-8a54-e8a7df801f33',NULL,'MA','Maintenance','Perform maintenance on organizational systems; control maintenance tools, activities, personnel, and remotely performed maintenance.',NULL,'mandatory','Operations',NULL,90,'2026-04-24 18:52:21'),('b9cbe57a-400e-11f1-8bc3-00155d012902','0b2dd67e-d51c-4158-8a54-e8a7df801f33',NULL,'MP','Media Protection','Protect system media, limit access to information on media, and sanitize or destroy media before disposal.',NULL,'mandatory','Data Protection',NULL,100,'2026-04-24 18:52:21'),('b9cbe6a5-400e-11f1-8bc3-00155d012902','0b2dd67e-d51c-4158-8a54-e8a7df801f33',NULL,'PE','Physical and Environmental Protection','Limit physical access to systems; protect the physical facility and support infrastructure.',NULL,'mandatory','Physical Security',NULL,110,'2026-04-24 18:52:21'),('b9cbe7ce-400e-11f1-8bc3-00155d012902','0b2dd67e-d51c-4158-8a54-e8a7df801f33',NULL,'PL','Planning','Develop security plans; establish rules of behavior for system users.',NULL,'mandatory','Governance',NULL,120,'2026-04-24 18:52:21'),('b9cbe8f5-400e-11f1-8bc3-00155d012902','0b2dd67e-d51c-4158-8a54-e8a7df801f33',NULL,'PM','Program Management','Implement program management controls to oversee the information security program at the organizational level.',NULL,'mandatory','Governance',NULL,130,'2026-04-24 18:52:21'),('b9cbea1d-400e-11f1-8bc3-00155d012902','0b2dd67e-d51c-4158-8a54-e8a7df801f33',NULL,'PS','Personnel Security','Ensure that individuals in positions of responsibility are trustworthy; establish personnel termination and transfer procedures.',NULL,'mandatory','People',NULL,140,'2026-04-24 18:52:21'),('b9cbeb41-400e-11f1-8bc3-00155d012902','0b2dd67e-d51c-4158-8a54-e8a7df801f33',NULL,'PT','PII Processing and Transparency','Implement controls for processing personally identifiable information; provide appropriate transparency.',NULL,'mandatory','Privacy',NULL,150,'2026-04-24 18:52:21'),('b9cbec6a-400e-11f1-8bc3-00155d012902','0b2dd67e-d51c-4158-8a54-e8a7df801f33',NULL,'RA','Risk Assessment','Assess the risk to organizational operations, organizational assets, individuals, and other organizations.',NULL,'mandatory','Risk Management',NULL,160,'2026-04-24 18:52:21'),('b9cbed8f-400e-11f1-8bc3-00155d012902','0b2dd67e-d51c-4158-8a54-e8a7df801f33',NULL,'SA','System and Services Acquisition','Allocate resources to protect organizational systems; employ system development life cycle processes.',NULL,'mandatory','Governance',NULL,170,'2026-04-24 18:52:21'),('b9cbeeb8-400e-11f1-8bc3-00155d012902','0b2dd67e-d51c-4158-8a54-e8a7df801f33',NULL,'SC','System and Communications Protection','Monitor, control, and protect organizational communications at external and key internal boundaries.',NULL,'mandatory','Technical Controls',NULL,180,'2026-04-24 18:52:21'),('b9cbefdd-400e-11f1-8bc3-00155d012902','0b2dd67e-d51c-4158-8a54-e8a7df801f33',NULL,'SI','System and Information Integrity','Identify, report, and correct information system flaws; protect systems from malicious code.',NULL,'mandatory','Technical Controls',NULL,190,'2026-04-24 18:52:21'),('b9cbf0ff-400e-11f1-8bc3-00155d012902','0b2dd67e-d51c-4158-8a54-e8a7df801f33',NULL,'SR','Supply Chain Risk Management','Establish a risk-based approach to protecting against supply chain risks to organizational systems and components.',NULL,'mandatory','Third-party Risk',NULL,200,'2026-04-24 18:52:21'),('b9d8b8ae-400e-11f1-8bc3-00155d012902','e89f5ae1-655d-4355-853f-d70e68259598',NULL,'3.1','Access Control','Limit system access to authorized users and the transactions and functions that authorized users are permitted to execute. 22 requirements.',NULL,'mandatory','Technical Controls',NULL,10,'2026-04-24 18:52:21'),('b9d8bda1-400e-11f1-8bc3-00155d012902','e89f5ae1-655d-4355-853f-d70e68259598',NULL,'3.2','Awareness and Training','Ensure that personnel are aware of security risks associated with their activities and trained to carry out duties. 3 requirements.',NULL,'mandatory','People',NULL,20,'2026-04-24 18:52:21'),('b9d8bf29-400e-11f1-8bc3-00155d012902','e89f5ae1-655d-4355-853f-d70e68259598',NULL,'3.3','Audit and Accountability','Create and retain system audit records to enable monitoring, analysis, investigation of unlawful activity. 9 requirements.',NULL,'mandatory','Technical Controls',NULL,30,'2026-04-24 18:52:21'),('b9d8c097-400e-11f1-8bc3-00155d012902','e89f5ae1-655d-4355-853f-d70e68259598',NULL,'3.4','Configuration Management','Establish and maintain baseline configurations; track, review, approve/disapprove changes. 9 requirements.',NULL,'mandatory','Technical Controls',NULL,40,'2026-04-24 18:52:21'),('b9d8c201-400e-11f1-8bc3-00155d012902','e89f5ae1-655d-4355-853f-d70e68259598',NULL,'3.5','Identification and Authentication','Identify system users, processes, and devices; authenticate identities before allowing access. 11 requirements.',NULL,'mandatory','Technical Controls',NULL,50,'2026-04-24 18:52:21'),('b9d8c374-400e-11f1-8bc3-00155d012902','e89f5ae1-655d-4355-853f-d70e68259598',NULL,'3.6','Incident Response','Establish operational incident-handling capability including preparation, detection, analysis, containment. 3 requirements.',NULL,'mandatory','Incident Response',NULL,60,'2026-04-24 18:52:21'),('b9d8c4ad-400e-11f1-8bc3-00155d012902','e89f5ae1-655d-4355-853f-d70e68259598',NULL,'3.7','Maintenance','Perform maintenance on organizational systems; provide controls on the tools, techniques, and personnel. 6 requirements.',NULL,'mandatory','Operations',NULL,70,'2026-04-24 18:52:21'),('b9d8c5da-400e-11f1-8bc3-00155d012902','e89f5ae1-655d-4355-853f-d70e68259598',NULL,'3.8','Media Protection','Protect system media containing CUI, both paper and digital. 9 requirements.',NULL,'mandatory','Data Protection',NULL,80,'2026-04-24 18:52:21'),('b9d8c70b-400e-11f1-8bc3-00155d012902','e89f5ae1-655d-4355-853f-d70e68259598',NULL,'3.9','Personnel Security','Screen individuals prior to authorizing access to systems containing CUI. 2 requirements.',NULL,'mandatory','People',NULL,90,'2026-04-24 18:52:21'),('b9d8c82d-400e-11f1-8bc3-00155d012902','e89f5ae1-655d-4355-853f-d70e68259598',NULL,'3.10','Physical Protection','Limit physical access to organizational systems, equipment, and operating environments. 6 requirements.',NULL,'mandatory','Physical Security',NULL,100,'2026-04-24 18:52:21'),('b9d8c957-400e-11f1-8bc3-00155d012902','e89f5ae1-655d-4355-853f-d70e68259598',NULL,'3.11','Risk Assessment','Periodically assess the risk to organizational operations, assets, and individuals. 3 requirements.',NULL,'mandatory','Risk Management',NULL,110,'2026-04-24 18:52:21'),('b9d8ca7d-400e-11f1-8bc3-00155d012902','e89f5ae1-655d-4355-853f-d70e68259598',NULL,'3.12','Security Assessment','Periodically assess security controls; develop and implement plans of action to correct deficiencies. 4 requirements.',NULL,'mandatory','Governance',NULL,120,'2026-04-24 18:52:21'),('b9d8cba4-400e-11f1-8bc3-00155d012902','e89f5ae1-655d-4355-853f-d70e68259598',NULL,'3.13','System and Communications Protection','Monitor, control, and protect communications at external boundaries and key internal boundaries. 16 requirements.',NULL,'mandatory','Technical Controls',NULL,130,'2026-04-24 18:52:21'),('b9d8ccce-400e-11f1-8bc3-00155d012902','e89f5ae1-655d-4355-853f-d70e68259598',NULL,'3.14','System and Information Integrity','Identify, report, and correct system flaws; provide protection from malicious code; monitor alerts. 7 requirements.',NULL,'mandatory','Technical Controls',NULL,140,'2026-04-24 18:52:21'),('b9e5e013-400e-11f1-8bc3-00155d012902','88665a55-9ddc-4c83-b223-b5314fc3d39c',NULL,'L1-AC','Access Control (Level 1)','Limit system access to authorized users, processes acting on behalf of users, and devices. 2 practices.',NULL,'mandatory','Level 1 – Foundational',NULL,10,'2026-04-24 18:52:21'),('b9e5e4ca-400e-11f1-8bc3-00155d012902','88665a55-9ddc-4c83-b223-b5314fc3d39c',NULL,'L1-IA','Identification and Authentication (Level 1)','Identify and authenticate system users and devices. 2 practices.',NULL,'mandatory','Level 1 – Foundational',NULL,20,'2026-04-24 18:52:21'),('b9e5e63f-400e-11f1-8bc3-00155d012902','88665a55-9ddc-4c83-b223-b5314fc3d39c',NULL,'L1-MP','Media Protection (Level 1)','Sanitize or destroy information system media before disposal or reuse. 1 practice.',NULL,'mandatory','Level 1 – Foundational',NULL,30,'2026-04-24 18:52:21'),('b9e5e7a4-400e-11f1-8bc3-00155d012902','88665a55-9ddc-4c83-b223-b5314fc3d39c',NULL,'L1-PE','Physical Protection (Level 1)','Limit physical access to systems and equipment. 4 practices.',NULL,'mandatory','Level 1 – Foundational',NULL,40,'2026-04-24 18:52:21'),('b9e5e910-400e-11f1-8bc3-00155d012902','88665a55-9ddc-4c83-b223-b5314fc3d39c',NULL,'L1-SC','System and Communications Protection (Level 1)','Monitor, control, and protect communications. 2 practices.',NULL,'mandatory','Level 1 – Foundational',NULL,50,'2026-04-24 18:52:21'),('b9e5ea81-400e-11f1-8bc3-00155d012902','88665a55-9ddc-4c83-b223-b5314fc3d39c',NULL,'L1-SI','System and Information Integrity (Level 1)','Identify and manage information system flaws; use malicious code protection. 3 practices.',NULL,'mandatory','Level 1 – Foundational',NULL,60,'2026-04-24 18:52:21'),('b9e5ebb9-400e-11f1-8bc3-00155d012902','88665a55-9ddc-4c83-b223-b5314fc3d39c',NULL,'L2-AC','Access Control (Level 2)','Implement all NIST 800-171 access control requirements. 22 practices.',NULL,'mandatory','Level 2 – Advanced',NULL,70,'2026-04-24 18:52:21'),('b9e5ecdd-400e-11f1-8bc3-00155d012902','88665a55-9ddc-4c83-b223-b5314fc3d39c',NULL,'L2-AT','Awareness and Training (Level 2)','Implement security awareness training across the organization. 3 practices.',NULL,'mandatory','Level 2 – Advanced',NULL,80,'2026-04-24 18:52:21'),('b9e5ee02-400e-11f1-8bc3-00155d012902','88665a55-9ddc-4c83-b223-b5314fc3d39c',NULL,'L2-CM','Configuration Management (Level 2)','Establish and maintain secure baseline configurations. 9 practices.',NULL,'mandatory','Level 2 – Advanced',NULL,90,'2026-04-24 18:52:21'),('b9e5ef2d-400e-11f1-8bc3-00155d012902','88665a55-9ddc-4c83-b223-b5314fc3d39c',NULL,'L2-IA','Identification and Authentication (Level 2)','Implement multi-factor authentication and privileged access controls. 11 practices.',NULL,'mandatory','Level 2 – Advanced',NULL,100,'2026-04-24 18:52:21'),('b9e5f055-400e-11f1-8bc3-00155d012902','88665a55-9ddc-4c83-b223-b5314fc3d39c',NULL,'L2-IR','Incident Response (Level 2)','Establish and maintain an operational incident response capability. 3 practices.',NULL,'mandatory','Level 2 – Advanced',NULL,110,'2026-04-24 18:52:21'),('b9e5f178-400e-11f1-8bc3-00155d012902','88665a55-9ddc-4c83-b223-b5314fc3d39c',NULL,'L2-RM','Risk Management (Level 2)','Periodically assess and manage risk to operations, assets, and individuals. 3 practices.',NULL,'mandatory','Level 2 – Advanced',NULL,120,'2026-04-24 18:52:21'),('b9e5f29e-400e-11f1-8bc3-00155d012902','88665a55-9ddc-4c83-b223-b5314fc3d39c',NULL,'L2-CA','Security Assessment (Level 2)','Assess security controls; develop plans of action to correct deficiencies. 4 practices.',NULL,'mandatory','Level 2 – Advanced',NULL,130,'2026-04-24 18:52:21'),('b9e5f3c7-400e-11f1-8bc3-00155d012902','88665a55-9ddc-4c83-b223-b5314fc3d39c',NULL,'L3','Level 3 — Expert (NIST 800-172 subset)','Additional practices beyond Level 2 to protect against advanced persistent threats (APTs). 24 additional practices.',NULL,'mandatory','Level 3 – Expert',NULL,140,'2026-04-24 18:52:21'),('b9f5105d-400e-11f1-8bc3-00155d012902','affe804b-ffcb-4957-a6f8-d013bf745160',NULL,'FedRAMP-Low','Low Impact Baseline','Minimum security controls for systems where loss of confidentiality, integrity, or availability would have limited adverse effect.',NULL,'mandatory','Authorization',NULL,5,'2026-04-24 18:52:21'),('b9f51488-400e-11f1-8bc3-00155d012902','affe804b-ffcb-4957-a6f8-d013bf745160',NULL,'FedRAMP-Mod','Moderate Impact Baseline','Security controls for systems where loss could have serious adverse effect on operations, assets, or individuals.',NULL,'mandatory','Authorization',NULL,6,'2026-04-24 18:52:21'),('b9f515f9-400e-11f1-8bc3-00155d012902','affe804b-ffcb-4957-a6f8-d013bf745160',NULL,'FedRAMP-High','High Impact Baseline','Security controls for systems where loss could have severe or catastrophic adverse effect.',NULL,'mandatory','Authorization',NULL,7,'2026-04-24 18:52:21'),('b9f51766-400e-11f1-8bc3-00155d012902','affe804b-ffcb-4957-a6f8-d013bf745160',NULL,'FR-AC','Access Control (FedRAMP)','All NIST 800-53 AC controls plus FedRAMP-specific parameter requirements for cloud environments.',NULL,'mandatory','Technical Controls',NULL,10,'2026-04-24 18:52:21'),('b9f518d3-400e-11f1-8bc3-00155d012902','affe804b-ffcb-4957-a6f8-d013bf745160',NULL,'FR-AU','Audit and Accountability (FedRAMP)','Audit log requirements with specific retention periods and SIEM integration requirements.',NULL,'mandatory','Technical Controls',NULL,20,'2026-04-24 18:52:21'),('b9f51a4c-400e-11f1-8bc3-00155d012902','affe804b-ffcb-4957-a6f8-d013bf745160',NULL,'FR-CA','Assessment, Authorization and Monitoring','Authorization to Operate (ATO) process, continuous monitoring, and annual assessments by 3PAO.',NULL,'mandatory','Authorization',NULL,30,'2026-04-24 18:52:21'),('b9f51b7e-400e-11f1-8bc3-00155d012902','affe804b-ffcb-4957-a6f8-d013bf745160',NULL,'FR-CM','Configuration Management (FedRAMP)','Baseline configurations; FIPS-validated cryptography; approved products in marketplace.',NULL,'mandatory','Technical Controls',NULL,40,'2026-04-24 18:52:21'),('b9f51cab-400e-11f1-8bc3-00155d012902','affe804b-ffcb-4957-a6f8-d013bf745160',NULL,'FR-CP','Contingency Planning (FedRAMP)','Government-specified RTO/RPO requirements and data backup in government-accessible storage.',NULL,'mandatory','Resilience',NULL,50,'2026-04-24 18:52:21'),('b9f51ddc-400e-11f1-8bc3-00155d012902','affe804b-ffcb-4957-a6f8-d013bf745160',NULL,'FR-IA','Identification and Authentication (FedRAMP)','PIV/CAC card support; MFA for all privileged and non-privileged accounts accessing federal systems.',NULL,'mandatory','Technical Controls',NULL,60,'2026-04-24 18:52:21'),('b9f51f0b-400e-11f1-8bc3-00155d012902','affe804b-ffcb-4957-a6f8-d013bf745160',NULL,'FR-IR','Incident Response (FedRAMP)','Report incidents to US-CERT within 1 hour; maintain incident response plan updated annually.',NULL,'mandatory','Incident Response',NULL,70,'2026-04-24 18:52:21'),('b9f52034-400e-11f1-8bc3-00155d012902','affe804b-ffcb-4957-a6f8-d013bf745160',NULL,'FR-RA','Risk Assessment (FedRAMP)','Annual risk assessments; vulnerability scanning at least monthly; penetration testing annually.',NULL,'mandatory','Risk Management',NULL,80,'2026-04-24 18:52:21'),('b9f5215f-400e-11f1-8bc3-00155d012902','affe804b-ffcb-4957-a6f8-d013bf745160',NULL,'FR-SA','System and Services Acquisition (FedRAMP)','Supply chain risk management; software assurance; developer security testing requirements.',NULL,'mandatory','Third-party Risk',NULL,90,'2026-04-24 18:52:21'),('b9f598cf-400e-11f1-8bc3-00155d012902','affe804b-ffcb-4957-a6f8-d013bf745160',NULL,'FR-SC','System and Communications Protection (FedRAMP)','FIPS 140-2 validated encryption; boundary protection; TIC compliance.',NULL,'mandatory','Technical Controls',NULL,100,'2026-04-24 18:52:21'),('b9f59ae1-400e-11f1-8bc3-00155d012902','affe804b-ffcb-4957-a6f8-d013bf745160',NULL,'FR-SI','System and Information Integrity (FedRAMP)','Malware protection with auto-updates; security alerts; flaw remediation within 30 days.',NULL,'mandatory','Technical Controls',NULL,110,'2026-04-24 18:52:21'),('b9f59c2d-400e-11f1-8bc3-00155d012902','affe804b-ffcb-4957-a6f8-d013bf745160',NULL,'FR-3PAO','Third-Party Assessment Organization','Engage an accredited 3PAO for independent security assessment during authorization.',NULL,'mandatory','Authorization',NULL,120,'2026-04-24 18:52:21'),('ba01c35e-400e-11f1-8bc3-00155d012902','906a1b55-4849-4909-a7ab-5a4c70f730f8',NULL,'FISMA-1','Information System Inventory','Maintain an inventory of all information systems operated by or under control of the agency.',NULL,'mandatory','Program Management',NULL,10,'2026-04-24 18:52:21'),('ba01c7d0-400e-11f1-8bc3-00155d012902','906a1b55-4849-4909-a7ab-5a4c70f730f8',NULL,'FISMA-2','Categorization (FIPS 199)','Categorize information and information systems according to impact levels using FIPS 199 standards.',NULL,'mandatory','Risk Management',NULL,20,'2026-04-24 18:52:21'),('ba01c943-400e-11f1-8bc3-00155d012902','906a1b55-4849-4909-a7ab-5a4c70f730f8',NULL,'FISMA-3','System Security Plans (NIST 800-18)','Develop, maintain, and implement system security plans covering all NIST 800-53 controls.',NULL,'mandatory','Documentation',NULL,30,'2026-04-24 18:52:21'),('ba01ca9c-400e-11f1-8bc3-00155d012902','906a1b55-4849-4909-a7ab-5a4c70f730f8',NULL,'FISMA-4','Security Control Selection (NIST 800-53)','Select, implement, and document security controls based on FIPS 199 categorization.',NULL,'mandatory','Technical Controls',NULL,40,'2026-04-24 18:52:21'),('ba01cbe7-400e-11f1-8bc3-00155d012902','906a1b55-4849-4909-a7ab-5a4c70f730f8',NULL,'FISMA-5','Risk Assessments (NIST 800-30)','Conduct risk assessments to identify threats, vulnerabilities, and potential impact to operations.',NULL,'mandatory','Risk Management',NULL,50,'2026-04-24 18:52:21'),('ba01cd1d-400e-11f1-8bc3-00155d012902','906a1b55-4849-4909-a7ab-5a4c70f730f8',NULL,'FISMA-6','Security Control Assessments','Assess the effectiveness of security controls using independent assessors or internal personnel.',NULL,'mandatory','Assessment',NULL,60,'2026-04-24 18:52:21'),('ba01ce4b-400e-11f1-8bc3-00155d012902','906a1b55-4849-4909-a7ab-5a4c70f730f8',NULL,'FISMA-7','Authorization to Operate (ATO)','Obtain ATO from authorizing official before placing systems into operation.',NULL,'mandatory','Authorization',NULL,70,'2026-04-24 18:52:21'),('ba01cf80-400e-11f1-8bc3-00155d012902','906a1b55-4849-4909-a7ab-5a4c70f730f8',NULL,'FISMA-8','Continuous Monitoring (NIST 800-137)','Implement a continuous monitoring strategy to maintain ongoing awareness of security status.',NULL,'mandatory','Monitoring',NULL,80,'2026-04-24 18:52:21'),('ba01d0b6-400e-11f1-8bc3-00155d012902','906a1b55-4849-4909-a7ab-5a4c70f730f8',NULL,'FISMA-9','Plans of Action and Milestones (POA&M)','Develop and maintain POA&Ms to document planned remediation of security weaknesses.',NULL,'mandatory','Remediation',NULL,90,'2026-04-24 18:52:21'),('ba01d1e6-400e-11f1-8bc3-00155d012902','906a1b55-4849-4909-a7ab-5a4c70f730f8',NULL,'FISMA-10','Incident Reporting','Report information security incidents to US-CERT in accordance with OMB and agency policy.',NULL,'mandatory','Incident Response',NULL,100,'2026-04-24 18:52:21'),('ba01d311-400e-11f1-8bc3-00155d012902','906a1b55-4849-4909-a7ab-5a4c70f730f8',NULL,'FISMA-11','Security Training and Awareness','Provide annual security awareness training and role-based training for personnel with security responsibilities.',NULL,'mandatory','People',NULL,110,'2026-04-24 18:52:21'),('ba01d440-400e-11f1-8bc3-00155d012902','906a1b55-4849-4909-a7ab-5a4c70f730f8',NULL,'FISMA-12','Configuration Management','Establish and manage secure configuration baselines for all information systems.',NULL,'mandatory','Technical Controls',NULL,120,'2026-04-24 18:52:21'),('ba0dcb73-400e-11f1-8bc3-00155d012902','e23cdd62-bdad-439b-9a8d-92c7312d3864',NULL,'CIP-002','BES Cyber System Categorization','Identify and categorize BES Cyber Systems and their associated BES Cyber Assets for the application of cybersecurity requirements.',NULL,'mandatory','Asset Management',NULL,10,'2026-04-24 18:52:22'),('ba0dd0fd-400e-11f1-8bc3-00155d012902','e23cdd62-bdad-439b-9a8d-92c7312d3864',NULL,'CIP-003','Security Management Controls','Specify consistent and sustainable security management controls that establish responsibility and accountability for the protection of BES Cyber Systems.',NULL,'mandatory','Governance',NULL,20,'2026-04-24 18:52:22'),('ba0dd270-400e-11f1-8bc3-00155d012902','e23cdd62-bdad-439b-9a8d-92c7312d3864',NULL,'CIP-004','Personnel and Training','Minimize the risk against compromise of BES Cyber Systems from personnel with authorized electronic or physical access.',NULL,'mandatory','People',NULL,30,'2026-04-24 18:52:22'),('ba0dd3d3-400e-11f1-8bc3-00155d012902','e23cdd62-bdad-439b-9a8d-92c7312d3864',NULL,'CIP-005','Electronic Security Perimeters','Manage electronic access to BES Cyber Systems by specifying a controlled Electronic Security Perimeter.',NULL,'mandatory','Network Security',NULL,40,'2026-04-24 18:52:22'),('ba0dd562-400e-11f1-8bc3-00155d012902','e23cdd62-bdad-439b-9a8d-92c7312d3864',NULL,'CIP-006','Physical Security of BES Cyber Systems','Manage physical access to BES Cyber Systems by specifying a physical security plan.',NULL,'mandatory','Physical Security',NULL,50,'2026-04-24 18:52:22'),('ba0dd6de-400e-11f1-8bc3-00155d012902','e23cdd62-bdad-439b-9a8d-92c7312d3864',NULL,'CIP-007','Systems Security Management','Manage system security by specifying selected technical, operational and procedural requirements.',NULL,'mandatory','Technical Controls',NULL,60,'2026-04-24 18:52:22'),('ba0dd821-400e-11f1-8bc3-00155d012902','e23cdd62-bdad-439b-9a8d-92c7312d3864',NULL,'CIP-008','Incident Reporting and Response Planning','Respond to and recover from incidents involving BES Cyber Systems.',NULL,'mandatory','Incident Response',NULL,70,'2026-04-24 18:52:22'),('ba0dd959-400e-11f1-8bc3-00155d012902','e23cdd62-bdad-439b-9a8d-92c7312d3864',NULL,'CIP-009','Recovery Plans for BES Cyber Systems','Recover reliability functions performed by BES Cyber Systems after a cybersecurity incident.',NULL,'mandatory','Resilience',NULL,80,'2026-04-24 18:52:22'),('ba0dda8d-400e-11f1-8bc3-00155d012902','e23cdd62-bdad-439b-9a8d-92c7312d3864',NULL,'CIP-010','Configuration Change Management and Vulnerability Management','Prevent and detect unauthorized changes to BES Cyber Systems by managing configuration changes.',NULL,'mandatory','Configuration Management',NULL,90,'2026-04-24 18:52:22'),('ba0ddbc2-400e-11f1-8bc3-00155d012902','e23cdd62-bdad-439b-9a8d-92c7312d3864',NULL,'CIP-011','Information Protection','Prevent unauthorized access to BES Cyber System Information.',NULL,'mandatory','Data Protection',NULL,100,'2026-04-24 18:52:22'),('ba0ddce7-400e-11f1-8bc3-00155d012902','e23cdd62-bdad-439b-9a8d-92c7312d3864',NULL,'CIP-013','Supply Chain Risk Management','Mitigate cybersecurity risks in the supply chain for industrial control system hardware, software, and services.',NULL,'mandatory','Third-party Risk',NULL,110,'2026-04-24 18:52:22'),('ba0dde1d-400e-11f1-8bc3-00155d012902','e23cdd62-bdad-439b-9a8d-92c7312d3864',NULL,'CIP-014','Physical Security of Transmission Stations','Identify and protect transmission stations and substations from physical attacks.',NULL,'mandatory','Physical Security',NULL,120,'2026-04-24 18:52:22'),('ba1da0f2-400e-11f1-8bc3-00155d012902','eec44c85-6639-4f22-bdea-7f33976d22ab',NULL,'1.1','SWIFT Environment Protection','Ensure the protection of the user\'s local SWIFT infrastructure from potentially compromised elements of the general IT environment.',NULL,'mandatory','Architecture',NULL,10,'2026-04-24 18:52:22'),('ba1da587-400e-11f1-8bc3-00155d012902','eec44c85-6639-4f22-bdea-7f33976d22ab',NULL,'1.2','Privileged Account Control','Restrict and control the allocation