Library

Canonical Controls

201 controls across 11 domains

ProfileHide the 11 controls this profile rules outApplicability statement →

ID	Name	Tier	Applicability	Mappings
AIG-001	AI PolicyAI	T1	required	15
AIG-002	AI Roles and ResponsibilitiesAI	T1	required	17
AIG-003	AI System InventoryAIGeneral-purpose model	T1	required	14
AIG-005	AI Risk Management ProcessAI	T2	required	43
AIG-006	AI Impact AssessmentAI	T2	required	25
AIG-007	AI System Requirements and Design DocumentationAI	T2	required	13
AIG-008	AI System Verification, Validation and TestingAI	T2	required	38
AIG-009	AI System Deployment and Change ManagementAI	T2	required	15
AIG-010	AI Model Registry and VersioningAI	T2	required	20
AIG-011	AI System DecommissioningAI	T2	required	4
AIG-012	Training Data Management and QualityAI	T2	required	27
AIG-013	Training Data ProvenanceAI	T2	required	29
AIG-014	Special Category Data in Training and Evaluation DatasetsAI	T2	required	10
AIG-015	AI System Technical DocumentationAI	T2	required	24
AIG-016	AI Interaction and Output DisclosureAIGenerative	T2	required	34
AIG-017	AI Model ExplainabilityAIPredictive	T2	required	13
AIG-018	AI System Operational MonitoringAI	T2	required	22
AIG-019	AI Model Performance and Drift DetectionAIPredictive	T2	required	16
AIG-020	AI System Event LoggingAIAgenticGenerative	T2	required	23
AIG-021	AI Incident Response and Error CommunicationAI	T2	required	22
AIG-022	Human Oversight of AI OutputsAI	T2	required	18
AIG-023	AI System Override and Safe-State MechanismsAI	T2	required	15
AIG-024	Prohibited AI PracticesAIGenerativePredictive	T2	required	23
AIG-025	AI Fairness and Bias ControlsAIPredictive	T2	required	18
AIG-026	AI Security and Adversarial RobustnessAIGenerative	T2	required	52
AIG-027	AI Output Validation and Confidence ControlsAIPredictive	T2	required	18
AIG-028	Hallucination and Factual Accuracy ControlsAIGenerative	T2	required	17
AIG-029	Prompt Injection ProtectionAIAgenticGenerative	T2	required	16
AIG-031	AI Misuse, Jailbreak and Abuse DetectionAIGenerative	T2	required	37
AIG-032	Third-Party AI Risk ManagementAIGeneral-purpose model	T2	required	24
AIG-034	Customer and Deployer Obligations CommunicationAI	T2	required	18
AIG-036	AI Quality Management SystemAI	T3	conditional	7
AIG-037	AI Regulatory Conformity Assessment and DeclarationAI	T3	conditional	7
AIG-038	AI Feedback and Adverse Impact Reporting ChannelAI	T2	required	30
AIG-039	Responsible and Intended Use of AI SystemsAI	T1	required	12
AIG-040	Customer Data Use in Model TrainingAI	T2	required	13
AIG-041	Regulatory Authorised RepresentativeAIGeneral-purpose model	T2	conditional	2
AIG-042	Agentic Tool Permissions and Action AuthorisationAIAgentic	T2	required	30
AIG-043	AI Non-Conformity Corrective Action and Authority CooperationAI	T2	conditional	6
AIG-044	Workplace AI Deployment Notification to WorkersAI	T2	not-applicable	2
AIG-045	Deployer Registration in a Public AI RegisterAI	T1	not-applicable	2
AIG-046	Fundamental Rights Impact AssessmentAI	T2	not-applicable	7
AIG-047	General-Purpose Model Documentation and Downstream InformationAIGeneral-purpose model	T2	not-applicable	7
AIG-048	Public Training Content SummaryAIGeneral-purpose model	T2	not-applicable	2
AIG-049	Copyright Policy and Rights Reservation ComplianceAIGeneral-purpose model	T2	not-applicable	8
AIG-050	Systemic Risk Framework and Acceptance DeterminationAIGeneral-purpose model	T3	not-applicable	20
AIG-051	Model Evaluation Under Standardised ProtocolsAIGeneral-purpose model	T3	not-applicable	6
AIG-052	Model Weight and Infrastructure ProtectionAIGeneral-purpose model	T3	not-applicable	8
AIG-053	Serious Incident Reporting to the AI OfficeAIGeneral-purpose model	T3	not-applicable	7
AIG-054	Safety and Security Model ReportAIGeneral-purpose model	T3	not-applicable	10
AIG-055	Training Pipeline SecurityAI	T2	required	3
AIG-056	Agent Memory and Context IntegrityAIAgentic	T2	required	4
AIG-057	Inbound Synthetic Media DetectionAI	T2	required	4
APP-001	Secure Development Lifecycle Policy	T2	required	12
APP-002	Security Requirements in Design	T2	required	12
APP-003	Secure Coding Standards	T2	required	7
