Skip to main content
Coverbase ships a curated Control Set library: ready-to-use control set templates you fork into your organization, tailor, and apply. Templates are versioned and maintained by Coverbase, and administrators can promote additional private templates from an uploaded spreadsheet. The library has two halves, reached from different tabs on the Controls page:

Vendor Controls Library

101 templates · 6,710 controls. Frameworks, regulations and questionnaires you assess a third party against: ISO 27001, SIG, HECVAT, NIST CSF, HIPAA, PCI DSS and the rest. Opens from the Vendor Controls tab.

Internal Controls Library

22 templates · 396 controls. Controls Coverbase Inspect evaluates against your own applications by signing in and reading the live admin console. Opens from the Internal Controls tab.
That is 123 templates spanning 7,106 curated controls in total. This page documents each one in more depth than the in-app picker: its full description, the risk types and domains it addresses, typical use cases, its control count, and, where the template is derived from a published framework, a link to the authoritative source.
Which library a template appears in follows from the kind of control set it creates, so a template is only ever listed in one of them. Forking either one produces an ordinary control set you own and can edit; nothing syncs back.
Control counts and wording are Coverbase’s structured interpretation of each source framework, intended to accelerate assessment. They are not a substitute for the official standard. Always consult the linked primary source for authoritative, legally binding text.

​
Vendor Controls Library

The 101 templates below assess a third party. Fork one, tailor it, then apply it to vendors, services, or assessments.

​
Cybersecurity & vendor security

Coverbase’s curated set of publicly verifiable security controls based on observable evidence available without vendor cooperation.Official source: Coverbase Content Library
  • Risk types: Information Security, Third-Party Risk
  • Risk domains: Vendor Due Diligence, Risk Governance
  • Typical use cases: Initial vendor screening; Lightweight due diligence; Passive vendor risk assessment; Pre-engagement risk triage
  • Coverage: 28 controls across 5 sections
Cloud Security Alliance Consensus Assessments Initiative Questionnaire v4, designed to assess cloud service providers against CCM security controls.Official source: CSA Cloud Controls Matrix / CAIQ
  • Risk types: Information Security, Third-Party Risk
  • Risk domains: Cloud Security, Data Protection, Identity & Access Management
  • Typical use cases: Cloud provider due diligence; SaaS vendor security assessment; Cloud security maturity evaluation; CSA STAR certification readiness
  • Coverage: 261 controls across 17 sections
Higher Education Community Vendor Assessment Tool (HECVAT) Full v4, the long-form questionnaire for assessing vendor security in higher education contexts.Official source: EDUCAUSE - HECVAT
  • Risk types: Third-Party Risk, Information Security, Data Privacy
  • Risk domains: Vendor Due Diligence, Data Protection
  • Typical use cases: Higher education vendor assessments; University third-party risk management; EdTech platform security evaluation; FERPA-aligned vendor due diligence
  • Coverage: 227 controls across 18 sections
Higher Education Community Vendor Assessment Tool (HECVAT) Lite v4, a condensed questionnaire for lower-risk vendors in higher education environments.Official source: EDUCAUSE - HECVAT
  • Risk types: Third-Party Risk, Information Security
  • Risk domains: Vendor Due Diligence, Data Protection
  • Typical use cases: Lightweight higher education vendor review; Annual vendor reassessments; Low-risk EdTech evaluation; Tiered vendor risk program (education)
  • Coverage: 56 controls across 11 sections
ISO/IEC 27001:2022 Edition 3, the international standard for information security management systems (ISMS), updated with new controls for cloud security, threat intelligence, and privacy.Official source: ISO/IEC 27001:2022
  • Risk types: Information Security, Regulatory Compliance
  • Risk domains: Risk Governance, Data Protection, Cloud Security
  • Typical use cases: ISO 27001 certification readiness; ISMS implementation assessment; International security compliance; Supply chain security evaluation
  • Coverage: 93 controls across 4 sections
MITRE ATT&CK framework controls mapped to adversary tactics, techniques, and procedures (TTPs) for evaluating threat detection and response capabilities.Official source: MITRE ATT&CK
  • Risk types: Information Security, Operational Risk
  • Risk domains: Threat Intelligence, Incident Response, Network Security
  • Typical use cases: Threat detection capability assessment; Red team readiness evaluation; SOC maturity measurement; Adversary simulation alignment
  • Coverage: 52 controls across 19 sections
The original NIST Cybersecurity Framework covering five core functions: Identify, Protect, Detect, Respond, and Recover. Widely adopted as the foundational cybersecurity standard.Official source: NIST Cybersecurity Framework 1.1
  • Risk types: Information Security, Operational Risk
  • Risk domains: Risk Governance, Network Security, Incident Response
  • Typical use cases: Cybersecurity program baseline; Legacy CSF alignment; Security maturity measurement; NIST CSF 1.1 compliance verification
  • Coverage: 108 controls across 23 sections
NIST Cybersecurity Framework 2.0, updated in 2024 with a new Govern function, covering cybersecurity risk management for organizations of any size.Official source: NIST Cybersecurity Framework
  • Risk types: Information Security, Operational Risk
  • Risk domains: Risk Governance, Network Security, Incident Response
  • Typical use cases: Cybersecurity program governance; Board-level security reporting; Regulatory baseline alignment; Third-party risk governance
  • Coverage: 106 controls across 22 sections
The Shared Assessments SIG Core questionnaire, an 800+ question vendor risk assessment covering 20 risk domains.Official source: Shared Assessments - SIG
  • Risk types: Information Security, Third-Party Risk, Operational Risk
  • Risk domains: Vendor Due Diligence, Cloud Security, Identity & Access Management
  • Typical use cases: Full third-party vendor due diligence; Enterprise vendor risk assessments; Outsourced service provider evaluations; Regulatory-aligned vendor management
  • Coverage: 755 controls across 33 sections
A condensed version of the SIG Core questionnaire for lower-risk vendors, covering the most critical risk domains with fewer questions.Official source: Shared Assessments - SIG
  • Risk types: Third-Party Risk, Information Security
  • Risk domains: Vendor Due Diligence, Data Protection
  • Typical use cases: Lower-risk vendor assessments; Annual reassessments of established vendors; Faster onboarding due diligence; Tiered vendor risk programs
  • Coverage: 126 controls across 33 sections
Vendor Security Alliance (VSA) questionnaire 2025, a vendor security assessment covering cloud security, data management, and operational resilience.Official source: Vendor Security Alliance
  • Risk types: Third-Party Risk, Information Security, Operational Risk
  • Risk domains: Vendor Due Diligence, Cloud Security, Operational Continuity
  • Typical use cases: Vendor security program assessment; Cloud and SaaS vendor evaluation; VSA member organization compliance; Enterprise third-party risk management
  • Coverage: 106 controls across 7 sections