and usage of administrator-level operating system accounts.',NULL,'mandatory','Access Control',NULL,20,'2026-04-24 18:52:22'),('ba1da6fe-400e-11f1-8bc3-00155d012902','eec44c85-6639-4f22-bdea-7f33976d22ab',NULL,'1.3A','Virtualisation Platform Security','Secure the virtualisation platform and ensure it has a minimal footprint.',NULL,'mandatory','Infrastructure',NULL,30,'2026-04-24 18:52:22'),('ba1da86c-400e-11f1-8bc3-00155d012902','eec44c85-6639-4f22-bdea-7f33976d22ab',NULL,'2.1','Internal Data Flow Security','Ensure the confidentiality and integrity of data flows between SWIFT-related components.',NULL,'mandatory','Network Security',NULL,40,'2026-04-24 18:52:22'),('ba1da9e9-400e-11f1-8bc3-00155d012902','eec44c85-6639-4f22-bdea-7f33976d22ab',NULL,'2.2','Security Updates','Minimise the occurrence of known technical vulnerabilities by applying security updates for all SWIFT-related components.',NULL,'mandatory','Vulnerability Management',NULL,50,'2026-04-24 18:52:22'),('ba1dab5c-400e-11f1-8bc3-00155d012902','eec44c85-6639-4f22-bdea-7f33976d22ab',NULL,'2.3','System Hardening','Reduce the cyber attack surface of SWIFT-related components by performing system hardening.',NULL,'mandatory','System Hardening',NULL,60,'2026-04-24 18:52:22'),('ba1dac8b-400e-11f1-8bc3-00155d012902','eec44c85-6639-4f22-bdea-7f33976d22ab',NULL,'2.5A','External Transmission Data Protection','Protect the confidentiality of SWIFT-related data transmitted or stored outside the secure zone.',NULL,'mandatory','Data Protection',NULL,70,'2026-04-24 18:52:22'),('ba1dadbc-400e-11f1-8bc3-00155d012902','eec44c85-6639-4f22-bdea-7f33976d22ab',NULL,'2.6','Operator Session Confidentiality and Integrity','Protect the confidentiality and integrity of interactive operator sessions connecting to SWIFT-related infrastructure.',NULL,'mandatory','Access Control',NULL,80,'2026-04-24 18:52:22'),('ba1daeef-400e-11f1-8bc3-00155d012902','eec44c85-6639-4f22-bdea-7f33976d22ab',NULL,'2.7','Vulnerability Scanning','Identify known vulnerabilities within the SWIFT environment by implementing a regular vulnerability scanning process.',NULL,'mandatory','Vulnerability Management',NULL,90,'2026-04-24 18:52:22'),('ba1db01e-400e-11f1-8bc3-00155d012902','eec44c85-6639-4f22-bdea-7f33976d22ab',NULL,'2.9A','Transaction Business Controls','Restrict transaction activity to documented and approved business scope.',NULL,'mandatory','Fraud Prevention',NULL,100,'2026-04-24 18:52:22'),('ba1db144-400e-11f1-8bc3-00155d012902','eec44c85-6639-4f22-bdea-7f33976d22ab',NULL,'4.1','Password Policy','Ensure passwords meet defined complexity and rotation requirements for all SWIFT components.',NULL,'mandatory','Access Control',NULL,110,'2026-04-24 18:52:22'),('ba1db272-400e-11f1-8bc3-00155d012902','eec44c85-6639-4f22-bdea-7f33976d22ab',NULL,'4.2','Multi-Factor Authentication','Prevent unauthorised access to SWIFT-related infrastructure components or operating systems.',NULL,'mandatory','Access Control',NULL,120,'2026-04-24 18:52:22'),('ba1db3ce-400e-11f1-8bc3-00155d012902','eec44c85-6639-4f22-bdea-7f33976d22ab',NULL,'5.1','Logical Access Controls','Enforce the security principles of need-to-know access, least privilege, and separation of duties for SWIFT accounts.',NULL,'mandatory','Access Control',NULL,130,'2026-04-24 18:52:22'),('ba1db4fa-400e-11f1-8bc3-00155d012902','eec44c85-6639-4f22-bdea-7f33976d22ab',NULL,'6.1','Malware Protection','Ensure that all SWIFT-related systems are protected against malware and intrusions.',NULL,'mandatory','Endpoint Security',NULL,140,'2026-04-24 18:52:22'),('ba1db624-400e-11f1-8bc3-00155d012902','eec44c85-6639-4f22-bdea-7f33976d22ab',NULL,'6.2','Software Integrity','Know the software installed on SWIFT-related systems and protect against unauthorised software installation.',NULL,'mandatory','Integrity',NULL,150,'2026-04-24 18:52:22'),('ba1db753-400e-11f1-8bc3-00155d012902','eec44c85-6639-4f22-bdea-7f33976d22ab',NULL,'7.1','Cyber Incident Response Planning','Ensure a consistent and effective approach to cyber incident management.',NULL,'mandatory','Incident Response',NULL,160,'2026-04-24 18:52:22'),('ba1db87f-400e-11f1-8bc3-00155d012902','eec44c85-6639-4f22-bdea-7f33976d22ab',NULL,'7.2','Security Training and Awareness','Ensure staff are aware of their security responsibilities and have the capabilities to detect and escalate incidents.',NULL,'mandatory','People',NULL,170,'2026-04-24 18:52:22'),('ba1db9a7-400e-11f1-8bc3-00155d012902','eec44c85-6639-4f22-bdea-7f33976d22ab',NULL,'7.3A','Penetration Testing','Validate the operational security of the SWIFT environment against relevant threats through penetration testing.',NULL,'mandatory','Security Testing',NULL,180,'2026-04-24 18:52:22'),('ba294494-400e-11f1-8bc3-00155d012902','50db3692-94cc-48b4-91a5-a7adde83bf85',NULL,'ITGC-CM','Change Management','Manage changes to systems supporting financial reporting to prevent unauthorised or untested changes. Covers development, testing, approval, and migration.',NULL,'mandatory','Change Management',NULL,10,'2026-04-24 18:52:22'),('ba294b6b-400e-11f1-8bc3-00155d012902','50db3692-94cc-48b4-91a5-a7adde83bf85',NULL,'ITGC-LA','Logical Access','Restrict access to systems, applications, and data supporting financial reporting based on business need. Includes user provisioning, access reviews, and privileged access.',NULL,'mandatory','Access Control',NULL,20,'2026-04-24 18:52:22'),('ba294d10-400e-11f1-8bc3-00155d012902','50db3692-94cc-48b4-91a5-a7adde83bf85',NULL,'ITGC-CO','Computer Operations','Ensure reliable and consistent processing of financial data. Covers job scheduling, batch processing, error handling, and backup/recovery procedures.',NULL,'mandatory','Operations',NULL,30,'2026-04-24 18:52:22'),('ba294e7b-400e-11f1-8bc3-00155d012902','50db3692-94cc-48b4-91a5-a7adde83bf85',NULL,'ITGC-SD','System Development and Acquisition','Ensure new and modified systems supporting financial reporting are properly developed, tested, and approved before go-live.',NULL,'mandatory','Development',NULL,40,'2026-04-24 18:52:22'),('ba294fe9-400e-11f1-8bc3-00155d012902','50db3692-94cc-48b4-91a5-a7adde83bf85',NULL,'ITGC-SoD','Segregation of Duties','Prevent any single individual from having incompatible IT duties that could lead to unauthorised changes or access to financial data.',NULL,'mandatory','Access Control',NULL,50,'2026-04-24 18:52:22'),('ba295167-400e-11f1-8bc3-00155d012902','50db3692-94cc-48b4-91a5-a7adde83bf85',NULL,'ITGC-DR','Data Backup and Recovery','Ensure financial data can be recovered in the event of a disruption through regular backups and tested recovery procedures.',NULL,'mandatory','Resilience',NULL,60,'2026-04-24 18:52:22'),('ba2952a1-400e-11f1-8bc3-00155d012902','50db3692-94cc-48b4-91a5-a7adde83bf85',NULL,'ITGC-3P','Third-Party Management','Assess and monitor IT controls at third-party service providers that support financial reporting processes.',NULL,'mandatory','Third-party Risk',NULL,70,'2026-04-24 18:52:22'),('ba2953d1-400e-11f1-8bc3-00155d012902','50db3692-94cc-48b4-91a5-a7adde83bf85',NULL,'ITGC-LOG','Audit Trail and Logging','Maintain audit trails for all significant transactions and access events in financial reporting systems.',NULL,'mandatory','Audit',NULL,80,'2026-04-24 18:52:22'),('ba295500-400e-11f1-8bc3-00155d012902','50db3692-94cc-48b4-91a5-a7adde83bf85',NULL,'ITGC-SEC','IT Security Program','Maintain a security program covering policies, vulnerability management, incident response, and encryption of financial data.',NULL,'mandatory','Security Program',NULL,90,'2026-04-24 18:52:22'),('ba295667-400e-11f1-8bc3-00155d012902','50db3692-94cc-48b4-91a5-a7adde83bf85',NULL,'ITGC-REV','User Access Reviews','Conduct periodic reviews of user access rights to financial systems to ensure continued appropriateness.',NULL,'mandatory','Access Control',NULL,100,'2026-04-24 18:52:22'),('ba3e991b-400e-11f1-8bc3-00155d012902','06b057d3-fe17-42e1-92e3-5e3292cf8880',NULL,'CC-0','Information Security Management Program','Establish and maintain an information security management program with executive sponsorship and defined scope.',NULL,'mandatory','Governance',NULL,10,'2026-04-24 18:52:22'),('ba3e9da0-400e-11f1-8bc3-00155d012902','06b057d3-fe17-42e1-92e3-5e3292cf8880',NULL,'CC-1','Access Control','Manage access to information and systems based on business and security requirements through identity and access management.',NULL,'mandatory','Access Control',NULL,20,'2026-04-24 18:52:22'),('ba3e9f0c-400e-11f1-8bc3-00155d012902','06b057d3-fe17-42e1-92e3-5e3292cf8880',NULL,'CC-2','Audit Logging and Monitoring','Implement logging of all security-relevant events and monitor logs for anomalous or suspicious activity.',NULL,'mandatory','Monitoring',NULL,30,'2026-04-24 18:52:22'),('ba3f38c6-400e-11f1-8bc3-00155d012902','06b057d3-fe17-42e1-92e3-5e3292cf8880',NULL,'CC-3','Education, Training and Awareness','Provide regular security and privacy awareness training and specialised training for personnel with security roles.',NULL,'mandatory','People',NULL,40,'2026-04-24 18:52:22'),('ba3f3ac0-400e-11f1-8bc3-00155d012902','06b057d3-fe17-42e1-92e3-5e3292cf8880',NULL,'CC-4','Incident Management','Establish an incident management program covering detection, response, reporting, and post-incident review.',NULL,'mandatory','Incident Response',NULL,50,'2026-04-24 18:52:22'),('ba3f3c49-400e-11f1-8bc3-00155d012902','06b057d3-fe17-42e1-92e3-5e3292cf8880',NULL,'CC-5','Business Continuity and Disaster Recovery','Develop, implement, and test business continuity and disaster recovery plans for critical systems and processes.',NULL,'mandatory','Resilience',NULL,60,'2026-04-24 18:52:22'),('ba3f3d94-400e-11f1-8bc3-00155d012902','06b057d3-fe17-42e1-92e3-5e3292cf8880',NULL,'CC-6','IT Risk Management','Implement an IT risk management program covering identification, assessment, treatment, and monitoring of risks.',NULL,'mandatory','Risk Management',NULL,70,'2026-04-24 18:52:22'),('ba3f3edb-400e-11f1-8bc3-00155d012902','06b057d3-fe17-42e1-92e3-5e3292cf8880',NULL,'CC-7','Third Party Assurance','Assess and monitor the security posture of third-party vendors, contractors, and business associates.',NULL,'mandatory','Third-party Risk',NULL,80,'2026-04-24 18:52:22'),('ba3f4014-400e-11f1-8bc3-00155d012902','06b057d3-fe17-42e1-92e3-5e3292cf8880',NULL,'CC-8','Configuration Management','Establish secure baseline configurations and manage changes to systems and software.',NULL,'mandatory','Configuration Management',NULL,90,'2026-04-24 18:52:22'),('ba3f4147-400e-11f1-8bc3-00155d012902','06b057d3-fe17-42e1-92e3-5e3292cf8880',NULL,'CC-9','Network Protection','Implement network security controls including firewalls, IDS/IPS, network segmentation, and wireless security.',NULL,'mandatory','Network Security',NULL,100,'2026-04-24 18:52:22'),('ba3f4276-400e-11f1-8bc3-00155d012902','06b057d3-fe17-42e1-92e3-5e3292cf8880',NULL,'CC-10','Transmission Protection','Protect data in transit using encryption and secure protocols for all networks including public networks.',NULL,'mandatory','Data Protection',NULL,110,'2026-04-24 18:52:22'),('ba3f43aa-400e-11f1-8bc3-00155d012902','06b057d3-fe17-42e1-92e3-5e3292cf8880',NULL,'CC-11','Password Management','Implement and enforce password policies meeting NIST and HIPAA requirements including complexity and MFA.',NULL,'mandatory','Access Control',NULL,120,'2026-04-24 18:52:22'),('ba3f44db-400e-11f1-8bc3-00155d012902','06b057d3-fe17-42e1-92e3-5e3292cf8880',NULL,'CC-12','Audit Control and Management','Implement controls to record and examine activity on systems containing ePHI as required by HIPAA.',NULL,'mandatory','Compliance',NULL,130,'2026-04-24 18:52:22'),('ba3f4615-400e-11f1-8bc3-00155d012902','06b057d3-fe17-42e1-92e3-5e3292cf8880',NULL,'CC-13','Physical and Environmental Security','Control physical access to facilities housing systems that process, store, or transmit ePHI.',NULL,'mandatory','Physical Security',NULL,140,'2026-04-24 18:52:22'),('ba3f4746-400e-11f1-8bc3-00155d012902','06b057d3-fe17-42e1-92e3-5e3292cf8880',NULL,'CC-14','Data Protection and Privacy','Implement data protection controls aligned with HIPAA Privacy Rule covering PHI use, disclosure, and safeguards.',NULL,'mandatory','Privacy',NULL,150,'2026-04-24 18:52:22'),('ba3f4878-400e-11f1-8bc3-00155d012902','06b057d3-fe17-42e1-92e3-5e3292cf8880',NULL,'CC-15','Mobile Device Security','Manage mobile devices and removable media accessing ePHI including encryption, MDM, and remote wipe.',NULL,'mandatory','Endpoint Security',NULL,160,'2026-04-24 18:52:22'),('ba3f49aa-400e-11f1-8bc3-00155d012902','06b057d3-fe17-42e1-92e3-5e3292cf8880',NULL,'CC-16','Wireless Protection','Secure wireless network access to systems containing ePHI using enterprise-grade authentication and encryption.',NULL,'mandatory','Network Security',NULL,170,'2026-04-24 18:52:22'),('ba3f4ade-400e-11f1-8bc3-00155d012902','06b057d3-fe17-42e1-92e3-5e3292cf8880',NULL,'CC-17','Application and Interface Security','Implement application security controls including secure SDLC, vulnerability testing, and API security.',NULL,'mandatory','Application Security',NULL,180,'2026-04-24 18:52:22'),('ba3f4c17-400e-11f1-8bc3-00155d012902','06b057d3-fe17-42e1-92e3-5e3292cf8880',NULL,'CC-18','Vulnerability Management','Continuously identify, assess, prioritize, and remediate vulnerabilities across all systems and software.',NULL,'mandatory','Vulnerability Management',NULL,190,'2026-04-24 18:52:22'),('ba92808e-d6d2-4ffd-bb83-791aa70b0e44','a27eef01-4113-11f1-8bc3-00155d012902','aeb68f9b-1470-4a0d-b475-d07416b4629c','RC.CO','Incident Recovery Communication','Restoration activities are coordinated with internal and external parties.',NULL,'mandatory',NULL,NULL,1,'2026-04-26 02:00:01'),('bba7a8c0-58c4-4fbf-9aa6-8c563ff3b43a','a25c0c03-4113-11f1-8bc3-00155d012902','0af8380e-b045-444d-90d8-9845e51354d9','6.1.1','General','Consider the context and interested parties requirements.',NULL,'mandatory',NULL,NULL,0,'2026-04-26 02:00:00'),('bbf2b2da-7c4a-484e-9885-fa4c8b538b22','a23897c7-4113-11f1-8bc3-00155d012902','0caaab79-0896-4807-824d-e108deabd590','SYSC.5.1','Apportionment and oversight','Ensure oversight of relevant persons engaged in any activity on behalf of the firm.',NULL,'mandatory',NULL,NULL,0,'2026-04-26 02:00:00'),('bc902e8f-6d82-4bd2-8cc3-7fdf516ee2d1','a29cdc11-4113-11f1-8bc3-00155d012902',NULL,'S30','Right to withdraw consent','Data subject may withdraw consent at any time; withdrawal shall not affect the lawfulness of processing based on consent before its withdrawal.',NULL,'mandatory','Data Subject Rights',NULL,4,'2026-04-26 02:00:01'),('bdee5c3c-4a98-11f1-8bc3-00155d012902','b8c9d0e1-0021-0001-0001-000000000001',NULL,'GRI-1','GRI 1: Foundation 2021','Sets out the purpose of GRI Standards, the requirements for using them, how to claim use of the Standards, and the role of different standards in the framework.',NULL,'mandatory','GRI Universal Standards',NULL,10,'2026-05-08 04:45:30'),('bdee610c-4a98-11f1-8bc3-00155d012902','b8c9d0e1-0021-0001-0001-000000000001',NULL,'GRI-2','GRI 2: General Disclosures 2021','Covers organizational profile, governance, strategy, policies, practices, and stakeholder engagement information applicable to all organizations.',NULL,'mandatory','GRI Universal Standards',NULL,20,'2026-05-08 04:45:30'),('bdee6652-4a98-11f1-8bc3-00155d012902','b8c9d0e1-0021-0001-0001-000000000001',NULL,'GRI-3','GRI 3: Material Topics 2021','Provides requirements and guidance for determining material topics and for how an organization reports on its management of these topics.',NULL,'mandatory','GRI Universal Standards',NULL,30,'2026-05-08 04:45:30'),('bdee6807-4a98-11f1-8bc3-00155d012902','b8c9d0e1-0021-0001-0001-000000000001',NULL,'GRI-ENV','Environmental Topic Standards (GRI 300 Series)','Covers environmental disclosures including materials, energy, water, biodiversity, emissions, effluents and waste, and environmental compliance.',NULL,'mandatory','GRI Topic Standards',NULL,40,'2026-05-08 04:45:30'),('bdee6a96-4a98-11f1-8bc3-00155d012902','b8c9d0e1-0021-0001-0001-000000000001',NULL,'GRI-SOC','Social Topic Standards (GRI 400 Series)','Covers social disclosures including employment, labor/management relations, health and safety, training, diversity, human rights, local communities, and customer privacy.',NULL,'mandatory','GRI Topic Standards',NULL,50,'2026-05-08 04:45:30'),('bdee6c73-4a98-11f1-8bc3-00155d012902','b8c9d0e1-0021-0001-0001-000000000001',NULL,'GRI-ECO','Economic Topic Standards (GRI 200 Series)','Covers economic disclosures including economic performance, market presence, indirect economic impacts, procurement practices, and anti-corruption.',NULL,'mandatory','GRI Topic Standards',NULL,60,'2026-05-08 04:45:30'),('bdf7afe0-b5c4-457b-87f4-2e1e03aa7d2e','a23897c7-4113-11f1-8bc3-00155d012902','e030f67e-22f0-4eb1-9cad-aa0e5f55af8f','SYSC.4.1','Systems and controls','Implement appropriate systems and controls to manage risks to its business, customers and market integrity.',NULL,'mandatory',NULL,NULL,0,'2026-04-26 02:00:00'),('bdffca2e-4a98-11f1-8bc3-00155d012902','b8c9d0e1-0021-0002-0001-000000000001',NULL,'SASB-FIN','Financials Sector','Industry-specific sustainability topics for asset management, commercial banking, insurance, and financial services companies.',NULL,'mandatory','SASB Sectors',NULL,10,'2026-05-08 04:45:30'),('bdffcf87-4a98-11f1-8bc3-00155d012902','b8c9d0e1-0021-0002-0001-000000000001',NULL,'SASB-HC','Health Care Sector','Sustainability topics for biotechnology, drug retail, health care delivery, managed care, medical equipment, and pharmaceutical industries.',NULL,'mandatory','SASB Sectors',NULL,20,'2026-05-08 04:45:30'),('bdffd392-4a98-11f1-8bc3-00155d012902','b8c9d0e1-0021-0002-0001-000000000001',NULL,'SASB-TC','Technology and Communications Sector','Sustainability topics for electronic manufacturing, hardware, internet media, semiconductors, software, and telecommunications companies.',NULL,'mandatory','SASB Sectors',NULL,30,'2026-05-08 04:45:30'),('bdffd608-4a98-11f1-8bc3-00155d012902','b8c9d0e1-0021-0002-0001-000000000001',NULL,'SASB-NR','Non-Renewable Resources Sector','Sustainability topics for coal, construction materials, iron and steel, metals and mining, oil and gas exploration, and refining companies.',NULL,'mandatory','SASB Sectors',NULL,40,'2026-05-08 04:45:30'),('bdffd87d-4a98-11f1-8bc3-00155d012902','b8c9d0e1-0021-0002-0001-000000000001',NULL,'SASB-TR','Transportation Sector','Sustainability topics for air freight, airlines, auto parts, automobiles, cruise lines, marine, rail, and road transportation companies.',NULL,'mandatory','SASB Sectors',NULL,50,'2026-05-08 04:45:30'),('bdffdac4-4a98-11f1-8bc3-00155d012902','b8c9d0e1-0021-0002-0001-000000000001',NULL,'SASB-SV','Services Sector','Sustainability topics for advertising, casinos, education, hotels, leisure facilities, media, restaurants, and professional services companies.',NULL,'mandatory','SASB Sectors',NULL,60,'2026-05-08 04:45:30'),('bdffdcf4-4a98-11f1-8bc3-00155d012902','b8c9d0e1-0021-0002-0001-000000000001',NULL,'SASB-RT','Resource Transformation Sector','Sustainability topics for aerospace, chemicals, containers, electrical equipment, industrial machinery, and waste management companies.',NULL,'mandatory','SASB Sectors',NULL,70,'2026-05-08 04:45:30'),('bdffdf1d-4a98-11f1-8bc3-00155d012902','b8c9d0e1-0021-0002-0001-000000000001',NULL,'SASB-CN','Consumer Goods Sector','Sustainability topics for apparel, building products, e-commerce, food, household products, and toys and sporting goods industries.',NULL,'mandatory','SASB Sectors',NULL,80,'2026-05-08 04:45:30'),('bdffe15c-4a98-11f1-8bc3-00155d012902','b8c9d0e1-0021-0002-0001-000000000001',NULL,'SASB-IF','Infrastructure Sector','Sustainability topics for electric utilities, engineering and construction, gas utilities, home builders, REITs, waste management, and water utilities.',NULL,'mandatory','SASB Sectors',NULL,90,'2026-05-08 04:45:30'),('bdffe395-4a98-11f1-8bc3-00155d012902','b8c9d0e1-0021-0002-0001-000000000001',NULL,'SASB-RR','Renewable Resources and Alternative Energy Sector','Sustainability topics for biofuels, forestry, fuel cells, pulp and paper, solar, and wind energy companies.',NULL,'mandatory','SASB Sectors',NULL,100,'2026-05-08 04:45:30'),('be0854e3-4a98-11f1-8bc3-00155d012902','b8c9d0e1-0021-0003-0001-000000000001',NULL,'TCFD-GV','Governance','Describe the organization\'s governance around climate-related risks and opportunities including board oversight and management\'s role.',NULL,'mandatory','TCFD Pillars',NULL,10,'2026-05-08 04:45:30'),('be085a7c-4a98-11f1-8bc3-00155d012902','b8c9d0e1-0021-0003-0001-000000000001',NULL,'TCFD-ST','Strategy','Describe the actual and potential impacts of climate-related risks and opportunities on the organization\'s businesses, strategy, and financial planning using climate scenarios.',NULL,'mandatory','TCFD Pillars',NULL,20,'2026-05-08 04:45:30'),('be085eca-4a98-11f1-8bc3-00155d012902','b8c9d0e1-0021-0003-0001-000000000001',NULL,'TCFD-RM','Risk Management','Describe the processes used to identify, assess, and manage climate-related risks and how those processes are integrated into overall risk management.',NULL,'mandatory','TCFD Pillars',NULL,30,'2026-05-08 04:45:30'),('be08611b-4a98-11f1-8bc3-00155d012902','b8c9d0e1-0021-0003-0001-000000000001',NULL,'TCFD-MT','Metrics and Targets','Disclose metrics and targets used to assess and manage relevant climate-related risks and opportunities, including Scope 1, 2, and 3 GHG emissions.',NULL,'mandatory','TCFD Pillars',NULL,40,'2026-05-08 04:45:30'),('be15dfad-4a98-11f1-8bc3-00155d012902','b8c9d0e1-0021-0004-0001-000000000001',NULL,'ESRS-E1','ESRS E1: Climate Change','Disclose transition plans, physical and transition climate risks, and GHG emission reduction targets and progress.',NULL,'mandatory','ESRS Standards',NULL,10,'2026-05-08 04:45:30'),('be15e63c-4a98-11f1-8bc3-00155d012902','b8c9d0e1-0021-0004-0001-000000000001',NULL,'ESRS-E2','ESRS E2: Pollution','Disclose pollution-related impacts, risks, and opportunities including air, water, and soil pollution and substances of concern.',NULL,'mandatory','ESRS Standards',NULL,20,'2026-05-08 04:45:30'),('be15e8af-4a98-11f1-8bc3-00155d012902','b8c9d0e1-0021-0004-0001-000000000001',NULL,'ESRS-E3','ESRS E3: Water and Marine Resources','Disclose water and marine resource use, water stress impacts, and ocean and marine ecosystem impacts.',NULL,'mandatory','ESRS Standards',NULL,30,'2026-05-08 04:45:30'),('be15eb0f-4a98-11f1-8bc3-00155d012902','b8c9d0e1-0021-0004-0001-000000000001',NULL,'ESRS-E4','ESRS E4: Biodiversity and Ecosystems','Disclose impacts and dependencies on biodiversity and ecosystems across operations and value chain.',NULL,'mandatory','ESRS Standards',NULL,40,'2026-05-08 04:45:30'),('be15ed43-4a98-11f1-8bc3-00155d012902','b8c9d0e1-0021-0004-0001-000000000001',NULL,'ESRS-E5','ESRS E5: Resource Use and Circular Economy','Disclose resource inflows and outflows, waste generation, and circular economy strategy and targets.',NULL,'mandatory','ESRS Standards',NULL,50,'2026-05-08 04:45:30'),('be15ef81-4a98-11f1-8bc3-00155d012902','b8c9d0e1-0021-0004-0001-000000000001',NULL,'ESRS-S1','ESRS S1: Own Workforce','Disclose working conditions, equal treatment, wages, health and safety, and