APP-004	Security Testing in the Development Pipeline	T2	required	11
APP-005	Penetration Testing	T2	required	11
APP-007	Software Supply Chain and Dependency Management	T2	required	17
APP-008	Secrets Management	T1	required	8
APP-009	Change Management	T2	required	25
APP-010	Environment Separation	T2	required	11
APP-011	API Security	T2	required	13
APP-012	Software Integrity Verification	T2	required	23
APP-013	Secure System Architecture and Design Principles	T2	required	13
APP-014	Vulnerability Disclosure Programme	T2	required	8
APP-015	Processing Integrity	T2	required	10
APP-016	Sandboxed Execution of Untrusted CodeGenerative	T2	required	10
BCM-001	Business Continuity Plan	T2	required	24
BCM-002	Disaster Recovery Plan	T2	required	13
BCM-003	RTO and RPO Definitions	T2	required	9
BCM-004	Backup Policy and Implementation	T1	required	12
BCM-005	Backup Restoration Testing	T1	required	12
BCM-006	BCM and DR Testing	T2	required	12
BCM-007	Alternate Processing and Communications	T2	required	15
BCM-008	Business Impact Analysis	T2	required	9
BCM-009	Backup Immutability and Isolation	T2	required	8
BCM-010	Third-Party and AI Provider Service Continuity	T2	required	13
DAT-001	Data Classification Scheme	T2	required	18
DAT-002	Information Labelling	T2	required	6
DAT-003	Encryption at Rest	T1	required	24
DAT-004	Encryption in Transit	T1	required	30
DAT-005	Cryptographic Key Management	T2	required	48
DAT-006	Data Inventory and Records of Processing	T2	required	16
DAT-007	Data Minimisation and Purpose Limitation	T2	required	11
DAT-008	Data Retention and Deletion	T2	required	22
DAT-009	Privacy Notice and Transparency	T2	required	11
DAT-010	Consent Management	T2	required	10
DAT-011	Data Subject Rights Fulfilment	T2	required	16
DAT-012	Data Protection by Design and Default	T2	required	9
DAT-013	Data Protection Impact Assessment	T2	required	10
DAT-015	Data Transfer Controls	T2	required	12
DAT-016	Data Masking and Pseudonymisation	T2	required	17
DAT-017	Data Leakage Prevention	T2	required	14
DAT-018	Data Protection Officer	T3	required	5
DAT-019	Lawful Basis for Processing	T2	required	11
DAT-020	Accuracy of Personal Data	T2	required	7
DAT-021	Customer-Managed Encryption Keys	T3	required	5
DAT-022	Data Residency and Location Transparency	T2	required	11
DAT-023	Customer Data Export and Portability	T2	required	20
DAT-024	Special Category and Criminal Conviction Data	T2	required	4
DAT-025	Automated Decision-Making and Profiling Rights	T2	required	3
DAT-026	Customer Transition and Switching Execution	T2	required	10
DAT-027	Switching Interfaces and Functional Equivalence Support	T2	required	5
GOV-001	Information Security Policy	T1	required	16
GOV-002	Information Security Roles and Responsibilities	T1	required	10
GOV-003	Management Commitment and Accountability	T2	required	10
GOV-004	Information Security Programme	T2	required	16
GOV-005	Risk Assessment	T2	required	18
GOV-006	Risk Management Programme	T2	required	15
GOV-007	Risk Treatment and Remediation Tracking	T2	required	12
GOV-008	Fraud Risk Assessment	T2	required	3
GOV-009	Segregation of Duties	T2	required	7
GOV-010	Legal, Regulatory and Contractual Compliance Inventory	T2	required	19
GOV-011	Compliance Monitoring and Internal Audit	T2	required	20
GOV-012	Continuous Monitoring Strategy	T2	required	18
GOV-013	Exception and Requirement Determination Register	T2	required	9
GOV-014	Asset Inventory	T1	required	17
GOV-015	Intellectual Property Rights Management	T2	required	10
GOV-016	Records and Information Governance	T2	required	16
GOV-018	Threat Intelligence Programme	T2	required	21
GOV-019	Information Security in Project Management	T2	required	3
GOV-020	Independent Security Review	T2	required	21
GOV-021	Audit and Assurance Policy	T2	required	6
GOV-022	Privacy Programme and Data Protection Policy	T2	required	11
GOV-023	Security Measures Performance Measurement	T2	required	18
GOV-024	Documented Operating Procedures	T2	required	11
GOV-028	Regulatory Cooperation and Supervisory Access	T2	required	3
HRS-001	Personnel Security Policy	T2	required	7
HRS-002	Pre-Employment Background Screening	T2	required	16
