The CIAO Standard ECF

CAO-100 Governance › CAO-110 Information Governance Policy › CAO-111 Information Governance Framework and Strategy › CAO-1111 Recognise and govern information as a strategic organisational asset › CAO-11111 Information recognised and governed as a strategic asset across the organisation.

CAO-111111 · Examine the information governance framework and asset inventories to confirm information is governed as a strategic asset.

Method: examine · Expected evidence: IG framework; information asset inventory

Operational controls: CAO-1111111 Information Governance Framework — template

CAO-100 Governance › CAO-110 Information Governance Policy › CAO-111 Information Governance Framework and Strategy › CAO-1112 Integrate information governance into organisational governance with leadership commitment › CAO-11121 Information governance integrated into the organisation’s governance frameworks with visible leadership commitment.

CAO-111211 · Examine governing-body records to confirm information governance integration and leadership engagement.

Method: examine · Expected evidence: governance minutes; IG charter

Operational controls: CAO-1112111 Information Governance Charter — template

CAO-100 Governance › CAO-110 Information Governance Policy › CAO-112 Information Lifecycle, Access and Culture › CAO-1121 Govern information across its lifecycle, available and accessible to stakeholders › CAO-11211 Information governed across its whole lifecycle with availability and accessibility to stakeholders.

CAO-112111 · Examine lifecycle schedules and access records to confirm information availability and accessibility.

Method: examine · Expected evidence: lifecycle schedules; access records

Operational controls: CAO-1121111 Information Asset Register

CAO-100 Governance › CAO-110 Information Governance Policy › CAO-112 Information Lifecycle, Access and Culture › CAO-1122 Operate risk-based information governance supported by collaborative culture › CAO-11221 Risk-based information governance operated with a collaborative, sustainable information culture.

CAO-112211 · Examine risk assessments and culture programmes supporting information governance.

Method: examine · Expected evidence: risk register extracts; awareness records

Operational controls: CAO-1122111 Information Governance Risk and Culture Record

CAO-100 Governance › CAO-120 Board Charter › CAO-121 Board Composition and Independence › CAO-1211 Ensure an appropriately composed and independent board › CAO-12111 Board composed with appropriate balance, diversity and independence.

CAO-121111 · Examine board composition to confirm appropriate balance, diversity and independence.

Method: Examine · Expected evidence: Board composition records

Operational controls: CAO-1211111 Board Composition Register

CAO-100 Governance › CAO-120 Board Charter › CAO-122 Succession and Evaluation › CAO-1221 Plan board and executive succession › CAO-12211 Board and executive succession planned to ensure continuity of leadership.

CAO-122111 · Examine succession plans to confirm board and executive continuity is planned.

Method: Examine · Expected evidence: Succession plan

Operational controls: CAO-1221111 Succession Plan — template

CAO-100 Governance › CAO-120 Board Charter › CAO-122 Succession and Evaluation › CAO-1222 Evaluate the performance of the board and its members › CAO-12221 Board and member performance evaluated periodically.

CAO-122211 · Examine board evaluation records to confirm performance is evaluated.

Method: Examine · Expected evidence: Board evaluation records

Operational controls: CAO-1222111 Board Evaluation Register

CAO-100 Governance › CAO-130 Data Governance Policy › CAO-131 Data Governance Framework and Stewardship › CAO-1311 Establish data governance aligned to the information governance umbrella › CAO-13111 Data governance established and aligned to the information governance umbrella.

CAO-131111 · Examine the data governance framework to confirm alignment and operation.

Method: examine · Expected evidence: data governance framework; operating records

Operational controls: CAO-1311111 Data Governance Charter — template

CAO-100 Governance › CAO-130 Data Governance Policy › CAO-131 Data Governance Framework and Stewardship › CAO-1312 Define data stewardship roles, accountabilities and decision rights › CAO-13121 Data stewardship roles, accountabilities and decision rights defined and operated.

CAO-131211 · Examine stewardship assignments and decision records to confirm accountabilities are operated.

Method: examine · Expected evidence: stewardship assignments; decision logs

Operational controls: CAO-1312111 Data Stewardship Register

CAO-100 Governance › CAO-140 Corporate Governance Policy › CAO-141 Board Leadership and Accountability › CAO-1411 Establish effective and ethical board leadership › CAO-14111 Effective and ethical board leadership established.

CAO-141111 · Examine the board charter and conduct to confirm effective and ethical leadership.

Method: Examine · Expected evidence: Board charter

Operational controls: CAO-1411111 Board Charter — template

CAO-100 Governance › CAO-140 Corporate Governance Policy › CAO-141 Board Leadership and Accountability › CAO-1412 Ensure board accountability and oversight › CAO-14121 Board accountability and oversight of the organisation ensured.

CAO-141211 · Examine board oversight records to confirm accountability and oversight.

Method: Examine · Expected evidence: Board oversight records

Operational controls: CAO-1412111 Board Oversight Register

CAO-100 Governance › CAO-140 Corporate Governance Policy › CAO-142 Governance Roles and Responsibilities › CAO-1421 Define governance roles and the division of responsibilities › CAO-14211 Governance roles and the division of responsibilities defined.

CAO-142111 · Examine governance role definitions to confirm responsibilities are divided.

Method: Examine · Expected evidence: Governance roles and delegation of authority

Operational controls: CAO-1421111 Delegation of Authority Framework

CAO-100 Governance › CAO-140 Corporate Governance Policy › CAO-142 Governance Roles and Responsibilities › CAO-1422 Assign accountability and appoint data-protection responsibility › CAO-14221 Accountability assigned and data-protection responsibility appointed.

CAO-142211 · Examine accountability assignments to confirm data-protection responsibility is appointed.

Method: Examine · Expected evidence: DPO appointment and accountability records

Operational controls: CAO-1422111 Accountability and DPO Register

CAO-100 Governance › CAO-140 Corporate Governance Policy › CAO-142 Governance Roles and Responsibilities › CAO-1423 Delegate authority to executive management and ensure its effectiveness › CAO-14231 Authority delegated to executive management with effectiveness ensured.

CAO-142311 · Examine the delegation framework and executive performance records to confirm effective delegation.

Method: examine · Expected evidence: delegation framework; performance reviews

Operational controls: CAO-1423111 Executive Delegation and Performance Record

CAO-100 Governance › CAO-140 Corporate Governance Policy › CAO-143 Board Committees › CAO-1431 Establish and empower board committees with defined terms of reference › CAO-14311 Board committees established with defined terms of reference, composition and reporting.

CAO-143111 · Examine committee terms of reference, composition, meeting and reporting records.