social dialogue with own employees and workers.',NULL,'mandatory','ESRS Standards',NULL,60,'2026-05-08 04:45:30'),('be15f1a4-4a98-11f1-8bc3-00155d012902','b8c9d0e1-0021-0004-0001-000000000001',NULL,'ESRS-S2','ESRS S2: Workers in the Value Chain','Disclose impacts on and engagement with workers in the supply chain beyond direct employees.',NULL,'mandatory','ESRS Standards',NULL,70,'2026-05-08 04:45:30'),('be15f3cf-4a98-11f1-8bc3-00155d012902','b8c9d0e1-0021-0004-0001-000000000001',NULL,'ESRS-S3','ESRS S3: Affected Communities','Disclose impacts on local communities affected by the organization\'s operations and engagement activities.',NULL,'mandatory','ESRS Standards',NULL,80,'2026-05-08 04:45:30'),('be15f601-4a98-11f1-8bc3-00155d012902','b8c9d0e1-0021-0004-0001-000000000001',NULL,'ESRS-S4','ESRS S4: Consumers and End-Users','Disclose impacts related to consumer and end-user safety, privacy, access, and fair treatment.',NULL,'mandatory','ESRS Standards',NULL,90,'2026-05-08 04:45:30'),('be15f815-4a98-11f1-8bc3-00155d012902','b8c9d0e1-0021-0004-0001-000000000001',NULL,'ESRS-G1','ESRS G1: Business Conduct','Disclose corporate culture, anti-corruption policies, political engagement, payment practices, and whistleblower protections.',NULL,'mandatory','ESRS Standards',NULL,100,'2026-05-08 04:45:30'),('be2278fa-4a98-11f1-8bc3-00155d012902','b8c9d0e1-0021-0005-0001-000000000001',NULL,'SLSA-L1','SLSA Level 1: Documentation of the Build Process','The build process is scripted/automated and provenance is available; no tamper protection but provides a starting point for build integrity.',NULL,'mandatory','SLSA Levels',NULL,10,'2026-05-08 04:45:31'),('be227dfd-4a98-11f1-8bc3-00155d012902','b8c9d0e1-0021-0005-0001-000000000001',NULL,'SLSA-L2','SLSA Level 2: Tamper Protection of the Build Service','The build service is hosted and generates signed provenance; provides protection against source and build platform tampering.',NULL,'mandatory','SLSA Levels',NULL,20,'2026-05-08 04:45:31'),('be227fab-4a98-11f1-8bc3-00155d012902','b8c9d0e1-0021-0005-0001-000000000001',NULL,'SLSA-L3','SLSA Level 3: Hardened Builds','The build platform meets additional security requirements and provenance is non-forgeable; provides strong protection against build tampering.',NULL,'mandatory','SLSA Levels',NULL,30,'2026-05-08 04:45:31'),('be228143-4a98-11f1-8bc3-00155d012902','b8c9d0e1-0021-0005-0001-000000000001',NULL,'SLSA-SRC','Source Requirements','Source integrity requirements covering version control, source retention, and two-person review to ensure source code authenticity.',NULL,'mandatory','SLSA Requirements',NULL,40,'2026-05-08 04:45:31'),('be228439-4a98-11f1-8bc3-00155d012902','b8c9d0e1-0021-0005-0001-000000000001',NULL,'SLSA-BLD','Build Requirements','Build process requirements ensuring builds are scripted, run on managed platforms, and produce provenance documenting how the artifact was built.',NULL,'mandatory','SLSA Requirements',NULL,50,'2026-05-08 04:45:31'),('be2285d1-4a98-11f1-8bc3-00155d012902','b8c9d0e1-0021-0005-0001-000000000001',NULL,'SLSA-PRV','Provenance Requirements','Requirements for build provenance completeness, authenticity, and non-forgeability to enable downstream consumers to verify artifact integrity.',NULL,'mandatory','SLSA Requirements',NULL,60,'2026-05-08 04:45:31'),('be22877a-4a98-11f1-8bc3-00155d012902','b8c9d0e1-0021-0005-0001-000000000001',NULL,'SLSA-COM','Common Requirements','Security requirements applicable to all SLSA levels covering security best practices for the build environment and supply chain.',NULL,'mandatory','SLSA Requirements',NULL,70,'2026-05-08 04:45:31'),('be2d8dd1-4a98-11f1-8bc3-00155d012902','b8c9d0e1-0021-0006-0001-000000000001',NULL,'EO-SBOM','SBOM Requirements','Software vendors selling to the federal government must provide SBOMs to enable identification of vulnerabilities in software components used in federal systems.',NULL,'mandatory','EO 14028 Sections',NULL,10,'2026-05-08 04:45:31'),('be2d93a7-4a98-11f1-8bc3-00155d012902','b8c9d0e1-0021-0006-0001-000000000001',NULL,'EO-ZTA','Zero Trust Architecture','Federal agencies must develop plans to implement Zero Trust Architecture consistent with NIST SP 800-207 and migrate to ZTA within defined timelines.',NULL,'mandatory','EO 14028 Sections',NULL,20,'2026-05-08 04:45:31'),('be2d9569-4a98-11f1-8bc3-00155d012902','b8c9d0e1-0021-0006-0001-000000000001',NULL,'EO-IR','Incident Response Improvements','Federal agencies and contractors must improve detection of cybersecurity incidents and share cyber threat information with CISA and FBI.',NULL,'mandatory','EO 14028 Sections',NULL,30,'2026-05-08 04:45:31'),('be2d96ff-4a98-11f1-8bc3-00155d012902','b8c9d0e1-0021-0006-0001-000000000001',NULL,'EO-STD','Security Standards','NIST must publish guidelines for critical software security standards; federal agencies must only use software meeting those standards.',NULL,'mandatory','EO 14028 Sections',NULL,40,'2026-05-08 04:45:31'),('be2d9967-4a98-11f1-8bc3-00155d012902','b8c9d0e1-0021-0006-0001-000000000001',NULL,'EO-IOT','IoT Security','NIST must define IoT cybersecurity criteria for consumer-grade IoT devices; FTC and NIST coordinate labeling to inform consumers.',NULL,'recommended','EO 14028 Sections',NULL,50,'2026-05-08 04:45:31'),('be2d9b2a-4a98-11f1-8bc3-00155d012902','b8c9d0e1-0021-0006-0001-000000000001',NULL,'EO-LABEL','Consumer Labeling','Pilot program for consumer labeling of software and IoT devices based on security criteria to promote security-conscious purchasing decisions.',NULL,'recommended','EO 14028 Sections',NULL,60,'2026-05-08 04:45:31'),('be3ac941-4a98-11f1-8bc3-00155d012902','b8c9d0e1-0021-0007-0001-000000000001',NULL,'SPDX-DC','SPDX: Document Creation Information','SPDX document metadata including SPDX version, data license, document namespace, creator information, and creation timestamp.',NULL,'mandatory','SPDX Elements',NULL,10,'2026-05-08 04:45:31'),('be3ace82-4a98-11f1-8bc3-00155d012902','b8c9d0e1-0021-0007-0001-000000000001',NULL,'SPDX-PK','SPDX: Package Information','Describes software packages with name, version, download location, checksum, supplier, originator, and license information.',NULL,'mandatory','SPDX Elements',NULL,20,'2026-05-08 04:45:31'),('be3ad058-4a98-11f1-8bc3-00155d012902','b8c9d0e1-0021-0007-0001-000000000001',NULL,'SPDX-FI','SPDX: File Information','Per-file metadata including file name, checksum, license information, copyright text, and file types.',NULL,'optional','SPDX Elements',NULL,30,'2026-05-08 04:45:31'),('be3ad1f9-4a98-11f1-8bc3-00155d012902','b8c9d0e1-0021-0007-0001-000000000001',NULL,'SPDX-SN','SPDX: Snippet Information','Information about portions of files that have different licensing from the file as a whole.',NULL,'optional','SPDX Elements',NULL,40,'2026-05-08 04:45:31'),('be3ad377-4a98-11f1-8bc3-00155d012902','b8c9d0e1-0021-0007-0001-000000000001',NULL,'SPDX-LI','SPDX: License Information','Custom license text for licenses not in the SPDX License List, with license identifier and extracted text.',NULL,'optional','SPDX Elements',NULL,50,'2026-05-08 04:45:31'),('be3ad4f1-4a98-11f1-8bc3-00155d012902','b8c9d0e1-0021-0007-0001-000000000001',NULL,'CDX-META','CycloneDX: Metadata','BOM-level metadata including timestamp, tools used, component type, and the component being described.',NULL,'mandatory','CycloneDX Elements',NULL,60,'2026-05-08 04:45:31'),('be3adaaa-4a98-11f1-8bc3-00155d012902','b8c9d0e1-0021-0007-0001-000000000001',NULL,'CDX-COMP','CycloneDX: Components','Describes components with type, BOM reference, supplier, name, version, description, hashes, licenses, and PURL.',NULL,'mandatory','CycloneDX Elements',NULL,70,'2026-05-08 04:45:31'),('be3add8a-4a98-11f1-8bc3-00155d012902','b8c9d0e1-0021-0007-0001-000000000001',NULL,'CDX-DEP','CycloneDX: Dependencies','Defines dependency relationships between components to enable complete supply chain analysis and vulnerability impact assessment.',NULL,'mandatory','CycloneDX Elements',NULL,80,'2026-05-08 04:45:31'),('be3adf81-4a98-11f1-8bc3-00155d012902','b8c9d0e1-0021-0007-0001-000000000001',NULL,'CDX-SVC','CycloneDX: Services','Describes external services and APIs that the software calls or depends on, including authentication requirements.',NULL,'recommended','CycloneDX Elements',NULL,90,'2026-05-08 04:45:31'),('be3ae174-4a98-11f1-8bc3-00155d012902','b8c9d0e1-0021-0007-0001-000000000001',NULL,'CDX-VUL','CycloneDX: Vulnerabilities','Documents known vulnerabilities in components with CVE references, ratings, and remediation state.',NULL,'recommended','CycloneDX Elements',NULL,100,'2026-05-08 04:45:31'),('be44bdfc-4a98-11f1-8bc3-00155d012902','b8c9d0e1-0021-0008-0001-000000000001',NULL,'SC-SD','Secure Design Principles','Apply secure design principles throughout the SDLC including threat modeling, attack surface analysis, and security architecture reviews.',NULL,'mandatory','SAFECode Practices',NULL,10,'2026-05-08 04:45:31'),('be44c3c5-4a98-11f1-8bc3-00155d012902','b8c9d0e1-0021-0008-0001-000000000001',NULL,'SC-ST','Security Testing','Conduct security testing including SAST, DAST, SCA, fuzzing, and penetration testing proportionate to the risk level of the software.',NULL,'mandatory','SAFECode Practices',NULL,20,'2026-05-08 04:45:31'),('be44c8a7-4a98-11f1-8bc3-00155d012902','b8c9d0e1-0021-0008-0001-000000000001',NULL,'SC-TP','Third-Party Component Management','Manage third-party and open source components through inventory tracking, license compliance, and vulnerability monitoring.',NULL,'mandatory','SAFECode Practices',NULL,30,'2026-05-08 04:45:31'),('be44cb2e-4a98-11f1-8bc3-00155d012902','b8c9d0e1-0021-0008-0001-000000000001',NULL,'SC-VR','Vulnerability Response','Establish a vulnerability response process including coordinated disclosure, severity assessment, patch development, and customer notification.',NULL,'mandatory','SAFECode Practices',NULL,40,'2026-05-08 04:45:31'),('be44ccd4-4a98-11f1-8bc3-00155d012902','b8c9d0e1-0021-0008-0001-000000000001',NULL,'SC-GV','Security Governance','Establish security governance for software development including executive accountability, security policies, training, and metrics.',NULL,'mandatory','SAFECode Practices',NULL,50,'2026-05-08 04:45:31'),('be5403b2-4a98-11f1-8bc3-00155d012902','b8c9d0e1-0021-0009-0001-000000000001',NULL,'OSCAL-CAT','Catalog','Machine-readable representation of a security controls catalog (e.g., NIST SP 800-53) enabling automated import and processing of control definitions.',NULL,'mandatory','OSCAL Layers',NULL,10,'2026-05-08 04:45:31'),('be540a02-4a98-11f1-8bc3-00155d012902','b8c9d0e1-0021-0009-0001-000000000001',NULL,'OSCAL-PRF','Profile','Represents a baseline or overlay by selecting, tailoring, and extending controls from one or more catalogs to create an organization-specific control set.',NULL,'mandatory','OSCAL Layers',NULL,20,'2026-05-08 04:45:31'),('be540c84-4a98-11f1-8bc3-00155d012902','b8c9d0e1-0021-0009-0001-000000000001',NULL,'OSCAL-COM','Component Definition','Documents how a specific component (hardware, software, service) implements security controls, enabling reuse of component-level compliance evidence.',NULL,'mandatory','OSCAL Layers',NULL,30,'2026-05-08 04:45:31'),('be540e2e-4a98-11f1-8bc3-00155d012902','b8c9d0e1-0021-0009-0001-000000000001',NULL,'OSCAL-SSP','System Security Plan','Machine-readable SSP documenting system boundaries, system implementation, and how controls are satisfied by the system and its environment.',NULL,'mandatory','OSCAL Layers',NULL,40,'2026-05-08 04:45:31'),('be540fc0-4a98-11f1-8bc3-00155d012902','b8c9d0e1-0021-0009-0001-000000000001',NULL,'OSCAL-AP','Assessment Plan','Documents the scope, objectives, methods, and schedule for a security assessment in a machine-readable format linked to the SSP.',NULL,'mandatory','OSCAL Layers',NULL,50,'2026-05-08 04:45:31'),('be541146-4a98-11f1-8bc3-00155d012902','b8c9d0e1-0021-0009-0001-000000000001',NULL,'OSCAL-AR','Assessment Results','Machine-readable record of assessment findings, observations, and findings linked to the control objectives and methods in the assessment plan.',NULL,'mandatory','OSCAL Layers',NULL,60,'2026-05-08 04:45:31'),('be5412b8-4a98-11f1-8bc3-00155d012902','b8c9d0e1-0021-0009-0001-000000000001',NULL,'OSCAL-POAM','Plan of Action and Milestones (POA&M)','Tracks identified risks, weaknesses, and deficiencies along with remediation plans, milestones, and responsible parties.',NULL,'mandatory','OSCAL Layers',NULL,70,'2026-05-08 04:45:31'),('be5ff002-4a98-11f1-8bc3-00155d012902','b8c9d0e1-0021-0010-0001-000000000001',NULL,'DSO-PLAN','Plan Security','Integrate security requirements into sprint planning, conduct threat modeling for new features, and define security acceptance criteria.',NULL,'mandatory','DevSecOps Phases',NULL,10,'2026-05-08 04:45:31'),('be5ff712-4a98-11f1-8bc3-00155d012902','b8c9d0e1-0021-0010-0001-000000000001',NULL,'DSO-CODE','Secure Code','Apply secure coding standards, use pre-commit hooks for secrets scanning, and enforce code reviews with security focus.',NULL,'mandatory','DevSecOps Phases',NULL,20,'2026-05-08 04:45:31'),('be5ff8c8-4a98-11f1-8bc3-00155d012902','b8c9d0e1-0021-0010-0001-000000000001',NULL,'DSO-TEST','SAST / DAST / SCA','Run Static Application Security Testing (SAST), Dynamic Application Security Testing (DAST), and Software Composition Analysis (SCA) in the CI pipeline.',NULL,'mandatory','DevSecOps Phases',NULL,30,'2026-05-08 04:45:31'),('be5ffa73-4a98-11f1-8bc3-00155d012902','b8c9d0e1-0021-0010-0001-000000000001',NULL,'DSO-CON','Container and Infrastructure Security','Scan container images for vulnerabilities, enforce image signing, use Infrastructure as Code security scanning, and enforce least-privilege for workloads.',NULL,'mandatory','DevSecOps Phases',NULL,40,'2026-05-08 04:45:31'),('be5ffc16-4a98-11f1-8bc3-00155d012902','b8c9d0e1-0021-0010-0001-000000000001',NULL,'DSO-DEP','Secure Deploy','Enforce deployment gates based on security test results, use signed artifacts, and apply SLSA requirements for release integrity.',NULL,'mandatory','DevSecOps Phases',NULL,50,'2026-05-08 04:45:31'),('be5ffd9f-4a98-11f1-8bc3-00155d012902','b8c9d0e1-0021-0010-0001-000000000001',NULL,'DSO-MON','Monitor','Implement runtime security monitoring, RASP, application-level logging, and behavioral anomaly detection in production.',NULL,'mandatory','DevSecOps Phases',NULL,60,'2026-05-08 04:45:31'),('be5fff1c-4a98-11f1-8bc3-00155d012902','b8c9d0e1-0021-0010-0001-000000000001',NULL,'DSO-RSP','Respond','Automate incident response playbooks for security events detected in production, feed findings back into the vulnerability management process.',NULL,'mandatory','DevSecOps Phases',NULL,70,'2026-05-08 04:45:31'),('be6a51aa-4a98-11f1-8bc3-00155d012902','b8c9d0e1-0021-0011-0001-000000000001',NULL,'FIDO-AUTH','Authenticator (Authenticator API)','Hardware or software component that performs user verification (PIN, biometric, presence) and generates cryptographic assertions; may be platform-bound or roaming.',NULL,'mandatory','FIDO2 Components',NULL,10,'2026-05-08 04:45:31'),('be6a59fc-4a98-11f1-8bc3-00155d012902','b8c9d0e1-0021-0011-0001-000000000001',NULL,'FIDO-CLI','Client (Browser / Platform API)','Client-side software mediating between the authenticator and relying party, implementing the WebAuthn API and CTAP protocol handling.',NULL,'mandatory','FIDO2 Components',NULL,20,'2026-05-08 04:45:31'),('be6a5c49-4a98-11f1-8bc3-00155d012902','b8c9d0e1-0021-0011-0001-000000000001',NULL,'FIDO-SRV','Relying Party (Server)','Server-side component implementing WebAuthn, managing credential registration, challenge generation, and assertion verification.',NULL,'mandatory','FIDO2 Components',NULL,30,'2026-05-08 04:45:31'),('be6a5e6f-4a98-11f1-8bc3-00155d012902','b8c9d0e1-0021-0011-0001-000000000001',NULL,'FIDO-ATT','Attestation Types','Mechanisms for verifying the provenance and trust level of an authenticator during registration: packed, TPM, FIDO U2F, anonymization CA, and none.',NULL,'mandatory','FIDO2 Components',NULL,40,'2026-05-08 04:45:31'),('be6a6018-4a98-11f1-8bc3-00155d012902','b8c9d0e1-0021-0011-0001-000000000001',NULL,'FIDO-UV','User Verification Levels','Levels of user verification: Required (UV=true), Preferred, and Discouraged; combined with user presence check to balance security and usability.',NULL,'mandatory','FIDO2 Components',NULL,50,'2026-05-08 04:45:31'),('be77386f-4a98-11f1-8bc3-00155d012902','b8c9d0e1-0021-0012-0001-000000000001',NULL,'OAUTH-AC','Authorization Code Flow','The most secure OAuth 2.0 flow for server-side applications; uses an authorization code exchanged for tokens through the back channel.',NULL,'mandatory','OAuth 2.0 Flows',NULL,10,'2026-05-08 04:45:31'),('be774191-4a98-11f1-8bc3-00155d012902','b8c9d0e1-0021-0012-0001-000000000001',NULL,'OAUTH-PKCE','Authorization Code with PKCE','Extension of the Authorization Code flow for public clients (SPAs, mobile apps) using a cryptographic code verifier/challenge to prevent interception attacks.',NULL,'mandatory','OAuth 2.0 Flows',NULL,20,'2026-05-08 04:45:31'),('be774356-4a98-11f1-8bc3-00155d012902','b8c9d0e1-0021-0012-0001-000000000001',NULL,'OAUTH-CC','Client Credentials Flow','Machine-to-machine flow where the client authenticates with its own credentials to obtain an access token for API access without user involvement.',NULL,'mandatory','OAuth 2.0 Flows',NULL,30,'2026-05-08 04:45:31'),('be774506-4a98-11f1-8bc3-00155d012902','b8c9d0e1-0021-0012-0001-000000000001',NULL,'OAUTH-DF','Device Authorization Flow','Flow for devices with limited input capabilities; user authorizes on a secondary device using a user code displayed on the constrained device.',NULL,'recommended','OAuth 2.0 Flows',NULL,40,'2026-05-08 04:45:31'),('be7746b0-4a98-11f1-8bc3-00155d012902','b8c9d0e1-0021-0012-0001-000000000001',NULL,'OIDC-IDT','OIDC: ID Token','JWT containing identity claims about the authenticated user; issued by the identity provider alongside the access token in the token response.',NULL,'mandatory','OIDC Components',NULL,50,'2026-05-08 04:45:31'),('be77484e-4a98-11f1-8bc3-00155d012902','b8c9d0e1-0021-0012-0001-000000000001',NULL,'OIDC-UI','OIDC: UserInfo Endpoint','Protected resource returning claims about the authenticated end-user; called by the relying party using the access token.',NULL,'mandatory','OIDC Components',NULL,60,'2026-05-08 04:45:31'),('be7749d0-4a98-11f1-8bc3-00155d012902','b8c9d0e1-0021-0012-0001-000000000001',NULL,'OIDC-DISC','OIDC: Discovery','Mechanism for relying parties to automatically discover identity provider configuration via the .well-known/openid-configuration endpoint.',NULL,'recommended','OIDC Components',NULL,70,'2026-05-08 04:45:31'),('be80f12b-4a98-11f1-8bc3-00155d012902','b8c9d0e1-0021-0013-0001-000000000001',NULL,'SAML-WBSSO','Profile: Web Browser SSO','The primary SAML profile enabling single sign-on for browser-based applications; supports SP-initiated and IdP-initiated flows.',NULL,'mandatory','SAML 2.0 Profiles',NULL,10,'2026-05-08 04:45:31'),('be80f6d1-4a98-11f1-8bc3-00155d012902','b8c9d0e1-0021-0013-0001-000000000001',NULL,'SAML-ECP','Profile: Enhanced Client or Proxy (ECP)','SAML profile for non-browser clients such as thick applications that can perform SOAP-based SAML exchanges.',NULL,'optional','SAML 2.0 Profiles',NULL,20,'2026-05-08 04:45:31'),('be80fb12-4a98-11f1-8bc3-00155d012902','b8c9d0e1-0021-0013-0001-000000000001',NULL,'SAML-SLO','Profile: Single Logout','SAML profile enabling coordinated logout across all sessions established through a single sign-on event.',NULL,'recommended','SAML 2.0 Profiles',NULL,30,'2026-05-08 04:45:31'),('be80fc9e-4a98-11f1-8bc3-00155d012902','b8c9d0e1-0021-0013-0001-000000000001',NULL,'SAML-REDIR','Binding: HTTP-Redirect','SAML binding transmitting messages through browser URL query string parameters; used for authentication requests in Web SSO.',NULL,'mandatory','SAML 2.0 Bindings',NULL,40,'2026-05-08 04:45:31'),('be80fe1d-4a98-11f1-8bc3-00155d012902','b8c9d0e1-0021-0013-0001-000000000001',NULL,'SAML-POST','Binding: HTTP-POST','SAML binding transmitting messages through HTML form POST; used for SAML responses containing assertions.',NULL,'mandatory','SAML 2.0 Bindings',NULL,50,'2026-05-08 04:45:31'),('be80ff97-4a98-11f1-8bc3-00155d012902','b8c9d0e1-0021-0013-0001-000000000001',NULL,'SAML-ART','Binding: HTTP-Artifact','SAML binding using a short artifact reference to retrieve the actual message via a back-channel SOAP call, preventing assertion exposure in browser.',NULL,'optional','SAML 2.0 Bindings',NULL,60,'2026-05-08 04:45:31'),('be8e7e64-4a98-11f1-8bc3-00155d012902','b8c9d0e1-0021-0014-0001-000000000001',NULL,'SCIM-USER','User Resource','Core SCIM schema for representing user identity attributes including username, name, email, phone, address, group membership, and enterprise attributes.',NULL,'mandatory','SCIM Resources',NULL,10,'2026-05-08 04:45:31'),('be8e82d9-4a98-11f1-8bc3-00155d012902','b8c9d0e1-0021-0014-0001-000000000001',NULL,'SCIM-GRP','Group Resource','SCIM schema for representing groups of users with display name and member list for provisioning role and group assignments.',NULL,'mandatory','SCIM Resources',NULL,20,'2026-05-08 04:45:31'),('be8e84f6-4a98-11f1-8bc3-00155d012902','b8c9d0e1-0021-0014-0001-000000000001',NULL,'SCIM-CR','Create Operation','HTTP POST to provision new users or groups in the target system with defined attributes from the identity source.',NULL,'mandatory','SCIM Operations',NULL,30,'2026-05-08 04:45:31'),('be8e8688-4a98-11f1-8bc3-00155d012902','b8c9d0e1-0021-0014-0001-000000000001',NULL,'SCIM-RD','Read Operation','HTTP GET to retrieve user or group attributes from the target system for synchronization and audit purposes.',NULL,'mandatory','SCIM Operations',NULL,40,'2026-05-08 04:45:31'),('be8e8813-4a98-11f1-8bc3-00155d012902','b8c9d0e1-0021-0014-0001-000000000001',NULL,'SCIM-RP','Replace Operation','HTTP PUT to replace all attributes of a user or group resource with a full updated representation.',NULL,'mandatory','SCIM Operations',NULL,50,'2026-05-08 04:45:31'),('be8e89f2-4a98-11f1-8bc3-00155d012902','b8c9d0e1-0021-0014-0001-000000000001',NULL,'SCIM-DL','Delete Operation','HTTP DELETE to deprovision user or group resources in the target system when access should be revoked.',NULL,'mandatory','SCIM Operations',NULL,60,'2026-05-08 04:45:31'),('be8e8bde-4a98-11f1-8bc3-00155d012902','b8c9d0e1-0021-0014-0001-000000000001',NULL,'SCIM-SR','Search Operation','HTTP GET or POST to /Users or /Groups with filter parameters to search for resources matching specified criteria.',NULL,'mandatory','SCIM Operations',NULL,70,'2026-05-08 04:45:31'),('be8e8d7e-4a98-11f1-8bc3-00155d012902','b8c9d0e1-0021-0014-0001-000000000001',NULL,'SCIM-BLK','Bulk Operation','HTTP POST to /Bulk endpoint to perform multiple create, modify, and delete operations in a single request for efficiency.',NULL,'recommended','SCIM Operations',NULL,80,'2026-05-08 04:45:31'),('be9caa92-4a98-11f1-8bc3-00155d012902','b8c9d0e1-0021-0015-0001-000000000001',NULL,'NFPA-PM','Program Management','Establish the continuity, emergency, and crisis management program including policy, governance, resource management, and program coordination.',NULL,'mandatory','NFPA 1600 Elements',NULL,10,'2026-05-08 