HRS-003	Employment Agreements and Security Obligations	T1	required	14
HRS-004	Security Awareness Training	T1	required	26
HRS-005	Role-Based Security Training	T2	required	13
HRS-006	Disciplinary Process for Security Violations	T2	required	8
HRS-007	Termination and Access Revocation	T1	required	14
HRS-008	Remote Working Security	T2	required	7
HRS-009	Security Event Reporting Channel	T1	required	10
HRS-010	Personnel Roles and Security Responsibilities	T2	required	7
HRS-011	Acceptable Use of Information Assets	T1	required	21
HRS-012	Insider Threat Programme	T2	required	4
HRS-013	AI Literacy and Role-Based AI Training	T1	required	21
IAM-001	Access Control Policy	T1	required	13
IAM-002	Identity Inventory and Unique Identifiers	T1	required	11
IAM-003	User Account Lifecycle Management	T1	required	21
IAM-004	Access Review and Recertification	T1	required	11
IAM-005	Least Privilege and Need-to-Know Enforcement	T1	required	20
IAM-007	Privileged Access Management	T2	required	20
IAM-008	Multi-Factor Authentication	T1	required	16
IAM-009	Authentication Information Management	T1	required	14
IAM-010	Service Account and Non-Human Identity Management	T2	required	15
IAM-011	Remote Access Controls	T2	required	9
IAM-012	Session Management	T2	required	10
IAM-013	Logon Failure and Account Lockout	T1	required	6
IAM-014	Access to Source Code and Development Assets	T2	required	12
IAM-015	Role-Based Access Control	T2	required	11
IAM-016	Dedicated Administration Systems	T2	required	5
INC-001	Incident Response Plan	T1	required	21
INC-002	Incident Detection and Triage	T2	required	13
INC-003	Incident Classification and Escalation	T2	required	16
INC-004	Incident Containment and Eradication	T2	required	12
INC-005	Incident Reporting and Regulatory Notification	T2	required	24
INC-006	Customer Incident and Cyber Threat Notification	T2	required	11
INC-007	Evidence Collection and Preservation	T2	required	6
INC-008	Post-Incident Review	T2	required	12
INC-009	Incident Response Training and Testing	T2	required	16
INC-010	External Contact and Communication Points	T2	required	10
INF-002	Configuration Baseline and Hardening	T1	required	28
INF-003	System Component Inventory	T1	required	9
INF-004	Network Segmentation	T2	required	11
INF-005	Secure Network Architecture and Defence	T2	required	23
INF-007	Vulnerability Management	T1	required	26
INF-008	Patch Management	T1	required	9
INF-009	Malware and Endpoint Protection	T2	required	24
INF-012	Capacity and Performance Management	T2	required	12
INF-013	Infrastructure Redundancy	T2	required	14
INF-014	Clock Synchronisation	T1	required	7
INF-015	Multi-Tenant and Workload Isolation	T2	required	13
INF-016	Domain, DNS and Routing Security	T1	required	4
INF-017	Managed Endpoint Baseline	T1	required	44
INF-018	Physical Access and Environmental Protection	T2	required	53
MON-001	Audit Log Scope and Generation	T1	required	19
MON-002	Log Integrity and Protection	T2	required	16
MON-003	Log Retention	T1	required	8
MON-004	Centralised Log Management	T2	required	20
MON-005	Security Monitoring and Alerting	T2	required	25
MON-008	Detection Content Lifecycle	T2	required	5
MON-009	Log Access Control and Sensitive Data in Logs	T2	required	7
MON-010	Availability and SLO Monitoring with Status Communication	T2	required	9
VND-001	Vendor Risk Assessment and Due Diligence	T2	required	42
VND-002	Security Requirements in Vendor Contracts	T2	required	36
VND-003	Sub-Processor Management	T2	required	14
VND-004	Cloud Service Provider Security Management	T2	required	11
VND-006	Vendor Monitoring and Performance Review	T2	required	24
VND-007	Vendor Access Controls	T2	required	10
VND-008	Vendor Offboarding	T2	required	11
VND-010	Third-Party Data Disclosure Controls	T2	required	10
VND-011	Shared Responsibility Model and Customer Security Communication	T2	required	29
VND-012	Government and Law Enforcement Data Request Handling	T2	required	9
VND-013	Regulatory and Exit Terms in Customer Agreements	T2	required	26
VND-014	Customer and Regulator Audit and Inspection Rights	T2	required	8
VND-015	Subcontractor Disclosure and Change Approval	T2	required	10

Search controls and profiles

Canonical Controls