​
Compliance, privacy & payments

Supplier due diligence for Canadian designated operators under the Critical Cyber Systems Protection Act. Covers supply chain and third-party risk identification under section 9(1)(a), the duty to mitigate as soon as a risk is identified under section 15, incident notification fast enough for the 72 hour report to the Communications Security Establishment under section 17, material change notice under section 14, and the records section 30 requires.Official source: Bill C-8, Critical Cyber Systems Protection Act
  • Risk types: Regulatory Compliance, Third-Party Risk, Information Security, Operational Risk
  • Risk domains: Supply Chain, Vendor Due Diligence, Incident Response, Risk Governance, Resilience
  • Typical use cases: Canadian designated operator supplier due diligence; CCSPA s. 9(1)(a) supply chain risk identification; CCSPA s. 15 third-party risk mitigation; Critical cyber system supplier onboarding; CCSPA s. 30 record keeping
  • Coverage: 42 controls across 10 sections
California Consumer Privacy Act (CCPA) and California Privacy Rights Act (CPRA) requirements for businesses handling California residents’ personal information.Official source: California OAG - CCPA
  • Risk types: Data Privacy, Regulatory Compliance
  • Risk domains: Privacy Rights, Data Protection
  • Typical use cases: California privacy law compliance; Consumer data rights assessment; Data service provider evaluation; US state privacy law alignment
  • Coverage: 23 controls across 17 sections
Supplier due diligence on Chinese data exposure for a vendor, CRO, clinical site, distributor or affiliate that processes data in mainland China or moves it out: how the Cybersecurity Law, Data Security Law and PIPL layer, PIPL’s lawful bases and separate consent, the three Article 38 transfer routes and the thresholds the 2024 cross-border Provisions set for each, important data and CIIO designation, the Human Genetic Resources approval and filing regime that binds clinical research, localisation in practice, government and foreign-authority data requests, and exit.Official source: Personal Information Protection Law of the People’s Republic of China
  • Risk types: Regulatory Compliance, Data Privacy, Third-Party Risk, Life Sciences
  • Risk domains: Data Protection, Privacy Rights, Vendor Due Diligence, Pharmaceutical, Risk Governance
  • Typical use cases: China CRO and clinical site data diligence; PIPL cross-border transfer route verification; Human genetic resources approval and filing evidence; China affiliate data localisation review; Distributor and agent personal information review
  • Coverage: 60 controls across 12 sections
COBIT 5/2019 governance and management framework for enterprise IT, covering IT governance, risk management, and information systems controls.Official source: ISACA - COBIT
  • Risk types: Operational Risk, Regulatory Compliance, Financial Controls
  • Risk domains: Risk Governance, Operational Continuity
  • Typical use cases: IT governance program assessment; Enterprise risk management alignment; IT audit readiness; SOX IT controls evaluation
  • Coverage: 30 controls across 7 sections
The customer-side (user entity) controls a SOC 2 report assigns to the organizations that consume a service, organized to mirror the five Trust Services Criteria categories. Use it to track the shared-responsibility controls you must implement for a provider’s SOC 2 controls to operate effectively.Official source: AICPA SOC 2 (Trust Services Criteria)
  • Risk types: Third-Party Risk, Information Security, Regulatory Compliance
  • Risk domains: Vendor Due Diligence, Data Protection, Risk Governance
  • Typical use cases: SOC 2 shared-responsibility tracking; Vendor onboarding CUEC attestation; User-entity control self-assessment; Third-party SOC report review
  • Coverage: 30 controls across 5 sections
Supplier due diligence across the EU sustainability regime as it now stands after the Omnibus I simplification package: CSRD and the revised ESRS of Delegated Regulation (EU) 2026/1563, the value-chain cap and the VSME ceiling in Delegated Regulation (EU) 2026/1560, the amended CSDDD risk-based duty with its deleted climate transition plan and civil liability provisions, EUDR plot-level data and due diligence statements on the amended 2026 and 2027 dates, and CBAM embedded-emissions data under the amended 50 tonne de minimis.Official source: Directive (EU) 2024/1760 (Corporate Sustainability Due Diligence)
  • Risk types: Regulatory Compliance, Third-Party Risk, Operational Risk, Audit Readiness
  • Risk domains: Supply Chain, Vendor Due Diligence, Risk Governance, Logistics, Manufacturing Quality
  • Typical use cases: CSRD value-chain data collection from a supplier; Value-chain cap and VSME ceiling assessment; CSDDD chain-of-activities supplier onboarding; EUDR relevant-product and plot-level data request; CBAM embedded-emissions data collection from a non-EU installation
  • Coverage: 57 controls across 13 sections
Due diligence for a processor handling special-category health, genetic or biometric data on our behalf in a life-sciences context: clinical trial data, patient-support programmes, real-world-evidence and registry vendors, genomic sequencing providers, medical-device telemetry and pharmacovigilance safety data. Covers the Article 9(2) condition relied on and Article 9(4) Member State derogations, the Article 28 processor terms clause by clause, Article 32 security and the pseudonymisation key, Article 33(2) notification to the controller, Chapter V transfers under the 2021 Standard Contractual Clauses, Article 89 research safeguards, and readiness for the European Health Data Space Regulation (EU) 2025/327.Official source: EU GDPR (Regulation 2016/679)
  • Risk types: Data Privacy, Regulatory Compliance, Third-Party Risk, Healthcare, Life Sciences
  • Risk domains: Data Protection, Privacy Rights, Healthcare Compliance, Vendor Due Diligence, Risk Governance
  • Typical use cases: CRO, central lab and eClinical vendor privacy diligence; Real-world-evidence and registry vendor onboarding; Genomic sequencing and biobank provider review; Medical-device telemetry and connected-device data review; Pharmacovigilance safety-data vendor review; Article 28 data processing agreement negotiation; Chapter V transfer impact assessment evidence pack
  • Coverage: 60 controls across 14 sections
EU General Data Protection Regulation (GDPR) standard requirements covering lawful processing, data subject rights, controller obligations, and breach notification.Official source: EU GDPR (Regulation 2016/679)
  • Risk types: Data Privacy, Regulatory Compliance
  • Risk domains: Privacy Rights, Data Protection
  • Typical use cases: EU/EEA data privacy compliance; Data processor assessment; Privacy-by-design evaluation; GDPR vendor due diligence
  • Coverage: 18 controls across 13 sections
Supplier due diligence for EU essential and important entities under the NIS 2 Directive. Structured on the thirteen technical and methodological requirements in the Annex to Implementing Regulation (EU) 2024/2690, so the supply chain title carries the four supplier selection criteria of point 5.1.2 and the eight contract requirements of point 5.1.4. Incident questions are tied to the 24 hour early warning in Article 23(4)(a), which runs from your own awareness rather than the supplier’s.Official source: Directive (EU) 2022/2555 (NIS 2)
  • Risk types: Regulatory Compliance, Third-Party Risk, Information Security, Operational Risk
  • Risk domains: Supply Chain, Vendor Due Diligence, Incident Response, Risk Governance, Resilience, Network Security, Identity & Access Management, Data Protection
  • Typical use cases: EU essential or important entity supplier due diligence; NIS 2 Art. 21(2)(d) supply chain security; NIS 2 Art. 21(3) direct supplier risk assessment; ICT supplier and managed service provider onboarding; NIS 2 Art. 23 incident notification readiness
  • Coverage: 64 controls across 14 sections
NIST SP 800-18 Revision 2, guidance for developing and maintaining system security, privacy, and cybersecurity supply-chain risk management (C-SCRM) plans that document a system’s purpose, boundary, categorization, and selected controls across its life cycle.Official source: NIST SP 800-18 Rev 2
  • Risk types: Regulatory Compliance, Information Security, Operational Risk
  • Risk domains: Risk Governance, Data Protection, Supply Chain
  • Typical use cases: System security plan development; RMF authorization package preparation; Privacy and C-SCRM plan alignment; Federal system documentation review
  • Coverage: 39 controls across 11 sections
The PCI 3DS Core Security Standard defines physical and logical security requirements for environments that perform EMV 3-D Secure (3DS) functions: the 3DS Server, 3DS Directory Server, and 3DS Access Control Server. It comprises Part 1 baseline security requirements and Part 2 3DS-specific requirements, and applies to entities that store, process, or transmit 3DS data or that could impact the security of 3DS transactions.Official source: PCI SSC - 3DS
  • Risk types: Regulatory Compliance, Information Security, Financial Controls
  • Risk domains: Data Protection, Network Security, Financial Reporting
  • Typical use cases: EMV 3-D Secure environment security; 3DS Server / DS / ACS assessment; 3DS data and key management; Authentication service compliance
  • Coverage: 37 controls across 12 sections
The prior major version of the Payment Card Industry Data Security Standard, retired in 2024 but retained for legacy audits and contracts that still reference v3.2.1. Use it for historical gap analysis and transition planning toward PCI DSS v4.0.Official source: PCI SSC Document Library (legacy)
  • Risk types: Regulatory Compliance, Information Security, Financial Controls
  • Risk domains: Financial Reporting, Data Protection, Network Security
  • Typical use cases: Legacy PCI DSS v3.2.1 assessment; Contract referencing v3.2.1; Historical compliance gap analysis; Transition planning to v4.0
  • Coverage: 89 controls across 12 sections
Payment Card Industry Data Security Standard v4.0, the security standard for organizations that handle cardholder data, updated with new authentication and monitoring requirements.Official source: PCI SSC Document Library
  • Risk types: Regulatory Compliance, Information Security, Financial Controls
  • Risk domains: Financial Reporting, Data Protection, Network Security
  • Typical use cases: Payment processing compliance; Merchant security assessment; Card data environment evaluation; PCI QSA audit preparation
  • Coverage: 63 controls across 12 sections
For card-not-present merchants (e-commerce or mail/telephone-order) that have fully outsourced all cardholder data functions to PCI DSS validated third parties, with no electronic storage, processing, or transmission of cardholder data on the merchant’s systems.Official source: PCI SSC - SAQs
  • Risk types: Regulatory Compliance, Information Security, Financial Controls
  • Risk domains: Financial Reporting, Data Protection, Network Security
  • Typical use cases: Fully outsourced e-commerce merchant; Mail/telephone-order (MOTO) merchant; No electronic cardholder data storage; All payment functions handled by validated third parties
  • Coverage: 22 controls across 7 sections
For e-commerce merchants that partially outsource payment processing to a PCI DSS validated third party but whose own website can impact the security of the payment transaction, with no electronic storage of cardholder data on merchant systems.Official source: PCI SSC - SAQs
  • Risk types: Regulatory Compliance, Information Security, Financial Controls
  • Risk domains: Financial Reporting, Data Protection, Network Security
  • Typical use cases: Partially outsourced e-commerce merchant; Merchant website impacts payment transactions; Direct-post or JavaScript-based payment integration; No electronic cardholder data storage
  • Coverage: 90 controls across 12 sections
For merchants that process cardholder data only via imprint machines or standalone, dial-out payment terminals with no electronic cardholder data storage, and that do not transmit cardholder data over the internet.Official source: PCI SSC - SAQs
  • Risk types: Regulatory Compliance, Information Security, Financial Controls
  • Risk domains: Financial Reporting, Data Protection, Network Security
  • Typical use cases: Imprint-machine merchant; Standalone dial-out terminal merchant; No internet-connected payment processing; No electronic cardholder data storage
  • Coverage: 40 controls across 5 sections
For merchants with payment application systems connected to the internet (for example a POS system on a network with internet access) that do not electronically store cardholder data after a transaction is authorized.Official source: PCI SSC - SAQs
  • Risk types: Regulatory Compliance, Information Security, Financial Controls
  • Risk domains: Financial Reporting, Data Protection, Network Security
  • Typical use cases: Payment application connected to the internet; Internet-connected POS environment; No electronic cardholder data storage; Segmented merchant location network
  • Coverage: 80 controls across 11 sections
For all other merchants not addressed by SAQ types A through C, and for all service providers eligible to complete an SAQ. This SAQ covers substantially the full set of PCI DSS v4.0 requirements.Official source: PCI SSC - SAQs
  • Risk types: Regulatory Compliance, Information Security, Financial Controls
  • Risk domains: Financial Reporting, Data Protection, Network Security
  • Typical use cases: Merchant storing cardholder data electronically; Service provider eligible for SAQ; Full-scope PCI DSS environment; Complex payment processing environment
  • Coverage: 130 controls across 12 sections
Full defined-requirement-level coverage of PCI DSS v4.0 across all 12 requirements, with one control per numbered requirement for organizations that store, process, or transmit cardholder data. Intended for in-depth, QSA-grade assessment of the entire cardholder data environment.Official source: PCI SSC Document Library
  • Risk types: Regulatory Compliance, Information Security, Financial Controls
  • Risk domains: Financial Reporting, Data Protection, Network Security
  • Typical use cases: Full PCI DSS v4.0 audit preparation; Level 1 merchant/service provider assessment; QSA-led compliance evaluation; Cardholder data environment deep review
  • Coverage: 249 controls across 12 sections
The PCI PIN Security Requirements define controls for the secure management, processing, and transmission of personal identification number (PIN) data during online and offline payment transactions on ATMs and attended/unattended POS terminals. They apply to acquirers, processors, and any entity that manages PINs or the cryptographic keys used to protect them.Official source: PCI SSC - PIN Security
  • Risk types: Regulatory Compliance, Information Security, Financial Controls
  • Risk domains: Data Protection, Network Security, Financial Reporting
  • Typical use cases: PIN encryption and key management; ATM and POS terminal security; Cryptographic key lifecycle governance; Acquirer and processor PIN compliance
  • Coverage: 33 controls across 7 sections
The PCI Point-to-Point Encryption (P2PE) Standard defines security requirements for solutions that encrypt account data at the point of interaction and decrypt it only within a secure environment, so that clear-text account data is never present in the merchant environment. It applies to P2PE solution providers, component providers, and merchants seeking to reduce PCI DSS scope through a validated P2PE solution.Official source: PCI SSC - P2PE
  • Risk types: Regulatory Compliance, Information Security, Financial Controls
  • Risk domains: Data Protection, Network Security, Financial Reporting
  • Typical use cases: Point-to-point encryption solution validation; POI device and key-injection management; Merchant PCI DSS scope reduction; Decryption environment (HSM) security
  • Coverage: 38 controls across 6 sections
The PCI Software Security Framework comprises the Secure Software Standard and the Secure Software Lifecycle (Secure SLC) Standard, defining security requirements and assessment procedures for payment software and for the processes used to design, develop, and maintain it. It applies to software vendors and their payment software products, and is the successor to the legacy PA-DSS program.Official source: PCI SSC - Software Security Framework
  • Risk types: Regulatory Compliance, Information Security, Financial Controls
  • Risk domains: Data Protection, Network Security, Financial Reporting
  • Typical use cases: Secure payment software validation; Secure software lifecycle governance; Software vulnerability and threat management; PA-DSS successor compliance
  • Coverage: 40 controls across 20 sections
SOC 2 Type II standard requirements covering the Trust Services Criteria: Security, Availability, Processing Integrity, Confidentiality, and Privacy.Official source: AICPA SOC 2 (Trust Services Criteria)
  • Risk types: Audit Readiness, Information Security, Regulatory Compliance
  • Risk domains: Data Protection, Operational Continuity, Risk Governance
  • Typical use cases: SOC 2 audit preparation; Customer security questionnaire responses; Service provider compliance verification; SaaS security due diligence
  • Coverage: 18 controls across 1 sections
Due diligence for the intermediaries that carry the most corruption exposure: distributors, agents, resellers, customs brokers, freight forwarders, licence and permit consultants, joint-venture partners, lobbying and government-relations firms, and any supplier that deals with government officials or state-employed healthcare professionals on our behalf. Built on the FCPA anti-bribery provisions (15 U.S.C. 78dd-1, 78dd-2, 78dd-3) and accounting provisions (15 U.S.C. 78m(b)(2)), the UK Bribery Act 2010 including the section 7(2) adequate procedures defence, and the third-party management criteria in the DOJ Evaluation of Corporate Compliance Programs (Updated September 2024).Official source: DOJ Foreign Corrupt Practices Act
  • Risk types: Regulatory Compliance, Third-Party Risk, Financial Controls, Vendor Assessment, Audit Readiness
  • Risk domains: Vendor Due Diligence, Risk Governance, Supply Chain, Financial Reporting, Healthcare Compliance
  • Typical use cases: Distributor, agent and reseller onboarding; Customs broker and freight forwarder diligence; Joint-venture and consortium partner screening; Section 7(2) adequate procedures evidence pack; Government-official and state-employed HCP exposure review; Periodic re-certification of high-risk intermediaries
  • Coverage: 60 controls across 12 sections

​
Financial services & banking

For how these map onto the supervisory expectations themselves, stage by stage, see Regulatory alignment for banks and credit unions.
Bank Secrecy Act (BSA) and Anti-Money Laundering (AML) controls covering customer due diligence, suspicious activity reporting, and transaction monitoring.Official source: FinCEN - Bank Secrecy Act
  • Risk types: Regulatory Compliance, Financial Controls
  • Risk domains: Banking & Finance, Financial Reporting
  • Typical use cases: BSA/AML compliance program assessment; FinCEN regulatory alignment; Financial crime risk management; AML vendor evaluation
  • Coverage: 35 controls across 24 sections
EU Digital Operational Resilience Act (DORA) controls for financial entities, covering ICT risk management, incident reporting, third-party risk, and resilience testing.Official source: EU DORA (Regulation 2022/2554)
  • Risk types: Regulatory Compliance, Operational Risk, Third-Party Risk
  • Risk domains: Resilience, Banking & Finance, Supply Chain
  • Typical use cases: EU financial institution DORA compliance; ICT third-party risk assessment; Digital resilience program evaluation; Financial sector operational continuity
  • Coverage: 25 controls across 6 sections
Federal Financial Institutions Examination Council (FFIEC) guidance on managing third-party service provider relationships for financial institutions.Official source: FFIEC IT Handbook - Outsourcing
  • Risk types: Regulatory Compliance, Third-Party Risk, Financial Controls
  • Risk domains: Banking & Finance, Supply Chain, Risk Governance
  • Typical use cases: Financial institution third-party oversight; Bank vendor due diligence; FFIEC regulatory compliance; Financial services outsourcing review
  • Coverage: 30 controls across 13 sections
Gramm-Leach-Bliley Act (GLBA) Safeguards Rule (16 CFR Part 313) requirements for financial institutions protecting customer financial information.Official source: 16 CFR Part 313 (eCFR)
  • Risk types: Regulatory Compliance, Data Privacy, Financial Controls
  • Risk domains: Banking & Finance, Data Protection
  • Typical use cases: GLBA compliance for financial services; Customer financial data protection; Financial institution privacy program; FTC Safeguards Rule alignment
  • Coverage: 20 controls across 3 sections
Detailed interagency guidance on third-party relationships for banking organizations, with controls across the full vendor lifecycle.Official source: Interagency Guidance on Third-Party Relationships
  • Risk types: Regulatory Compliance, Third-Party Risk, Operational Risk
  • Risk domains: Banking & Finance, Supply Chain, Risk Governance
  • Typical use cases: Full-lifecycle bank vendor oversight; Critical third-party assessments; OCC/Fed/FDIC regulatory alignment; Senior management reporting on TPRM
  • Coverage: 156 controls across 12 sections
Interagency guidance on third-party relationships for banking organizations, covering risk management expectations for vendor lifecycle management.Official source: Interagency Guidance on Third-Party Relationships
  • Risk types: Regulatory Compliance, Third-Party Risk
  • Risk domains: Banking & Finance, Supply Chain
  • Typical use cases: Bank third-party risk program; Federal banking agency compliance; Vendor lifecycle risk management; Regulatory examination preparation
  • Coverage: 44 controls across 13 sections
National Credit Union Administration (NCUA) Information Security Examination (ISE) program covering cybersecurity maturity for credit unions.Official source: NCUA - Information Security Examination
  • Risk types: Regulatory Compliance, Information Security
  • Risk domains: Banking & Finance, Risk Governance
  • Typical use cases: Credit union security examination; NCUA regulatory compliance; Credit union cybersecurity maturity; NCUA examination preparation
  • Coverage: 30 controls across 17 sections
Sarbanes-Oxley Act (SOX) controls based on the COSO internal control framework, covering financial reporting accuracy and IT general controls for public companies.Official source: COSO - Internal Control Framework
  • Risk types: Financial Controls, Regulatory Compliance, Audit Readiness
  • Risk domains: Financial Reporting, Risk Governance
  • Typical use cases: SOX compliance program assessment; Public company internal controls review; IT general controls evaluation; External auditor readiness
  • Coverage: 56 controls across 12 sections

