Enterprise Controls Framework for the Regulatory Compliance domain — the optimised set of process controls that give effect to its technical controls.
3 process controls, grouped by sub-policy and shown in full six-level lineage with operational artifacts.
CAO-800 Regulatory Compliance
CAO-810 Legal and Regulatory Compliance Policy
CAO-800 Regulatory Compliance › CAO-810 Legal and Regulatory Compliance Policy › CAO-811 Legal and Regulatory Obligations › CAO-8111 Meet legal, regulatory and IP obligations › CAO-81111 Legal, regulatory, statutory and intellectual-property obligations identified and met.
CAO-811111 · Examine the legal and regulatory register to confirm obligations are identified and met.
Method: Examine · Expected evidence: Legal and regulatory obligations register
Operational controls: CAO-8111112 PAIA Manual – template · CAO-8111111 Legal and Regulatory Obligations Register
CAO-800 Regulatory Compliance › CAO-810 Legal and Regulatory Compliance Policy › CAO-812 Cyber-Crime and Incident Reporting › CAO-8121 Comply with cyber-crime and incident-reporting law › CAO-81211 Cyber-crime and incident-reporting legal obligations complied with.
CAO-812111 · Examine incident-reporting compliance to confirm legal reporting obligations are met.
Method: Examine · Expected evidence: Regulatory incident-reporting records
Operational controls: CAO-8121112 Cyber Offence 72-hour Report – form · CAO-8121111 Regulatory Reporting Register
CAO-800 Regulatory Compliance › CAO-810 Legal and Regulatory Compliance Policy › CAO-813 Information Access Compliance › CAO-8131 Operate statutory information-access request handling › CAO-81311 Access-request receipt, decision and response operated within statutory timeframes and fees
CAO-813111 · Examine access-request records against statutory forms, fees and decision deadlines
Method: examine · Expected evidence: request register; decision notices
Operational controls: CAO-8131111 Information Access Request Register