Method: examine · Expected evidence: committee ToR; minutes; reports

Operational controls: CAO-1431111 Committee Terms of Reference — template

CAO-100 Governance › CAO-140 Corporate Governance Policy › CAO-144 Stakeholder and Shareholder Engagement › CAO-1441 Engage stakeholders and shareholders in the organisation’s best interests › CAO-14411 Stakeholders and shareholders engaged in the best interests of the organisation.

CAO-144111 · Examine stakeholder and shareholder engagement records to confirm engagement quality.

Method: examine · Expected evidence: engagement plans; meeting records

Operational controls: CAO-1441111 Stakeholder Engagement Register

CAO-100 Governance › CAO-140 Corporate Governance Policy › CAO-144 Stakeholder and Shareholder Engagement › CAO-1442 Govern the group governance framework › CAO-14421 Group governance framework defined and operated across the group.

CAO-144211 · Examine the group governance framework and its application across group entities.

Method: examine · Expected evidence: group governance framework; adoption records

Operational controls: CAO-1442111 Group Governance Framework — template

CAO-100 Governance › CAO-140 Corporate Governance Policy › CAO-145 Transparency and Disclosure › CAO-1451 Ensure transparency and stakeholder disclosure › CAO-14511 Transparency and stakeholder disclosure ensured through accurate, timely reporting.

CAO-145111 · Examine disclosures and stakeholder reporting to confirm transparency.

Method: Examine · Expected evidence: Disclosure and reporting records

Operational controls: CAO-1451112 Governance Disclosure Statement — template · CAO-1451111 Stakeholder Disclosure Register

CAO-100 Governance › CAO-150 Technology Governance Policy › CAO-151 IT Strategy and Value › CAO-1511 Govern information technology and digital strategy › CAO-15111 Information technology and digital strategy governed and aligned to organisational objectives.

CAO-151111 · Examine IT strategy governance to confirm alignment to objectives.

Method: Examine · Expected evidence: IT strategy and governance records

Operational controls: CAO-1511111 IT Strategy and Governance Plan

CAO-100 Governance › CAO-150 Technology Governance Policy › CAO-152 IT Oversight and Conformance › CAO-1521 Oversee IT performance, risk and conformance › CAO-15211 IT performance, risk and conformance overseen by the governing body.

CAO-152111 · Examine IT oversight reporting to confirm performance, risk and conformance are overseen.

Method: Examine · Expected evidence: IT oversight reports

Operational controls: CAO-1521111 IT Governance Reporting Register

CAO-100 Governance › CAO-160 Quality Management Policy › CAO-161 Quality Management System › CAO-1611 Establish and operate a quality management system › CAO-16111 Quality management system established and operated.

CAO-161111 · Examine the quality management system to confirm it is established and operated.

Method: Examine · Expected evidence: QMS documentation

Operational controls: CAO-1611111 Quality Management System — template

CAO-100 Governance › CAO-160 Quality Management Policy › CAO-161 Quality Management System › CAO-1612 Drive continual improvement of quality › CAO-16121 Continual improvement of quality driven through measurement and corrective action.

CAO-161211 · Examine improvement and corrective-action records to confirm continual improvement.

Method: Examine · Expected evidence: Improvement and corrective-action records

Operational controls: CAO-1612111 Continual Improvement Register

CAO-100 Governance › CAO-170 Remuneration Policy › CAO-171 Remuneration Governance › CAO-1711 Govern remuneration and incentives fairly and transparently › CAO-17111 Remuneration and incentives governed fairly, transparently and responsibly.

CAO-171111 · Examine remuneration policy and disclosures to confirm fair and transparent governance.

Method: Examine · Expected evidence: Remuneration policy and disclosures

Operational controls: CAO-1711111 Remuneration Policy — template

CAO-100 Governance › CAO-190 Security Governance Policy › CAO-192 Information Security Governance › CAO-1921 Establish and govern an information security management system › CAO-19211 Information security management system established and governed.

CAO-192111 · Examine the information security management system to confirm it is established, governed and maintained.

Method: Examine · Expected evidence: ISMS documentation

Operational controls: CAO-1921111 Information Security Management System — template

CAO-100 Governance › CAO-190 Security Governance Policy › CAO-192 Information Security Governance › CAO-1922 Maintain the information security programme › CAO-19221 Information security programme maintained, resourced and continually improved.

CAO-192211 · Examine the security programme to confirm it is resourced and continually improved.

Method: Examine · Expected evidence: Security programme and improvement records

Operational controls: CAO-1922111 Security Programme Plan

CAO-200 Audit and Risk › CAO-210 Risk Management Policy › CAO-211 Risk Governance and Appetite › CAO-2111 Establish a risk management framework › CAO-21111 Risk management framework established and integrated into governance and operations.

CAO-211111 · Examine the risk management framework to confirm it is established and integrated.

Method: Examine · Expected evidence: Risk management framework

Operational controls: CAO-2111111 Risk Management Framework — template

CAO-200 Audit and Risk › CAO-210 Risk Management Policy › CAO-211 Risk Governance and Appetite › CAO-2112 Define risk appetite and tolerance › CAO-21121 Risk appetite and tolerance defined and approved by the governing body.

CAO-211211 · Examine risk appetite statements to confirm they are defined and approved.

Method: Examine · Expected evidence: Risk appetite statement

Operational controls: CAO-2112111 Risk Appetite Statement — template

CAO-200 Audit and Risk › CAO-210 Risk Management Policy › CAO-212 Risk Identification and Assessment › CAO-2121 Identify risks across the organisation › CAO-21211 Risks identified systematically across the organisation.

CAO-212111 · Examine the risk register to confirm risks are identified across the organisation.

Method: Examine · Expected evidence: Risk register

Operational controls: CAO-2121111 Risk Register

CAO-200 Audit and Risk › CAO-210 Risk Management Policy › CAO-212 Risk Identification and Assessment › CAO-2122 Analyse and evaluate risks › CAO-21221 Risks analysed and evaluated against criteria to prioritise treatment.

CAO-212211 · Examine risk assessments to confirm risks are analysed and evaluated.

Method: Examine · Expected evidence: Risk assessment records

Operational controls: CAO-2122111 Risk Assessment Template

CAO-200 Audit and Risk › CAO-210 Risk Management Policy › CAO-213 Risk Treatment › CAO-2131 Treat and mitigate risks › CAO-21311 Risks treated through selected options, with treatment plans implemented and tracked.

CAO-213111 · Examine risk treatment plans to confirm risks are treated and tracked.