​
Healthcare & life sciences

Supplier due diligence for a manufacturer, marketing-authorisation partner, importer or distributor of medicines or devices across the major APAC regimes: Japan’s PMD Act marketing authorisation holder system with GQP and GMP, Australian sponsorship and GMP clearance, Singapore dealer’s licences and GDP, China’s marketing authorisation holder and GSP distribution chain, India’s import and manufacturing licences with revised Schedule M, and Korea, Taiwan and ASEAN at licence and standard level, plus cold chain, serialisation, local labelling, diversion, falsified product and recall coordination.Official source: Act on Securing Quality, Efficacy and Safety of Products Including Pharmaceuticals and Medical Devices
  • Risk types: Regulatory Compliance, Life Sciences, Third-Party Risk, Audit Readiness
  • Risk domains: Pharmaceutical, Manufacturing Quality, Logistics, Supply Chain, Vendor Due Diligence
  • Typical use cases: APAC distributor and importer qualification; Japanese marketing authorisation holder partner diligence; TGA sponsor and GMP clearance evidence pack; China marketing authorisation holder and agent review; Multi-market cold chain and serialisation readiness
  • Coverage: 53 controls across 12 sections
Supplier due diligence built on the certified and accredited management-system claims a life-sciences buyer relies on. Because ISO 13485:2016, ISO/IEC 17025:2017, ISO 14971:2019 and ISO 15189 are copyrighted standards this instrument does not quote, every control asks the supplier to evidence its claim: which certificate or accreditation is held, who issued it and under which recognition arrangement, exactly what the scope statement covers, whether the site and activity we buy fall inside it, the surveillance and nonconformity history, which test methods are on the schedule of accreditation, and the method validation, traceability, proficiency testing, uncertainty, impartiality, data integrity and notification arrangements behind them.Official source: ISO 13485:2016
  • Risk types: Regulatory Compliance, Audit Readiness, Third-Party Risk, Life Sciences, Vendor Assessment
  • Risk domains: Manufacturing Quality, Vendor Due Diligence, Supply Chain, Risk Governance, Healthcare Compliance
  • Typical use cases: ISO 13485 certified supplier qualification; ISO/IEC 17025 testing and calibration laboratory approval; Contract laboratory scope-of-accreditation verification; Certificate and schedule-of-accreditation evidence pack; Annual requalification of a certified or accredited supplier
  • Coverage: 55 controls across 14 sections
Service provider, CRO, site and eClinical vendor diligence across the three clinical regimes: the 21 CFR 312.52 written transfer of obligations and its silent-failure default, the absence of any equivalent under Part 812, ICH E6(R3)‘s service-provider concept and its rule that untransferred activities stay with the sponsor, EU CTR delegation under Article 71 that never moves responsibility, and the safety, serious-breach and archiving clocks each regime sets in its own units.Official source: 21 CFR Part 312 (Investigational New Drug Application)
  • Risk types: Regulatory Compliance, Life Sciences, Third-Party Risk, Audit Readiness
  • Risk domains: Pharmaceutical, Vendor Due Diligence, Healthcare Compliance, Data Protection, Risk Governance
  • Typical use cases: CRO and service provider qualification; Central laboratory and eClinical vendor assessment; Transfer of obligations reconciliation; Safety reporting timeline verification; Trial master file and archiving review
  • Coverage: 75 controls across 14 sections
Supplier due diligence on safety features across the EU supply chain: the unique identifier and its data carrier, the anti-tampering device, who applies the features and who uploads to the repositories system, the risk-based verification and decommissioning duties on wholesalers and on persons authorised to supply to the public, the suspected-falsification alert path, the 10-day reactivation window, equivalent identifiers on repackaged and parallel-distributed packs, and the upstream active-substance audit and registration duties.Official source: Commission Delegated Regulation (EU) 2016/161
  • Risk types: Regulatory Compliance, Life Sciences, Third-Party Risk, Audit Readiness
  • Risk domains: Pharmaceutical, Supply Chain, Manufacturing Quality, Logistics, Vendor Due Diligence
  • Typical use cases: Serialisation readiness of a contract packer or CMO; Wholesale distributor FMD verification assessment; Parallel importer and repackager qualification; Repository or serialisation IT provider diligence; Active-substance chain registration and audit evidence
  • Coverage: 59 controls across 13 sections
Supplier due diligence for a Contract Acceptor performing outsourced GMP activities for an EU or EEA manufacturing authorisation holder or marketing authorisation holder: the Chapter 7 Contract Giver and Contract Acceptor split, the written contract and technical quality agreement, subcontracting and change control, Chapter 4 documentation and retention, Chapter 5 supplier qualification and active-substance supply-chain traceability, what the Qualified Person needs under Annex 16, unexpected deviations and quality defects, and reference and retention samples under Annex 19 as revised by C(2026) 4135 final.Official source: EudraLex Volume 4 (EU GMP Guidelines)
  • Risk types: Regulatory Compliance, Life Sciences, Third-Party Risk, Audit Readiness
  • Risk domains: Pharmaceutical, Manufacturing Quality, Supply Chain, Vendor Due Diligence, Healthcare Compliance
  • Typical use cases: Contract manufacturing organisation qualification; Contract laboratory and contract analysis qualification; Technical quality agreement review; Qualified Person batch certification evidence pack; Active-substance supply-chain audit programme
  • Coverage: 59 controls across 13 sections
Supplier due diligence for a wholesale distributor, contract logistics provider or broker handling medicinal products for human use in the EU or EEA, worked chapter by chapter through the Guidelines of 5 November 2013 on Good Distribution Practice (2013/C 343/01): quality system and risk management, the Responsible Person and their named duties, premises and temperature mapping, documentation, supplier and customer qualification, receipt and storage, picking, supply, destruction and export, complaints, returns, falsified products and recalls, outsourced activities, self-inspections, transport and in-transit excursions, brokers, plus the Article 80 wholesale-dealer duties and the Article 46b active-substance import duties of Directive 2001/83/EC.Official source: Guidelines on Good Distribution Practice (2013/C 343/01)
  • Risk types: Regulatory Compliance, Life Sciences, Third-Party Risk, Operational Risk, Audit Readiness
  • Risk domains: Pharmaceutical, Logistics, Supply Chain, Vendor Due Diligence, Healthcare Compliance
  • Typical use cases: Wholesale distributor qualification; Third-party logistics and cold-chain provider qualification; Responsible Person evidence pack; Broker registration and procedure check; GDP self-inspection and audit preparation
  • Coverage: 59 controls across 14 sections
Supplier due diligence for a supplier, subcontractor, component manufacturer, authorised representative, importer or distributor in the supply chain of a medical device or in-vitro diagnostic placed on the EU market. Runs Regulation (EU) 2017/745 and Regulation (EU) 2017/746 in parallel and names where the two diverge: Article 10 general obligations and the quality management system, the Article 15 person responsible for regulatory compliance, Articles 11, 13, 14 and 16 economic-operator duties, UDI and EUDAMED, Annex I software and IT security with MDCG 2019-16, clinical and performance evaluation, post-market surveillance, the Article 87 / Article 82 vigilance clocks with the event type each one attaches to, and the Article 10a duty to give advance notice of an interruption or discontinuation of supply.Official source: Regulation (EU) 2017/745 (Medical Devices)
  • Risk types: Regulatory Compliance, Life Sciences, Third-Party Risk, Audit Readiness, Healthcare
  • Risk domains: Manufacturing Quality, Supply Chain, Vendor Due Diligence, Healthcare Compliance, Risk Governance
  • Typical use cases: MDR/IVDR critical supplier qualification; Authorised representative, importer and distributor due diligence; Contract manufacturer and sterilisation subcontractor onboarding; Medical device software and cybersecurity supplier review; Notified body audit readiness across the supply chain
  • Coverage: 58 controls across 13 sections
Electronic records and signatures for a vendor-hosted or SaaS GxP system: the closed-system controls of 11.10, open-system controls of 11.30, signature requirements of 11.50 to 11.300, and the supplier-suitability, written-agreement and decommissioning expectations FDA set out in its October 2024 guidance on electronic systems in clinical investigations.Official source: 21 CFR Part 11 (Electronic Records; Electronic Signatures)
  • Risk types: Regulatory Compliance, Life Sciences, Information Security, Audit Readiness
  • Risk domains: Data Protection, Identity & Access Management, Pharmaceutical, Vendor Due Diligence, Healthcare Compliance
  • Typical use cases: eClinical and EDC vendor qualification; LIMS, MES and QMS software supplier assessment; Part 11 responsibility matrix for a hosted system; Data integrity (ALCOA+) supplier review; System decommissioning and data-exit planning
  • Coverage: 45 controls across 10 sections
Device supplier diligence under the Quality Management System Regulation in force since 2 February 2026: the ISO 13485 bridge at 820.10(a), the written quality agreement that clause 4.1.5 now makes a binding US requirement, purchasing and verification under clause 7.4, the US-specific delta at 820.10(b) to Parts 803, 806, 830 and 821, the 820.35 and 820.45 record fields, and the withdrawal of the supplier-audit-report inspection exemption.Official source: 21 CFR Part 820 (Quality Management System Regulation)
  • Risk types: Regulatory Compliance, Life Sciences, Third-Party Risk, Audit Readiness
  • Risk domains: Manufacturing Quality, Supply Chain, Vendor Due Diligence, Healthcare Compliance, Pharmaceutical
  • Typical use cases: Device contract manufacturer qualification; Contract sterilizer and relabeler diligence; QMSR transition gap review against a pre-2026 checklist; Supplier change-notification agreement review; Combination product constituent-part supplier review
  • Coverage: 51 controls across 12 sections
Contract manufacturer, contract packager and contract laboratory diligence under 21 CFR 210 and 211: the written quality agreement FDA’s 2016 guidance expects, quality unit release under 211.22(a), the two-part test for relying on a supplier’s test results under 211.84(d), investigation duties under 211.192 that reach other batches and other products, the 211.180 retention and location rules, and the field alert and adverse-event forwarding clocks.Official source: 21 CFR Part 211 (cGMP for Finished Pharmaceuticals)
  • Risk types: Regulatory Compliance, Life Sciences, Third-Party Risk, Audit Readiness
  • Risk domains: Pharmaceutical, Manufacturing Quality, Supply Chain, Vendor Due Diligence, Healthcare Compliance
  • Typical use cases: Contract manufacturing organisation qualification; Contract analytical laboratory diligence; Quality agreement gap review; API and excipient supplier approval; Pre-approval inspection readiness
  • Coverage: 58 controls across 12 sections
Good Practice (GxP) controls for life sciences, covering GMP, GLP, and GCP requirements for pharmaceutical, biotech, and medical device companies.Official source: FDA - GxP Compliance
  • Risk types: Life Sciences, Regulatory Compliance, Operational Risk
  • Risk domains: Pharmaceutical, Data Protection
  • Typical use cases: Pharma/biotech supplier qualification; FDA/EMA compliance assessment; Clinical trial data integrity; GxP-regulated vendor due diligence
  • Coverage: 83 controls across 11 sections
Due diligence on the business associate relationship itself rather than the Security Rule safeguards: whether the supplier is a business associate at all, the provisions 45 CFR 164.504(e) and 164.314(a) require in the agreement, the flow-down duty to subcontractors, the breach notification clocks in 45 CFR 164.400-414, the individual rights the supplier has to support, return or destruction of PHI at termination, offshore access, the supplier’s own direct liability under HITECH, and its readiness for the proposed Security Rule amendments.Official source: 45 CFR Part 164 (HIPAA Security and Privacy)
  • Risk types: Healthcare, Data Privacy, Regulatory Compliance, Third-Party Risk
  • Risk domains: Healthcare Compliance, Privacy Rights, Data Protection, Vendor Due Diligence, Incident Response
  • Typical use cases: Business associate agreement negotiation and renewal; Covered entity vendor onboarding where PHI is disclosed; Business associate diligence on its own subcontractors; Breach notification readiness review; Termination and PHI disposition planning
  • Coverage: 53 controls across 13 sections
Health Insurance Portability and Accountability Act (HIPAA) security and privacy rules covering administrative, physical, and technical safeguards for protected health information (PHI).Official source: HHS - HIPAA Security Rule
  • Risk types: Healthcare, Data Privacy, Regulatory Compliance
  • Risk domains: Healthcare Compliance, Data Protection
  • Typical use cases: HIPAA Business Associate assessment; Healthcare data security evaluation; PHI vendor due diligence; Healthcare compliance auditing
  • Coverage: 42 controls across 10 sections
Risk-based supplier and outsourcing governance against the global standards: ICH Q10 section 2.7, Q9(R1) quality risk management, Q12 change communication across the supply chain, Q13 input-material control, the PIC/S PE 009 Chapter 7 Contract Giver model and Chapter 5 supplier qualification, and WHO TRS 986 Annex 2 contract production and supplier approval.Official source: ICH Quality Guidelines
  • Risk types: Regulatory Compliance, Life Sciences, Third-Party Risk, Audit Readiness
  • Risk domains: Pharmaceutical, Manufacturing Quality, Supply Chain, Vendor Due Diligence, Risk Governance
  • Typical use cases: Contract manufacturer and contract laboratory qualification; ICH Q10 outsourced-activity governance evidence; PIC/S jurisdiction site assessment; WHO prequalification supply chain review; Excipient and API supplier risk assessment
  • Coverage: 42 controls across 9 sections
Software and component supplier diligence for a cyber device: what the supplier must furnish for the sponsor to meet section 524B(b), software bill of materials depth and the two fields FDA adds beyond the NTIA baseline, coordinated vulnerability disclosure, notification and patch timelines back-solved from the sponsor’s 30 and 60 day postmarket conditions, end-of-support and escrow, and the supplier’s own update infrastructure as a related system.Official source: FD&C Act section 524B (21 U.S.C. 360n-2)
  • Risk types: Information Security, Regulatory Compliance, Life Sciences, Third-Party Risk
  • Risk domains: Supply Chain, Threat Intelligence, Incident Response, Vendor Due Diligence, Healthcare Compliance
  • Typical use cases: Device software and component supplier assessment; SBOM ingestion and depth review; Coordinated vulnerability disclosure readiness; End-of-support and source-code escrow negotiation; Premarket submission evidence gathering
  • Coverage: 47 controls across 10 sections
Supplier due diligence on a vendor performing pharmacovigilance activities for a marketing authorisation holder: the safety data exchange agreement and the mandatory subcontract terms introduced by Implementing Regulation (EU) 2025/1466, onward subcontracting and written consent, the quality system and training, the QPPV and delegated tasks, what the vendor feeds into the pharmacovigilance system master file, case intake through day zero to the 15 and 90 day clocks, literature and digital-media screening, signal management, audit rights and the audit programme, inspection readiness under GVP Module III Rev 2, the safety database and business continuity, and retention and exit.Official source: Commission Implementing Regulation (EU) No 520/2012
  • Risk types: Regulatory Compliance, Life Sciences, Third-Party Risk, Audit Readiness, Operational Risk
  • Risk domains: Pharmaceutical, Healthcare Compliance, Vendor Due Diligence, Operational Continuity, Risk Governance
  • Typical use cases: Pharmacovigilance service provider qualification; Safety data exchange agreement review; Adverse-event call centre and case-processing vendor diligence; Literature screening and signal detection vendor assessment; Pharmacovigilance inspection readiness of a subcontractor
  • Coverage: 59 controls across 14 sections
Supplier due diligence for UK and Irish licence holders: the regulation 37(4) active-substance audit duty, the Responsible Person (import), Windsor Framework packaging and QP geography, UK GDP and GCP under ICH E6(R3) by dynamic reference, UK pharmacovigilance and the PSMF, and the points where an Irish site’s EU obligations diverge from a GB site’s retained ones.Official source: Human Medicines Regulations 2012 (SI 2012/1916)
  • Risk types: Regulatory Compliance, Life Sciences, Third-Party Risk, Audit Readiness
  • Risk domains: Pharmaceutical, Manufacturing Quality, Supply Chain, Vendor Due Diligence, Healthcare Compliance
  • Typical use cases: MHRA licence holder supplier qualification; Active-substance manufacturer audit under HMR reg 37(4); Responsible Person (import) evidence pack; Windsor Framework packaging readiness; HPRA Irish site qualification
  • Coverage: 40 controls across 9 sections
Third-party diligence on US healthcare fraud-and-abuse exposure for distributors, agencies, contract sales organisations, speaker-bureau and advisory-board managers, patient-support and hub vendors, charitable-foundation intermediaries and other HCP-engagement intermediaries: the Anti-Kickback Statute and the safe harbor relied on, Stark, the False Claims Act and the 60-day overpayment rule, Open Payments transfer-of-value data, exclusion and debarment screening, the OIG seven compliance elements, the voluntary industry codes and state marketing laws, and the government price-reporting and 340B points a vendor can touch.Official source: OIG General Compliance Program Guidance
  • Risk types: Regulatory Compliance, Healthcare, Third-Party Risk, Life Sciences, Audit Readiness
  • Risk domains: Healthcare Compliance, Vendor Due Diligence, Risk Governance, Pharmaceutical
  • Typical use cases: Distributor, agency and contract sales organisation onboarding; Speaker bureau and advisory board vendor diligence; Patient support programme and hub vendor diligence; Charitable foundation and copay intermediary diligence; Open Payments data-feed assurance; Exclusion and debarment screening assurance
  • Coverage: 58 controls across 14 sections