04:45:31'),('be9cafef-4a98-11f1-8bc3-00155d012902','b8c9d0e1-0021-0015-0001-000000000001',NULL,'nfpa-pv','Prevention','Implement measures to eliminate or reduce the likelihood of hazardous events, including regulatory compliance and risk reduction activities.',NULL,'mandatory','NFPA 1600 Elements',NULL,20,'2026-05-08 04:45:31'),('be9cb1b2-4a98-11f1-8bc3-00155d012902','b8c9d0e1-0021-0015-0001-000000000001',NULL,'NFPA-MI','Mitigation','Implement sustained actions to reduce long-term risk by modifying characteristics of hazards or reducing vulnerable elements to minimize losses.',NULL,'mandatory','NFPA 1600 Elements',NULL,30,'2026-05-08 04:45:31'),('be9cb34b-4a98-11f1-8bc3-00155d012902','b8c9d0e1-0021-0015-0001-000000000001',NULL,'NFPA-PR','Preparedness','Develop response plans, train personnel, conduct exercises, and establish resource management systems in advance of an incident.',NULL,'mandatory','NFPA 1600 Elements',NULL,40,'2026-05-08 04:45:31'),('be9cb592-4a98-11f1-8bc3-00155d012902','b8c9d0e1-0021-0015-0001-000000000001',NULL,'NFPA-RS','Response','Implement immediate actions following an incident to save lives, protect property, and stabilize the situation.',NULL,'mandatory','NFPA 1600 Elements',NULL,50,'2026-05-08 04:45:31'),('be9cb719-4a98-11f1-8bc3-00155d012902','b8c9d0e1-0021-0015-0001-000000000001',NULL,'NFPA-RC','Recovery','Implement short-term and long-term activities to restore essential functions, repair damage, and return operations to normal or improved state.',NULL,'mandatory','NFPA 1600 Elements',NULL,60,'2026-05-08 04:45:31'),('c16aad41-4a96-11f1-8bc3-00155d012902','a1b2c3d4-0014-0001-0001-000000000001',NULL,'RMF-P','Step 0: Prepare','Carry out essential activities at the organization and system levels to help prepare the organization to manage security and privacy risks using the RMF.',NULL,'mandatory','RMF Steps',NULL,10,'2026-05-08 04:31:17'),('c16ab325-4a96-11f1-8bc3-00155d012902','a1b2c3d4-0014-0001-0001-000000000001',NULL,'RMF-1','Step 1: Categorize','Categorize the system and the information processed, stored, and transmitted by the system based on an impact analysis.',NULL,'mandatory','RMF Steps',NULL,20,'2026-05-08 04:31:17'),('c16ab50c-4a96-11f1-8bc3-00155d012902','a1b2c3d4-0014-0001-0001-000000000001',NULL,'RMF-2','Step 2: Select','Select, tailor, and document the controls necessary to protect the system and the organization based on risk assessment.',NULL,'mandatory','RMF Steps',NULL,30,'2026-05-08 04:31:17'),('c16ab6d1-4a96-11f1-8bc3-00155d012902','a1b2c3d4-0014-0001-0001-000000000001',NULL,'RMF-3','Step 3: Implement','Implement the controls and document how the controls are deployed within the system and its environment of operation.',NULL,'mandatory','RMF Steps',NULL,40,'2026-05-08 04:31:17'),('c16ab8bd-4a96-11f1-8bc3-00155d012902','a1b2c3d4-0014-0001-0001-000000000001',NULL,'RMF-4','Step 4: Assess','Assess the controls to determine if they are implemented correctly, operating as intended, and producing the desired outcome.',NULL,'mandatory','RMF Steps',NULL,50,'2026-05-08 04:31:17'),('c16abb19-4a96-11f1-8bc3-00155d012902','a1b2c3d4-0014-0001-0001-000000000001',NULL,'RMF-5','Step 5: Authorize','Authorize the system or common controls based on a determination that the risk is acceptable; a senior official accepts responsibility.',NULL,'mandatory','RMF Steps',NULL,60,'2026-05-08 04:31:17'),('c16abd34-4a96-11f1-8bc3-00155d012902','a1b2c3d4-0014-0001-0001-000000000001',NULL,'RMF-6','Step 6: Monitor','Monitor the system and the associated controls on an ongoing basis to assess control effectiveness and changes in risk.',NULL,'mandatory','RMF Steps',NULL,70,'2026-05-08 04:31:17'),('c1716e47-4a96-11f1-8bc3-00155d012902','a1b2c3d4-0014-0002-0001-000000000001',NULL,'RA-P','Step 1: Prepare for Risk Assessment','Establish the context for the risk assessment including scope, assumptions, constraints, sources of threat and vulnerability information, and risk model.',NULL,'mandatory','Risk Assessment Steps',NULL,10,'2026-05-08 04:31:17'),('c1717302-4a96-11f1-8bc3-00155d012902','a1b2c3d4-0014-0002-0001-000000000001',NULL,'RA-C','Step 2: Conduct the Risk Assessment','Identify threat sources and events, identify vulnerabilities, determine likelihood, determine magnitude of impact, and determine risk.',NULL,'mandatory','Risk Assessment Steps',NULL,20,'2026-05-08 04:31:17'),('c17174d2-4a96-11f1-8bc3-00155d012902','a1b2c3d4-0014-0002-0001-000000000001',NULL,'RA-COM','Step 3: Communicate Risk Assessment Results','Communicate the risk assessment results and share risk-related information with key organizational stakeholders.',NULL,'mandatory','Risk Assessment Steps',NULL,30,'2026-05-08 04:31:17'),('c171766e-4a96-11f1-8bc3-00155d012902','a1b2c3d4-0014-0002-0001-000000000001',NULL,'RA-M','Step 4: Maintain the Risk Assessment','Maintain the risk assessment on an ongoing basis by monitoring risk factors and updating when significant changes occur.',NULL,'mandatory','Risk Assessment Steps',NULL,40,'2026-05-08 04:31:17'),('c17c36e8-4a96-11f1-8bc3-00155d012902','a1b2c3d4-0014-0003-0001-000000000001',NULL,'CP-1','Contingency Planning Policy and Procedures','Develop an organizational contingency planning policy and procedures that address purpose, scope, roles, responsibilities, management commitment, and compliance.',NULL,'mandatory','Contingency Planning',NULL,10,'2026-05-08 04:31:17'),('c17cd029-4a96-11f1-8bc3-00155d012902','a1b2c3d4-0014-0003-0001-000000000001',NULL,'CP-2','Business Impact Analysis (BIA)','Identify critical systems and functions, determine outage impacts and acceptable recovery time objectives (RTO) and recovery point objectives (RPO).',NULL,'mandatory','Contingency Planning',NULL,20,'2026-05-08 04:31:17'),('c17cd249-4a96-11f1-8bc3-00155d012902','a1b2c3d4-0014-0003-0001-000000000001',NULL,'CP-3','Preventive Controls','Implement preventive measures to reduce the effects of system disruptions and increase system availability.',NULL,'recommended','Contingency Planning',NULL,30,'2026-05-08 04:31:17'),('c17cd3db-4a96-11f1-8bc3-00155d012902','a1b2c3d4-0014-0003-0001-000000000001',NULL,'CP-4','Recovery Strategies','Develop recovery strategies aligned with system criticality and the BIA, addressing backup sites, telecommunications, and equipment replacement.',NULL,'mandatory','Contingency Planning',NULL,40,'2026-05-08 04:31:17'),('c17cd743-4a96-11f1-8bc3-00155d012902','a1b2c3d4-0014-0003-0001-000000000001',NULL,'CP-5','Contingency Plan Development','Develop a formal, written contingency plan identifying essential functions, resources, interoperability requirements, and detailed recovery procedures.',NULL,'mandatory','Contingency Planning',NULL,50,'2026-05-08 04:31:17'),('c17cd8b5-4a96-11f1-8bc3-00155d012902','a1b2c3d4-0014-0003-0001-000000000001',NULL,'CP-6','Plan Testing and Exercises','Test the contingency plan to evaluate the plan\'s effectiveness and the organization\'s readiness to execute it; update based on results.',NULL,'mandatory','Contingency Planning',NULL,60,'2026-05-08 04:31:17'),('c17cda29-4a96-11f1-8bc3-00155d012902','a1b2c3d4-0014-0003-0001-000000000001',NULL,'CP-7','Plan Maintenance','Update the contingency plan to address changes to the organization, information system, or environment, and problems encountered during testing or plan activation.',NULL,'mandatory','Contingency Planning',NULL,70,'2026-05-08 04:31:17'),('c1836c94-4a96-11f1-8bc3-00155d012902','a1b2c3d4-0014-0004-0001-000000000001',NULL,'IR-1','Phase 1: Preparation','Establish an incident response capability including policy, plan, procedures, team structure, communication guidelines, and necessary tools and resources.',NULL,'mandatory','IR Phases',NULL,10,'2026-05-08 04:31:17'),('c1837267-4a96-11f1-8bc3-00155d012902','a1b2c3d4-0014-0004-0001-000000000001',NULL,'IR-2','Phase 2: Detection and Analysis','Detect, alert, and report on potential incidents; analyze precursors and indicators; prioritize incident handling based on impact.',NULL,'mandatory','IR Phases',NULL,20,'2026-05-08 04:31:17'),('c18373fb-4a96-11f1-8bc3-00155d012902','a1b2c3d4-0014-0004-0001-000000000001',NULL,'IR-3','Phase 3: Containment, Eradication, and Recovery','Contain the incident to prevent further damage, eradicate the root cause, and recover affected systems to normal operation.',NULL,'mandatory','IR Phases',NULL,30,'2026-05-08 04:31:17'),('c1837586-4a96-11f1-8bc3-00155d012902','a1b2c3d4-0014-0004-0001-000000000001',NULL,'IR-4','Phase 4: Post-Incident Activity','Conduct lessons-learned meetings, produce incident reports, retain evidence, update policies and procedures, and track recommendations for improvement.',NULL,'mandatory','IR Phases',NULL,40,'2026-05-08 04:31:17'),('c18aae54-4a96-11f1-8bc3-00155d012902','a1b2c3d4-0014-0005-0001-000000000001',NULL,'800-63A','Volume A: Enrollment and Identity Proofing','Defines requirements for identity proofing at three assurance levels (IAL1, IAL2, IAL3), covering remote and in-person proofing, document verification, and biometric collection.',NULL,'mandatory','Identity Volumes',NULL,10,'2026-05-08 04:31:17'),('c18ab3e1-4a96-11f1-8bc3-00155d012902','a1b2c3d4-0014-0005-0001-000000000001',NULL,'800-63B','Volume B: Authentication and Lifecycle Management','Defines requirements for authenticators and authentication protocols at three assurance levels (AAL1, AAL2, AAL3), covering passwords, OTPs, cryptographic devices, and biometrics.',NULL,'mandatory','Identity Volumes',NULL,20,'2026-05-08 04:31:17'),('c18ab57e-4a96-11f1-8bc3-00155d012902','a1b2c3d4-0014-0005-0001-000000000001',NULL,'800-63C','Volume C: Federation and Assertions','Defines requirements for federation protocols and assertions at three assurance levels (FAL1, FAL2, FAL3), covering identity provider, relying party, and assertion binding requirements.',NULL,'mandatory','Identity Volumes',NULL,30,'2026-05-08 04:31:17'),('c191eafc-4a96-11f1-8bc3-00155d012902','a1b2c3d4-0014-0006-0001-000000000001',NULL,'ST-PL','Planning','Define the scope, objectives, rules of engagement, team roles, and schedule for the security assessment; obtain approvals and coordinate logistics.',NULL,'mandatory','Testing Phases',NULL,10,'2026-05-08 04:31:17'),('c191ef76-4a96-11f1-8bc3-00155d012902','a1b2c3d4-0014-0006-0001-000000000001',NULL,'ST-DI','Discovery','Gather information about the target environment through network scanning, enumeration, vulnerability scanning, and wireless testing without active exploitation.',NULL,'mandatory','Testing Phases',NULL,20,'2026-05-08 04:31:17'),('c191f105-4a96-11f1-8bc3-00155d012902','a1b2c3d4-0014-0006-0001-000000000001',NULL,'ST-AT','Attack Phase','Attempt to exploit discovered vulnerabilities to demonstrate exploitability and evaluate the actual risk, including password cracking, penetration testing, and social engineering.',NULL,'recommended','Testing Phases',NULL,30,'2026-05-08 04:31:17'),('c191f274-4a96-11f1-8bc3-00155d012902','a1b2c3d4-0014-0006-0001-000000000001',NULL,'ST-RP','Reporting','Document findings in a security assessment report covering methodology, results, risk ratings, and prioritized recommendations for remediation.',NULL,'mandatory','Testing Phases',NULL,40,'2026-05-08 04:31:17'),('c19a1b88-4a96-11f1-8bc3-00155d012902','a1b2c3d4-0014-0007-0001-000000000001',NULL,'ISCM-1','Define','Define an ISCM strategy that addresses risk tolerance, metrics, frequency of monitoring, and the types of information required by organizational officials.',NULL,'mandatory','ISCM Steps',NULL,10,'2026-05-08 04:31:17'),('c19a2065-4a96-11f1-8bc3-00155d012902','a1b2c3d4-0014-0007-0001-000000000001',NULL,'ISCM-2','Establish','Establish an ISCM program determining metrics, monitoring and assessment frequencies, and the ISCM technical architecture.',NULL,'mandatory','ISCM Steps',NULL,20,'2026-05-08 04:31:17'),('c19a21fd-4a96-11f1-8bc3-00155d012902','a1b2c3d4-0014-0007-0001-000000000001',NULL,'ISCM-3','Implement','Implement the ISCM program by collecting security-related information required for ongoing authorizations and reporting.',NULL,'mandatory','ISCM Steps',NULL,30,'2026-05-08 04:31:17'),('c19bb510-4a96-11f1-8bc3-00155d012902','a1b2c3d4-0014-0007-0001-000000000001',NULL,'ISCM-4','Analyze and Report','Analyze the monitoring data and report findings to enable timely risk management decisions by authorizing officials and other stakeholders.',NULL,'mandatory','ISCM Steps',NULL,40,'2026-05-08 04:31:17'),('c19bb784-4a96-11f1-8bc3-00155d012902','a1b2c3d4-0014-0007-0001-000000000001',NULL,'ISCM-5','Respond','Respond to findings with technically sound and fiscally responsible corrective actions, updating security plans and risk assessments as needed.',NULL,'mandatory','ISCM Steps',NULL,50,'2026-05-08 04:31:17'),('c19bb901-4a96-11f1-8bc3-00155d012902','a1b2c3d4-0014-0007-0001-000000000001',NULL,'ISCM-6','Review and Update','Review the ISCM strategy and program annually and update based on changes in risk tolerance, threats, vulnerabilities, mission, or organizational priorities.',NULL,'mandatory','ISCM Steps',NULL,60,'2026-05-08 04:31:17'),('c1adda42-4a96-11f1-8bc3-00155d012902','a1b2c3d4-0014-0008-0001-000000000001',NULL,'3.1','Access Control','Employ enhanced access control mechanisms including attribute-based access control and dynamic access decisions to protect CUI against APT.',NULL,'mandatory','Security Domains',NULL,10,'2026-05-08 04:31:18'),('c1ade0ed-4a96-11f1-8bc3-00155d012902','a1b2c3d4-0014-0008-0001-000000000001',NULL,'3.2','Awareness and Training','Provide advanced security awareness training and role-based training covering insider threat indicators and APT tactics, techniques, and procedures.',NULL,'mandatory','Security Domains',NULL,20,'2026-05-08 04:31:18'),('c1ade28d-4a96-11f1-8bc3-00155d012902','a1b2c3d4-0014-0008-0001-000000000001',NULL,'3.3','Audit and Accountability','Implement enhanced audit logging and correlation capabilities to detect, analyze, and respond to anomalous activity indicative of advanced threats.',NULL,'mandatory','Security Domains',NULL,30,'2026-05-08 04:31:18'),('c1ade3ff-4a96-11f1-8bc3-00155d012902','a1b2c3d4-0014-0008-0001-000000000001',NULL,'3.4','Configuration Management','Employ advanced configuration management practices including CIS benchmarks, automated configuration checking, and configuration drift detection.',NULL,'mandatory','Security Domains',NULL,40,'2026-05-08 04:31:18'),('c1ade562-4a96-11f1-8bc3-00155d012902','a1b2c3d4-0014-0008-0001-000000000001',NULL,'3.5','Identification and Authentication','Implement strong authentication mechanisms including hardware-based multi-factor authentication and privileged access workstations for CUI systems.',NULL,'mandatory','Security Domains',NULL,50,'2026-05-08 04:31:18'),('c1ade6c3-4a96-11f1-8bc3-00155d012902','a1b2c3d4-0014-0008-0001-000000000001',NULL,'3.6','Incident Response','Develop advanced incident response capabilities to detect, respond to, and recover from security incidents involving CUI, including APT-specific playbooks.',NULL,'mandatory','Security Domains',NULL,60,'2026-05-08 04:31:18'),('c1ade822-4a96-11f1-8bc3-00155d012902','a1b2c3d4-0014-0008-0001-000000000001',NULL,'3.7','Maintenance','Sanitize equipment before maintenance and verify the integrity of tools and personnel before allowing maintenance activities on CUI systems.',NULL,'mandatory','Security Domains',NULL,70,'2026-05-08 04:31:18'),('c1ade97b-4a96-11f1-8bc3-00155d012902','a1b2c3d4-0014-0008-0001-000000000001',NULL,'3.8','Media Protection','Implement enhanced media protection controls including controlled interfaces, media sanitization, and encryption for all CUI stored on removable media.',NULL,'mandatory','Security Domains',NULL,80,'2026-05-08 04:31:18'),('c1adeacf-4a96-11f1-8bc3-00155d012902','a1b2c3d4-0014-0008-0001-000000000001',NULL,'3.9','Personnel Security','Screen individuals prior to authorizing access to CUI and enforce separation of duties to reduce risk of unauthorized access or insider threat.',NULL,'mandatory','Security Domains',NULL,90,'2026-05-08 04:31:18'),('c1adec21-4a96-11f1-8bc3-00155d012902','a1b2c3d4-0014-0008-0001-000000000001',NULL,'3.10','Physical Protection','Protect CUI systems with advanced physical security controls including access monitoring, visitor control, and protection of physical assets.',NULL,'mandatory','Security Domains',NULL,100,'2026-05-08 04:31:18'),('c1aded78-4a96-11f1-8bc3-00155d012902','a1b2c3d4-0014-0008-0001-000000000001',NULL,'3.11','Risk Assessment','Conduct comprehensive risk assessments with threat modeling specific to APT targeting of CUI and update continuously based on intelligence.',NULL,'mandatory','Security Domains',NULL,110,'2026-05-08 04:31:18'),('c1adeec5-4a96-11f1-8bc3-00155d012902','a1b2c3d4-0014-0008-0001-000000000001',NULL,'3.12','Security Assessment','Conduct periodic security assessments and penetration testing to evaluate effectiveness of enhanced security requirements for CUI protection.',NULL,'mandatory','Security Domains',NULL,120,'2026-05-08 04:31:18'),('c1adf02b-4a96-11f1-8bc3-00155d012902','a1b2c3d4-0014-0008-0001-000000000001',NULL,'3.13','System and Communications Protection','Architect systems to achieve visibility and include isolation boundaries to provide protection against advanced threats targeting CUI.',NULL,'mandatory','Security Domains',NULL,130,'2026-05-08 04:31:18'),('c1adf181-4a96-11f1-8bc3-00155d012902','a1b2c3d4-0014-0008-0001-000000000001',NULL,'3.14','System and Information Integrity','Employ advanced threat intelligence, intrusion detection, and security information and event management capabilities to detect and respond to APT.',NULL,'mandatory','Security Domains',NULL,140,'2026-05-08 04:31:18'),('c1adf2d9-4a96-11f1-8bc3-00155d012902','a1b2c3d4-0014-0008-0001-000000000001',NULL,'3.15','Supply Chain Risk Management','Protect against supply chain risks from adversarial insertion of counterfeits, malicious software, or backdoors into CUI-related systems and components.',NULL,'mandatory','Security Domains',NULL,150,'2026-05-08 04:31:18'),('c1b7d34b-4a96-11f1-8bc3-00155d012902','a1b2c3d4-0014-0009-0001-000000000001',NULL,'ID-P','Identify-P','Develop organizational understanding to manage privacy risks for individuals arising from data processing, including inventory of data processing activities and risk assessment.',NULL,'mandatory','Privacy Framework Functions',NULL,10,'2026-05-08 04:31:18'),('c1b7d850-4a96-11f1-8bc3-00155d012902','a1b2c3d4-0014-0009-0001-000000000001',NULL,'GV-P','Govern-P','Develop and implement organizational governance structures, policies, processes, and procedures to manage privacy risks and meet legal, regulatory, and contractual obligations.',NULL,'mandatory','Privacy Framework Functions',NULL,20,'2026-05-08 04:31:18'),('c1b7d9ea-4a96-11f1-8bc3-00155d012902','a1b2c3d4-0014-0009-0001-000000000001',NULL,'CT-P','Control-P','Develop and implement appropriate activities to enable organizations and individuals to manage data with sufficient granularity to manage privacy risks.',NULL,'mandatory','Privacy Framework Functions',NULL,30,'2026-05-08 04:31:18'),('c1b7db7d-4a96-11f1-8bc3-00155d012902','a1b2c3d4-0014-0009-0001-000000000001',NULL,'CM-P','Communicate-P','Develop and implement appropriate activities to enable organizations and individuals to have a reliable understanding and engage in discourse about how data is processed.',NULL,'recommended','Privacy Framework Functions',NULL,40,'2026-05-08 04:31:18'),('c1b7dd02-4a96-11f1-8bc3-00155d012902','a1b2c3d4-0014-0009-0001-000000000001',NULL,'PR-P','Protect-P','Develop and implement safeguards for data processing to prevent cybersecurity-related privacy events that affect individuals\' privacy interests.',NULL,'mandatory','Privacy Framework Functions',NULL,50,'2026-05-08 04:31:18'),('c1be858f-4a96-11f1-8bc3-00155d012902','a1b2c3d4-0014-0010-0001-000000000001',NULL,'PO','Prepare the Organization (PO)','Ensure the organization has the people, processes, and technology ready to perform secure software development at the organization level.',NULL,'mandatory','SSDF Practice Groups',NULL,10,'2026-05-08 04:31:18'),('c1be8ae4-4a96-11f1-8bc3-00155d012902','a1b2c3d4-0014-0010-0001-000000000001',NULL,'PS','Protect the Software (PS)','Protect all components of the software from tampering and unauthorized access throughout the software development lifecycle.',NULL,'mandatory','SSDF Practice Groups',NULL,20,'2026-05-08 04:31:18'),('c1be8cc6-4a96-11f1-8bc3-00155d012902','a1b2c3d4-0014-0010-0001-000000000001',NULL,'PW','Produce Well-Secured Software (PW)','Produce well-secured software with minimal security vulnerabilities in its release by applying security practices at each stage of development.',NULL,'mandatory','SSDF Practice Groups',NULL,30,'2026-05-08 04:31:18'),('c1be8e68-4a96-11f1-8bc3-00155d012902','a1b2c3d4-0014-0010-0001-000000000001',NULL,'RV','Respond to Vulnerabilities (RV)','Identify residual vulnerabilities in software releases and respond appropriately to address those vulnerabilities, including coordinated disclosure.',NULL,'mandatory','SSDF Practice Groups',NULL,40,'2026-05-08 04:31:18'),('c2a5b034-0d93-4eee-b5c5-8cc70dc2641f','a2a4e62d-4113-11f1-8bc3-00155d012902','84ccacc2-a87b-4929-8f10-ef85d16f3a34','CC1.2','COSO Principle 2: Exercises Oversight Responsibility','The board of directors demonstrates independence from management and exercises oversight.',NULL,'mandatory',NULL,NULL,1,'2026-04-26 02:00:01'),('c3117c09-58a5-4e48-af41-6e0201ba79ba','a27eef01-4113-11f1-8bc3-00155d012902','5e916319-60b9-433a-a62a-797dab76c0cf','PR.AT','Awareness and Training','The organization\'s personnel are provided with cybersecurity awareness and training.',NULL,'mandatory',NULL,NULL,1,'2026-04-26 02:00:01'),('c3e1fe9d-9bbc-4d3c-973e-82b4b38c3900','d4e5f6a1-b2c3-4d4e-8f6a-1b2c3d4e5f6a',NULL,'164.310','Physical Safeguards',NULL,NULL,'mandatory','Security Rule - Physical',NULL,1,'2026-04-26 02:00:00'),('c52ee91d-001e-4890-9df9-7854c54efb06','a23897c7-4113-11f1-8bc3-00155d012902','6a0bbbc3-fbc7-44d5-b3b0-ca8a0deb2ab2','SYSC.6.2','Internal audit function','Establish and maintain an internal audit function which is separate and independent.',NULL,'mandatory',NULL,NULL,1,'2026-04-26 02:00:00'),('c7dcf091-0eb7-4be6-aac9-8c7bc63605e0','a25c0c03-4113-11f1-8bc3-00155d012902','b5d335e2-66ea-4a33-b65f-e52f9b7ce7d6','7.5','Documented information','Maintain documented information required by the standard.',NULL,'mandatory',NULL,NULL,4,'2026-04-26 02:00:01'),('c83f6ecd-75c6-4231-8706-e4588debacb5','a2a4e62d-4113-11f1-8bc3-00155d012902','dd797d48-8b9e-4e29-b966-37875790779f','C1.1','Confidential information identification','The entity identifies and maintains confidential information to meet the entity\'s objectives.',NULL,'recommended',NULL,NULL,0,'2026-04-26 02:00:01'),('cc43e4cb-4a96-11f1-8bc3-00155d012902','b2c3d4e5-0015-0001-0001-000000000001',NULL,'Clause 5','Organizational Controls (Clause 5)','37 controls addressing governance, policies, roles, responsibilities, threat intelligence, information security in projects, and supplier relationships.',NULL,'mandatory','Control Themes',NULL,10,'2026-05-08 04:31:35'),('cc43eae4-4a96-11f1-8bc3-00155d012902','b2c3d4e5-0015-0001-0001-000000000001',NULL,'Clause 6','People Controls (Clause 6)','8 controls covering screening, terms of employment, awareness and training, disciplinary process, remote working, and information security