Method: Examine · Expected evidence: Risk treatment plan

Operational controls: CAO-2131111 Risk Treatment Plan

CAO-200 Audit and Risk › CAO-210 Risk Management Policy › CAO-214 Risk Monitoring and Reporting › CAO-2141 Monitor and report on risk › CAO-21411 Risks monitored and reported to the governing body and stakeholders.

CAO-214111 · Examine risk monitoring and reporting to confirm risks are tracked and reported.

Method: Examine · Expected evidence: Risk reports

Operational controls: CAO-2141111 Risk Reporting Register

CAO-200 Audit and Risk › CAO-220 Audit and Assurance Policy › CAO-221 Audit Oversight › CAO-2211 Oversee audit, assurance and internal control › CAO-22111 Audit, assurance and internal control overseen by an independent audit function.

CAO-221111 · Examine audit oversight arrangements to confirm independent oversight of assurance and controls.

Method: Examine · Expected evidence: Audit committee and assurance records

Operational controls: CAO-2211111 Internal Audit Charter — template

CAO-200 Audit and Risk › CAO-220 Audit and Assurance Policy › CAO-221 Audit Oversight › CAO-2212 Operate a combined assurance model across management, functions and assurance providers › CAO-22121 Combined assurance model developed, designed for coverage and coordinated across assurance providers.

CAO-221211 · Examine the combined assurance model for coverage, coordination and effectiveness.

Method: examine · Expected evidence: combined assurance model; assurance coverage map; audit committee minutes

Operational controls: CAO-2212111 Combined Assurance Model — template

CAO-200 Audit and Risk › CAO-220 Audit and Assurance Policy › CAO-222 Conformance and Independent Review › CAO-2221 Assure conformance and independent review › CAO-22211 Conformance assured through independent review and audit programmes.

CAO-222111 · Examine independent review and audit results to confirm conformance is assured.

Method: Examine · Expected evidence: Independent review and audit reports

Operational controls: CAO-2221111 Audit Programme Register

CAO-300 Privacy › CAO-310 Consent Management Policy › CAO-311 Privacy Notice and Transparency › CAO-3111 Provide a clear and current privacy notice › CAO-31111 Clear, current and accessible privacy notice provided describing the processing, its purposes and data-subject rights.

CAO-311111 · Examine the privacy notice to confirm it is current, accessible and describes processing and rights.

Method: Examine · Expected evidence: Published privacy notice

Operational controls: CAO-3111111 Privacy Notice — template

CAO-300 Privacy › CAO-310 Consent Management Policy › CAO-312 Obtaining Consent › CAO-3121 Obtain valid consent for processing › CAO-31211 Valid, freely given, specific and informed consent obtained and recorded where processing relies on consent.

CAO-312111 · Examine consent records to confirm consent is valid, specific and recorded.

Method: Examine · Expected evidence: Consent records

Operational controls: CAO-3121111 Consent Register

CAO-300 Privacy › CAO-310 Consent Management Policy › CAO-313 Consent Withdrawal and Choice › CAO-3131 Enable withdrawal of consent and exercise of choice › CAO-31311 Mechanisms provided to withdraw consent and exercise choice as easily as consent was given.

CAO-313111 · Examine consent-withdrawal mechanisms to confirm withdrawal is enabled and actioned.

Method: Examine, test · Expected evidence: Withdrawal records

Operational controls: CAO-3131111 Consent Withdrawal Work Instruction

CAO-300 Privacy › CAO-310 Consent Management Policy › CAO-314 Marketing and Opt-Out › CAO-3141 Honour opt-out of sale, sharing and direct marketing › CAO-31411 Opt-out of sale, sharing and direct marketing honoured, and preferences maintained.

CAO-314111 · Examine opt-out handling to confirm requests are honoured and preferences maintained.

Method: Examine · Expected evidence: Opt-out and preference records

Operational controls: CAO-3141111 Marketing Preference Register

CAO-300 Privacy › CAO-320 Data Subject Rights Policy › CAO-321 Right of Access › CAO-3211 Provide data subjects access to their personal information › CAO-32111 Data subjects provided access to their personal data and information about its processing.

CAO-321111 · Examine access-request handling to confirm requests are fulfilled within mandated timeframes.

Method: Examine · Expected evidence: Access-request records

Operational controls: CAO-3211111 Data Subject Access Request Register

CAO-300 Privacy › CAO-320 Data Subject Rights Policy › CAO-322 Rectification and Erasure › CAO-3221 Enable rectification and erasure of personal data › CAO-32211 Rectification and erasure of personal data enabled on valid request.

CAO-322111 · Examine rectification and erasure handling to confirm valid requests are actioned.

Method: Examine · Expected evidence: Rectification and erasure records

Operational controls: CAO-3221111 Rectification and Erasure Register

CAO-300 Privacy › CAO-320 Data Subject Rights Policy › CAO-323 Restriction, Objection and Portability › CAO-3231 Honour rights to restriction, objection and data portability › CAO-32311 Rights to restriction, objection and data portability honoured.

CAO-323111 · Examine handling of restriction, objection and portability requests to confirm they are honoured.

Method: Examine · Expected evidence: Restriction, objection and portability records

Operational controls: CAO-3231111 Data Rights Request Register

CAO-300 Privacy › CAO-320 Data Subject Rights Policy › CAO-324 Non-Discrimination and Complaints › CAO-3241 Ensure non-discrimination and handle complaints › CAO-32411 Non-discrimination ensured for the exercise of privacy rights, and complaints handled and resolved.

CAO-324111 · Examine complaint records to confirm complaints are handled and resolved without discrimination.

Method: Examine · Expected evidence: Complaint records and resolutions

Operational controls: CAO-3241111 Privacy Complaints Register

CAO-300 Privacy › CAO-330 Privacy by Design Policy › CAO-331 Privacy by Design and Default › CAO-3311 Embed privacy by design and by default across systems and processing › CAO-33111 Privacy embedded by design and by default across systems, products and processing activities.

CAO-331111 · Examine design and data-protection impact-assessment records to confirm privacy is embedded by design and default.

Method: Examine · Expected evidence: DPIA and privacy-by-design records

Operational controls: CAO-3311111 Privacy by Design Assessment Template

CAO-300 Privacy › CAO-340 Information Classification Policy › CAO-341 Information Classification › CAO-3411 Classify information according to its sensitivity and value › CAO-34111 Information classified according to its sensitivity, value and legal requirements.

CAO-341111 · Examine the classification scheme and classified assets to confirm consistent classification.

Method: Examine · Expected evidence: Classification scheme and classified inventory

Operational controls: CAO-3411111 Information Classification Scheme

CAO-300 Privacy › CAO-340 Information Classification Policy › CAO-342 Information Labelling › CAO-3421 Label information in line with its classification › CAO-34211 Information labelled in line with its classification across formats and media.