​
AI governance

How a vendor authorises what its AI agents do at the moment they act on your data or on your behalf. Identity establishes what an agent could ever do; this set asks whether each action is checked when it runs, on its parameters, under the person who delegated it, with short-lived credentials, one central policy, an audit record you can read and a kill switch you can pull. It pairs with the internal AI Agents, Copilots & Autonomous Actions template that Inspect runs against your own tenants, so a vendor’s agents and yours are held to the same questions. See Agent runtime authorization.
  • Risk types: AI Risk, Information Security, Third-Party Risk
  • Risk domains: AI Governance, Identity & Access Management, Data Protection
  • Typical use cases: Due diligence on a vendor whose AI agents act on your data; Reassessment after a vendor adds agentic features; Evidence of runtime authorization for an AI inventory or model risk review; Pairing with Inspect’s internal AI agent controls for one view of agent risk
  • Coverage: 16 controls across 4 sections
AIUC-1, the AI Usage & Controls standard for AI agents, covering security, safety, reliability, data & privacy, accountability, and societal risk. Its 51 controls span six domains (A Data & Privacy, B Security, C Safety, D Reliability, E Accountability, F Society) and crosswalk to the EU AI Act, NIST AI RMF, ISO/IEC 42001, MITRE ATLAS, and OWASP.Official source: AIUC-1
  • Risk types: AI Risk, Information Security, Third-Party Risk, Regulatory Compliance
  • Risk domains: AI Governance, Data Protection
  • Typical use cases: AI agent vendor due diligence; AI safety and security assessment; Generative AI supplier evaluation; AI governance readiness
  • Coverage: 51 controls across 6 sections
Cloud Security Alliance AI Controls Matrix (AICM) 2025, a framework of security controls specifically designed for AI/ML systems and platforms.Official source: CSA AI Controls Matrix
  • Risk types: AI Risk, Information Security, Regulatory Compliance
  • Risk domains: AI Governance, Cloud Security, Data Protection
  • Typical use cases: AI/ML platform security assessment; Cloud AI vendor evaluation; AI security controls gap analysis; Emerging AI regulatory alignment
  • Coverage: 243 controls across 19 sections
EU AI Act (Regulation (EU) 2024/1689), the European Union’s horizontal regulation for artificial intelligence. This template organizes the Act’s core obligations by theme: prohibited practices, risk classification, high-risk system requirements, provider and deployer duties, transparency, general-purpose AI models, and post-market governance.Official source: Regulation (EU) 2024/1689
  • Risk types: AI Risk, Regulatory Compliance, Data Privacy
  • Risk domains: AI Governance, Risk Governance
  • Typical use cases: EU AI Act readiness assessment; High-risk AI system conformity review; AI vendor regulatory due diligence; GPAI model obligation mapping
  • Coverage: 22 controls across 8 sections
ISO/IEC 42001:2023, the international management-system standard for artificial intelligence (AIMS). This template covers the Annex A reference controls across nine control objectives, from AI policy and impact assessment to data governance and third-party relationships.Official source: ISO/IEC 42001:2023
  • Risk types: AI Risk, Regulatory Compliance, Audit Readiness
  • Risk domains: AI Governance, Risk Governance
  • Typical use cases: AI management system (AIMS) assessment; ISO/IEC 42001 readiness and gap analysis; AI vendor due diligence; Responsible AI program evaluation
  • Coverage: 38 controls across 9 sections
MITRE ATLAS (Adversarial Threat Landscape for Artificial-Intelligence Systems), a knowledge base of adversary tactics and techniques against AI/ML systems, modeled on MITRE ATT&CK. This template turns the ATLAS tactics into a defensive assessment of a vendor’s resilience to adversarial machine-learning attacks.Official source: MITRE ATLAS
  • Risk types: AI Risk, Information Security, Third-Party Risk
  • Risk domains: AI Governance, Threat Intelligence
  • Typical use cases: Adversarial ML threat assessment; AI/ML security vendor evaluation; AI red-team and threat-model scoping; AI supply-chain security review
  • Coverage: 14 controls across 1 section
NIST AI Risk Management Framework (AI RMF 1.0), a voluntary framework for managing risks of AI systems across four core functions: Govern, Map, Measure, and Manage.Official source: NIST AI Risk Management Framework
  • Risk types: AI Risk, Operational Risk, Regulatory Compliance
  • Risk domains: AI Governance, Risk Governance
  • Typical use cases: AI system risk assessment; Responsible AI program evaluation; AI vendor due diligence; AI governance readiness
  • Coverage: 72 controls across 4 sections
NIST SP 800-53 controls adapted for AI systems, a catalog of security and privacy controls for AI risk management in federal and enterprise contexts.Official source: NIST SP 800-53 Rev 5
  • Risk types: AI Risk, Information Security, Regulatory Compliance
  • Risk domains: AI Governance, Risk Governance, Data Protection
  • Typical use cases: Federal AI system compliance; AI risk control catalog alignment; Enterprise AI security program; FedRAMP-adjacent AI assessments
  • Coverage: 17 controls across 4 sections
OWASP Top 10 for Large Language Model Applications (2025), the ten most critical security risks for LLM and generative-AI applications, from prompt injection and sensitive-information disclosure to excessive agency and unbounded consumption. Used to assess the security posture of AI/LLM vendors.Official source: OWASP Top 10 for LLM Apps
  • Risk types: AI Risk, Information Security, Third-Party Risk
  • Risk domains: AI Governance, Data Protection
  • Typical use cases: LLM application security assessment; Generative AI vendor security review; AI red-team scoping; Secure AI development gap analysis
  • Coverage: 10 controls across 1 section