event reporting.',NULL,'mandatory','Control Themes',NULL,20,'2026-05-08 04:31:35'),('cc43ece9-4a96-11f1-8bc3-00155d012902','b2c3d4e5-0015-0001-0001-000000000001',NULL,'Clause 7','Physical Controls (Clause 7)','14 controls addressing physical security perimeters, entry controls, securing offices and facilities, clear desk/screen policies, and equipment maintenance.',NULL,'mandatory','Control Themes',NULL,30,'2026-05-08 04:31:35'),('cc43eed4-4a96-11f1-8bc3-00155d012902','b2c3d4e5-0015-0001-0001-000000000001',NULL,'Clause 8','Technological Controls (Clause 8)','34 controls covering user endpoint devices, privileged access, access control, cryptography, secure development, vulnerability management, and network filtering.',NULL,'mandatory','Control Themes',NULL,40,'2026-05-08 04:31:35'),('cc4e9901-4a96-11f1-8bc3-00155d012902','b2c3d4e5-0015-0002-0001-000000000001',NULL,'27005-4','Context Establishment','Define the scope of risk management activities, establish organizational context, and define risk criteria including risk acceptance and evaluation criteria.',NULL,'mandatory','Risk Management Process',NULL,10,'2026-05-08 04:31:35'),('cc4e9e38-4a96-11f1-8bc3-00155d012902','b2c3d4e5-0015-0002-0001-000000000001',NULL,'27005-5','Risk Assessment','Perform comprehensive risk assessment including risk identification, risk analysis (likelihood and consequence), and risk evaluation against defined criteria.',NULL,'mandatory','Risk Management Process',NULL,20,'2026-05-08 04:31:35'),('cc4ea00d-4a96-11f1-8bc3-00155d012902','b2c3d4e5-0015-0002-0001-000000000001',NULL,'27005-6','Risk Treatment','Select and implement appropriate risk treatment options (modify, retain, avoid, or share) and prepare a risk treatment plan with residual risk determination.',NULL,'mandatory','Risk Management Process',NULL,30,'2026-05-08 04:31:35'),('cc4ea1b8-4a96-11f1-8bc3-00155d012902','b2c3d4e5-0015-0002-0001-000000000001',NULL,'27005-7','Risk Acceptance','Formally accept residual risks that cannot be further reduced or that fall within acceptable thresholds, with documented authorization from risk owners.',NULL,'mandatory','Risk Management Process',NULL,40,'2026-05-08 04:31:35'),('cc4ea34b-4a96-11f1-8bc3-00155d012902','b2c3d4e5-0015-0002-0001-000000000001',NULL,'27005-8','Risk Communication and Consultation','Communicate risk information to internal and external stakeholders and consult with them to support decision-making throughout the risk management process.',NULL,'mandatory','Risk Management Process',NULL,50,'2026-05-08 04:31:35'),('cc4ea4dc-4a96-11f1-8bc3-00155d012902','b2c3d4e5-0015-0002-0001-000000000001',NULL,'27005-9','Risk Monitoring and Review','Monitor and review risks, controls, and the risk management process on an ongoing basis to detect changes in context that may impact risk decisions.',NULL,'mandatory','Risk Management Process',NULL,60,'2026-05-08 04:31:35'),('cc57c8dd-4a96-11f1-8bc3-00155d012902','b2c3d4e5-0015-0003-0001-000000000001',NULL,'27031-P','Policy and Management','Establish ICT readiness for business continuity policy, assign management responsibility, and integrate ICT readiness into the overall business continuity management system.',NULL,'mandatory','ICT Readiness',NULL,10,'2026-05-08 04:31:35'),('cc57cdde-4a96-11f1-8bc3-00155d012902','b2c3d4e5-0015-0003-0001-000000000001',NULL,'27031-PL','Planning for IRBC','Conduct business impact analysis for ICT, perform risk assessments, define recovery time and recovery point objectives, and plan ICT redundancy and recovery strategies.',NULL,'mandatory','ICT Readiness',NULL,20,'2026-05-08 04:31:35'),('cc57cfa4-4a96-11f1-8bc3-00155d012902','b2c3d4e5-0015-0003-0001-000000000001',NULL,'27031-IM','Implementation','Implement ICT continuity solutions including redundant infrastructure, data replication, backup systems, and documented recovery procedures.',NULL,'mandatory','ICT Readiness',NULL,30,'2026-05-08 04:31:35'),('cc57d157-4a96-11f1-8bc3-00155d012902','b2c3d4e5-0015-0003-0001-000000000001',NULL,'27031-CH','Checking (Testing and Exercises)','Test and exercise ICT continuity capabilities including failover tests, recovery drills, and tabletop exercises; monitor ICT readiness indicators.',NULL,'mandatory','ICT Readiness',NULL,40,'2026-05-08 04:31:35'),('cc57d2f1-4a96-11f1-8bc3-00155d012902','b2c3d4e5-0015-0003-0001-000000000001',NULL,'27031-IM2','Improving','Review and improve ICT readiness capabilities based on test results, lessons learned, and changes to the business environment or technology.',NULL,'mandatory','ICT Readiness',NULL,50,'2026-05-08 04:31:35'),('cc57d486-4a96-11f1-8bc3-00155d012902','b2c3d4e5-0015-0003-0001-000000000001',NULL,'27031-ICT','ICT Readiness for Business Continuity (IRBC)','Maintain ICT services and infrastructure at levels consistent with business continuity requirements, covering people, facilities, technology, data, processes, and suppliers.',NULL,'mandatory','ICT Readiness',NULL,60,'2026-05-08 04:31:35'),('cc5d2748-1268-437e-948e-8749904982ef','a29cdc11-4113-11f1-8bc3-00155d012902',NULL,'S6','General Principles for Personal Data Processing','Personal data shall be collected, used, or disclosed under lawful basis and with consideration to purpose limitation, data minimization, accuracy and security.',NULL,'mandatory','Principles',NULL,0,'2026-04-26 02:00:01'),('cc60f3c2-4a96-11f1-8bc3-00155d012902','b2c3d4e5-0015-0004-0001-000000000001',NULL,'27032-GV','Cybersecurity Governance','Establish governance structures, policies, roles, and responsibilities for managing cybersecurity in the Internet ecosystem.',NULL,'mandatory','Cybersecurity Sections',NULL,10,'2026-05-08 04:31:35'),('cc60f954-4a96-11f1-8bc3-00155d012902','b2c3d4e5-0015-0004-0001-000000000001',NULL,'27032-RM','Cybersecurity Risk Management','Identify and assess cybersecurity risks from Internet-based threats and implement risk treatments appropriate to the organizational context.',NULL,'mandatory','Cybersecurity Sections',NULL,20,'2026-05-08 04:31:35'),('cc60fb54-4a96-11f1-8bc3-00155d012902','b2c3d4e5-0015-0004-0001-000000000001',NULL,'27032-IS','Information Sharing','Participate in cybersecurity information sharing with peers, CERTs, and government agencies to improve collective defense and threat awareness.',NULL,'recommended','Cybersecurity Sections',NULL,30,'2026-05-08 04:31:35'),('cc60fd22-4a96-11f1-8bc3-00155d012902','b2c3d4e5-0015-0004-0001-000000000001',NULL,'27032-SM','Stakeholder Management','Coordinate cybersecurity responsibilities and activities across the ecosystem of consumers, organizations, providers, and governments.',NULL,'recommended','Cybersecurity Sections',NULL,40,'2026-05-08 04:31:35'),('cc60fee4-4a96-11f1-8bc3-00155d012902','b2c3d4e5-0015-0004-0001-000000000001',NULL,'27032-IR','Incident Response','Prepare for and respond to cybersecurity incidents affecting Internet-connected services, coordinating with relevant stakeholders.',NULL,'mandatory','Cybersecurity Sections',NULL,50,'2026-05-08 04:31:35'),('cc6100a6-4a96-11f1-8bc3-00155d012902','b2c3d4e5-0015-0004-0001-000000000001',NULL,'27032-AS','Application Security','Apply security controls to web applications and services to protect against common Internet-based attacks.',NULL,'mandatory','Cybersecurity Sections',NULL,60,'2026-05-08 04:31:35'),('cc690407-4a96-11f1-8bc3-00155d012902','b2c3d4e5-0015-0005-0001-000000000001',NULL,'27035-PP','Planning and Preparation','Establish an incident management policy, create an incident response plan, form an incident response team, and provide awareness and training.',NULL,'mandatory','Incident Management',NULL,10,'2026-05-08 04:31:36'),('cc6909b0-4a96-11f1-8bc3-00155d012902','b2c3d4e5-0015-0005-0001-000000000001',NULL,'27035-DR','Detection and Reporting','Detect and report information security events using monitoring tools, alert mechanisms, and structured reporting channels.',NULL,'mandatory','Incident Management',NULL,20,'2026-05-08 04:31:36'),('cc690b96-4a96-11f1-8bc3-00155d012902','b2c3d4e5-0015-0005-0001-000000000001',NULL,'27035-AD','Assessment and Decision','Assess reported events to determine whether they constitute incidents, classify severity, and decide on the appropriate response actions.',NULL,'mandatory','Incident Management',NULL,30,'2026-05-08 04:31:36'),('cc690e8c-4a96-11f1-8bc3-00155d012902','b2c3d4e5-0015-0005-0001-000000000001',NULL,'27035-RP','Response','Execute incident response activities including evidence collection, containment, eradication, recovery, and communication to stakeholders.',NULL,'mandatory','Incident Management',NULL,40,'2026-05-08 04:31:36'),('cc69104a-4a96-11f1-8bc3-00155d012902','b2c3d4e5-0015-0005-0001-000000000001',NULL,'27035-LL','Lessons Learned','Conduct post-incident reviews to identify root causes, improve controls, and update the incident management plan based on findings.',NULL,'mandatory','Incident Management',NULL,50,'2026-05-08 04:31:36'),('cc70ab2a-4a96-11f1-8bc3-00155d012902','b2c3d4e5-0015-0006-0001-000000000001',NULL,'27036-1','Part 1: Overview and Concepts','Provides an overview of information security in supplier relationships, defining key concepts and risk factors in acquiring products and services from external parties.',NULL,'mandatory','Supplier Relationships',NULL,10,'2026-05-08 04:31:36'),('cc70b06f-4a96-11f1-8bc3-00155d012902','b2c3d4e5-0015-0006-0001-000000000001',NULL,'27036-2','Part 2: Requirements','Specifies fundamental information security requirements applicable to both acquirers and suppliers to address information security risks in supply chain relationships.',NULL,'mandatory','Supplier Relationships',NULL,20,'2026-05-08 04:31:36'),('cc70b2d5-4a96-11f1-8bc3-00155d012902','b2c3d4e5-0015-0006-0001-000000000001',NULL,'27036-3','Part 3: ICT Supply Chain Security','Provides guidelines for the security of ICT products and services throughout the supply chain, covering risk assessment, supplier selection, and ongoing monitoring.',NULL,'mandatory','Supplier Relationships',NULL,30,'2026-05-08 04:31:36'),('cc70f35b-4a96-11f1-8bc3-00155d012902','b2c3d4e5-0015-0006-0001-000000000001',NULL,'27036-4','Part 4: Cloud Service Security','Provides guidelines for cloud service customers to assess security risks of cloud services and establish appropriate security controls in cloud provider agreements.',NULL,'mandatory','Supplier Relationships',NULL,40,'2026-05-08 04:31:36'),('cc7eb088-4a96-11f1-8bc3-00155d012902','b2c3d4e5-0015-0007-0001-000000000001',NULL,'PP','Protection Profile (PP)','An implementation-independent statement of security requirements for a category of TOEs that meet specific consumer needs.',NULL,'mandatory','CC Documents',NULL,10,'2026-05-08 04:31:36'),('cc7eb6f0-4a96-11f1-8bc3-00155d012902','b2c3d4e5-0015-0007-0001-000000000001',NULL,'ST','Security Target (ST)','A set of security requirements and specifications to be used as the basis for evaluation of an identified TOE, including both functional and assurance requirements.',NULL,'mandatory','CC Documents',NULL,20,'2026-05-08 04:31:36'),('cc7eb9cf-4a96-11f1-8bc3-00155d012902','b2c3d4e5-0015-0007-0001-000000000001',NULL,'TOE','TOE Summary Specification','A description of how the TOE meets each SFR, describing the security mechanisms implemented and how they satisfy the stated security objectives.',NULL,'mandatory','CC Documents',NULL,30,'2026-05-08 04:31:36'),('cc7ebeeb-4a96-11f1-8bc3-00155d012902','b2c3d4e5-0015-0007-0001-000000000001',NULL,'EAL1','EAL1 — Functionally Tested','The TOE is informally tested; provides basic confidence that the TOE operates as claimed without developer involvement beyond documentation.',NULL,'optional','Assurance Levels',NULL,40,'2026-05-08 04:31:36'),('cc7ec14d-4a96-11f1-8bc3-00155d012902','b2c3d4e5-0015-0007-0001-000000000001',NULL,'EAL2','EAL2 — Structurally Tested','Requires design information and testing; suitable when developers or users require low to moderate assurance with limited access to developer source.',NULL,'optional','Assurance Levels',NULL,50,'2026-05-08 04:31:36'),('cc7ec3c9-4a96-11f1-8bc3-00155d012902','b2c3d4e5-0015-0007-0001-000000000001',NULL,'EAL3','EAL3 — Methodically Tested and Checked','Requires rigorous development and test documentation; suitable when developers require security engineering at design stage without major development restructuring.',NULL,'optional','Assurance Levels',NULL,60,'2026-05-08 04:31:36'),('cc7ec63c-4a96-11f1-8bc3-00155d012902','b2c3d4e5-0015-0007-0001-000000000001',NULL,'EAL4','EAL4 — Methodically Designed, Tested and Reviewed','The highest level economically feasible for existing products; involves rigorous commercial development practices and independent vulnerability analysis.',NULL,'optional','Assurance Levels',NULL,70,'2026-05-08 04:31:36'),('cc7ec8c9-4a96-11f1-8bc3-00155d012902','b2c3d4e5-0015-0007-0001-000000000001',NULL,'EAL5','EAL5 — Semiformally Designed and Tested','Requires specialist security engineering techniques; developers plan for EAL5 from the start; suitable for moderately high assurance needs.',NULL,'optional','Assurance Levels',NULL,80,'2026-05-08 04:31:36'),('cc7ecb2a-4a96-11f1-8bc3-00155d012902','b2c3d4e5-0015-0007-0001-000000000001',NULL,'EAL6','EAL6 — Semiformally Verified Design and Tested','Requires security engineering techniques for high-risk environments; significant development cost and time investment with formal model and analysis.',NULL,'optional','Assurance Levels',NULL,90,'2026-05-08 04:31:36'),('cc7ecd5d-4a96-11f1-8bc3-00155d012902','b2c3d4e5-0015-0007-0001-000000000001',NULL,'EAL7','EAL7 — Formally Verified Design and Tested','The highest CC assurance level; requires comprehensive formal analysis; applicable only to highest-risk situations such as military or government critical systems.',NULL,'optional','Assurance Levels',NULL,100,'2026-05-08 04:31:36'),('cc893605-4a96-11f1-8bc3-00155d012902','b2c3d4e5-0015-0008-0001-000000000001',NULL,'31000-5','Scope, Context and Criteria','Define the scope of risk management, establish external and internal context, and define risk criteria for evaluating risk significance.',NULL,'mandatory','Risk Management Process',NULL,10,'2026-05-08 04:31:36'),('cc893c1d-4a96-11f1-8bc3-00155d012902','b2c3d4e5-0015-0008-0001-000000000001',NULL,'31000-6.1','Risk Identification','Identify and describe risks by finding, recognizing, and describing risks that might help or prevent the organization achieving its objectives.',NULL,'mandatory','Risk Management Process',NULL,20,'2026-05-08 04:31:36'),('cc893eb1-4a96-11f1-8bc3-00155d012902','b2c3d4e5-0015-0008-0001-000000000001',NULL,'31000-6.2','Risk Analysis','Comprehend the nature, sources, and characteristics of risk including the level of risk, considering uncertainty, consequences, and likelihood.',NULL,'mandatory','Risk Management Process',NULL,30,'2026-05-08 04:31:36'),('cc897da3-4a96-11f1-8bc3-00155d012902','b2c3d4e5-0015-0008-0001-000000000001',NULL,'31000-6.3','Risk Evaluation','Compare risk analysis results with risk criteria to determine whether risk requires treatment and to support treatment prioritization decisions.',NULL,'mandatory','Risk Management Process',NULL,40,'2026-05-08 04:31:36'),('cc898040-4a96-11f1-8bc3-00155d012902','b2c3d4e5-0015-0008-0001-000000000001',NULL,'31000-7','Risk Treatment','Select and implement risk treatment options to modify risk, including avoiding, reducing, sharing, or retaining risk, with a documented risk treatment plan.',NULL,'mandatory','Risk Management Process',NULL,50,'2026-05-08 04:31:36'),('cc8982ac-4a96-11f1-8bc3-00155d012902','b2c3d4e5-0015-0008-0001-000000000001',NULL,'31000-8','Monitoring and Review','Monitor risks, treatments, and the effectiveness of the risk management process on an ongoing basis; adapt to changes in context.',NULL,'mandatory','Risk Management Process',NULL,60,'2026-05-08 04:31:36'),('cc898527-4a96-11f1-8bc3-00155d012902','b2c3d4e5-0015-0008-0001-000000000001',NULL,'31000-9','Recording and Reporting','Record and report risk management activities and outcomes to support decision-making, accountability, and communication with stakeholders.',NULL,'mandatory','Risk Management Process',NULL,70,'2026-05-08 04:31:36'),('cc91cd98-4a96-11f1-8bc3-00155d012902','b2c3d4e5-0015-0009-0001-000000000001',NULL,'22313-4','Context of the Organization','Understand the organization and its context, stakeholder needs, and define the scope of the business continuity management system.',NULL,'mandatory','BCMS Clauses',NULL,10,'2026-05-08 04:31:36'),('cc91d2ba-4a96-11f1-8bc3-00155d012902','b2c3d4e5-0015-0009-0001-000000000001',NULL,'22313-5','Leadership','Demonstrate top management commitment to BCMS, establish a BC policy, assign roles and responsibilities, and ensure resources are provided.',NULL,'mandatory','BCMS Clauses',NULL,20,'2026-05-08 04:31:36'),('cc91d487-4a96-11f1-8bc3-00155d012902','b2c3d4e5-0015-0009-0001-000000000001',NULL,'22313-6','Planning','Address risks and opportunities, set business continuity objectives, and plan actions to achieve them including consideration of critical activities.',NULL,'mandatory','BCMS Clauses',NULL,30,'2026-05-08 04:31:36'),('cc91d623-4a96-11f1-8bc3-00155d012902','b2c3d4e5-0015-0009-0001-000000000001',NULL,'22313-7','Support','Provide resources, ensure competence, promote awareness, establish communication processes, and maintain documented information.',NULL,'mandatory','BCMS Clauses',NULL,40,'2026-05-08 04:31:36'),('cc91d7a9-4a96-11f1-8bc3-00155d012902','b2c3d4e5-0015-0009-0001-000000000001',NULL,'22313-8','Operation','Conduct business impact analysis, risk assessment, develop BC strategies and plans, and establish warning and communication procedures.',NULL,'mandatory','BCMS Clauses',NULL,50,'2026-05-08 04:31:36'),('cc91d928-4a96-11f1-8bc3-00155d012902','b2c3d4e5-0015-0009-0001-000000000001',NULL,'22313-9','Performance Evaluation','Monitor, measure, analyze, and evaluate BCMS performance; conduct internal audits and management reviews.',NULL,'mandatory','BCMS Clauses',NULL,60,'2026-05-08 04:31:36'),('cc91daae-4a96-11f1-8bc3-00155d012902','b2c3d4e5-0015-0009-0001-000000000001',NULL,'22313-10','Improvement','Address nonconformities, take corrective action, and continually improve the suitability, adequacy, and effectiveness of the BCMS.',NULL,'mandatory','BCMS Clauses',NULL,70,'2026-05-08 04:31:36'),('cc996f61-4a96-11f1-8bc3-00155d012902','b2c3d4e5-0015-0010-0001-000000000001',NULL,'22316-P','Principles of Organizational Resilience','Establish shared vision and clarity of purpose, understand the organization\'s context, and foster a resilience culture across the organization.',NULL,'mandatory','Resilience Framework',NULL,10,'2026-05-08 04:31:36'),('cc997527-4a96-11f1-8bc3-00155d012902','b2c3d4e5-0015-0010-0001-000000000001',NULL,'22316-A','Attributes of Resilience','Identify and develop the key attributes that contribute to resilience including leadership, organizational culture, change readiness, and anticipatory awareness.',NULL,'mandatory','Resilience Framework',NULL,20,'2026-05-08 04:31:36'),('cc9976ec-4a96-11f1-8bc3-00155d012902','b2c3d4e5-0015-0010-0001-000000000001',NULL,'22316-AS','Assessment of Resilience','Assess the organization\'s current resilience maturity against the resilience attributes and benchmark against peers or industry standards.',NULL,'recommended','Resilience Framework',NULL,30,'2026-05-08 04:31:36'),('cc997890-4a96-11f1-8bc3-00155d012902','b2c3d4e5-0015-0010-0001-000000000001',NULL,'22316-IM','Improvement of Resilience','Develop and implement an improvement plan to strengthen resilience capabilities based on assessment findings and changes in operating environment.',NULL,'recommended','Resilience Framework',NULL,40,'2026-05-08 04:31:36'),('cca5faeb-4a96-11f1-8bc3-00155d012902','b2c3d4e5-0015-0011-0001-000000000001',NULL,'20000-4','SMS Context','Determine the internal and external context of the SMS, identify interested parties, and define the scope of services covered by the SMS.',NULL,'mandatory','SMS Clauses',NULL,10,'2026-05-08 04:31:36'),('cca602bb-4a96-11f1-8bc3-00155d012902','b2c3d4e5-0015-0011-0001-000000000001',NULL,'20000-5','Leadership','Top management shall demonstrate leadership and commitment, establish a service management policy, and assign roles and responsibilities.',NULL,'mandatory','SMS Clauses',NULL,20,'2026-05-08 04:31:36'),('cca60475-4a96-11f1-8bc3-00155d012902','b2c3d4e5-0015-0011-0001-000000000001',NULL,'20000-6','Planning','Plan actions to address risks and opportunities, set service management objectives, and plan changes to the SMS.',NULL,'mandatory','SMS Clauses',NULL,30,'2026-05-08 04:31:36'),('cca60615-4a96-11f1-8bc3-00155d012902','b2c3d4e5-0015-0011-0001-000000000001',NULL,'20000-7','Support','Determine and provide necessary resources, ensure competence, manage awareness, communication, and documented information.',NULL,'mandatory','SMS Clauses',NULL,40,'2026-05-08 04:31:36'),('cca6078f-4a96-11f1-8bc3-00155d012902','b2c3d4e5-0015-0011-0001-000000000001',NULL,'20000-8.2','Service Delivery','Plan, implement, control, and improve service delivery processes including service catalogue management, capacity, availability, and continuity.',NULL,'mandatory','SMS Clauses',NULL,50,'2026-05-08 04:31:36'),('cca608ff-4a96-11f1-8bc3-00155d012902','b2c3d4e5-0015-0011-0001-000000000001',NULL,'20000-8.3','Relationship and Agreement','Manage business relationships, service level agreements, supplier contracts, and service agreements to meet customer requirements.',NULL,'mandatory','SMS Clauses',NULL,60,'2026-05-08 04:31:36'),('cca60c9d-4a96-11f1-8bc3-00155d012902','b2c3d4e5-0015-0011-0001-000000000001',NULL,'20000-8.6','Resolution and Fulfillment','Manage incidents, service requests, and problems to restore service and prevent recurrence; maintain a known-error database.',NULL,'mandatory','SMS Clauses',NULL,70,'2026-05-08 04:31:36'),('cca60e28-4a96-11f1-8bc3-00155d012902','b2c3d4e5-0015-0011-0001-000000000001',NULL,'20000-8.7','Control','Control configuration, assets, changes, releases, and deployments to maintain service integrity and minimize disruption.',NULL,'mandatory','SMS Clauses',NULL,80,'2026-05-08 04:31:36'),('cca60f94-4a96-11f1-8bc3-00155d012902','b2c3d4e5-0015-0011-0001-000000000001',NULL,'20000-9','Performance Evaluation','Monitor, measure, and evaluate SMS performance; conduct internal audits, manage service performance, and perform management reviews.',NULL,'mandatory','SMS Clauses',NULL,90,'2026-05-08 04:31:36'),('cca61103-4a96-11f1-8bc3-00155d012902','b2c3d4e5-0015-0011-0001-000000000001',NULL,'20000-10','Improvement','Manage nonconformity and corrective actions, and continually improve the SMS and services based on evaluation results.',NULL,'mandatory','SMS Clauses',NULL,100,'2026-05-08 04:31:36'),('ccafdc1d-4a96-11f1-8bc3-00155d012902','b2c3d4e5-0015-0012-0001-000000000001',NULL,'38500-P1','Principle 1: Responsibility','Individuals and groups throughout the organization understand and accept their responsibilities in respect of both supply of, and demand for, IT.',NULL,'mandatory','IT Governance Principles',NULL,10,'2026-05-08 04:31:36'),('ccafe173-4a96-11f1-8bc3-00155d012902','b2c3d4e5-0015-0012-0001-000000000001',NULL,'38500-P2','Principle 2: Strategy','The organization\'s business strategy takes into account the current and future capabilities of IT; IT strategic plans satisfy the current