CAO-342111 · Examine labelling practices to confirm information is labelled per its classification.

Method: Examine · Expected evidence: Labelling procedure and samples

Operational controls: CAO-3421111 Information Labelling Work Instruction

CAO-300 Privacy › CAO-350 Information Transfer Policy › CAO-351 Information Transfer › CAO-3511 Transfer information securely within and outside the organisation › CAO-35111 Information transferred securely within and outside the organisation under agreements and protective controls.

CAO-351111 · Examine transfer agreements and controls to confirm secure transfer of information.

Method: Examine · Expected evidence: Transfer agreements and protection evidence

Operational controls: CAO-3511111 Information Transfer Agreement Template

CAO-300 Privacy › CAO-360 Records Management Policy › CAO-361 Records of Processing › CAO-3611 Maintain records of processing activities › CAO-36111 Records of processing activities maintained and kept current.

CAO-361111 · Examine the records of processing to confirm they are maintained and current.

Method: Examine · Expected evidence: Records of processing activities

Operational controls: CAO-3611111 Records of Processing Activities Register

CAO-300 Privacy › CAO-360 Records Management Policy › CAO-362 Records Retention and Documentation › CAO-3621 Retain and protect records in line with retention obligations › CAO-36211 Records retained and protected in line with retention obligations, then securely disposed.

CAO-362111 · Examine the retention schedule and records to confirm retention obligations are met.

Method: Examine · Expected evidence: Records retention schedule and disposal records

Operational controls: CAO-3621111 Records Retention Schedule

CAO-300 Privacy › CAO-370 Data Protection and Privacy Policy › CAO-371 Lawful Basis for Processing › CAO-3711 Establish a lawful basis for processing personal data › CAO-37111 A lawful basis identified and documented for each processing activity.

CAO-371111 · Examine processing records to confirm a lawful basis is identified for each activity.

Method: Examine · Expected evidence: Lawful basis register

Operational controls: CAO-3711111 Lawful Basis Register

CAO-300 Privacy › CAO-370 Data Protection and Privacy Policy › CAO-371 Lawful Basis for Processing › CAO-3712 Apply additional safeguards for special-category data › CAO-37121 Additional safeguards and conditions applied to special-category and sensitive personal data.

CAO-371211 · Examine processing of special-category data to confirm additional conditions and safeguards are met.

Method: Examine · Expected evidence: Special-category processing records

Operational controls: CAO-3712111 Special Category Data Register

CAO-300 Privacy › CAO-370 Data Protection and Privacy Policy › CAO-371 Lawful Basis for Processing › CAO-3713 Uphold the principles of lawful and fair processing › CAO-37131 Processing conducted lawfully, fairly and transparently in line with data-protection principles.

CAO-371311 · Examine processing practices to confirm alignment with lawful, fair and transparent principles.

Method: Examine · Expected evidence: Processing assessment records

Operational controls: CAO-3713111 Data Protection Principles Assessment

CAO-300 Privacy › CAO-370 Data Protection and Privacy Policy › CAO-372 Data Minimisation and Limitation › CAO-3721 Minimise personal data to what is necessary › CAO-37211 Personal data limited to what is adequate, relevant and necessary for the purpose.

CAO-372111 · Examine data collection and storage to confirm minimisation to necessary data.

Method: Examine · Expected evidence: Data minimisation records

Operational controls: CAO-3721111 Data Minimisation Assessment

CAO-300 Privacy › CAO-370 Data Protection and Privacy Policy › CAO-372 Data Minimisation and Limitation › CAO-3722 Limit processing to specified, explicit purposes › CAO-37221 Processing limited to specified, explicit and legitimate purposes.

CAO-372211 · Examine purpose specifications to confirm processing is limited to stated purposes.

Method: Examine · Expected evidence: Purpose specification records

Operational controls: CAO-3722111 Processing Purpose Register

CAO-300 Privacy › CAO-370 Data Protection and Privacy Policy › CAO-372 Data Minimisation and Limitation › CAO-3723 Limit the retention of personal data › CAO-37231 Personal data retained only as long as necessary for the purpose, then deleted.

CAO-372311 · Examine retention controls to confirm personal data is retained only as long as necessary.

Method: Examine · Expected evidence: Personal data retention records

Operational controls: CAO-3723111 Personal Data Retention Schedule

CAO-300 Privacy › CAO-370 Data Protection and Privacy Policy › CAO-373 Cross-Border Data Transfers › CAO-3731 Govern cross-border transfers of personal data › CAO-37311 Cross-border transfers of personal data governed by lawful transfer mechanisms and safeguards.

CAO-373111 · Examine transfer mechanisms to confirm cross-border transfers use lawful safeguards such as adequacy or standard clauses.

Method: Examine · Expected evidence: Transfer mechanism records

Operational controls: CAO-3731111 Cross-Border Transfer Register

CAO-300 Privacy › CAO-370 Data Protection and Privacy Policy › CAO-374 Personal Data Breach Notification › CAO-3741 Notify personal data breaches to regulators and data subjects › CAO-37411 Personal data breaches assessed and notified to regulators and data subjects within mandated timeframes.

CAO-374111 · Examine breach records to confirm assessment and timely notification to required parties.

Method: Examine · Expected evidence: Breach assessment and notification records

Operational controls: CAO-3741111 Personal Data Breach Register

CAO-300 Privacy › CAO-370 Data Protection and Privacy Policy › CAO-375 Data Quality and Protection › CAO-3751 Maintain the accuracy and quality of personal data › CAO-37511 Personal data kept accurate and up to date, with inaccuracies corrected.

CAO-375111 · Examine data-quality controls to confirm accuracy is maintained and corrections actioned.

Method: Examine · Expected evidence: Data-quality and correction records

Operational controls: CAO-3751111 Data Quality Register

CAO-300 Privacy › CAO-370 Data Protection and Privacy Policy › CAO-375 Data Quality and Protection › CAO-3752 Protect records and personally identifiable information › CAO-37521 Records and personally identifiable information protected against loss, misuse and unauthorised access.

CAO-375211 · Examine protection controls for records and PII to confirm protection against loss and misuse.

Method: Examine · Expected evidence: PII protection configuration and records

Operational controls: CAO-3752111 PII Protection Register

CAO-400 Cybersecurity › CAO-410 Access Control Policy › CAO-411 Access Control Governance › CAO-4111 Establish and maintain an access control policy aligned to business and security requirements › CAO-41111 Signed, reviewed, stored, communicated and acknowledged access control policy, with technical proof held in the document management system.