​
Government & public sector

Templates for agencies buying from vendors and for companies selling to government: US federal, US state and local, and national programs in the UK, Canada, Australia, New Zealand, Germany, France, Spain, Japan and Singapore.
Due diligence for cloud providers (SaaS, PaaS, CaaS, IaaS) against the French ANSSI SecNumCloud requirements referential, version 3.2 of 8 March 2022, still the current version published on cyber.gouv.fr as of November 2026. It checks qualification status and scope (Ch. 3), the immunity from non-EU law criteria on headquarters, shareholding caps of 24 and 39 percent, governance, third party access and operating autonomy (19.6), EU data location, administration from the EU and supervised support from outside the EU (19.2, 9.7.d, 12.13), the mandatory service agreement clauses (19.1), and the security chapters 5 to 18.Official source: ANSSI SecNumCloud
  • Risk types: Regulatory Compliance, Third-Party Risk, Information Security, Data Privacy
  • Risk domains: Cloud Security, Data Protection, Privacy Rights, Identity & Access Management, Incident Response, Supply Chain, Risk Governance
  • Typical use cases: French public sector cloud procurement; Sovereign cloud and extraterritorial law risk assessment; Verifying SecNumCloud qualification claims; Gap analysis for a non qualified cloud provider
  • Coverage: 58 controls across 13 sections
Supplier due diligence for Australian Government entities buying ICT, outsourced and cloud services. Covers alignment with ASD’s Information Security Manual (September 2026 release) and IRAP assessment within the previous 24 months, Essential Eight maturity under the November 2023 Maturity Model (with the ASD Essentials transition announced October 2026), Hosting Certification Framework Strategic and Assured certification, PSPF Release 2026 third party and contract security expectations, and Privacy Act 1988 obligations including APP 8 cross border disclosure, section 95B contracted service provider terms and the Notifiable Data Breaches scheme.Official source: ASD Information Security Manual
  • Risk types: Regulatory Compliance, Third-Party Risk, Information Security, Data Privacy
  • Risk domains: Cloud Security, Vendor Due Diligence, Threat Intelligence, Identity & Access Management, Data Protection, Incident Response, Supply Chain
  • Typical use cases: Commonwealth cloud service procurement requiring a current IRAP assessment; Essential Eight maturity verification for an outsourced ICT provider; Hosting Certification Framework check for data centre and cloud providers; PSPF contract security terms and foreign ownership, control or influence review; Privacy Act APP 8 and section 95B due diligence for an offshore capable supplier
  • Coverage: 39 controls across 7 sections
Due diligence for cloud service providers against the German BSI Cloud Computing Compliance Criteria Catalogue, in its current edition C5:2026 (final 2026, Version 1.1.0 of 11 August 2026; mandatory for Type 1 dates and Type 2 periods starting on or after 1 June 2027, with C5:2020 reports accepted until then). It covers the attestation type and ISAE 3000 basis (Sections 3.4, 3.5), the General Conditions on jurisdiction, data location and government requests (GC-01 to GC-06, the successor to the C5:2020 surrounding parameters), all seventeen criteria domains from OIS to PSS (IDM is now IAM), and the complementary customer criteria and CUECs the buyer must operate.Official source: BSI C5 Criteria Catalogue
  • Risk types: Regulatory Compliance, Third-Party Risk, Information Security, Audit Readiness
  • Risk domains: Cloud Security, Risk Governance, Data Protection, Privacy Rights, Identity & Access Management, Incident Response, Resilience, Supply Chain
  • Typical use cases: German public sector and regulated cloud procurement; Reviewing a vendor’s C5 Type 1 or Type 2 report; Assessing jurisdiction and government access risk for cloud data; Mapping complementary customer criteria and CUECs to buyer controls; Planning the C5:2020 to C5:2026 transition with a cloud vendor
  • Coverage: 63 controls across 14 sections
Software supplier due diligence for federal, state and regulated buyers built on the CISA Secure Software Development Attestation Common Form (OMB control 1670-0052) and its mapping to EO 14028 Sec. 4(e) and NIST SP 800-218 SSDF v1.1 practices, plus SBOM (NTIA Minimum Elements, CISA guidance) and vulnerability disclosure. OMB M-26-05 (January 23, 2026) rescinded M-22-18 and M-23-16, so federal agencies are no longer required to collect the form but may still use it and may require an SBOM on request; EO 14306 (June 6, 2025) had already removed the related attestation provisions from EO 14144. NIST SP 800-218 Rev. 1 (SSDF 1.2) was still a draft as of November 2026.Official source: NIST SP 800-218 SSDF v1.1
  • Risk types: Information Security, Third-Party Risk, Regulatory Compliance, Vendor Assessment
  • Risk domains: Supply Chain, Threat Intelligence, Cloud Security, Identity & Access Management, Incident Response
  • Typical use cases: Federal software and SaaS procurement; Collecting the CISA Common Form after M-26-05 on a risk basis; SBOM contract requirements; Secure development review of software suppliers
  • Coverage: 50 controls across 12 sections
Due diligence for defense contractors and subcontractors that process, store, or transmit Federal Contract Information and must hold a CMMC Status of Final Level 1 (Self). Covers each of the 15 basic safeguarding requirements in FAR 52.204-21(b)(1)(i) to (xv), assessed against the NIST SP 800-171A objectives mapped in 32 CFR 170.15, plus the annual self-assessment, SPRS entry, and Affirming Official affirmation under 32 CFR 170.15 and 170.22 and DFARS 252.204-7021. No POA&M is permitted at Level 1.Official source: 32 CFR Part 170 (CMMC Program)
  • Risk types: Regulatory Compliance, Third-Party Risk, Information Security
  • Risk domains: Identity & Access Management, Operational Continuity, Network Security, Threat Intelligence, Data Protection, Supply Chain
  • Typical use cases: DoD subcontractor handling FCI only; Verifying a supplier’s CMMC Level 1 status and SPRS affirmation before award; FAR 52.204-21 basic safeguarding flow-down review; Annual supplier reaffirmation check
  • Coverage: 30 controls across 9 sections
Due diligence for defense contractors, subcontractors, and service providers that process, store, or transmit CUI and need a CMMC Level 2 status. Covers all 110 NIST SP 800-171 Rev. 2 requirements, which 32 CFR 170.14(c)(3) adopts as CMMC Level 2, one control each with its 32 CFR 170.24 point value and POA&M eligibility. Adds assessment type (Self or C3PAO), SPRS score and affirmation, 180-day POA&M closeout (170.21), External Service Provider and FedRAMP Moderate equivalency rules (170.19(c)(2)), and DFARS 252.204-7012 72-hour incident reporting through DIBNet and DC3. Notes the July 2026 suspension of CMMC Phase 2.Official source: 32 CFR Part 170 (CMMC Program)
  • Risk types: Regulatory Compliance, Third-Party Risk, Information Security, Audit Readiness
  • Risk domains: Identity & Access Management, Incident Response, Cloud Security, Threat Intelligence, Data Protection, Network Security, Operational Continuity, Supply Chain
  • Typical use cases: DoD subcontractor handling CUI; Verifying CMMC Level 2 status, SPRS score and POA&M closeout before award; Cloud or managed service provider supporting a CMMC environment; DFARS 252.204-7012 flow-down and incident reporting readiness; Pre-assessment readiness review before a C3PAO assessment
  • Coverage: 133 controls across 18 sections
Due diligence for contractors, sub-contractors and cloud providers that build, host or operate systems for the Centers for Medicare & Medicaid Services (CMS), or that support ACA and Medicaid partner systems built on the CMS baseline. Structured on CMS ARS 5.2 (released 07/01/2026), the CMS tailoring of NIST SP 800-53 Rev. 5 that applies to all CMS contractors and sub-contractors under the CMS IS2P2, with Low, Moderate, High and HVA baselines. Covers PII processing and privacy (PT family, PM-5(1), SI-12(1), IR-8(1)), one-hour incident reporting (IR-6), POA&M tracking (CA-5), assessments and penetration testing (CA-2, CA-8), and external service controls (SA-4, SA-9). Note that MARS-E was superseded by ARC-AMPE (released March 4, 2025; compliance date March 4, 2026), not by ARS; ARC-AMPE is based on ARS and governs Exchanges and state Medicaid and CHIP agencies.Official source: CMS Acceptable Risk Safeguards (ARS)
  • Risk types: Regulatory Compliance, Third-Party Risk, Information Security, Data Privacy, Healthcare, Audit Readiness
  • Risk domains: Privacy Rights, Data Protection, Incident Response, Threat Intelligence, Identity & Access Management, Vendor Due Diligence, Risk Governance, Supply Chain
  • Typical use cases: CMS contractor or sub-contractor security and privacy due diligence; Cloud provider review for a CMS FISMA system; Vendor support for a system Authority to Operate and POA&M; Vendor review for an ACA Administering Entity or partner entity using the CMS baseline; High Value Asset (HVA) vendor assessment
  • Coverage: 48 controls across 12 sections
Due diligence for vendors, system integrators and cloud providers that build, host or operate systems for ACA Administering Entities: state Medicaid, CHIP and Basic Health Program agencies, State-based Exchanges and SBE-FPs. Built on CMS Acceptable Risk Controls for ACA, Medicaid, and Partner Entities (ARC-AMPE) Volume I v1.02 (April 10, 2025) and the Volume II AE System Security and Privacy Plan baseline v1.02. ARC-AMPE was released March 4, 2025 with a compliance date of March 4, 2026, and supersedes MARS-E and the NEE GRC Framework. Controls cover 45 CFR 155.260 contract terms, one-hour incident reporting to CMS (IR-6), FIPS 140 encryption (SC-8, SC-13, SC-28), onshore PII processing and the 60-day offshore notice (SA-9(5)), quarterly POA&M and scan deliveries, three-year independent assessment and annual penetration testing, and 10-year record retention under 45 CFR 155.1210.Official source: CMS CCIIO Regulations and Guidance (ARC-AMPE)
  • Risk types: Regulatory Compliance, Third-Party Risk, Information Security, Data Privacy, Healthcare, Audit Readiness
  • Risk domains: Privacy Rights, Data Protection, Incident Response, Threat Intelligence, Identity & Access Management, Vendor Due Diligence, Risk Governance
  • Typical use cases: State Medicaid or CHIP eligibility and enrollment system vendor review; State-based Exchange platform or cloud hosting vendor due diligence; Vendor support for an Authority to Connect renewal; Replacing MARS-E 2.2 vendor questionnaires with ARC-AMPE; Offshore support or development notification review
  • Coverage: 42 controls across 12 sections
Vendor accessibility due diligence for federal, state and local, and EU public buyers. Covers the Revised Section 508 Standards (36 CFR Part 1194, incorporating WCAG 2.0 Level A and AA, implemented in FAR Subpart 39.2), the DOJ ADA Title II web and mobile rule (28 CFR 35.200 to 35.205, WCAG 2.1 Level A and AA) with compliance dates as extended by the April 20, 2026 interim final rule to April 26, 2027 (entities of 50,000 or more) and April 26, 2028 (smaller entities and special districts), Accessibility Conformance Reports on ITI VPAT 2.5Rev, EN 301 549 for EU procurement, testing methods and remediation commitments.Official source: Section 508 Standards (36 CFR Part 1194)
  • Risk types: Regulatory Compliance, Third-Party Risk, Vendor Assessment
  • Risk domains: Risk Governance, Vendor Due Diligence, Manufacturing Quality
  • Typical use cases: Federal ICT procurement under Section 508; State and local government ADA Title II web and mobile vendor review; VPAT and ACR evaluation; EU public tender accessibility review under EN 301 549; Accessibility remediation commitments in contracts
  • Coverage: 43 controls across 11 sections
Due diligence for private contractors, cloud providers and IT vendors that process, store, transmit or support access to criminal justice information (CJI) for a criminal justice or noncriminal justice agency. Structured on CJIS Security Policy (CJISSECPOL) v6.1, dated 06/25/2026, which updates the modernized v6.0 of 12/27/2024 and maps to NIST SP 800-53 control families. Covers the CJIS Security Addendum (Appendix H, 28 CFR 20.33(a)(7)), SA-9 external service agreements, PS-3 fingerprint-based record checks, AT-2 and AT-3 training, IA-2 multi-factor authentication, SC-13 and SC-28 FIPS 140-3 encryption and APB-member-country data location, media protection, IR-6 incident reporting and audit requirements. Priority 1 and existing controls are sanctionable now; Priority 2 to 4 controls are in a zero-cycle that ends September 30, 2027.Official source: FBI CJIS Security Policy
  • Risk types: Regulatory Compliance, Third-Party Risk, Information Security, Data Privacy, Audit Readiness
  • Risk domains: Identity & Access Management, Vendor Due Diligence, Risk Governance, Data Protection, Incident Response, Threat Intelligence, Operational Continuity
  • Typical use cases: Onboarding a vendor that hosts or supports systems containing CJI; CJIS Security Addendum due diligence for private contractors; Cloud provider review for CJI storage and data location; Preparing for a CSA triennial audit of an outsourced service; Records management, dispatch or body camera vendor assessment
  • Coverage: 54 controls across 13 sections
Due diligence for federal agencies and federal contractors buying a cloud service offering that claims FedRAMP status. It covers certification type, path and class under the FedRAMP Consolidated Rules for 2026 (CR26, launched June 2026, mandatory January 1, 2027), the legacy Rev5 agency path and impact levels, the FedRAMP 20x Key Security Indicators, the NIST SP 800-53 Rev. 5 baseline (FRC-CSF-BSL), and the CR26 assurance rulesets for vulnerability detection and response (VDR, VER), Collaborative Continuous Monitoring (CCM), Significant Change Notification (SCN) and Incident Evaluation and Communication (IEC), with OMB M-24-15 as the policy basis.Official source: FedRAMP Consolidated Rules for 2026
  • Risk types: Regulatory Compliance, Third-Party Risk, Information Security, Audit Readiness
  • Risk domains: Cloud Security, Vendor Due Diligence, Threat Intelligence, Risk Governance, Incident Response, Identity & Access Management, Supply Chain, Data Protection
  • Typical use cases: Federal agency cloud service acquisition and ATO reuse; Federal contractor due diligence on a FedRAMP cloud service; Verifying FedRAMP Marketplace status, class and boundary; Monitoring a FedRAMP provider’s transition to the 2026 Consolidated Rules; Ongoing review of vulnerability, change and incident reporting
  • Coverage: 66 controls across 11 sections
Vendor due diligence for Government of Canada departments buying cloud and IT services that handle Protected B, Medium integrity, Medium availability information. Covers the CCCS Medium Cloud Control Profile (ITSP.50.103 Annex B, derived from ITSG-33) and the Cyber Centre Cloud Security Assessment Program, the GC Cloud Guardrails under Appendix G of the Directive on Service and Digital, Canadian data residency under requirement 4.4.1.10 of that Directive and the Direction on the Secure Use of Commercial Cloud Services (SPIN 2017-01), Contract Security Program personnel and organization screening, and Privacy Act obligations.Official source: Canadian Centre for Cyber Security, ITSP.50.103
  • Risk types: Regulatory Compliance, Third-Party Risk, Information Security, Data Privacy
  • Risk domains: Cloud Security, Data Protection, Identity & Access Management, Vendor Due Diligence, Incident Response, Supply Chain
  • Typical use cases: Protected B cloud service procurement for a federal department; Reuse of a Cyber Centre cloud security assessment in a departmental SA&A; GC Cloud Guardrails validation for a vendor managed cloud environment; Contract Security Program screening checks for IT contractors; Privacy Act due diligence for a contractor handling personal information
  • Coverage: 45 controls across 9 sections