and ongoing needs of the business strategy.',NULL,'mandatory','IT Governance Principles',NULL,20,'2026-05-08 04:31:36'),('ccafe327-4a96-11f1-8bc3-00155d012902','b2c3d4e5-0015-0012-0001-000000000001',NULL,'38500-P3','Principle 3: Acquisition','IT acquisitions are made for valid reasons, on the basis of appropriate and ongoing analysis, with clear and transparent decision making.',NULL,'mandatory','IT Governance Principles',NULL,30,'2026-05-08 04:31:36'),('ccafe4be-4a96-11f1-8bc3-00155d012902','b2c3d4e5-0015-0012-0001-000000000001',NULL,'38500-P4','Principle 4: Performance','IT is fit for purpose in supporting the organization, providing services, levels of service, and service quality required to meet current and future business requirements.',NULL,'mandatory','IT Governance Principles',NULL,40,'2026-05-08 04:31:36'),('ccafe643-4a96-11f1-8bc3-00155d012902','b2c3d4e5-0015-0012-0001-000000000001',NULL,'38500-P5','Principle 5: Conformance','IT complies with all mandatory legislation and regulations; policies and practices are clearly defined, implemented, and enforced.',NULL,'mandatory','IT Governance Principles',NULL,50,'2026-05-08 04:31:36'),('ccafe7ca-4a96-11f1-8bc3-00155d012902','b2c3d4e5-0015-0012-0001-000000000001',NULL,'38500-P6','Principle 6: Human Behavior','IT policies, practices, and decisions demonstrate respect for human behavior, including the current and evolving needs of all the people in the process.',NULL,'mandatory','IT Governance Principles',NULL,60,'2026-05-08 04:31:36'),('ccb97c04-4a96-11f1-8bc3-00155d012902','b2c3d4e5-0015-0013-0001-000000000001',NULL,'37301-4','Context of the Organization','Understand the organization\'s context including relevant obligations, interested parties, and define the scope of the compliance management system.',NULL,'mandatory','CMS Clauses',NULL,10,'2026-05-08 04:31:36'),('ccb982a7-4a96-11f1-8bc3-00155d012902','b2c3d4e5-0015-0013-0001-000000000001',NULL,'37301-5','Leadership and Commitment','Governing body and top management demonstrate active commitment to compliance, establish a compliance policy, and assign a compliance function.',NULL,'mandatory','CMS Clauses',NULL,20,'2026-05-08 04:31:36'),('ccb984a8-4a96-11f1-8bc3-00155d012902','b2c3d4e5-0015-0013-0001-000000000001',NULL,'37301-6','Planning','Identify compliance obligations and risks, set compliance objectives, and plan actions to address compliance risks and opportunities.',NULL,'mandatory','CMS Clauses',NULL,30,'2026-05-08 04:31:36'),('ccb9864c-4a96-11f1-8bc3-00155d012902','b2c3d4e5-0015-0013-0001-000000000001',NULL,'37301-7','Support','Provide resources for compliance, ensure competence of personnel, foster compliance culture, and manage compliance documentation.',NULL,'mandatory','CMS Clauses',NULL,40,'2026-05-08 04:31:36'),('ccb987d6-4a96-11f1-8bc3-00155d012902','b2c3d4e5-0015-0013-0001-000000000001',NULL,'37301-8','Operation','Implement compliance processes including due diligence, controls, reporting mechanisms, investigations, and compliance in procurement.',NULL,'mandatory','CMS Clauses',NULL,50,'2026-05-08 04:31:36'),('ccb98958-4a96-11f1-8bc3-00155d012902','b2c3d4e5-0015-0013-0001-000000000001',NULL,'37301-9','Performance Evaluation','Monitor compliance obligations and performance through audits, management reviews, and compliance reporting.',NULL,'mandatory','CMS Clauses',NULL,60,'2026-05-08 04:31:36'),('ccb98b0a-4a96-11f1-8bc3-00155d012902','b2c3d4e5-0015-0013-0001-000000000001',NULL,'37301-10','Improvement','Take corrective actions for nonconformities and continually improve the effectiveness of the compliance management system.',NULL,'mandatory','CMS Clauses',NULL,70,'2026-05-08 04:31:36'),('ccc3d658-4a96-11f1-8bc3-00155d012902','b2c3d4e5-0015-0014-0001-000000000001',NULL,'37001-4','Context of the Organization','Analyze bribery risk context, identify interested parties, define scope of the ABMS, and understand the organization\'s exposure to bribery.',NULL,'mandatory','ABMS Clauses',NULL,10,'2026-05-08 04:31:36'),('ccc3dc3f-4a96-11f1-8bc3-00155d012902','b2c3d4e5-0015-0014-0001-000000000001',NULL,'37001-5','Leadership','Top management and governing body demonstrate commitment to anti-bribery, establish an anti-bribery policy, and designate a compliance function.',NULL,'mandatory','ABMS Clauses',NULL,20,'2026-05-08 04:31:36'),('ccc3de20-4a96-11f1-8bc3-00155d012902','b2c3d4e5-0015-0014-0001-000000000001',NULL,'37001-6','Planning','Conduct a bribery risk assessment, set anti-bribery objectives, and plan controls proportionate to bribery risks.',NULL,'mandatory','ABMS Clauses',NULL,30,'2026-05-08 04:31:36'),('ccc3dfbe-4a96-11f1-8bc3-00155d012902','b2c3d4e5-0015-0014-0001-000000000001',NULL,'37001-7','Support','Provide adequate resources, ensure personnel competence in anti-bribery, promote awareness, and establish reporting channels.',NULL,'mandatory','ABMS Clauses',NULL,40,'2026-05-08 04:31:36'),('ccc3e14b-4a96-11f1-8bc3-00155d012902','b2c3d4e5-0015-0014-0001-000000000001',NULL,'37001-8','Operation','Implement anti-bribery controls including due diligence on business associates, financial controls, non-financial controls, and gifts and hospitality procedures.',NULL,'mandatory','ABMS Clauses',NULL,50,'2026-05-08 04:31:36'),('ccc3e2cc-4a96-11f1-8bc3-00155d012902','b2c3d4e5-0015-0014-0001-000000000001',NULL,'37001-9','Performance Evaluation','Monitor anti-bribery controls, conduct internal audits, and perform management reviews of the ABMS effectiveness.',NULL,'mandatory','ABMS Clauses',NULL,60,'2026-05-08 04:31:36'),('ccc3e442-4a96-11f1-8bc3-00155d012902','b2c3d4e5-0015-0014-0001-000000000001',NULL,'37001-10','Improvement','Address nonconformities with corrective actions and continually improve the anti-bribery management system.',NULL,'mandatory','ABMS Clauses',NULL,70,'2026-05-08 04:31:36'),('ccc484c0-4a96-11f1-8bc3-00155d012902','b2c3d4e5-0015-0014-0001-000000000001',NULL,'37001-A','Annex A: Additional Guidance on Controls','Provides supplementary guidance on anti-bribery controls including board oversight, due diligence procedures, and sector-specific considerations.',NULL,'recommended','ABMS Clauses',NULL,80,'2026-05-08 04:31:36'),('ccccd5e3-4a96-11f1-8bc3-00155d012902','b2c3d4e5-0015-0015-0001-000000000001',NULL,'13485-4','Quality Management System','Establish, document, implement, maintain, and continually improve a QMS for medical devices, including risk management throughout product realization.',NULL,'mandatory','QMS Sections',NULL,10,'2026-05-08 04:31:36'),('ccccdacb-4a96-11f1-8bc3-00155d012902','b2c3d4e5-0015-0015-0001-000000000001',NULL,'13485-5','Management Responsibility','Top management commits to QMS development, establishes quality policy and objectives, ensures regulatory requirements are communicated, and reviews the QMS.',NULL,'mandatory','QMS Sections',NULL,20,'2026-05-08 04:31:36'),('ccccdc89-4a96-11f1-8bc3-00155d012902','b2c3d4e5-0015-0015-0001-000000000001',NULL,'13485-6','Resource Management','Determine and provide resources for QMS implementation and maintenance, ensure personnel competence, manage infrastructure, and maintain work environment.',NULL,'mandatory','QMS Sections',NULL,30,'2026-05-08 04:31:36'),('ccccde3d-4a96-11f1-8bc3-00155d012902','b2c3d4e5-0015-0015-0001-000000000001',NULL,'13485-7','Product Realization','Plan and control product realization processes including customer-related processes, design and development, purchasing, production, and service provision.',NULL,'mandatory','QMS Sections',NULL,40,'2026-05-08 04:31:36'),('ccccdfcb-4a96-11f1-8bc3-00155d012902','b2c3d4e5-0015-0015-0001-000000000001',NULL,'13485-8','Measurement, Analysis and Improvement','Monitor and measure processes and product, analyze data, control nonconforming product, conduct corrective and preventive action, and issue MDR/vigilance reports.',NULL,'mandatory','QMS Sections',NULL,50,'2026-05-08 04:31:36'),('ccd6849d-4a96-11f1-8bc3-00155d012902','b2c3d4e5-0015-0016-0001-000000000001',NULL,'21434-5','Cybersecurity Governance','Establish and maintain a cybersecurity management system including policy, responsibilities, cybersecurity culture, and organizational cybersecurity audit.',NULL,'mandatory','Automotive Cybersecurity',NULL,10,'2026-05-08 04:31:36'),('ccd6d151-4a96-11f1-8bc3-00155d012902','b2c3d4e5-0015-0016-0001-000000000001',NULL,'21434-8','Cybersecurity Risk Assessment','Identify and assess cybersecurity risks for items and components throughout their lifecycle using threat analysis and risk assessment (TARA).',NULL,'mandatory','Automotive Cybersecurity',NULL,20,'2026-05-08 04:31:36'),('ccd6d369-4a96-11f1-8bc3-00155d012902','b2c3d4e5-0015-0016-0001-000000000001',NULL,'21434-9','Concept Phase','Define item definition, cybersecurity goals, cybersecurity concept, and cybersecurity requirements at the vehicle or system level.',NULL,'mandatory','Automotive Cybersecurity',NULL,30,'2026-05-08 04:31:36'),('ccd6d505-4a96-11f1-8bc3-00155d012902','b2c3d4e5-0015-0016-0001-000000000001',NULL,'21434-10','Product Development','Implement cybersecurity requirements in hardware and software design, including cybersecurity-informed design and integration testing.',NULL,'mandatory','Automotive Cybersecurity',NULL,40,'2026-05-08 04:31:36'),('ccd6d694-4a96-11f1-8bc3-00155d012902','b2c3d4e5-0015-0016-0001-000000000001',NULL,'21434-12','Production','Control cybersecurity risks in the production process including supplier management, production controls, and security of production environments.',NULL,'mandatory','Automotive Cybersecurity',NULL,50,'2026-05-08 04:31:36'),('ccd6d81b-4a96-11f1-8bc3-00155d012902','b2c3d4e5-0015-0016-0001-000000000001',NULL,'21434-13','Operations and Maintenance','Manage cybersecurity incidents in the field, apply patches and updates, and maintain cybersecurity monitoring throughout operational life.',NULL,'mandatory','Automotive Cybersecurity',NULL,60,'2026-05-08 04:31:36'),('ccd6d99e-4a96-11f1-8bc3-00155d012902','b2c3d4e5-0015-0016-0001-000000000001',NULL,'21434-14','End of Life','Manage cybersecurity aspects at end of vehicle life including decommissioning, data deletion, and disclosure of vulnerabilities.',NULL,'recommended','Automotive Cybersecurity',NULL,70,'2026-05-08 04:31:36'),('cce1aa51-4a96-11f1-8bc3-00155d012902','b2c3d4e5-0015-0017-0001-000000000001',NULL,'62304-5.1','Software Development Planning','Develop a software development plan defining development lifecycle model, deliverables, activities, roles, and standards used.',NULL,'mandatory','Software Lifecycle',NULL,10,'2026-05-08 04:31:36'),('cce1af8a-4a96-11f1-8bc3-00155d012902','b2c3d4e5-0015-0017-0001-000000000001',NULL,'62304-5.2','Software Requirements Analysis','Establish and document software requirements derived from system requirements, user needs, and risk management outputs.',NULL,'mandatory','Software Lifecycle',NULL,20,'2026-05-08 04:31:36'),('cce1b359-4a96-11f1-8bc3-00155d012902','b2c3d4e5-0015-0017-0001-000000000001',NULL,'62304-5.3','Software Architectural Design','Design the software architecture to define software items, their interfaces, and how they implement the software requirements.',NULL,'mandatory','Software Lifecycle',NULL,30,'2026-05-08 04:31:36'),('cce1b4fe-4a96-11f1-8bc3-00155d012902','b2c3d4e5-0015-0017-0001-000000000001',NULL,'62304-5.4','Software Detailed Design','Develop detailed design for each software unit specifying algorithms, data structures, and interfaces needed to implement the software item.',NULL,'mandatory','Software Lifecycle',NULL,40,'2026-05-08 04:31:36'),('cce1b697-4a96-11f1-8bc3-00155d012902','b2c3d4e5-0015-0017-0001-000000000001',NULL,'62304-5.5','Software Unit Implementation','Implement software units according to detailed design and establish unit acceptance criteria based on risk classification.',NULL,'mandatory','Software Lifecycle',NULL,50,'2026-05-08 04:31:36'),('cce1b81d-4a96-11f1-8bc3-00155d012902','b2c3d4e5-0015-0017-0001-000000000001',NULL,'62304-5.6','Software Integration and Testing','Integrate software items and test integrated software to verify that software items work together and meet requirements.',NULL,'mandatory','Software Lifecycle',NULL,60,'2026-05-08 04:31:36'),('cce1b9a0-4a96-11f1-8bc3-00155d012902','b2c3d4e5-0015-0017-0001-000000000001',NULL,'62304-5.8','Software Release','Document the software version being released, archive software items and build records, and prepare release documentation.',NULL,'mandatory','Software Lifecycle',NULL,70,'2026-05-08 04:31:36'),('cce1bb25-4a96-11f1-8bc3-00155d012902','b2c3d4e5-0015-0017-0001-000000000001',NULL,'62304-6','Software Maintenance','Plan, implement, document, and test modifications to released software; evaluate changes for risk and re-verify affected requirements.',NULL,'mandatory','Software Lifecycle',NULL,80,'2026-05-08 04:31:36'),('cced7705-4a96-11f1-8bc3-00155d012902','b2c3d4e5-0015-0018-0001-000000000001',NULL,'62443-2-1','Part 2-1: Security Management System for IACS','Specifies requirements for establishing, operating, and maintaining a cybersecurity management system for industrial automation and control systems.',NULL,'mandatory','IACS Security Parts',NULL,10,'2026-05-08 04:31:36'),('cced7e5f-4a96-11f1-8bc3-00155d012902','b2c3d4e5-0015-0018-0001-000000000001',NULL,'62443-2-3','Part 2-3: Patch Management in the IACS Environment','Provides guidance on patch management for IACS including risk assessment of patches, testing, deployment, and verification.',NULL,'mandatory','IACS Security Parts',NULL,20,'2026-05-08 04:31:36'),('cced807a-4a96-11f1-8bc3-00155d012902','b2c3d4e5-0015-0018-0001-000000000001',NULL,'62443-2-4','Part 2-4: Security Program Requirements for IACS Service Providers','Specifies security capabilities that a service provider must maintain when providing integration or maintenance services for IACS.',NULL,'mandatory','IACS Security Parts',NULL,30,'2026-05-08 04:31:36'),('cced833a-4a96-11f1-8bc3-00155d012902','b2c3d4e5-0015-0018-0001-000000000001',NULL,'62443-3-2','Part 3-2: Security Risk Assessment for System Design','Provides a risk assessment methodology for designing IACS security zones and conduits and establishing target security levels.',NULL,'mandatory','IACS Security Parts',NULL,40,'2026-05-08 04:31:36'),('cced852c-4a96-11f1-8bc3-00155d012902','b2c3d4e5-0015-0018-0001-000000000001',NULL,'62443-3-3','Part 3-3: System Security Requirements and Security Levels','Defines system-level security requirements aligned with seven foundational requirements and four security levels for IACS.',NULL,'mandatory','IACS Security Parts',NULL,50,'2026-05-08 04:31:36'),('cced86be-4a96-11f1-8bc3-00155d012902','b2c3d4e5-0015-0018-0001-000000000001',NULL,'62443-4-1','Part 4-1: Secure Product Development Lifecycle Requirements','Specifies process requirements for secure development of products used in IACS environments including design, implementation, verification, and delivery.',NULL,'mandatory','IACS Security Parts',NULL,60,'2026-05-08 04:31:36'),('cced8836-4a96-11f1-8bc3-00155d012902','b2c3d4e5-0015-0018-0001-000000000001',NULL,'62443-4-2','Part 4-2: Technical Security Requirements for IACS Components','Defines technical security requirements for IACS components (software, hardware, and network) mapped to foundational requirements and security levels.',NULL,'mandatory','IACS Security Parts',NULL,70,'2026-05-08 04:31:36'),('d016f41c-fd61-4368-b69a-ed5c81577191','a27eef01-4113-11f1-8bc3-00155d012902','343a705f-889e-48af-8f4e-03d344b01c0c','RS.AN','Incident Analysis','Investigations are conducted to ensure effective response and support forensics and recovery activities.',NULL,'mandatory',NULL,NULL,1,'2026-04-26 02:00:01'),('d10ce909-2042-4fbe-acf0-4e757de77978','a2a4e62d-4113-11f1-8bc3-00155d012902','34e539d9-3e70-4253-9e88-27714276f81b','CC6.2','Prior authorization access','Prior to issuing system credentials and granting system access, the entity registers and authorizes new internal and external users.',NULL,'mandatory',NULL,NULL,1,'2026-04-26 02:00:01'),('d1a72624-0ba6-4227-a659-c41bd9d8577d','a28c08f1-4113-11f1-8bc3-00155d012902',NULL,'6','Develop and Maintain Secure Systems and Software',NULL,NULL,'mandatory','Secure Development',NULL,5,'2026-04-26 02:00:01'),('d2a12b78-0db7-4237-b2ae-178e648161a4','a29cdc11-4113-11f1-8bc3-00155d012902',NULL,'S33','Right to data portability','Data subject has right to receive personal data in a commonly used and machine-readable format.',NULL,'mandatory','Data Subject Rights',NULL,6,'2026-04-26 02:00:01'),('d3b7f331-4669-47f6-bc10-d47b822f48e7','a271e304-4113-11f1-8bc3-00155d012902','44fa2be4-6427-45d9-ab33-88b5a1412f8b','5.2','Cyber risk assessment','Regularly conduct cyber risk assessments to identify and evaluate cyber risks.',NULL,'mandatory',NULL,NULL,1,'2026-04-26 02:00:01'),('d469fe64-f77c-46ea-a29d-81908bdd28d7','a2a4e62d-4113-11f1-8bc3-00155d012902',NULL,'A1','Availability',NULL,NULL,'recommended','Availability Criteria',NULL,5,'2026-04-26 02:00:01'),('d50e0e13-6055-4a2d-8372-ed42bd38d64a','a25c0c03-4113-11f1-8bc3-00155d012902','e925195e-a5f8-4a84-8823-6df95025e13c','A.5.15','Access control','Rules for physical and logical access to information and associated assets shall be established and implemented.',NULL,'mandatory',NULL,NULL,3,'2026-04-26 02:00:01'),('d67a2774-4f85-40cf-bb7c-2a8bbb0f72a2','a271e304-4113-11f1-8bc3-00155d012902','44fa2be4-6427-45d9-ab33-88b5a1412f8b','5.3','Cyber security measures','Implement robust cyber security measures to protect systems and data.',NULL,'mandatory',NULL,NULL,2,'2026-04-26 02:00:01'),('d71e225b-753b-4ebe-bde3-c6b343c51d02','161ca661-dcfc-41d6-ae04-4d515194f119','b9930df0-400e-11f1-8bc3-00155d012902','Art.5.1.c','Data minimisation','Personal data shall be adequate, relevant and limited to what is necessary.',NULL,'mandatory',NULL,NULL,2,'2026-04-26 02:00:00'),('d7a31a12-33b2-4b7d-8bb9-3519129b9437','a27eef01-4113-11f1-8bc3-00155d012902','343a705f-889e-48af-8f4e-03d344b01c0c','RS.MA','Incident Management','Responses to detected cybersecurity incidents are managed.',NULL,'mandatory',NULL,NULL,0,'2026-04-26 02:00:01'),('d9d5efd7-d9ef-4880-9f63-05d07ee2d387','a29cdc11-4113-11f1-8bc3-00155d012902',NULL,'S44','Data Processor Requirements','Processing by a processor shall be governed by a binding contract ensuring that the processor processes personal data only on instructions from the controller.',NULL,'mandatory','Vendor Management',NULL,10,'2026-04-26 02:00:01'),('d9fccc5b-1c5a-48b4-ac11-5cbb462cc26c','a271e304-4113-11f1-8bc3-00155d012902','44fa2be4-6427-45d9-ab33-88b5a1412f8b','5.1','Cybersecurity governance and oversight','Establish a robust cybersecurity governance framework.',NULL,'mandatory',NULL,NULL,0,'2026-04-26 02:00:01'),('db05c0b8-be4a-4f54-babe-37b10db09d18','a271e304-4113-11f1-8bc3-00155d012902',NULL,'8','Information Security',NULL,NULL,'mandatory','Information Security',NULL,5,'2026-04-26 02:00:01'),('db906fcf-b7b9-4f90-848a-7a22c4364745','a28c08f1-4113-11f1-8bc3-00155d012902','4db13685-d465-4cb7-b0a5-b2d0bb82f8ff','11.3','External and internal penetration testing is regularly performed',NULL,NULL,'mandatory',NULL,NULL,0,'2026-04-26 02:00:01'),('dbb46b77-8174-41de-8097-b682a207478a','a23072ef-4113-11f1-8bc3-00155d012902',NULL,'1798.125','Right to non-discrimination','A business shall not discriminate against a consumer because the consumer exercised any of the consumer\'s rights.',NULL,'mandatory','Non-Discrimination',NULL,5,'2026-04-26 02:00:00'),('dd4e61d0-b592-4179-89d6-5950d8b0ebb7','a271e304-4113-11f1-8bc3-00155d012902','db05c0b8-be4a-4f54-babe-37b10db09d18','8.2','Cryptography','Apply cryptographic controls to protect the confidentiality and integrity of data.',NULL,'mandatory',NULL,NULL,1,'2026-04-26 02:00:01'),('dd797d48-8b9e-4e29-b966-37875790779f','a2a4e62d-4113-11f1-8bc3-00155d012902',NULL,'C1','Confidentiality',NULL,NULL,'recommended','Confidentiality Criteria',NULL,6,'2026-04-26 02:00:01'),('dde99a31-7141-4f43-96a5-e46655833a3f','a29cdc11-4113-11f1-8bc3-00155d012902',NULL,'S40','Security Measures',NULL,NULL,'mandatory','Security',NULL,9,'2026-04-26 02:00:01'),('deed7b79-3495-43a3-bef6-364e72cbc7e6','a2a4e62d-4113-11f1-8bc3-00155d012902',NULL,'CC2','Communication and Information',NULL,NULL,'mandatory','Common Criteria',NULL,1,'2026-04-26 02:00:01'),('e023c8a4-3b18-46d1-a739-acc6aaf6b5c7','a2a4e62d-4113-11f1-8bc3-00155d012902','34e539d9-3e70-4253-9e88-27714276f81b','CC6.1','Logical access security','The entity implements logical access security software, infrastructure, and architectures over protected information assets.',NULL,'mandatory',NULL,NULL,0,'2026-04-26 02:00:01'),('e030f67e-22f0-4eb1-9cad-aa0e5f55af8f','a23897c7-4113-11f1-8bc3-00155d012902',NULL,'SYSC.4','General Organisational Requirements',NULL,NULL,'mandatory','Governance',NULL,1,'2026-04-26 02:00:00'),('e0e7ee5e-c552-4905-9b85-84272c16631b','a28c08f1-4113-11f1-8bc3-00155d012902','f0ecc496-ad8b-41f0-b93f-4ac30b6a14a2','4.2.1','Strong cryptography used for all cardholder data transmissions','Use strong cryptography and security protocols to safeguard PAN during transmission over open, public networks.',NULL,'mandatory',NULL,NULL,0,'2026-04-26 02:00:01'),('e168a694-553e-4849-af84-2acc1479c3d6','a2a4e62d-4113-11f1-8bc3-00155d012902','34e539d9-3e70-4253-9e88-27714276f81b','CC6.7','Transmission protection','The entity restricts the transmission, movement, and removal of information to authorized internal and external users.',NULL,'mandatory',NULL,NULL,4,'2026-04-26 02:00:01'),('e66244d4-1250-4487-8ba0-f755a0d58687','a29cdc11-4113-11f1-8bc3-00155d012902',NULL,'S23','Privacy Notice','Inform data subjects about the collection, use, or disclosure of personal data before or at the time of collection.',NULL,'mandatory','Transparency',NULL,2,'2026-04-26 02:00:01'),('e68bbf48-cd85-43a8-910e-625909046425','161ca661-dcfc-41d6-ae04-4d515194f119','b9936327-400e-11f1-8bc3-00155d012902','Art.32.1.b','Ongoing confidentiality, integrity, availability','Ensure ongoing confidentiality, integrity, availability and resilience of processing systems.',NULL,'mandatory',NULL,NULL,1,'2026-04-26 02:00:00'),('e7538167-4a97-11f1-8bc3-00155d012902','d4e5f6a7-0017-0001-0001-000000000001',NULL,'Art.5-11','Principles and Lawfulness of Processing','Core data protection principles (Art.5), lawful bases for processing (Art.6), special category data (Art.9), and criminal convictions data (Art.10).',NULL,'mandatory','UK GDPR Chapters',NULL,10,'2026-05-08 04:39:30'),('e75386c7-4a97-11f1-8bc3-00155d012902','d4e5f6a7-0017-0001-0001-000000000001',NULL,'Art.12-22','Rights of the Data Subject','Data subject rights including transparency (Art.12-14), access (Art.15), rectification (Art.16), erasure (Art.17), restriction (Art.18), portability (Art.20), and objection (Art.21).',NULL,'mandatory','UK GDPR Chapters',NULL,20,'2026-05-08 04:39:30'),('e75388d8-4a97-11f1-8bc3-00155d012902','d4e5f6a7-0017-0001-0001-000000000001',NULL,'Art.24-43','Controller and Processor Obligations','Obligations on controllers (Art.24), data protection by design (Art.25), records of processing (Art.30), security (Art.32), DPIAs (Art.35), and DPO designation (Art.37).',NULL,'mandatory','UK GDPR Chapters',NULL,30,'2026-05-08 04:39:30'),('e7538abd-4a97-11f1-8bc3-00155d012902','d4e5f6a7-0017-0001-0001-000000000001',NULL,'Art.44-49','Transfers to Third Countries','Requirements