CAO-411111 · Examine the access-control policy and confirm it is documented, management-approved, current, and defines purpose, scope and responsibilities.

Method: Examine · Expected evidence: Approved access-control policy document with version and approval record

Operational controls: CAO-4111112 Policy Approval & Version Register · CAO-4111111 Access Control Policy — controlled template

CAO-400 Cybersecurity › CAO-410 Access Control Policy › CAO-411 Access Control Governance › CAO-4111 Establish and maintain an access control policy aligned to business and security requirements › CAO-41111 Signed, reviewed, stored, communicated and acknowledged access control policy, with technical proof held in the document management system.

CAO-411112 · Confirm the access-control policy is communicated to, and acknowledged by, all affected parties.

Method: Examine, interview · Expected evidence: Distribution and acknowledgement records

Operational controls: CAO-4111122 Policy Acknowledgement Register · CAO-4111121 Policy Communication Work Instruction

CAO-400 Cybersecurity › CAO-410 Access Control Policy › CAO-411 Access Control Governance › CAO-4111 Establish and maintain an access control policy aligned to business and security requirements › CAO-41112 Document management system workflow configured for scheduled review and approval, with automated email notifications to owners and approvers.

CAO-411121 · Verify a scheduled review-and-approval workflow exists in the document management system, with review dates and owner/approver notifications.

Method: Examine, observe · Expected evidence: DMS workflow configuration, review schedule and notification logs

Operational controls: CAO-4111212 Policy Review Schedule Register · CAO-4111211 Document Review & Approval Workflow — work instruction

CAO-400 Cybersecurity › CAO-410 Access Control Policy › CAO-411 Access Control Governance › CAO-4111 Establish and maintain an access control policy aligned to business and security requirements › CAO-41113 Access-control model enforcing need-to-know and least-privilege, with access assigned by role and job function.

CAO-411131 · Examine the defined access-control model and confirm access is assigned by role and job function on a least-privilege, need-to-know basis.

Method: Examine · Expected evidence: Documented access-control / role-based access model and role definitions

Operational controls: CAO-4111312 Role Definition Register · CAO-4111311 Role-Based Access Model — template

CAO-400 Cybersecurity › CAO-410 Access Control Policy › CAO-411 Access Control Governance › CAO-4111 Establish and maintain an access control policy aligned to business and security requirements › CAO-41114 Access-control system configured to enforce assigned permissions and to deny access by default.

CAO-411141 · Inspect the access-control system configuration to confirm assigned permissions are enforced and the default setting is deny-all.

Method: Examine, test · Expected evidence: Access-control system configuration showing default-deny and permission enforcement

Operational controls: CAO-4111412 Configuration Baseline Register · CAO-4111411 Access Control Configuration Standard — template

CAO-400 Cybersecurity › CAO-410 Access Control Policy › CAO-411 Access Control Governance › CAO-4111 Establish and maintain an access control policy aligned to business and security requirements › CAO-41115 Periodic review and recertification of user, privileged and system-account access rights, approved by authorised personnel.

CAO-411151 · Examine access-review records to confirm user, privileged and system-account access is reviewed at defined intervals and approved by authorised personnel.

Method: Examine · Expected evidence: Completed access-review / recertification records with approver sign-off

Operational controls: CAO-4111512 Access Recertification Work Instruction · CAO-4111511 User Access Review Form

CAO-400 Cybersecurity › CAO-410 Access Control Policy › CAO-411 Access Control Governance › CAO-4112 Enforce segregation of duties to prevent conflicting access › CAO-41121 Conflicting duties and areas of responsibility identified and segregated within the access model to prevent unauthorised or unintentional modification or misuse.

CAO-411211 · Examine the access model and role assignments to confirm conflicting duties are identified and segregated.

Method: Examine · Expected evidence: Segregation-of-duties matrix and conflict-analysis records

Operational controls: CAO-4112112 SoD Conflict Register · CAO-4112111 Segregation-of-Duties Matrix — template

CAO-400 Cybersecurity › CAO-410 Access Control Policy › CAO-411 Access Control Governance › CAO-4112 Enforce segregation of duties to prevent conflicting access › CAO-41122 Compensating controls applied where segregation of duties is impractical — activity logging, monitoring and independent supervisory review.

CAO-411221 · Where segregation of duties is not feasible, confirm compensating controls — logging, monitoring and supervisory review — are documented and operating.

Method: Examine, observe · Expected evidence: Documented compensating controls and monitoring / review logs

Operational controls: CAO-4112212 Supervisory Review Work Instruction · CAO-4112211 Compensating Controls Register

CAO-400 Cybersecurity › CAO-410 Access Control Policy › CAO-412 Identity Management › CAO-4121 Assign and manage unique identities for users, services and devices across the lifecycle › CAO-41211 Unique identifier assigned to every user, service and device before access is granted; shared or generic accounts permitted only by exception and held individually accountable.

CAO-412111 · Examine identity records and system settings to confirm every user, service and device has a unique ID, and that any shared or generic accounts are authorised exceptions held individually accountable.

Method: Examine, test · Expected evidence: Identity register and shared-account exception approvals

Operational controls: CAO-4121112 Shared / Generic Account Exception Form · CAO-4121111 Identity Register

CAO-400 Cybersecurity › CAO-410 Access Control Policy › CAO-412 Identity Management › CAO-4121 Assign and manage unique identities for users, services and devices across the lifecycle › CAO-41212 Identity lifecycle managed end to end — provisioning, modification and de-provisioning authorised; access for terminated users revoked immediately and inactive accounts disabled within a defined period.

CAO-412121 · Examine joiner-mover-leaver records to confirm provisioning, modification and de-provisioning are authorised, leaver access is revoked immediately, and inactive accounts are disabled within the defined period.

Method: Examine · Expected evidence: Joiner-mover-leaver records and account-disablement log

Operational controls: CAO-4121212 Account Disablement Register · CAO-4121211 Joiner-Mover-Leaver Work Instruction

CAO-400 Cybersecurity › CAO-410 Access Control Policy › CAO-412 Identity Management › CAO-4121 Assign and manage unique identities for users, services and devices across the lifecycle › CAO-41213 Third-party and remote-support accounts enabled only when required, monitored while in use, and disabled when not in use.

CAO-412131 · Examine third-party and remote-support account controls to confirm accounts are enabled only when required, monitored while in use, and disabled when idle.

Method: Examine, observe · Expected evidence: Third-party account activity logs

Operational controls: CAO-4121311 Third-Party Access Register

CAO-400 Cybersecurity › CAO-410 Access Control Policy › CAO-412 Identity Management › CAO-4122 Proof and bind identities to the correct entity before issuing credentials › CAO-41221 Identity proofing performed to verify an entity before credentials are issued, with the verified identity bound to the issued credential.