Due diligence for state, local, tribal and education buyers of cloud products that claim GovRAMP status. It covers the GovRAMP verification ladder (Security Snapshot, Progressing Security Snapshot, Core, Ready, Provisional and Authorized), impact level, 3PAO assessment, continuous monitoring, the Progressing Snapshot rules in effect since January 1, 2026, federal reciprocity and TX-RAMP recognition. GovRAMP is built on NIST SP 800-53 Rev. 5; StateRAMP announced its rebrand to GovRAMP on February 14, 2025 and still operates legally as StateRAMP.Official source: GovRAMP
  • Risk types: Regulatory Compliance, Third-Party Risk, Information Security, Vendor Assessment
  • Risk domains: Cloud Security, Vendor Due Diligence, Threat Intelligence, Incident Response, Identity & Access Management, Data Protection, Supply Chain
  • Typical use cases: State or local agency cloud procurement requiring GovRAMP status; Verifying a vendor’s GovRAMP status and listing; Tracking a Progressing Snapshot vendor toward verification; Reusing GovRAMP status for TX-RAMP or other state programs; Ongoing monitoring of a GovRAMP verified cloud product
  • Coverage: 48 controls across 10 sections
Due diligence for contractors, sub-contractors, consolidated data centers and cloud providers that receive, process, store, access or transmit Federal Tax Information (FTI) on behalf of a federal, state or local agency. Built on IRS Publication 1075, Tax Information Security Guidelines (Rev. 11-2021, the revision still current on the IRS Safeguards site), and the IRC 6103(p)(4) safeguards it implements: disclosure limits and the 45-day contractor and cloud notification (Section 2.E.6, Exhibit 6), Exhibit 7 contract language, background investigations (2.C.3), commingling and labeling (2.C.5, MP-3), the offshore prohibition (2.C.7), cloud requirements (3.3.1), and reporting to TIGTA and the IRS Office of Safeguards within 24 hours (1.8).Official source: IRS Publication 1075
  • Risk types: Regulatory Compliance, Third-Party Risk, Information Security, Data Privacy, Audit Readiness
  • Risk domains: Data Protection, Vendor Due Diligence, Risk Governance, Incident Response, Identity & Access Management, Threat Intelligence
  • Typical use cases: Onboarding a contractor that will receive FTI from a state tax or child support agency; Cloud provider due diligence before the 45-day Safeguards notification; Consolidated data center or managed service provider review; Preparing contractors for an IRS Safeguards on-site review; Shred, print or off-site storage vendor assessment
  • Coverage: 53 controls across 14 sections
Due diligence for cloud services offered to Japanese government ministries and related agencies under the Information system Security Management and Assessment Program (ISMAP) and its low-impact SaaS track, ISMAP-LIU. It checks registration status on the ISMAP Cloud Service List or ISMAP-LIU Cloud Service List, the statement and audit by a registered ISMAP assessor, and the governance, management and controls criteria of the Control Criteria of ISMAP, which are built on JIS Q 27001:2014, JIS Q 27002:2014, JIS Q 27017:2016 and JIS Q 27014:2015. It also covers the Registration Rules duties on foreign law risk disclosure, incident reporting and significant control changes.Official source: ISMAP
  • Risk types: Regulatory Compliance, Third-Party Risk, Information Security, Audit Readiness
  • Risk domains: Vendor Due Diligence, Cloud Security, Risk Governance, Identity & Access Management, Data Protection, Threat Intelligence, Incident Response, Supply Chain
  • Typical use cases: Japanese government cloud procurement from the ISMAP Cloud Service List; ISMAP-LIU low-impact SaaS onboarding; Verifying an ISMAP assessment report and improvement plan; Foreign law and jurisdiction risk review for government data; Ongoing monitoring of ISMAP registration validity and control changes
  • Coverage: 52 controls across 13 sections
Due diligence for education technology vendors that receive student data from US school districts. Built on the SDPC National Data Privacy Agreement (Standard Version 2.2), the FERPA school official exception (34 CFR 99.31(a)(1)(i)(B), 99.33), the COPPA Rule as amended April 22, 2025 (16 CFR 312.5, 312.8, 312.10) and PPRA (20 U.S.C. 1232h). Adds state operator and contract requirements from California (Bus. & Prof. Code 22584, Educ. Code 49073.1), New York (Education Law 2-d, 8 NYCRR Part 121), Illinois (105 ILCS 85), Colorado (C.R.S. 22-16), Connecticut (C.G.S. 10-234aa to 10-234dd) and Texas (Educ. Code 32.151 to 32.157), covering no targeted ads, no sale, subprocessors, de-identification, breach notice windows and deletion on termination.Official source: FERPA (34 CFR Part 99)
  • Risk types: Data Privacy, Regulatory Compliance, Third-Party Risk, Information Security, Vendor Assessment
  • Risk domains: Data Protection, Privacy Rights, Incident Response, Supply Chain, Identity & Access Management, Vendor Due Diligence
  • Typical use cases: School district edtech vendor vetting; Student data privacy agreement (NDPA) review; COPPA and FERPA vendor compliance check; Multi-state student privacy law coverage; Edtech contract renewal due diligence
  • Coverage: 63 controls across 14 sections
Third-party contractor due diligence for vendors receiving student data or teacher or principal (APPR) data from New York school districts, BOCES, schools or the State Education Department. Covers the Parents Bill of Rights and supplemental information (8 NYCRR 121.3), the data security and privacy plan (121.6), NIST Cybersecurity Framework alignment (121.5, 121.9(a)(1), updated to CSF 2.0 effective February 25, 2026), use and disclosure limits and encryption (121.9), breach notice within seven calendar days and cost reimbursement (121.10) and civil penalties (121.11).Official source: NYSED Data Privacy and Security
  • Risk types: Regulatory Compliance, Data Privacy, Third-Party Risk, Information Security
  • Risk domains: Data Protection, Privacy Rights, Incident Response, Identity & Access Management, Supply Chain, Risk Governance
  • Typical use cases: New York school district vendor onboarding; Education Law 2-d contract review; Data security and privacy plan acceptance; Parents Bill of Rights supplemental information collection; BOCES and regional information center vendor vetting
  • Coverage: 43 controls across 10 sections
Due diligence for suppliers and cloud providers to New Zealand government organizations. It follows the supplier requirements in Protective Security Requirements GOV 5 (Manage risks when working with others, version 2.0 of 1 October 2026) and GOV 6, the public cloud and supply chain chapters of the New Zealand Information Security Manual (v3.9), and the Government Chief Digital Officer’s Cloud First policy and cloud risk assessment process. It also covers notifiable privacy breaches and cross-border disclosure under Privacy Act 2020 IPP 12, including the section 11 agent rule.Official source: New Zealand Information Security Manual
  • Risk types: Regulatory Compliance, Third-Party Risk, Information Security, Data Privacy
  • Risk domains: Supply Chain, Cloud Security, Data Protection, Identity & Access Management, Incident Response, Vendor Due Diligence
  • Typical use cases: NZ government agency supplier onboarding under PSR GOV 5; Public cloud risk assessment input for agency certification and accreditation; Offshore hosting and jurisdictional risk review; Privacy Act 2020 IPP 12 cross-border disclosure check
  • Coverage: 34 controls across 10 sections
Due diligence for nonfederal contractors, subcontractors, and cloud or managed service vendors that process, store, or transmit Controlled Unclassified Information, structured on all 17 requirement families of NIST SP 800-171 Rev. 3 (May 2024) and assessable with SP 800-171A Rev. 3. It asks for the system security plan (03.15.02), the plan of action and milestones (03.12.02), organization-defined parameter values, and external service provider evidence (03.16.03). DoD contracts under DFARS 252.204-7012 and CMMC Level 2 remain on Rev. 2 under Class Deviation 2024-O0013, so the template flags where Rev. 3 differs.Official source: NIST SP 800-171 Rev. 3
  • Risk types: Regulatory Compliance, Third-Party Risk, Information Security, Data Privacy
  • Risk domains: Identity & Access Management, Incident Response, Cloud Security, Threat Intelligence, Data Protection, Supply Chain, Operational Continuity
  • Typical use cases: CUI subcontractor due diligence; Cloud or managed service provider handling CUI; NIST SP 800-171 Rev. 3 gap review against an SSP and POA&M; Federal agency or prime contractor flow-down verification
  • Coverage: 71 controls across 15 sections
Due diligence for ICT and cloud vendors to Singapore public agencies and to owners of critical information infrastructure (CII). It covers the publicly documented parts of the Instruction Manual for ICT&SS Management (formerly IM8): the Third-Party Management lifecycle and the Government Data Security Policies; Multi-Tier Cloud Security certification under SS 584:2020 at Levels 1 to 3; the outsourcing, cloud and access clauses of the Cybersecurity Code of Practice for CII 2026 issued under the Cybersecurity Act 2018 as amended in 2024; and the PDPA duties of a data intermediary acting for a public agency, including the section 26E breach notice.Official source: IMDA MTCS SS 584
  • Risk types: Regulatory Compliance, Third-Party Risk, Information Security, Data Privacy
  • Risk domains: Vendor Due Diligence, Cloud Security, Data Protection, Identity & Access Management, Incident Response, Operational Continuity, Resilience
  • Typical use cases: Singapore public agency ICT vendor onboarding under IM on ICT&SS Management; Cloud service evaluation against MTCS SS 584:2020; CII owner outsourcing and cloud due diligence under CCoP 2026; Data intermediary review for personal data processed for a public agency; Exit and data return planning for government contracts
  • Coverage: 42 controls across 10 sections
Due diligence for private sector suppliers that provide services or solutions to Spanish public sector bodies and so fall under the National Security Framework (ENS) through Article 2.3 of Royal Decree 311/2022 (BOE-A-2022-7191, consolidated text last amended 6 November 2024). It covers the Article 12 security policy, system categorization as BASIC, MEDIUM or HIGH (Article 40, Annex I), the Declaration or Certification of Conformity and two yearly audits (Articles 31, 38, Annex III, ITS de conformidad and CCN-STIC 809), and the Annex II measures most relevant to suppliers, including op.ext, op.nub.1 for cloud services, incident handling and the mp protection measures.Official source: Real Decreto 311/2022 (BOE)
  • Risk types: Regulatory Compliance, Third-Party Risk, Information Security, Audit Readiness
  • Risk domains: Risk Governance, Identity & Access Management, Incident Response, Resilience, Cloud Security, Supply Chain, Data Protection
  • Typical use cases: Spanish public sector supplier onboarding; Verifying ENS Certification of Conformity for MEDIUM or HIGH systems; Cloud service procurement under op.nub.1; Flowing ENS requirements down a contractor supply chain
  • Coverage: 49 controls across 12 sections
Due diligence for Texas state agencies, institutions of higher education and public community colleges buying cloud computing services, and for vendors selling to them. It covers scope and certification under Texas Government Code 2054.0593 and 1 TAC 202.5, 202.27 and 202.77, TX-RAMP Level 1 and Level 2 certification, provisional certification, reciprocity with FedRAMP and GovRAMP (formerly StateRAMP), continuous compliance, the Texas Cybersecurity Framework objectives relevant to vendors, incident notification support for Government Code 2054.603, and contractor cybersecurity training under 2054.5192.Official source: Texas DIR TX-RAMP
  • Risk types: Regulatory Compliance, Third-Party Risk, Information Security, Vendor Assessment
  • Risk domains: Cloud Security, Vendor Due Diligence, Threat Intelligence, Incident Response, Identity & Access Management, Data Protection, Risk Governance
  • Typical use cases: Texas state agency or university cloud procurement and renewal; Verifying TX-RAMP certification level and expiration; Tracking a provisionally certified vendor to full certification; Accepting FedRAMP or GovRAMP status through TX-RAMP reciprocity; Contract compliance for incident notification and contractor training
  • Coverage: 47 controls across 10 sections
Supplier due diligence for UK central government, NHS and wider public sector buyers. Covers Cyber Essentials and Cyber Essentials Plus under the NCSC Requirements for IT Infrastructure v3.3 (Danzell question set, April 2026) as called for by PPN 014 (February 2025, which replaced PPN 09/23 and the original PPN 09/14), the 14 NCSC Cloud Security Principles used in G-Cloud, handling of OFFICIAL information under the Government Security Classifications Policy, UK GDPR Article 28 processor terms, and the NCSC Cyber Assessment Framework v4.0 where the supplier supports an essential function.Official source: NCSC Cyber Essentials
  • Risk types: Regulatory Compliance, Third-Party Risk, Information Security, Data Privacy
  • Risk domains: Vendor Due Diligence, Cloud Security, Identity & Access Management, Threat Intelligence, Data Protection, Incident Response, Supply Chain
  • Typical use cases: PPN 014 Cyber Essentials verification for central government contracts; G-Cloud and cloud supplier assurance against the NCSC Cloud Security Principles; Supplier handling OFFICIAL and OFFICIAL-SENSITIVE information; UK GDPR Article 28 processor due diligence for a public authority controller; CAF v4.0 supply chain assurance for operators of essential services
  • Coverage: 55 controls across 8 sections
Vendor due diligence for federal agencies, and for companies and state buyers flowing down federal terms, on the statutory supply chain prohibitions: Section 889 (FAR 52.204-24, -25, -26), Kaspersky (52.204-23), FASCSA orders (52.204-28, -29, -30), ByteDance (52.204-27, now affected by OMB M-26-17), American Security Drone Act UAS (52.240-1), Trade Agreements Act origin (52.225-5, -6), SAM.gov registration and exclusions, foreign ownership, and the Commerce ICTS connected vehicle rule (15 CFR Part 791 Subpart D). Clause numbers are as published on acquisition.gov in November 2026; agencies using the Revolutionary FAR Overhaul Part 40 deviation consolidate these into 52.240-90 and 52.240-91, which FAR Case 2026-001 (proposed June 23, 2026) would codify.Official source: FAR Part 52 (acquisition.gov)
  • Risk types: Regulatory Compliance, Third-Party Risk, Information Security, Vendor Assessment
  • Risk domains: Supply Chain, Vendor Due Diligence, Incident Response
  • Typical use cases: Federal IT, telecom and cloud vendor onboarding; Section 889 and FASCSA representation review; GSA schedule reseller country of origin review; Drone service provider due diligence; State and local buyers flowing down federal grant terms
  • Coverage: 51 controls across 12 sections
A cross-state security baseline for IT vendors serving US state and local government agencies, drawn from common requirements rather than any one state’s law. Uses CIS Controls v8.1 IG1 and IG2 and NIST CSF as the control spine, with state examples cited where verified: California SAM Chapter 5300 and SIMM 5300-A and 5305-A, Texas Gov. Code 2054.138 and Chapter 2063 (TX-RAMP, contractor training, 48-hour agency incident reporting) and 1 TAC Chapter 477 (formerly 202), and New York ITS policies NYS-P03-002, NYS-P23-001, NYS-P26-001 and NYS-S13-003. Covers data residency, background checks, breach notice, right to audit, cyber insurance and return and destruction of data.Official source: California SAM Chapter 5300
  • Risk types: Information Security, Third-Party Risk, Regulatory Compliance, Vendor Assessment, Operational Risk
  • Risk domains: Identity & Access Management, Incident Response, Threat Intelligence, Data Protection, Vendor Due Diligence, Supply Chain, Resilience
  • Typical use cases: State agency IT vendor onboarding; Local government SaaS security review; Cross-state procurement security baseline; Cloud vendor TX-RAMP and GovRAMP readiness check; Contract renewal security evidence review
  • Coverage: 53 controls across 15 sections