for transferring personal data to third countries including adequacy decisions (Art.45), appropriate safeguards (Art.46), and derogations (Art.49).',NULL,'mandatory','UK GDPR Chapters',NULL,40,'2026-05-08 04:39:30'),('e7538c9f-4a97-11f1-8bc3-00155d012902','d4e5f6a7-0017-0001-0001-000000000001',NULL,'Art.55-76','Supervisory Authority (ICO)','Role and powers of the Information Commissioner\'s Office including competence (Art.55), tasks (Art.57), powers (Art.58), and cooperation mechanisms.',NULL,'mandatory','UK GDPR Chapters',NULL,50,'2026-05-08 04:39:30'),('e7538e89-4a97-11f1-8bc3-00155d012902','d4e5f6a7-0017-0001-0001-000000000001',NULL,'Art.82-84','Remedies, Liability and Penalties','Right to compensation (Art.82), liability and exemptions (Art.83 UK fines up to £17.5M or 4% global turnover), and penalties for member state rules.',NULL,'mandatory','UK GDPR Chapters',NULL,60,'2026-05-08 04:39:30'),('e75b9045-4a97-11f1-8bc3-00155d012902','d4e5f6a7-0017-0002-0001-000000000001',NULL,'HIT-A','Subtitle A: Promotion of Health Information Technology','Extends HIPAA Privacy and Security Rules directly to business associates, imposes civil and criminal penalties, and strengthens enforcement with increased fines.',NULL,'mandatory','HITECH Subtitles',NULL,10,'2026-05-08 04:39:30'),('e75b94f8-4a97-11f1-8bc3-00155d012902','d4e5f6a7-0017-0002-0001-000000000001',NULL,'HIT-B','Subtitle B: Incentives for Use of Health Information Technology','Provides requirements for meaningful use of EHR systems and performance measures related to health information technology adoption.',NULL,'mandatory','HITECH Subtitles',NULL,20,'2026-05-08 04:39:30'),('e75b96d4-4a97-11f1-8bc3-00155d012902','d4e5f6a7-0017-0002-0001-000000000001',NULL,'HIT-D','Subtitle D: Privacy','Mandates breach notification to affected individuals, HHS, and media for unsecured PHI breaches; limits marketing and sale of PHI; strengthens patient rights.',NULL,'mandatory','HITECH Subtitles',NULL,30,'2026-05-08 04:39:30'),('e763f578-4a97-11f1-8bc3-00155d012902','d4e5f6a7-0017-0003-0001-000000000001',NULL,'GLBA-FPR','Financial Privacy Rule','Requires financial institutions to give customers privacy notices explaining information-sharing practices and provide opt-out rights for sharing with non-affiliated third parties.',NULL,'mandatory','GLBA Rules',NULL,10,'2026-05-08 04:39:30'),('e763fa71-4a97-11f1-8bc3-00155d012902','d4e5f6a7-0017-0003-0001-000000000001',NULL,'GLBA-SR','Safeguards Rule (2023)','Requires financial institutions to develop and maintain a comprehensive written information security program with administrative, technical, and physical safeguards for customer information.',NULL,'mandatory','GLBA Rules',NULL,20,'2026-05-08 04:39:30'),('e763fc43-4a97-11f1-8bc3-00155d012902','d4e5f6a7-0017-0003-0001-000000000001',NULL,'GLBA-PP','Pretexting Protection','Prohibits using false pretenses to obtain customer financial information and requires financial institutions to have policies and procedures to detect and prevent pretexting.',NULL,'mandatory','GLBA Rules',NULL,30,'2026-05-08 04:39:30'),('e76fd9dc-4a97-11f1-8bc3-00155d012902','d4e5f6a7-0017-0004-0001-000000000001',NULL,'FERPA-R','Rights of Parents and Eligible Students','Parents have the right to inspect and review education records; rights transfer to the student (eligible student) at age 18 or upon attending postsecondary school.',NULL,'mandatory','FERPA Sections',NULL,10,'2026-05-08 04:39:30'),('e76fded0-4a97-11f1-8bc3-00155d012902','d4e5f6a7-0017-0004-0001-000000000001',NULL,'FERPA-D','Disclosure Limitations','Schools must have written consent before disclosing education records, with exceptions for school officials, transfers, audits, safety emergencies, and judicial orders.',NULL,'mandatory','FERPA Sections',NULL,20,'2026-05-08 04:39:30'),('e76fe0b2-4a97-11f1-8bc3-00155d012902','d4e5f6a7-0017-0004-0001-000000000001',NULL,'FERPA-DI','Directory Information','Schools may disclose directory information without consent if they notify parents/students of the information they have designated as directory information and allow opt-out.',NULL,'mandatory','FERPA Sections',NULL,30,'2026-05-08 04:39:30'),('e76fe263-4a97-11f1-8bc3-00155d012902','d4e5f6a7-0017-0004-0001-000000000001',NULL,'FERPA-E','Enforcement','The Family Policy Compliance Office enforces FERPA; failure to comply can result in withholding of federal education funding from institutions.',NULL,'mandatory','FERPA Sections',NULL,40,'2026-05-08 04:39:30'),('e77bfade-4a97-11f1-8bc3-00155d012902','d4e5f6a7-0017-0005-0001-000000000001',NULL,'COPPA-N','Notice','Post clear and prominent privacy notices on websites and online services directed to children under 13, describing collection, use, and disclosure practices.',NULL,'mandatory','COPPA Requirements',NULL,10,'2026-05-08 04:39:30'),('e77bffb9-4a97-11f1-8bc3-00155d012902','d4e5f6a7-0017-0005-0001-000000000001',NULL,'COPPA-PC','Parental Consent','Obtain verifiable parental consent before collecting, using, or disclosing personal information from children under 13.',NULL,'mandatory','COPPA Requirements',NULL,20,'2026-05-08 04:39:30'),('e77c0172-4a97-11f1-8bc3-00155d012902','d4e5f6a7-0017-0005-0001-000000000001',NULL,'COPPA-PR','Parental Rights','Provide parents with the ability to review, correct, and delete their child\'s information, and to refuse further collection or use.',NULL,'mandatory','COPPA Requirements',NULL,30,'2026-05-08 04:39:30'),('e77c02f6-4a97-11f1-8bc3-00155d012902','d4e5f6a7-0017-0005-0001-000000000001',NULL,'COPPA-S','Security','Establish and maintain reasonable security procedures and practices appropriate to the sensitivity of children\'s personal information.',NULL,'mandatory','COPPA Requirements',NULL,40,'2026-05-08 04:39:30'),('e77c047a-4a97-11f1-8bc3-00155d012902','d4e5f6a7-0017-0005-0001-000000000001',NULL,'COPPA-DR','Data Retention and Deletion','Retain children\'s personal information only as long as is reasonably necessary for the purpose collected, and delete it using reasonable security measures.',NULL,'mandatory','COPPA Requirements',NULL,50,'2026-05-08 04:39:30'),('e78ce4b7-4a97-11f1-8bc3-00155d012902','d4e5f6a7-0017-0006-0001-000000000001',NULL,'PIPEDA-1','Principle 1: Accountability','An organization is responsible for personal information under its control and shall designate one or more persons accountable for compliance.',NULL,'mandatory','PIPEDA Principles',NULL,10,'2026-05-08 04:39:31'),('e78cea7a-4a97-11f1-8bc3-00155d012902','d4e5f6a7-0017-0006-0001-000000000001',NULL,'PIPEDA-2','Principle 2: Identifying Purposes','The purposes for which personal information is collected shall be identified by the organization at or before the time of collection.',NULL,'mandatory','PIPEDA Principles',NULL,20,'2026-05-08 04:39:31'),('e78cec32-4a97-11f1-8bc3-00155d012902','d4e5f6a7-0017-0006-0001-000000000001',NULL,'PIPEDA-3','Principle 3: Consent','The knowledge and consent of the individual are required for the collection, use, or disclosure of personal information, with limited exceptions.',NULL,'mandatory','PIPEDA Principles',NULL,30,'2026-05-08 04:39:31'),('e78cedc3-4a97-11f1-8bc3-00155d012902','d4e5f6a7-0017-0006-0001-000000000001',NULL,'PIPEDA-4','Principle 4: Limiting Collection','The collection of personal information shall be limited to that which is necessary for the purposes identified by the organization.',NULL,'mandatory','PIPEDA Principles',NULL,40,'2026-05-08 04:39:31'),('e78cef43-4a97-11f1-8bc3-00155d012902','d4e5f6a7-0017-0006-0001-000000000001',NULL,'PIPEDA-5','Principle 5: Limiting Use, Disclosure and Retention','Personal information shall not be used or disclosed for purposes other than those for which it was collected; retained only as long as necessary.',NULL,'mandatory','PIPEDA Principles',NULL,50,'2026-05-08 04:39:31'),('e78cf0bc-4a97-11f1-8bc3-00155d012902','d4e5f6a7-0017-0006-0001-000000000001',NULL,'PIPEDA-6','Principle 6: Accuracy','Personal information shall be as accurate, complete, and up-to-date as is necessary for the purposes for which it is to be used.',NULL,'mandatory','PIPEDA Principles',NULL,60,'2026-05-08 04:39:31'),('e78cf228-4a97-11f1-8bc3-00155d012902','d4e5f6a7-0017-0006-0001-000000000001',NULL,'PIPEDA-7','Principle 7: Safeguards','Personal information shall be protected by security safeguards appropriate to the sensitivity of the information.',NULL,'mandatory','PIPEDA Principles',NULL,70,'2026-05-08 04:39:31'),('e78cf3a1-4a97-11f1-8bc3-00155d012902','d4e5f6a7-0017-0006-0001-000000000001',NULL,'PIPEDA-8','Principle 8: Openness','An organization shall make readily available to individuals specific information about its policies and practices relating to the management of personal information.',NULL,'mandatory','PIPEDA Principles',NULL,80,'2026-05-08 04:39:31'),('e78cf51d-4a97-11f1-8bc3-00155d012902','d4e5f6a7-0017-0006-0001-000000000001',NULL,'PIPEDA-9','Principle 9: Individual Access','Upon request, an individual shall be informed of the existence, use, and disclosure of his or her personal information and shall be given access to that information.',NULL,'mandatory','PIPEDA Principles',NULL,90,'2026-05-08 04:39:31'),('e78cf697-4a97-11f1-8bc3-00155d012902','d4e5f6a7-0017-0006-0001-000000000001',NULL,'PIPEDA-10','Principle 10: Challenging Compliance','An individual shall be able to address a challenge concerning compliance with the above principles to the designated accountable person.',NULL,'mandatory','PIPEDA Principles',NULL,100,'2026-05-08 04:39:31'),('e79b45a1-4a97-11f1-8bc3-00155d012902','d4e5f6a7-0017-0007-0001-000000000001',NULL,'LGPD-I','General Provisions and Scope','Establishes the legal basis for data protection in Brazil, defines key terms, and determines the scope of application including territorial application.',NULL,'mandatory','LGPD Chapters',NULL,10,'2026-05-08 04:39:31'),('e79b7f6a-4a97-11f1-8bc3-00155d012902','d4e5f6a7-0017-0007-0001-000000000001',NULL,'LGPD-II','Data Processing Principles','Sets out the ten principles governing personal data processing: purpose, adequacy, necessity, free access, quality, transparency, security, prevention, non-discrimination, and accountability.',NULL,'mandatory','LGPD Chapters',NULL,20,'2026-05-08 04:39:31'),('e79b8165-4a97-11f1-8bc3-00155d012902','d4e5f6a7-0017-0007-0001-000000000001',NULL,'LGPD-III','Data Subject Rights','Grants data subjects rights to confirmation, access, correction, anonymization/deletion, portability, information on sharing, non-consent consequences, and revocation.',NULL,'mandatory','LGPD Chapters',NULL,30,'2026-05-08 04:39:31'),('e79b830c-4a97-11f1-8bc3-00155d012902','d4e5f6a7-0017-0007-0001-000000000001',NULL,'LGPD-IV','Processing Conditions and Lawful Bases','Defines 10 lawful bases for processing personal data including consent, legitimate interest, legal obligation, contract performance, and research.',NULL,'mandatory','LGPD Chapters',NULL,40,'2026-05-08 04:39:31'),('e79b8671-4a97-11f1-8bc3-00155d012902','d4e5f6a7-0017-0007-0001-000000000001',NULL,'LGPD-V','Data Controller and Processor','Establishes responsibilities of controllers and processors, requirements for data processing agreements, and joint controller arrangements.',NULL,'mandatory','LGPD Chapters',NULL,50,'2026-05-08 04:39:31'),('e79b8803-4a97-11f1-8bc3-00155d012902','d4e5f6a7-0017-0007-0001-000000000001',NULL,'LGPD-VI','Data Protection Officer (DPO)','Requires controllers to designate a DPO (encarregado), defines DPO responsibilities, and establishes communication channels with data subjects and ANPD.',NULL,'mandatory','LGPD Chapters',NULL,60,'2026-05-08 04:39:31'),('e79b897b-4a97-11f1-8bc3-00155d012902','d4e5f6a7-0017-0007-0001-000000000001',NULL,'LGPD-VII','Security, Good Practices and Incidents','Requires technical and organizational security measures, incident response and breach notification to ANPD and affected data subjects.',NULL,'mandatory','LGPD Chapters',NULL,70,'2026-05-08 04:39:31'),('e79b8af6-4a97-11f1-8bc3-00155d012902','d4e5f6a7-0017-0007-0001-000000000001',NULL,'LGPD-VIII','National Data Protection Authority (ANPD)','Establishes the ANPD, its structure, powers, and functions for overseeing compliance with LGPD and issuing guidelines.',NULL,'mandatory','LGPD Chapters',NULL,80,'2026-05-08 04:39:31'),('e7ad9cc2-4a97-11f1-8bc3-00155d012902','d4e5f6a7-0017-0008-0001-000000000001',NULL,'POPIA-C1','Condition 1: Accountability','Responsible parties must ensure and demonstrate compliance with POPIA conditions for all personal information processing.',NULL,'mandatory','POPIA Conditions',NULL,10,'2026-05-08 04:39:31'),('e7ada1c2-4a97-11f1-8bc3-00155d012902','d4e5f6a7-0017-0008-0001-000000000001',NULL,'POPIA-C2','Condition 2: Processing Limitation','Personal information may only be processed if it is adequate, relevant, and not excessive given the purpose; data minimization principle.',NULL,'mandatory','POPIA Conditions',NULL,20,'2026-05-08 04:39:31'),('e7ada36f-4a97-11f1-8bc3-00155d012902','d4e5f6a7-0017-0008-0001-000000000001',NULL,'POPIA-C3','Condition 3: Purpose Specification','Personal information must be collected for a specific, explicitly defined, and lawful purpose and not processed in a way incompatible with that purpose.',NULL,'mandatory','POPIA Conditions',NULL,30,'2026-05-08 04:39:31'),('e7ada4ea-4a97-11f1-8bc3-00155d012902','d4e5f6a7-0017-0008-0001-000000000001',NULL,'POPIA-C4','Condition 4: Further Processing Limitation','Further processing must be compatible with the purpose of collection; records may not be kept longer than necessary for the purpose.',NULL,'mandatory','POPIA Conditions',NULL,40,'2026-05-08 04:39:31'),('e7ada659-4a97-11f1-8bc3-00155d012902','d4e5f6a7-0017-0008-0001-000000000001',NULL,'POPIA-C5','Condition 5: Information Quality','Responsible parties must take reasonable steps to ensure personal information is complete, accurate, not misleading, and updated where necessary.',NULL,'mandatory','POPIA Conditions',NULL,50,'2026-05-08 04:39:31'),('e7ada7c3-4a97-11f1-8bc3-00155d012902','d4e5f6a7-0017-0008-0001-000000000001',NULL,'POPIA-C6','Condition 6: Openness','Data subjects must be notified when personal information about them is collected, including the identity of the responsible party and the purpose of collection.',NULL,'mandatory','POPIA Conditions',NULL,60,'2026-05-08 04:39:31'),('e7ade827-4a97-11f1-8bc3-00155d012902','d4e5f6a7-0017-0008-0001-000000000001',NULL,'POPIA-C7','Condition 7: Security Safeguards','Responsible parties must secure the integrity and confidentiality of personal information in their possession by implementing appropriate technical and organizational measures.',NULL,'mandatory','POPIA Conditions',NULL,70,'2026-05-08 04:39:31'),('e7ade9f7-4a97-11f1-8bc3-00155d012902','d4e5f6a7-0017-0008-0001-000000000001',NULL,'POPIA-C8','Condition 8: Data Subject Participation','Data subjects have the right to request access to, correct, or object to processing of their personal information and to request deletion.',NULL,'mandatory','POPIA Conditions',NULL,80,'2026-05-08 04:39:31'),('e7c373f2-4a97-11f1-8bc3-00155d012902','d4e5f6a7-0017-0009-0001-000000000001',NULL,'PDPA-SG-1','Consent Obligation','Obtain consent before collecting, using, or disclosing personal data unless an exception applies; deemed consent and legitimate interests provisions apply.',NULL,'mandatory','PDPA Singapore Obligations',NULL,10,'2026-05-08 04:39:31'),('e7c37971-4a97-11f1-8bc3-00155d012902','d4e5f6a7-0017-0009-0001-000000000001',NULL,'PDPA-SG-2','Purpose Limitation Obligation','Collect, use, or disclose personal data only for purposes that a reasonable person would consider appropriate in the circumstances.',NULL,'mandatory','PDPA Singapore Obligations',NULL,20,'2026-05-08 04:39:31'),('e7c37b3d-4a97-11f1-8bc3-00155d012902','d4e5f6a7-0017-0009-0001-000000000001',NULL,'PDPA-SG-3','Notification Obligation','Notify individuals of the purposes for which their personal data is being collected, used, or disclosed on or before collection.',NULL,'mandatory','PDPA Singapore Obligations',NULL,30,'2026-05-08 04:39:31'),('e7c37cb5-4a97-11f1-8bc3-00155d012902','d4e5f6a7-0017-0009-0001-000000000001',NULL,'PDPA-SG-4','Access and Correction Obligation','Provide individuals access to their personal data and correct any error or omission upon request within a reasonable timeframe.',NULL,'mandatory','PDPA Singapore Obligations',NULL,40,'2026-05-08 04:39:31'),('e7c37e2c-4a97-11f1-8bc3-00155d012902','d4e5f6a7-0017-0009-0001-000000000001',NULL,'PDPA-SG-5','Accuracy Obligation','Make reasonable effort to ensure personal data collected is accurate and complete for the purpose it will be used.',NULL,'mandatory','PDPA Singapore Obligations',NULL,50,'2026-05-08 04:39:31'),('e7c37f91-4a97-11f1-8bc3-00155d012902','d4e5f6a7-0017-0009-0001-000000000001',NULL,'PDPA-SG-6','Protection Obligation','Protect personal data in possession or under control by making reasonable security arrangements to prevent unauthorized access, collection, use, or disclosure.',NULL,'mandatory','PDPA Singapore Obligations',NULL,60,'2026-05-08 04:39:31'),('e7c380f4-4a97-11f1-8bc3-00155d012902','d4e5f6a7-0017-0009-0001-000000000001',NULL,'PDPA-SG-7','Retention Limitation Obligation','Cease retaining personal data or dispose of it in a secure manner when it is no longer necessary for any business or legal purpose.',NULL,'mandatory','PDPA Singapore Obligations',NULL,70,'2026-05-08 04:39:31'),('e7c38255-4a97-11f1-8bc3-00155d012902','d4e5f6a7-0017-0009-0001-000000000001',NULL,'PDPA-SG-8','Transfer Limitation Obligation','Transfer personal data outside Singapore only to countries with comparable data protection standards or under contractual arrangements.',NULL,'mandatory','PDPA Singapore Obligations',NULL,80,'2026-05-08 04:39:31'),('e7c383e6-4a97-11f1-8bc3-00155d012902','d4e5f6a7-0017-0009-0001-000000000001',NULL,'PDPA-SG-9','Openness Obligation','Make information about data protection policies and practices available on request and designate a Data Protection Officer.',NULL,'mandatory','PDPA Singapore Obligations',NULL,90,'2026-05-08 04:39:31'),('e7c3854e-4a97-11f1-8bc3-00155d012902','d4e5f6a7-0017-0009-0001-000000000001',NULL,'PDPA-SG-10','Data Breach Notification Obligation','Notify PDPC within 3 days and affected individuals without undue delay for breaches that result in significant harm or affect 500 or more individuals.',NULL,'mandatory','PDPA Singapore Obligations',NULL,100,'2026-05-08 04:39:31'),('e7cf6a36-4a97-11f1-8bc3-00155d012902','d4e5f6a7-0017-0010-0001-000000000001',NULL,'PDPA-TH-1','General Provisions','Defines the scope, definitions, and application of PDPA Thailand; establishes lawful bases for processing personal data.',NULL,'mandatory','PDPA Thailand Chapters',NULL,10,'2026-05-08 04:39:31'),('e7cf6efe-4a97-11f1-8bc3-00155d012902','d4e5f6a7-0017-0010-0001-000000000001',NULL,'PDPA-TH-2','Rights of Data Subject','Grants data subjects rights to access, portability, correction, deletion, restriction, and objection to processing of personal data.',NULL,'mandatory','PDPA Thailand Chapters',NULL,20,'2026-05-08 04:39:31'),('e7cf708d-4a97-11f1-8bc3-00155d012902','d4e5f6a7-0017-0010-0001-000000000001',NULL,'PDPA-TH-3','Duties of Data Controller and Processor','Establishes obligations for data controllers including DPO designation, record keeping, DPIAs, breach notification, and security measures.',NULL,'mandatory','PDPA Thailand Chapters',NULL,30,'2026-05-08 04:39:31'),('e7cf71fb-4a97-11f1-8bc3-00155d012902','d4e5f6a7-0017-0010-0001-000000000001',NULL,'PDPA-TH-4','International Data Transfers','Restricts transfers of personal data to countries with adequate protection standards or under appropriate safeguards such as standard contractual clauses.',NULL,'mandatory','PDPA Thailand Chapters',NULL,40,'2026-05-08 04:39:31'),('e7cf736b-4a97-11f1-8bc3-00155d012902','d4e5f6a7-0017-0010-0001-000000000001',NULL,'PDPA-TH-5','Enforcement and Penalties','Establishes the Personal Data Protection Committee (PDPC), its powers, and administrative fines up to THB 5M for violations.',NULL,'mandatory','PDPA Thailand Chapters',NULL,50,'2026-05-08 04:39:31'),('e7df12fe-4a97-11f1-8bc3-00155d012902','d4e5f6a7-0017-0011-0001-000000000001',NULL,'DPDP-1','Lawful Processing and Grounds','Personal data may be processed only for a lawful purpose with consent or under certain legitimate uses; special provisions for children.',NULL,'mandatory','DPDP Obligations',NULL,10,'2026-05-08 04:39:31'),('e7df1802-4a97-11f1-8bc3-00155d012902','d4e5f6a7-0017-0011-0001-000000000001',NULL,'DPDP-2','Notice Requirement','Data fiduciaries must provide clear and plain language notice to data principals describing the personal data to be processed and the purpose.',NULL,'mandatory','DPDP Obligations',NULL,20,'2026-05-08 04:39:31'),('e7df19c7-4a97-11f1-8bc3-00155d012902','d4e5f6a7-0017-0011-0001-000000000001',NULL,'DPDP-3','Consent Management','Consent must be free, specific, informed, unconditional, and unambiguous; data principals have the right to withdraw consent at any time.',NULL,'mandatory','DPDP Obligations',NULL,30,'2026-05-08 04:39:31'),('e7df1b8d-4a97-11f1-8bc3-00155d012902','d4e5f6a7-0017-0011-0001-000000000001',NULL,'DPDP-4','Rights of Data Principals','Data principals have rights to access information, correct and erase data, nominate a representative, and seek grievance redressal.',NULL,'mandatory','DPDP Obligations',NULL,40,'2026-05-08 04:39:31'),('e7df1d4d-4a97-11f1-8bc3-00155d012902','d4e5f6a7-0017-0011-0001-000000000001',NULL,'DPDP-5','Data Fiduciary Duties','Data fiduciaries must ensure data quality, implement security safeguards, report breaches to DPBI and data principals, and delete data when no longer needed.',NULL,'mandatory','DPDP Obligations',NULL,50,'2026-05-08 04:39:31'),('e7df1eb2-4a97-11f1-8bc3-00155d012902','d4e5f6a7-0017-0011-0001-000000000001',NULL,'DPDP-6','Cross-Border Data Transfers','Transfer of personal data outside India is permitted only to notified countries or territories as specified by the central government.',NULL,'mandatory','DPDP Obligations',NULL,60,'2026-05-08 04:39:31'),('e7df2008-4a97-11f1-8bc3-00155d012902','d4e5f6a7-0017-0011-0001-000000000001',NULL,'DPDP-7','Penalties and Enforcement','The Data Protection Board of India may impose financial penalties up to INR 250 crore for breaches; Right to approach courts preserved.',NULL,'mandatory','DPDP Obligations',NULL,70,'2026-05-08 04:39:31'),('e7fcdd61-4a97-11f1-8bc3-00155d012902','d4e5f6a7-0017-0012-0001-000000000001',NULL,'APP-1','APP 1: Open and Transparent Management of Personal Information','Organizations must manage personal information openly and transparently, maintaining a clearly expressed up-to-date APP privacy policy.',NULL,'mandatory','Australian Privacy Principles',NULL,10,'2026-05-08 04:39:31'),('e7fce229-4a97-11f1-8bc3-00155d012902','d4e5f6a7-0017-0012-0001-000000000001',NULL,'APP-2','APP 2: Anonymity and Pseudonymity','Individuals must have the option of dealing with organizations anonymously or under a pseudonym, where lawful and practicable.',NULL,'mandatory','Australian Privacy Principles',NULL,20,'2026-05-08 04:39:31'),('e7fce3d4-4a97-11f1-8bc3-00155d012902','d4e5f6a7-0017-0012-0001-000000000001',NULL,'APP-3','APP 3: Collection of Solicited Personal Information','Organizations may only collect personal information that is reasonably necessary; sensitive