CAO-412211 · Examine the identity-proofing process to confirm entities are verified and the verified identity is bound to the issued credential before issuance.

Method: Examine · Expected evidence: Identity-proofing records

Operational controls: CAO-4122111 Identity Proofing Work Instruction

CAO-400 Cybersecurity › CAO-410 Access Control Policy › CAO-412 Identity Management › CAO-4122 Proof and bind identities to the correct entity before issuing credentials › CAO-41222 User identity verified before any creation or modification of authentication factors.

CAO-412221 · Confirm user identity is verified before any creation or modification of authentication factors.

Method: Examine, observe · Expected evidence: Credential-change verification logs

Operational controls: CAO-4122211 Credential Change Request Form

CAO-400 Cybersecurity › CAO-410 Access Control Policy › CAO-413 Authentication › CAO-4131 Manage authentication information securely throughout its lifecycle › CAO-41311 Authentication factors generated, distributed, stored and reset under controlled processes, with first-use and reset values unique and changed on first use.

CAO-413111 · Examine the processes for generating, distributing, storing and resetting authentication factors, confirming first-use and reset values are unique and changed on first use.

Method: Examine · Expected evidence: Credential-management procedure and reset logs

Operational controls: CAO-4131112 Credential Reset Register · CAO-4131111 Credential Management Work Instruction

CAO-400 Cybersecurity › CAO-410 Access Control Policy › CAO-413 Authentication › CAO-4131 Manage authentication information securely throughout its lifecycle › CAO-41312 Authentication factors rendered unreadable using strong cryptography in transmission and storage.

CAO-413121 · Inspect configuration to confirm authentication factors are rendered unreadable with strong cryptography in transmission and storage.

Method: Examine, test · Expected evidence: Cryptographic configuration evidence

Operational controls: CAO-4131211 Cryptographic Configuration Standard

CAO-400 Cybersecurity › CAO-410 Access Control Policy › CAO-413 Authentication › CAO-4131 Manage authentication information securely throughout its lifecycle › CAO-41313 Password and passphrase strength enforced — minimum length, complexity and history — with periodic change or dynamic analysis where single-factor authentication is used.

CAO-413131 · Examine authentication settings to confirm password and passphrase length, complexity and history meet defined minimums, with periodic change or dynamic analysis where single-factor.

Method: Examine, test · Expected evidence: Password policy configuration

Operational controls: CAO-4131311 Password Policy Configuration Standard

CAO-400 Cybersecurity › CAO-410 Access Control Policy › CAO-413 Authentication › CAO-4131 Manage authentication information securely throughout its lifecycle › CAO-41314 Authentication policy and user guidance documented and communicated to all users.

CAO-413141 · Examine the authentication policy and confirm it is documented and communicated to all users with guidance on selecting strong authentication factors.

Method: Examine · Expected evidence: Authentication policy and communication records

Operational controls: CAO-4131412 User Authentication Guidance · CAO-4131411 Authentication Policy — template

CAO-400 Cybersecurity › CAO-410 Access Control Policy › CAO-413 Authentication › CAO-4132 Enforce strong, multi-factor authentication proportionate to risk › CAO-41321 Multi-factor authentication enforced for all administrative access, all remote access from outside the network, and all access to sensitive environments.

CAO-413211 · Test that multi-factor authentication is enforced for all administrative access, all remote access from outside the network, and all access to sensitive environments.

Method: Examine, test · Expected evidence: MFA configuration and enforcement evidence

Operational controls: CAO-4132111 MFA Configuration Standard

CAO-400 Cybersecurity › CAO-410 Access Control Policy › CAO-413 Authentication › CAO-4132 Enforce strong, multi-factor authentication proportionate to risk › CAO-41322 Multi-factor authentication systems resistant to replay and bypass, requiring at least two independent factor types.

CAO-413221 · Examine the multi-factor authentication system to confirm resistance to replay and bypass and the use of at least two independent factor types.

Method: Examine, test · Expected evidence: MFA system design and configuration

Operational controls: CAO-4132211 MFA System Design Record

CAO-400 Cybersecurity › CAO-410 Access Control Policy › CAO-413 Authentication › CAO-4132 Enforce strong, multi-factor authentication proportionate to risk › CAO-41323 Invalid authentication attempts limited through account lockout thresholds and lockout durations.

CAO-413231 · Test that invalid authentication attempts trigger account lockout in line with defined thresholds and durations.

Method: Test · Expected evidence: Lockout configuration evidence

Operational controls: CAO-4132311 Account Lockout Configuration Standard

CAO-400 Cybersecurity › CAO-410 Access Control Policy › CAO-413 Authentication › CAO-4133 Protect identity assertions and authentication transactions against compromise › CAO-41331 Idle sessions required to re-authenticate after a defined period of inactivity.

CAO-413311 · Test that idle sessions require re-authentication after the defined period of inactivity.

Method: Test · Expected evidence: Session-timeout configuration

Operational controls: CAO-4133111 Session Timeout Configuration Standard

CAO-400 Cybersecurity › CAO-410 Access Control Policy › CAO-413 Authentication › CAO-4133 Protect identity assertions and authentication transactions against compromise › CAO-41332 Application and system account credentials protected — not hard-coded, rotated regularly, and interactive use prevented or tightly controlled.

CAO-413321 · Examine application and system account credential handling to confirm credentials are not hard-coded, are rotated, and interactive use is prevented or controlled.

Method: Examine · Expected evidence: Secrets-management evidence and service-account inventory

Operational controls: CAO-4133212 Service Account Register · CAO-4133211 Secrets Management Work Instruction

CAO-400 Cybersecurity › CAO-410 Access Control Policy › CAO-413 Authentication › CAO-4133 Protect identity assertions and authentication transactions against compromise › CAO-41333 Hardware tokens, smart cards and certificates individually assigned and protected against unauthorised use.

CAO-413331 · Examine assignment records to confirm hardware tokens, smart cards and certificates are individually assigned and protected against misuse.

Method: Examine · Expected evidence: Authenticator assignment register

Operational controls: CAO-4133311 Authenticator Assignment Register

CAO-400 Cybersecurity › CAO-410 Access Control Policy › CAO-414 Authorization and Access Rights › CAO-4141 Provision, modify and revoke access rights through a formal joiner-mover-leaver process › CAO-41411 Formal joiner-mover-leaver workflow authorising the provisioning, modification and revocation of access rights, with records retained.

CAO-414111 · Examine joiner-mover-leaver workflow records to confirm provisioning, modification and revocation of access are authorised and recorded.