​
Operations & supply chain

Five templates for suppliers of physical goods and services, where the risk is a stopped production line rather than a breach. Each is organised into six sections covering the supplier lifecycle from planning through verification. Unlike the frameworks above, these are written by Coverbase rather than derived from a single published standard, so they cite no external source. Individual controls do reference standards where one applies, such as ISO 9001 for quality systems or EU 10/2011 for food contact materials.
Oversight of a third party building your product. Covers quality system scope at the producing site, change control and which changes need your approval, undisclosed onward subcontracting, batch traceability, non-conformance handling and who may release held product, and capacity and customer-owned tooling. Backward traceability alone does not bound a recall, so it also asks the forward question: given a suspect input lot, which finished units contain it.
  • Risk types: Operational Risk, Third-Party Risk, Audit Readiness
  • Risk domains: Manufacturing Quality, Supply Chain, Vendor Due Diligence
  • Typical use cases: Contract manufacturer onboarding; Toll processing oversight; Private label supplier qualification
  • Sections: Quality management system, Change control, Subcontracting, Traceability and records, Non-conformance and corrective action, Capacity and tooling
  • Coverage: 25 controls across 6 sections
Freight forwarders, carriers and third-party logistics providers. Covers cargo cover set against the governing liability convention, chain of custody and seal integrity, condition monitoring and excursion reporting, the named list of facilities that will hold your goods, contingency routing and peak capacity, and trade compliance. Insurance limits and convention caps are asked separately, because the gap between the two is where your exposure sits.
  • Risk types: Operational Risk, Third-Party Risk
  • Risk domains: Logistics, Supply Chain, Operational Continuity
  • Typical use cases: 3PL onboarding; Freight forwarder review; Cold chain partner qualification
  • Sections: Coverage and liability, Chain of custody, Condition control, Network and facilities, Contingency, Trade compliance
  • Coverage: 24 controls across 6 sections
Converters and packaging suppliers. Covers product contact compliance across the markets you sell into, declarations of compliance and what triggers a reissue, recycled content substantiation and whether a claim is physical or mass balance, the data behind packaging waste reporting, migration testing conditions, and recall support. Recycled content in a product contact layer usually needs its own authorisation, which a general recycled claim does not provide.
  • Risk types: Regulatory Compliance, Operational Risk
  • Risk domains: Manufacturing Quality, Risk Governance, Supply Chain
  • Typical use cases: Packaging supplier qualification; Product contact compliance; Packaging waste reporting readiness
  • Sections: Product contact compliance, Declarations and change management, Sustainability claims, Extended producer responsibility, Testing and verification, Recall and incident support
  • Coverage: 23 controls across 6 sections
Resin, chemical and commodity inputs. Covers certificates of analysis issued against an agreed specification, composition disclosure including substances below reportable thresholds, restricted substance and PFAS declarations, regulatory change monitoring, country of origin and lot traceability, responsible sourcing and forced labour risk, and shelf life and retained samples. Undisclosed blending across sources breaks the link between certificate and delivery, so it is asked directly.
  • Risk types: Operational Risk, Regulatory Compliance, Third-Party Risk
  • Risk domains: Supply Chain, Risk Governance
  • Typical use cases: Raw material supplier qualification; Restricted substance diligence; Responsible sourcing review
  • Sections: Specification and certification, Composition and restricted substances, Regulatory monitoring, Origin and traceability, Responsible sourcing, Handling and stability
  • Coverage: 25 controls across 6 sections
Supplier due diligence on conflict minerals and responsible mineral sourcing for components, devices, packaging and equipment containing tin, tantalum, tungsten, gold, cobalt or mica: Dodd-Frank section 1502 and SEC Rule 13p-1 with Form SD, Regulation (EU) 2017/821 for Union importers, the OECD five-step framework and its Annex II risks, CMRT and EMRT completeness and declaration scope, smelter and refiner conformance, chain-of-custody claims, and the forced and child labour obligations a buyer bundles with them.Official source: Regulation (EU) 2017/821 (Conflict Minerals)
  • Risk types: Third-Party Risk, Regulatory Compliance, Operational Risk, Vendor Assessment
  • Risk domains: Supply Chain, Vendor Due Diligence, Risk Governance, Manufacturing Quality
  • Typical use cases: Conflict minerals survey of a component or device supplier; CMRT and EMRT review before a Form SD filing; Union importer due diligence under Regulation (EU) 2017/821; Smelter and refiner conformance gap closure; Forced labour and UFLPA traceability screening
  • Coverage: 49 controls across 11 sections
Whether a supplier can keep your line fed, and what happens when it cannot. Covers continuity planning and annual testing, recovery objectives, alternate sites and the lead time to qualify one, ownership and transfer of customer tooling, lead time and buffer stock, sub-tier visibility and geographic concentration, and how constrained supply is allocated across customers. Asks for a dated continuity test rather than the existence of a plan, and treats an alternate source the supplier cannot name as no alternate at all.
  • Risk types: Operational Risk, Third-Party Risk
  • Risk domains: Operational Continuity, Supply Chain, Resilience
  • Typical use cases: Production-critical supplier review; Single-source exposure; Business continuity due diligence
  • Sections: Continuity planning, Alternate sourcing and capacity, Lead time and inventory, Upstream dependency, Disruption response, Verification
  • Coverage: 27 controls across 6 sections

​
Internal Controls Library

The 22 templates below are evaluated against your own applications, not a vendor’s. Coverbase Inspect signs in to the application with read-only credentials, drives its admin console, and decides each control from what it can see.
These controls are written for an agent rather than a person. Each one states an expectation carrying its own threshold, names the admin surface to look at plus the alternate labels other vendors use for it, and defines what counts as incomplete. Incomplete is a real outcome, not a failure: an application that does not sell a capability cannot fail a control about it. Every control also forbids destructive or outbound actions, so a run reads state and never changes it.
Start with Security Configuration Baseline on a newly onboarded application, then layer a domain set on top. It is deliberately vendor-neutral and short enough to run against the long tail of niche tools that will never justify a bespoke control set.

​
Identity and access

How workforce users sign in to an application, read from the live admin console rather than from an attestation. Covers MFA enforcement and its exceptions, SSO federation and whether the local login form survives beside it, password and session policy, and the authentication events the tenant keeps. Written for continuous Inspect runs: every expectation carries its own threshold so a run can decide it without asking anyone.
  • Risk types: Information Security, Operational Risk
  • Risk domains: Identity & Access Management
  • Typical use cases: Continuous verification that MFA is enforced, not merely available; Detecting authentication policy drift between assessments; Evidence that SSO enforcement survived a tenant migration; Pre-contract validation of a SaaS application’s login controls
  • Coverage: 22 controls across 4 sections
Who holds administrative power inside an application right now, and what bounds it. Counts and names administrators from the live member list, checks whether privilege is standing or requested, and looks for the break-glass, service, and API principals that ordinary access reviews miss. Sized so an Inspect run can complete it against most admin consoles in one session.
  • Risk types: Information Security, Operational Risk, Audit Readiness
  • Risk domains: Identity & Access Management, Risk Governance
  • Typical use cases: Continuous administrator-count monitoring between access reviews; Detecting privilege creep in a high-risk SaaS application; Evidence for a SOX or SOC 2 access-review control; Finding service and break-glass accounts nobody owns
  • Coverage: 18 controls across 4 sections
Joiner, mover and leaver evidence read from inside the application rather than from the HR system that is supposed to drive it. Finds the accounts that outlived their owner, the invitations nobody accepted, the external collaborators still holding a seat, and the offboarding steps that stop at the identity provider and never reach the app.
  • Risk types: Information Security, Operational Risk, Audit Readiness
  • Risk domains: Identity & Access Management, Risk Governance
  • Typical use cases: Continuous leaver-account detection between HR and SaaS; Evidence that offboarding reached every in-scope application; Finding dormant seats before a renewal negotiation; Access-review support for an audited application
  • Coverage: 15 controls across 4 sections