information requires consent or a legally recognized exception.',NULL,'mandatory','Australian Privacy Principles',NULL,30,'2026-05-08 04:39:31'),('e7fce54e-4a97-11f1-8bc3-00155d012902','d4e5f6a7-0017-0012-0001-000000000001',NULL,'APP-4','APP 4: Dealing with Unsolicited Personal Information','Organizations must determine whether they could have collected unsolicited personal information under APP 3; if not, destroy or de-identify it.',NULL,'mandatory','Australian Privacy Principles',NULL,40,'2026-05-08 04:39:31'),('e7fce6c6-4a97-11f1-8bc3-00155d012902','d4e5f6a7-0017-0012-0001-000000000001',NULL,'APP-5','APP 5: Notification of Collection','At or before the time of collection, organizations must take reasonable steps to notify individuals of the matters set out in this principle.',NULL,'mandatory','Australian Privacy Principles',NULL,50,'2026-05-08 04:39:31'),('e7fce831-4a97-11f1-8bc3-00155d012902','d4e5f6a7-0017-0012-0001-000000000001',NULL,'APP-6','APP 6: Use or Disclosure of Personal Information','Personal information may only be used or disclosed for the primary purpose it was collected, or under specified secondary purpose exceptions.',NULL,'mandatory','Australian Privacy Principles',NULL,60,'2026-05-08 04:39:31'),('e7fce99a-4a97-11f1-8bc3-00155d012902','d4e5f6a7-0017-0012-0001-000000000001',NULL,'APP-7','APP 7: Direct Marketing','Personal information may not be used for direct marketing without consent; individuals must be provided an opt-out mechanism.',NULL,'mandatory','Australian Privacy Principles',NULL,70,'2026-05-08 04:39:31'),('e7fceafa-4a97-11f1-8bc3-00155d012902','d4e5f6a7-0017-0012-0001-000000000001',NULL,'APP-8','APP 8: Cross-Border Disclosure','Before disclosing personal information overseas, organizations must take reasonable steps to ensure the recipient does not breach the APPs.',NULL,'mandatory','Australian Privacy Principles',NULL,80,'2026-05-08 04:39:31'),('e7fcec5e-4a97-11f1-8bc3-00155d012902','d4e5f6a7-0017-0012-0001-000000000001',NULL,'APP-9','APP 9: Government Related Identifiers','Organizations must not adopt, use, or disclose a government related identifier of an individual unless an exception applies.',NULL,'mandatory','Australian Privacy Principles',NULL,90,'2026-05-08 04:39:31'),('e7fcedbb-4a97-11f1-8bc3-00155d012902','d4e5f6a7-0017-0012-0001-000000000001',NULL,'APP-10','APP 10: Quality of Personal Information','Organizations must take reasonable steps to ensure personal information collected, used, or disclosed is accurate, up-to-date, and complete.',NULL,'mandatory','Australian Privacy Principles',NULL,100,'2026-05-08 04:39:31'),('e7fcef23-4a97-11f1-8bc3-00155d012902','d4e5f6a7-0017-0012-0001-000000000001',NULL,'APP-11','APP 11: Security of Personal Information','Organizations must take reasonable steps to protect personal information from misuse, interference, loss, and unauthorized access, modification, or disclosure.',NULL,'mandatory','Australian Privacy Principles',NULL,110,'2026-05-08 04:39:31'),('e7fcf0b6-4a97-11f1-8bc3-00155d012902','d4e5f6a7-0017-0012-0001-000000000001',NULL,'APP-12','APP 12: Access to Personal Information','Organizations must give individuals access to their personal information on request, unless a specific access refusal ground applies.',NULL,'mandatory','Australian Privacy Principles',NULL,120,'2026-05-08 04:39:31'),('e7fcf21d-4a97-11f1-8bc3-00155d012902','d4e5f6a7-0017-0012-0001-000000000001',NULL,'APP-13','APP 13: Correction of Personal Information','Organizations must take reasonable steps to correct personal information to ensure it is accurate, up-to-date, complete, relevant, and not misleading.',NULL,'mandatory','Australian Privacy Principles',NULL,130,'2026-05-08 04:39:31'),('e819e3d0-4a97-11f1-8bc3-00155d012902','d4e5f6a7-0017-0013-0001-000000000001',NULL,'IPP-1','IPP 1: Purpose of Collection','Personal information shall not be collected unless the purpose of collection is connected with a lawful function of the agency.',NULL,'mandatory','NZ Privacy Principles',NULL,10,'2026-05-08 04:39:31'),('e819e865-4a97-11f1-8bc3-00155d012902','d4e5f6a7-0017-0013-0001-000000000001',NULL,'IPP-2','IPP 2: Source of Personal Information','Personal information shall be collected directly from the individual concerned, with limited exceptions.',NULL,'mandatory','NZ Privacy Principles',NULL,20,'2026-05-08 04:39:31'),('e819e9f3-4a97-11f1-8bc3-00155d012902','d4e5f6a7-0017-0013-0001-000000000001',NULL,'IPP-3','IPP 3: Collection of Information from Subject','Where personal information is collected from the individual, the agency must inform the individual of the purposes of collection.',NULL,'mandatory','NZ Privacy Principles',NULL,30,'2026-05-08 04:39:31'),('e819eb6e-4a97-11f1-8bc3-00155d012902','d4e5f6a7-0017-0013-0001-000000000001',NULL,'IPP-4','IPP 4: Manner of Collection','Personal information shall not be collected by unlawful means, or by means that in the circumstances are unfair or intrude to an unreasonable extent on the personal affairs of the individual.',NULL,'mandatory','NZ Privacy Principles',NULL,40,'2026-05-08 04:39:31'),('e819ecde-4a97-11f1-8bc3-00155d012902','d4e5f6a7-0017-0013-0001-000000000001',NULL,'IPP-5','IPP 5: Storage and Security','Agencies that hold personal information shall ensure the information is protected by such security safeguards as are reasonable in the circumstances.',NULL,'mandatory','NZ Privacy Principles',NULL,50,'2026-05-08 04:39:31'),('e819ee3e-4a97-11f1-8bc3-00155d012902','d4e5f6a7-0017-0013-0001-000000000001',NULL,'IPP-6','IPP 6: Access to Personal Information','Individuals are entitled to obtain confirmation of whether an agency holds personal information about them and to have access to that information.',NULL,'mandatory','NZ Privacy Principles',NULL,60,'2026-05-08 04:39:31'),('e819ef97-4a97-11f1-8bc3-00155d012902','d4e5f6a7-0017-0013-0001-000000000001',NULL,'IPP-7','IPP 7: Correction of Personal Information','Individuals are entitled to request correction of personal information where they believe it to be inaccurate, incomplete, or misleading.',NULL,'mandatory','NZ Privacy Principles',NULL,70,'2026-05-08 04:39:31'),('e819f0ed-4a97-11f1-8bc3-00155d012902','d4e5f6a7-0017-0013-0001-000000000001',NULL,'IPP-8','IPP 8: Accuracy of Personal Information','Agencies shall not use personal information without taking reasonable steps to ensure it is accurate, up-to-date, complete, and relevant.',NULL,'mandatory','NZ Privacy Principles',NULL,80,'2026-05-08 04:39:31'),('e819f242-4a97-11f1-8bc3-00155d012902','d4e5f6a7-0017-0013-0001-000000000001',NULL,'IPP-9','IPP 9: Retention','Agencies shall not keep personal information for longer than is required for the purpose for which the information may lawfully be used.',NULL,'mandatory','NZ Privacy Principles',NULL,90,'2026-05-08 04:39:31'),('e819f398-4a97-11f1-8bc3-00155d012902','d4e5f6a7-0017-0013-0001-000000000001',NULL,'IPP-10','IPP 10: Limits on Use of Personal Information','Agencies shall not use personal information for purposes other than those for which it was collected unless an exception applies.',NULL,'mandatory','NZ Privacy Principles',NULL,100,'2026-05-08 04:39:31'),('e819f4ec-4a97-11f1-8bc3-00155d012902','d4e5f6a7-0017-0013-0001-000000000001',NULL,'IPP-11','IPP 11: Limits on Disclosure of Personal Information','Agencies shall not disclose personal information unless the disclosure is directly related to the purpose of collection or an exception applies.',NULL,'mandatory','NZ Privacy Principles',NULL,110,'2026-05-08 04:39:31'),('e81a7487-4a97-11f1-8bc3-00155d012902','d4e5f6a7-0017-0013-0001-000000000001',NULL,'IPP-12','IPP 12: Unique Identifiers','Agencies shall not assign unique identifiers to individuals except where necessary; shall not require individuals to disclose their unique identifiers.',NULL,'mandatory','NZ Privacy Principles',NULL,120,'2026-05-08 04:39:31'),('e81a766a-4a97-11f1-8bc3-00155d012902','d4e5f6a7-0017-0013-0001-000000000001',NULL,'IPP-13','IPP 13: Transfers Overseas','Agencies shall not transfer personal information outside New Zealand unless the receiving country has comparable privacy protections or consent is obtained.',NULL,'mandatory','NZ Privacy Principles',NULL,130,'2026-05-08 04:39:31'),('e82935cb-4a97-11f1-8bc3-00155d012902','d4e5f6a7-0017-0014-0001-000000000001',NULL,'FADP-1','Scope and Definitions','Applies to processing of personal data of natural persons in Switzerland by private persons and federal bodies; excludes household activities.',NULL,'mandatory','FADP Sections',NULL,10,'2026-05-08 04:39:32'),('e8293a65-4a97-11f1-8bc3-00155d012902','d4e5f6a7-0017-0014-0001-000000000001',NULL,'FADP-2','Data Processing Principles','Data must be processed lawfully, in good faith, proportionately; purpose specification and accuracy must be maintained throughout processing.',NULL,'mandatory','FADP Sections',NULL,20,'2026-05-08 04:39:32'),('e8293c18-4a97-11f1-8bc3-00155d012902','d4e5f6a7-0017-0014-0001-000000000001',NULL,'FADP-3','Obligations of Controllers','Controllers must implement data protection by design and default, maintain records of processing activities, conduct DPIAs, and designate a DSCO where required.',NULL,'mandatory','FADP Sections',NULL,30,'2026-05-08 04:39:32'),('e8293da5-4a97-11f1-8bc3-00155d012902','d4e5f6a7-0017-0014-0001-000000000001',NULL,'FADP-4','Rights of Data Subjects','Data subjects have rights to information about their data, access to their data, correction, deletion, and data portability.',NULL,'mandatory','FADP Sections',NULL,40,'2026-05-08 04:39:32'),('e8293f1d-4a97-11f1-8bc3-00155d012902','d4e5f6a7-0017-0014-0001-000000000001',NULL,'FADP-5','Cross-Border Data Transfers','Personal data may be transferred abroad only to countries with adequate protection or under appropriate safeguards (SCCs, BCRs, or approved certifications).',NULL,'mandatory','FADP Sections',NULL,50,'2026-05-08 04:39:32'),('e8294082-4a97-11f1-8bc3-00155d012902','d4e5f6a7-0017-0014-0001-000000000001',NULL,'FADP-6','Enforcement and Penalties','The Federal Data Protection and Information Commissioner (FDPIC) oversees compliance; criminal sanctions of up to CHF 250,000 for violations.',NULL,'mandatory','FADP Sections',NULL,60,'2026-05-08 04:39:32'),('e8370b92-4a97-11f1-8bc3-00155d012902','d4e5f6a7-0017-0015-0001-000000000001',NULL,'DA-1','B2B and B2C Data Sharing (Connected Products)','Users of connected products have the right to access data generated by use of those products; manufacturers must design products to make data accessible by default.',NULL,'mandatory','EU Data Act Chapters',NULL,10,'2026-05-08 04:39:32'),('e8371043-4a97-11f1-8bc3-00155d012902','d4e5f6a7-0017-0015-0001-000000000001',NULL,'DA-2','Switching Cloud Providers','Cloud service providers must implement technical standards and contractual provisions enabling customers to switch providers without obstacles or excessive costs.',NULL,'mandatory','EU Data Act Chapters',NULL,20,'2026-05-08 04:39:32'),('e83711e4-4a97-11f1-8bc3-00155d012902','d4e5f6a7-0017-0015-0001-000000000001',NULL,'DA-3','Essential Requirements for Smart Contracts','Data sharing smart contracts must meet essential requirements for security, robustness, and termination mechanisms to ensure enforceable data access rights.',NULL,'mandatory','EU Data Act Chapters',NULL,30,'2026-05-08 04:39:32'),('e837135c-4a97-11f1-8bc3-00155d012902','d4e5f6a7-0017-0015-0001-000000000001',NULL,'DA-4','International Data Transfers','Providers of data processing services must implement technical and legal safeguards to prevent unlawful government access to non-personal data.',NULL,'mandatory','EU Data Act Chapters',NULL,40,'2026-05-08 04:39:32'),('e83714d0-4a97-11f1-8bc3-00155d012902','d4e5f6a7-0017-0015-0001-000000000001',NULL,'DA-5','Enforcement','Member states designate competent authorities to enforce the Data Act; penalties must be effective, proportionate, and dissuasive.',NULL,'mandatory','EU Data Act Chapters',NULL,50,'2026-05-08 04:39:32'),('e8427bf7-4a97-11f1-8bc3-00155d012902','d4e5f6a7-0017-0016-0001-000000000001',NULL,'DGA-1','Reuse of Public Sector Data','Establishes conditions and procedures for reuse of certain categories of protected public sector data (personal, IP-protected, confidential) held by public sector bodies.',NULL,'mandatory','EU DGA Chapters',NULL,10,'2026-05-08 04:39:32'),('e84280a6-4a97-11f1-8bc3-00155d012902','d4e5f6a7-0017-0016-0001-000000000001',NULL,'DGA-2','Data Sharing Services and Intermediaries','Providers of data intermediary services must notify authorities, comply with conditions ensuring neutrality, and may not use shared data for own purposes.',NULL,'mandatory','EU DGA Chapters',NULL,20,'2026-05-08 04:39:32'),('e8428365-4a97-11f1-8bc3-00155d012902','d4e5f6a7-0017-0016-0001-000000000001',NULL,'DGA-3','Data Altruism','Entities registered as recognized data altruism organizations may collect data for general interest purposes; must use a standardized consent form.',NULL,'recommended','EU DGA Chapters',NULL,30,'2026-05-08 04:39:32'),('e84284f4-4a97-11f1-8bc3-00155d012902','d4e5f6a7-0017-0016-0001-000000000001',NULL,'DGA-4','European Data Innovation Board (EDIB)','Establishes the EDIB to advise the Commission on data sharing practices, standards, and cross-border data flows in the European data space.',NULL,'mandatory','EU DGA Chapters',NULL,40,'2026-05-08 04:39:32'),('e8524681-4a97-11f1-8bc3-00155d012902','d4e5f6a7-0017-0017-0001-000000000001',NULL,'ePD-5','Confidentiality of Communications','Member states shall prohibit interception and surveillance of electronic communications and related traffic data without user consent.',NULL,'mandatory','ePrivacy Articles',NULL,10,'2026-05-08 04:39:32'),('e8524c33-4a97-11f1-8bc3-00155d012902','d4e5f6a7-0017-0017-0001-000000000001',NULL,'ePD-6','Traffic Data','Traffic data must be erased or made anonymous when no longer needed for transmission; processing for billing requires user consent.',NULL,'mandatory','ePrivacy Articles',NULL,20,'2026-05-08 04:39:32'),('e8524dc7-4a97-11f1-8bc3-00155d012902','d4e5f6a7-0017-0017-0001-000000000001',NULL,'ePD-9','Location Data','Location data other than traffic data may only be processed when anonymized or with users\' prior consent; users must be given opt-out right.',NULL,'mandatory','ePrivacy Articles',NULL,30,'2026-05-08 04:39:32'),('e8524f42-4a97-11f1-8bc3-00155d012902','d4e5f6a7-0017-0017-0001-000000000001',NULL,'ePD-5.3','Cookies and Similar Technologies (Consent)','Storage of or access to information on a user\'s device requires the user\'s prior informed consent (the \"cookie law\"); legitimate interest exceptions are limited.',NULL,'mandatory','ePrivacy Articles',NULL,40,'2026-05-08 04:39:32'),('e85250b4-4a97-11f1-8bc3-00155d012902','d4e5f6a7-0017-0017-0001-000000000001',NULL,'ePD-13','Unsolicited Communications (Spam)','Unsolicited commercial electronic communications (spam) are prohibited without prior consent; soft opt-in exception applies to existing customers.',NULL,'mandatory','ePrivacy Articles',NULL,50,'2026-05-08 04:39:32'),('e852521d-4a97-11f1-8bc3-00155d012902','d4e5f6a7-0017-0017-0001-000000000001',NULL,'ePD-4','Security of Services','Providers of publicly available electronic communications services must take appropriate technical and organizational measures to safeguard service security.',NULL,'mandatory','ePrivacy Articles',NULL,60,'2026-05-08 04:39:32'),('e8668da4-4a97-11f1-8bc3-00155d012902','d4e5f6a7-0017-0018-0001-000000000001',NULL,'CBPR-1','Preventing Harm','Personal information should be used in ways that prevent misuse; organizations should give special consideration to harms that could result from collection and use.',NULL,'mandatory','CBPR Principles',NULL,10,'2026-05-08 04:39:32'),('e8669382-4a97-11f1-8bc3-00155d012902','d4e5f6a7-0017-0018-0001-000000000001',NULL,'CBPR-2','Notice','Individuals should be notified about the collection, use, and disclosure of their personal information in clear and easily accessible statements.',NULL,'mandatory','CBPR Principles',NULL,20,'2026-05-08 04:39:32'),('e866951e-4a97-11f1-8bc3-00155d012902','d4e5f6a7-0017-0018-0001-000000000001',NULL,'CBPR-3','Collection Limitation','Collection of personal information should be limited to information that is relevant to the purposes of collection and obtained by lawful and fair means.',NULL,'mandatory','CBPR Principles',NULL,30,'2026-05-08 04:39:32'),('e86696e3-4a97-11f1-8bc3-00155d012902','d4e5f6a7-0017-0018-0001-000000000001',NULL,'CBPR-4','Uses of Personal Information','Personal information collected should be used only to fulfill the purposes of collection and other compatible or related purposes.',NULL,'mandatory','CBPR Principles',NULL,40,'2026-05-08 04:39:32'),('e8669860-4a97-11f1-8bc3-00155d012902','d4e5f6a7-0017-0018-0001-000000000001',NULL,'CBPR-5','Choice','Individuals should be given the ability to choose whether and how their personal information may be collected, used, and disclosed.',NULL,'mandatory','CBPR Principles',NULL,50,'2026-05-08 04:39:32'),('e86699bb-4a97-11f1-8bc3-00155d012902','d4e5f6a7-0017-0018-0001-000000000001',NULL,'CBPR-6','Integrity of Personal Information','Personal information should be accurate, complete, and kept up-to-date to the extent necessary for the purposes of use.',NULL,'mandatory','CBPR Principles',NULL,60,'2026-05-08 04:39:32'),('e8669b1b-4a97-11f1-8bc3-00155d012902','d4e5f6a7-0017-0018-0001-000000000001',NULL,'CBPR-7','Security Safeguards','Appropriate technical, physical, and organizational safeguards should be applied to protect personal information against risks of loss, unauthorized access, or disclosure.',NULL,'mandatory','CBPR Principles',NULL,70,'2026-05-08 04:39:32'),('e8669c7e-4a97-11f1-8bc3-00155d012902','d4e5f6a7-0017-0018-0001-000000000001',NULL,'CBPR-8','Access and Correction','Individuals should be able to obtain access to their personal information from data controllers and to correct inaccurate information.',NULL,'mandatory','CBPR Principles',NULL,80,'2026-05-08 04:39:32'),('e8669dd7-4a97-11f1-8bc3-00155d012902','d4e5f6a7-0017-0018-0001-000000000001',NULL,'CBPR-9','Accountability','Organizations must be accountable for complying with the CBPR privacy principles and provide mechanisms for individuals to address complaints.',NULL,'mandatory','CBPR Principles',NULL,90,'2026-05-08 04:39:32'),('e925195e-a5f8-4a84-8823-6df95025e13c','a25c0c03-4113-11f1-8bc3-00155d012902',NULL,'A.5','Organizational controls',NULL,NULL,'mandatory','Annex A Controls',NULL,7,'2026-04-26 02:00:01'),('eb781882-528c-41aa-b749-028ecbf7cfd0','161ca661-dcfc-41d6-ae04-4d515194f119','b9936327-400e-11f1-8bc3-00155d012902','Art.32.1.a','Pseudonymisation and encryption','Implement pseudonymisation and encryption of personal data.',NULL,'mandatory',NULL,NULL,0,'2026-04-26 02:00:00'),('ecee91a4-a5cd-42d7-bc50-f43b0f18480b','d4e5f6a1-b2c3-4d4e-8f6a-1b2c3d4e5f6a','415a8bdc-329f-4be1-9611-27b241e3cbdf','164.406(a)','Individual Notification','Notify each individual whose unsecured PHI has been or is reasonably believed to have been, accessed, acquired, used, or disclosed.',NULL,'mandatory',NULL,NULL,0,'2026-04-26 02:00:00'),('ee5dcf4f-bbf5-4418-b143-812bac34cbae','a27eef01-4113-11f1-8bc3-00155d012902','69d65d36-46ec-431d-9f7e-3eac15afb93d','GV.PO','Policy','Organizational cybersecurity policy is established, communicated, and enforced.',NULL,'mandatory',NULL,NULL,3,'2026-04-26 02:00:01'),('eff5c5fc-faa4-4f71-a698-55b336c9ad19','a2a4e62d-4113-11f1-8bc3-00155d012902','d469fe64-f77c-46ea-a29d-81908bdd28d7','A1.2','Environmental protections','The entity authorizes, designs, develops or acquires, implements, operates, approves, maintains, and monitors environmental protections.',NULL,'recommended',NULL,NULL,1,'2026-04-26 02:00:01'),('eff6538b-2240-4063-b284-3e778c8e50b6','161ca661-dcfc-41d6-ae04-4d515194f119','b9930df0-400e-11f1-8bc3-00155d012902','Art.5.1.a','Lawfulness, fairness and transparency','Personal data shall be processed lawfully, fairly and in a transparent manner in relation to the data subject.',NULL,'mandatory',NULL,NULL,0,'2026-04-26 02:00:00'),('f0ecc496-ad8b-41f0-b93f-4ac30b6a14a2','a28c08f1-4113-11f1-8bc3-00155d012902',NULL,'4','Protect Cardholder Data with Strong Cryptography During Transmission Over Open, Public Networks',NULL,NULL,'mandatory','Encryption in Transit',NULL,3,'2026-04-26 02:00:01'),('f29f6a69-1b83-468a-99ca-41ddfff15d47','a28c08f1-4113-11f1-8bc3-00155d012902',NULL,'3','Protect Stored Account Data','Protection methods such as encryption, truncation, masking, and hashing are critical components of account data protection.',NULL,'mandatory','Data Protection',NULL,2,'2026-04-26 02:00:01'),('f5d7e387-e22f-4800-93f7-ff6aac980759','a23897c7-4113-11f1-8bc3-00155d012902',NULL,'SYSC.7','Risk control',NULL,NULL,'mandatory','Risk Management',NULL,4,'2026-04-26 02:00:00'),('f674089d-e8bd-489c-bdf6-ef75f7dda891','a25c0c03-4113-11f1-8bc3-00155d012902','0af8380e-b045-444d-90d8-9845e51354d9','6.1.3','Information security risk treatment','Define and apply an information security risk treatment process.',NULL,'mandatory',NULL,NULL,2,'2026-04-26 02:00:00'),('f76fc69e-71d5-4799-892b-3db37732a238','a27eef01-4113-11f1-8bc3-00155d012902','35f1dd40-f7cc-43ae-ba7f-3006b4233500','ID.AM','Asset Management','Assets that enable the organization to achieve business purposes are identified and managed consistent with their relative importance.',NULL,'mandatory',NULL,NULL,0,'2026-04-26 02:00:01'),('f8118019-7758-463e-8282-f0fdc6632bde','a271e304-4113-11f1-8bc3-00155d012902','b2390b23-4231-4a58-92e2-ca248bc259bf','4.3','Technology risk identification and assessment','Establish processes to identify and assess technology risks in a timely and systematic manner.',NULL,'mandatory',NULL,NULL,2,'2026-04-26 02:00:01'),('fa56d813-4435-4b55-ac08-34b899c6ba83','161ca661-dcfc-41d6-ae04-4d515194f119','b9930df0-400e-11f1-8bc3-00155d012902','Art.5.1.d','Accuracy','Personal data shall be accurate and, where necessary, kept up to date.',NULL,'mandatory',NULL,NULL,3,'2026-04-26 02:00:00'),('fa85eae2-818a-455c-8e09-2a64091f6fe8','a25c0c03-4113-11f1-8bc3-00155d012902','215be14c-3698-4fce-a463-7aab14e4f886','4.2','Understanding the needs and expectations of interested parties','Determine the interested parties relevant to the ISMS and their requirements.',NULL,'mandatory',NULL,NULL,1,'2026-04-26 02:00:00'),('fc367235-0df3-4391-b94d-7ccc4c74c1dc','a25c0c03-4113-11f1-8bc3-00155d012902',NULL,'10','Improvement',NULL,NULL,'mandatory','Continual Improvement',NULL,6,'2026-04-26 02:00:01'),('fcba0871-2ad7-40fa-a16f-ef5551f41c00','a2a4e62d-4113-11f1-8bc3-00155d012902','4117244c-a7d4-4faf-a1cb-1a2cacf4d760','CC7.1','Vulnerability detection','The entity uses detection and monitoring procedures to identify changes to configurations.',NULL,'mandatory',NULL,NULL,0,'2026-04-26 02:00:01'),('fe1bd407-bcfb-4e19-8a92-94ee2ae6d821','a25c0c03-4113-11f1-8bc3-00155d012902','b5d335e2-66ea-4a33-b65f-e52f9b7ce7d6','7.3','Awareness','Persons doing work under the organization\'s control shall be aware of the information security policy.',NULL,'mandatory',NULL,NULL,2,'2026-04-26 02:00:00'),('feec5f76-5aeb-411c-9a39-bf09fef71bca','a28c08f1-4113-11f1-8bc3-00155d012902','93c9b683-2438-437b-8bc5-6db8a529ed85','8.4','Multi-factor authentication (MFA) is implemented to secure access',NULL,NULL,'mandatory',NULL,NULL,2,'2026-04-26 02:00:01');