Method: Examine · Expected evidence: Access request and approval records

Operational controls: CAO-4141111 Access Request & Approval Form

CAO-400 Cybersecurity › CAO-410 Access Control Policy › CAO-414 Authorization and Access Rights › CAO-4141 Provision, modify and revoke access rights through a formal joiner-mover-leaver process › CAO-41412 Access for leavers and role-changers removed or adjusted promptly on notification from human resources or management.

CAO-414121 · Examine termination notifications and access-removal logs to confirm leaver and role-change access is adjusted promptly.

Method: Examine · Expected evidence: Termination-to-revocation logs

Operational controls: CAO-4141211 Leaver Access Removal Register

CAO-400 Cybersecurity › CAO-410 Access Control Policy › CAO-414 Authorization and Access Rights › CAO-4142 Grant access on a least-privilege, need-to-know basis › CAO-41421 Access granted strictly on a least-privilege, need-to-know basis, scoped to job classification and function.

CAO-414211 · Examine access grants against role definitions to confirm least-privilege and need-to-know are applied by job function.

Method: Examine · Expected evidence: Access-grant records against the role matrix

Operational controls: CAO-4142111 Least-Privilege Access Standard

CAO-400 Cybersecurity › CAO-410 Access Control Policy › CAO-414 Authorization and Access Rights › CAO-4142 Grant access on a least-privilege, need-to-know basis › CAO-41422 Application and system accounts assigned only the least privilege necessary and restricted to their required functions.

CAO-414221 · Examine application and system account privileges to confirm they are limited to required functions.

Method: Examine · Expected evidence: Application and system account privilege records

Operational controls: CAO-4142211 Application & System Account Register

CAO-400 Cybersecurity › CAO-410 Access Control Policy › CAO-414 Authorization and Access Rights › CAO-4143 Review access rights at planned intervals and on role change › CAO-41431 User and privileged access rights reviewed at planned intervals and on role change, with recertification by the responsible owners.

CAO-414311 · Examine access-review records to confirm user and privileged access is reviewed at planned intervals and on role change, with owner recertification.

Method: Examine · Expected evidence: Periodic access-review records

Operational controls: CAO-4143111 Periodic Access Review Form

CAO-400 Cybersecurity › CAO-410 Access Control Policy › CAO-414 Authorization and Access Rights › CAO-4143 Review access rights at planned intervals and on role change › CAO-41432 Application and system account access reviewed periodically for continued appropriateness.

CAO-414321 · Examine periodic reviews of application and system account access for continued appropriateness.

Method: Examine · Expected evidence: Application and system account review records

Operational controls: CAO-4143211 System Account Review Register

CAO-400 Cybersecurity › CAO-410 Access Control Policy › CAO-415 Privileged Access › CAO-4151 Restrict, log and review privileged access rights › CAO-41511 Privileged access restricted to named individuals, approved, time-bound where feasible, and segregated from day-to-day user accounts.

CAO-415111 · Examine privileged access assignments to confirm they are restricted to named individuals, approved, time-bound where feasible, and segregated from day-to-day accounts.

Method: Examine · Expected evidence: Privileged access register and approvals

Operational controls: CAO-4151112 Privileged Access Approval Form · CAO-4151111 Privileged Access Register

CAO-400 Cybersecurity › CAO-410 Access Control Policy › CAO-415 Privileged Access › CAO-4151 Restrict, log and review privileged access rights › CAO-41512 Privileged activity logged and the logs reviewed for inappropriate or anomalous use.

CAO-415121 · Examine privileged-activity logs and review records to confirm privileged actions are logged and reviewed for inappropriate use.

Method: Examine · Expected evidence: Privileged-activity logs and review records

Operational controls: CAO-4151211 Privileged Activity Log-Review Work Instruction

CAO-400 Cybersecurity › CAO-410 Access Control Policy › CAO-415 Privileged Access › CAO-4151 Restrict, log and review privileged access rights › CAO-41513 Privileged access rights reviewed more frequently than standard access rights.

CAO-415131 · Examine the review schedule to confirm privileged access rights are reviewed more frequently than standard access.

Method: Examine · Expected evidence: Privileged-access review schedule and records

Operational controls: CAO-4151311 Privileged Access Review Schedule

CAO-400 Cybersecurity › CAO-410 Access Control Policy › CAO-415 Privileged Access › CAO-4152 Control the use of privileged utility programs › CAO-41521 Use of privileged utility programs capable of overriding system or application controls restricted, authorised and logged.

CAO-415211 · Examine controls over privileged utility programs to confirm their use is restricted, authorised and logged.

Method: Examine · Expected evidence: Privileged-utility authorisation records and logs

Operational controls: CAO-4152111 Privileged Utility Authorisation Register

CAO-400 Cybersecurity › CAO-410 Access Control Policy › CAO-415 Privileged Access › CAO-4152 Control the use of privileged utility programs › CAO-41522 Unnecessary privileged utility programs removed or disabled.

CAO-415221 · Examine systems to confirm unnecessary privileged utility programs are removed or disabled.

Method: Examine, test · Expected evidence: System hardening evidence and utility inventory

Operational controls: CAO-4152211 System Hardening Standard

CAO-400 Cybersecurity › CAO-410 Access Control Policy › CAO-416 Remote and Mobile Access › CAO-4161 Secure remote and mobile working through controlled connectivity and device requirements › CAO-41611 Remote access provided only over secured, encrypted channels (such as VPN or TLS) with multi-factor authentication enforced.

CAO-416111 · Examine remote-access configuration to confirm connections use secured, encrypted channels with multi-factor authentication.

Method: Examine, test · Expected evidence: Remote-access (VPN/TLS) configuration

Operational controls: CAO-4161111 Remote Access Configuration Standard

CAO-400 Cybersecurity › CAO-410 Access Control Policy › CAO-416 Remote and Mobile Access › CAO-4161 Secure remote and mobile working through controlled connectivity and device requirements › CAO-41612 Mobile and endpoint devices required to meet defined security baselines — encryption, patching, anti-malware and remote wipe — before connecting.

CAO-416121 · Examine endpoint and mobile device controls to confirm devices meet defined security baselines before connecting.

Method: Examine · Expected evidence: Device-compliance and MDM records

Operational controls: CAO-4161212 Mobile Device Register · CAO-4161211 Device Security Baseline Standard

CAO-400 Cybersecurity › CAO-410 Access Control Policy › CAO-416 Remote and Mobile Access › CAO-4161 Secure remote and mobile working through controlled connectivity and device requirements › CAO-41613 Remote and mobile working policy defining acceptable use, approved connectivity methods and device standards.