​
Application scope and integrations

What an application is being used for today, checked against what it was approved for. An assessment scopes a vendor once; the vendor then ships features, an admin turns one on, and the application quietly starts touching data or performing functions nobody vetted. These controls read the live feature and module state so a re-inspection surfaces the drift as a diff.
  • Risk types: Third-Party Risk, Operational Risk, Regulatory Compliance
  • Risk domains: Vendor Due Diligence, Risk Governance
  • Typical use cases: Detecting features enabled after the vendor was assessed; Confirming an application stayed inside its approved use case; Re-scoping trigger for an annual vendor review; Shadow-module discovery inside an approved application
  • Coverage: 13 controls across 3 sections
The fourth-party surface an application accumulates. Every OAuth grant, installed app, webhook and inbound connection is a path for data to leave the tenant, and most of them were authorised by an individual user rather than through a review. These controls enumerate the connections, read their scopes, and check whether an administrator ever has to approve one.
  • Risk types: Information Security, Third-Party Risk, Data Privacy
  • Risk domains: Supply Chain, Data Protection, Identity & Access Management
  • Typical use cases: Fourth-party discovery inside an approved application; OAuth scope review for a data-bearing SaaS tenant; Detecting user-authorised integrations that bypassed review; Shadow-integration monitoring between assessments
  • Coverage: 18 controls across 4 sections
The settings any business application should hold regardless of what it does. Deliberately vendor-neutral and short enough to run against every application in an estate, including the long tail of niche tools that will never justify a bespoke control set of their own. Use it as the default set for a newly onboarded application and layer a domain set on top.
  • Risk types: Information Security, Operational Risk
  • Risk domains: Identity & Access Management, Data Protection
  • Typical use cases: Default control set for every newly onboarded application; Baseline coverage across the long tail of niche SaaS tools; Configuration drift detection between assessments; Fast first Inspect run on an unfamiliar application
  • Coverage: 16 controls across 3 sections
What the organization is paying for against what it is using. Seat waste, unassigned licences, dormant accounts and shadow expansion are financial findings that happen to be readable from the same admin surfaces as the security ones, so a run that is already logged in should collect them.
  • Risk types: Financial Controls, Operational Risk, Third-Party Risk
  • Risk domains: Vendor Due Diligence, Risk Governance
  • Typical use cases: Seat utilisation evidence ahead of a renewal negotiation; Detecting licence expansion between contract reviews; Finding dormant paid seats across an estate; Reconciling contracted entitlement against deployed configuration
  • Coverage: 12 controls across 2 sections

​
Data handling and privacy

The storage, encryption, backup and key-management state an application exposes to its tenant. Most of this is the vendor’s to configure, but the parts a tenant owns (customer-managed keys, backup schedules, storage region, attachment handling) drift silently and are exactly what a SOC 2 report will not tell you about this tenant on this day.
  • Risk types: Information Security, Operational Risk
  • Risk domains: Data Protection, Cloud Security
  • Typical use cases: Verifying customer-managed encryption keys are still bound to the tenant; Confirming backup configuration between assessments; Storage region validation for a data-residency commitment; Evidence for an encryption-at-rest control
  • Coverage: 13 controls across 3 sections
Which categories of personal data an application holds, established from field names, object schemas and data-classification surfaces rather than from a questionnaire. Includes the masking, minimisation and subject-rights machinery a privacy programme depends on. Every instruction reads metadata: Inspect establishes that a field exists, never what any individual’s value is.
  • Risk types: Data Privacy, Regulatory Compliance, Information Security
  • Risk domains: Data Protection, Privacy Rights
  • Typical use cases: Continuous PII inventory for a records-of-processing obligation; Detecting personal data appearing in an application never scoped for it; Evidence that masking is applied to identifiers in a support tool; Privacy review of a newly onboarded SaaS application
  • Coverage: 16 controls across 4 sections
Where data sits, how long it stays, and what happens when somebody deletes it. These are contractual and regulatory commitments that live as tenant settings, which means they can be changed by an administrator without anyone renegotiating the contract, and a point-in-time assessment would never notice.
  • Risk types: Data Privacy, Regulatory Compliance, Operational Risk
  • Risk domains: Data Protection, Privacy Rights
  • Typical use cases: Verifying a contractual data-residency commitment still holds; Retention-policy drift detection between audits; Evidence for a records-management control; Confirming deletion reaches backups and logs
  • Coverage: 15 controls across 3 sections
Every way data leaves an application through a route the application itself provides: public links, external sharing, downloads, bulk exports, printing and email forwarding. These settings are changed by administrators for good operational reasons and are almost never revisited, which is what makes them worth reading on every run rather than once a year.
  • Risk types: Information Security, Data Privacy, Operational Risk
  • Risk domains: Data Protection
  • Typical use cases: Continuous monitoring of external sharing defaults; Finding public links created before a policy tightened; Evidence for a data-loss-prevention control; Egress review of a collaboration application
  • Coverage: 16 controls across 4 sections
The HIPAA Security Rule technical safeguards, expressed as things an agent can read from a live application rather than as policy language. Covers unique user identification, emergency access, automatic logoff, audit controls, transmission security and the minimum-necessary access standard. Written for covered entities and business associates running clinical, claims or patient- facing SaaS.
  • Risk types: Regulatory Compliance, Data Privacy, Healthcare
  • Risk domains: Healthcare Compliance, Data Protection, Identity & Access Management
  • Typical use cases: Continuous HIPAA Security Rule evidence for an in-scope application; Detecting PHI appearing in an application with no BAA; Minimum-necessary access verification between audits; Business associate application monitoring
  • Coverage: 21 controls across 4 sections
GDPR obligations that are configuration rather than paperwork: where personal data sits, who processes it, what the tenant can produce for a subject request, how long records live, and which transfers leave the EEA. Read from the live application so the record of processing reflects the tenant as configured today rather than as described at onboarding.
  • Risk types: Data Privacy, Regulatory Compliance
  • Risk domains: Privacy Rights, Data Protection
  • Typical use cases: Keeping an Article 30 record of processing accurate between reviews; Verifying an international transfer commitment still holds; Establishing that subject-rights requests can be served; Privacy review of an EEA-facing SaaS application
  • Coverage: 22 controls across 4 sections

​
AI usage

The AI surface a vendor has switched on inside an application. This is the fastest-drifting scope in any SaaS estate: features arrive enabled by default in a release the tenant did not choose, they read whatever the application holds, and they route it to a model the assessment never named. These controls enumerate what is on, what it reads, where it sends, and whether tenant data trains anything.
  • Risk types: AI Risk, Data Privacy, Third-Party Risk, Information Security
  • Risk domains: AI Governance, Data Protection, Supply Chain
  • Typical use cases: Detecting AI features enabled by a vendor release nobody reviewed; Establishing whether tenant data trains a vendor model; AI inventory for an EU AI Act or ISO 42001 obligation; Continuous monitoring of an application’s AI scope
  • Coverage: 23 controls across 4 sections
AI that acts rather than answers. An agent configured inside an application holds a standing identity, a set of tools, and permission to write, which makes it a privileged principal that no access review lists and no joiner process created. These controls enumerate the agents, read what they may do, check whether their actions are attributable and reversible, and, in the Runtime Authorization section, whether each action is checked against a policy on its parameters when it runs, whether agents hold task-scoped or standing credentials, whether actions carry the delegating person, and whether policy is set once for the tenant. See Agent runtime authorization.
  • Risk types: AI Risk, Information Security, Operational Risk
  • Risk domains: AI Governance, Identity & Access Management
  • Typical use cases: Inventorying autonomous agents operating inside a business application; Establishing what an agent is permitted to write and to whom it can send; Attribution evidence for actions taken by an AI agent; Continuous monitoring of agent scope expansion; Evidence that agent actions are authorised at runtime, per action, under the delegating person
  • Coverage: 21 controls across 4 sections

​
Resilience, performance and audit

Resilience evidence gathered from inside a live application on an ordinary working day, rather than from a scheduled Saturday failover test the vendor agreed to in advance. Reads the tenant’s own status, incident, maintenance and capacity surfaces, and records the observations that only mean something as a series: which instance served the run, what the response looked like, whether the data present today matches yesterday.
  • Risk types: Operational Risk, Third-Party Risk, Regulatory Compliance
  • Risk domains: Operational Continuity, Resilience
  • Typical use cases: Continuous third-party resilience testing without vendor coordination; Regulatory evidence for an operational resilience programme; Detecting an unannounced failover or instance migration; Building an uptime record independent of the vendor’s own status page
  • Coverage: 21 controls across 4 sections
Whether the service the tenant is receiving matches the service that was contracted. Reads the uptime figures, support response commitments, credit mechanisms and observed responsiveness that together answer ‘did they meet the SLA’, a question most organizations can only ask retrospectively, from the vendor’s own numbers.
  • Risk types: Operational Risk, Third-Party Risk, Financial Controls
  • Risk domains: Operational Continuity, Vendor Due Diligence
  • Typical use cases: Independent SLA conformance evidence for a renewal negotiation; Continuous uptime measurement not sourced from the vendor; Service credit eligibility detection; Support responsiveness monitoring for a critical application
  • Coverage: 14 controls across 3 sections
Whether an application can tell you what happened in it. Covers event coverage, attribution, retention, export and alerting: the properties that decide whether an investigation is possible at all. Kept deliberately small so it can run alongside a domain-specific set rather than competing with it for session time.
  • Risk types: Information Security, Audit Readiness, Operational Risk
  • Risk domains: Incident Response, Risk Governance
  • Typical use cases: Establishing whether an application supports a forensic investigation; Log retention and export verification for an in-scope application; Evidence for a monitoring control in an audited environment; Pre-incident readiness check on a critical SaaS tenant
  • Coverage: 13 controls across 3 sections

​
Application classes

A CRM holds the customer relationship: contacts, pipeline, contract terms, support history and whatever a salesperson attached to a record. It is usually the widest-reach application an organization runs and the one with the most integrations hanging off it. Written against the surfaces a Salesforce, HubSpot, Dynamics or Zoho admin console exposes.
  • Risk types: Information Security, Data Privacy, Operational Risk
  • Risk domains: Data Protection, Identity & Access Management
  • Typical use cases: Continuous monitoring of the organization’s primary CRM; Detecting customer data leaving through a CRM integration; Sharing-model verification after a CRM administrator change; Pipeline and contract data exposure review
  • Coverage: 22 controls across 4 sections
An HRIS holds the most sensitive employee data an organization has (compensation, bank details, national identifiers, performance and health-related absence), and it is the system that drives access everywhere else. These controls read the access model, the identifier fields, the payroll change trail and the downstream provisioning that depends on it.
  • Risk types: Data Privacy, Information Security, Financial Controls
  • Risk domains: Data Protection, Identity & Access Management, Financial Reporting
  • Typical use cases: Continuous monitoring of the system of record for employee data; Payroll change control evidence; Verifying HR-driven provisioning still reaches downstream applications; Employee personal-data exposure review
  • Coverage: 18 controls across 4 sections
Controls for applications operating inside a regulated financial institution, where the supervisory expectation is continuous rather than annual. Covers segregation of duties, records retention under books-and-records rules, communications capture, change control and the operational resilience evidence supervisors increasingly ask to see for a critical third party.
  • Risk types: Financial Controls, Regulatory Compliance, Operational Risk
  • Risk domains: Banking & Finance, Financial Reporting, Operational Continuity
  • Typical use cases: Continuous control evidence for a regulated financial institution; Books-and-records retention verification on a communications tool; Segregation-of-duties monitoring in a financial application; Critical third-party resilience evidence for a supervisor
  • Coverage: 17 controls across 4 sections

​
Framework-derived

Use this set when a security reviewer wants a framework they recognize rather than Coverbase’s own baselines.
The CIS Critical Security Controls v8.1, read from a SaaS application’s live admin console. Thirty controls across account management, access control, secure configuration, data protection, audit log management, alerting and service provider management, each derived from one CIS safeguard. A control decides only what the tenant’s admin console can show for its safeguard: the enforcement state, the threshold, the list. The safeguard’s process half, a documented policy or a review cadence, is not something a console shows and is not claimed. The instructions name each surface the way several vendors label it, so the same set runs against Salesforce, Box, Workday or a niche tool.Each control cites its CIS safeguard and the NIST SP 800-53 Rev. 5 controls that CIS’s own v8.1 mapping ties that safeguard to. The references appear on the evaluation, the finding and the control editor, and carry over when you fork the set.Official source: CIS Critical Security Controls v8.1
  • Risk types: Information Security, Operational Risk
  • Risk domains: Identity & Access Management, Data Protection
  • Typical use cases: Demonstrating SaaS posture against a framework a security reviewer recognizes; Continuous verification of CIS Controls v8.1 safeguards on business applications; Detecting posture drift against a CIS-anchored baseline between runs; Evidence for a NIST or CIS compliance report from live tenant configuration
  • Sections: Access Control Management (CIS Control 6), Account Management (CIS Control 5), Secure Configuration (CIS Control 4), Data Protection (CIS Control 3), Audit Log Management and Alerting (CIS Controls 8 and 17), Connected Applications (CIS Controls 15 and 2)
  • Coverage: 30 controls across 6 sections