CAO-416131 · Examine the remote and mobile working policy to confirm it defines acceptable use, approved connectivity and device standards.

Method: Examine · Expected evidence: Remote and mobile working policy

Operational controls: CAO-4161311 Remote & Mobile Working Policy — template

CAO-400 Cybersecurity › CAO-410 Access Control Policy › CAO-416 Remote and Mobile Access › CAO-4162 Enforce access segregation in shared and virtual environments › CAO-41621 Logical segregation enforced between tenants, environments and workloads in shared and virtualised infrastructure.

CAO-416211 · Examine shared and virtualised infrastructure to confirm logical segregation between tenants, environments and workloads.

Method: Examine, test · Expected evidence: Segregation configuration evidence

Operational controls: CAO-4162111 Environment Segregation Standard

CAO-400 Cybersecurity › CAO-410 Access Control Policy › CAO-416 Remote and Mobile Access › CAO-4162 Enforce access segregation in shared and virtual environments › CAO-41622 Administrative and management interfaces of shared and virtual environments access-controlled and isolated from general access.

CAO-416221 · Examine administrative and management interfaces of shared and virtual environments to confirm they are access-controlled and isolated.

Method: Examine · Expected evidence: Management-interface access configuration

Operational controls: CAO-4162211 Management Interface Access Standard

CAO-400 Cybersecurity › CAO-420 Network Security Policy › CAO-421 Network Security Management › CAO-4211 Establish and operate network security controls › CAO-42111 Network security controls (such as firewalls) installed at the network boundary and between network segments.

CAO-421111 · Examine network diagrams and device configurations to confirm network security controls are installed at the boundary and between segments.

Method: Examine, observe · Expected evidence: Network diagram and NSC configurations

Operational controls: CAO-4211112 Firewall / NSC Configuration Register · CAO-4211111 Network Architecture Diagram

CAO-400 Cybersecurity › CAO-420 Network Security Policy › CAO-421 Network Security Management › CAO-4211 Establish and operate network security controls › CAO-42112 Configuration standards for network security controls defined, applied and reviewed at a defined frequency.

CAO-421121 · Examine NSC configuration standards and change records to confirm they are defined, applied and reviewed.

Method: Examine · Expected evidence: NSC configuration standard and review records

Operational controls: CAO-4211212 NSC Ruleset Review Register · CAO-4211211 NSC Configuration Standard

CAO-400 Cybersecurity › CAO-420 Network Security Policy › CAO-421 Network Security Management › CAO-4211 Establish and operate network security controls › CAO-42113 Rulesets restrict inbound and outbound traffic to that which is necessary and deny all other traffic.

CAO-421131 · Examine NSC rulesets to confirm traffic is restricted to that which is necessary and all other traffic is denied.

Method: Examine, test · Expected evidence: NSC ruleset evidence

Operational controls: CAO-4211311 Network Traffic Ruleset Register

CAO-400 Cybersecurity › CAO-420 Network Security Policy › CAO-421 Network Security Management › CAO-4212 Secure network services and their security mechanisms › CAO-42121 Security mechanisms, service levels and management requirements of all network services identified and applied, whether provided in-house or outsourced.

CAO-421211 · Examine the network-services inventory and agreements to confirm security mechanisms and service levels are identified and applied.

Method: Examine · Expected evidence: Network-services inventory and service-level agreements

Operational controls: CAO-4212111 Network Services Register

CAO-400 Cybersecurity › CAO-420 Network Security Policy › CAO-421 Network Security Management › CAO-4212 Secure network services and their security mechanisms › CAO-42122 Insecure services, protocols and ports restricted, with business justification and additional security features documented where they are used.

CAO-421221 · Examine configurations to confirm insecure services, protocols and ports are restricted, with documented justification and safeguards where used.

Method: Examine · Expected evidence: Services, protocols and ports register with justifications

Operational controls: CAO-4212211 Allowed Services, Protocols and Ports Register

CAO-400 Cybersecurity › CAO-420 Network Security Policy › CAO-421 Network Security Management › CAO-4212 Secure network services and their security mechanisms › CAO-42123 Transmission of sensitive information over open or public networks protected using strong cryptography and secure protocols.

CAO-421231 · Examine configurations to confirm sensitive data in transit over open or public networks is protected with strong cryptography and trusted certificates.

Method: Examine, test · Expected evidence: TLS / encryption configuration evidence

Operational controls: CAO-4212312 Certificate Inventory Register · CAO-4212311 Transmission Encryption Standard

CAO-400 Cybersecurity › CAO-420 Network Security Policy › CAO-422 Network Segmentation › CAO-4221 Segregate networks into security zones › CAO-42211 Networks segregated into security zones based on trust level, with controls enforced between zones.

CAO-422111 · Examine network architecture to confirm segregation into security zones with controls enforced between them.

Method: Examine, observe · Expected evidence: Network segmentation diagram and zone controls

Operational controls: CAO-4221112 Security Zone Register · CAO-4221111 Network Segmentation Diagram

CAO-400 Cybersecurity › CAO-420 Network Security Policy › CAO-422 Network Segmentation › CAO-4221 Segregate networks into security zones › CAO-42212 Systems storing or processing sensitive data placed in a separate, controlled zone isolated from untrusted networks.

CAO-422121 · Examine the placement of sensitive systems to confirm isolation in a controlled zone.

Method: Examine · Expected evidence: Data-flow and zone-placement evidence

Operational controls: CAO-4221211 Data Flow and Zoning Register

CAO-400 Cybersecurity › CAO-420 Network Security Policy › CAO-422 Network Segmentation › CAO-4222 Control connectivity between trusted and untrusted networks › CAO-42221 Connections between trusted and untrusted networks controlled by network security controls that permit only authorised traffic.

CAO-422211 · Examine boundary controls to confirm only authorised traffic passes between trusted and untrusted networks.

Method: Examine, test · Expected evidence: Boundary NSC ruleset

Operational controls: CAO-4222111 Trust Boundary Ruleset Register

CAO-400 Cybersecurity › CAO-420 Network Security Policy › CAO-422 Network Segmentation › CAO-4222 Control connectivity between trusted and untrusted networks › CAO-42222 Inbound traffic from untrusted networks restricted to system components providing authorised, publicly accessible services.

CAO-422221 · Examine configurations to confirm inbound traffic from untrusted networks is restricted to authorised public-facing components.

Method: Examine · Expected evidence: DMZ configuration evidence

Operational controls: CAO-4222211 DMZ Configuration Standard

CAO-400 Cybersecurity › CAO-420 Network Security Policy › CAO-422 Network Segmentation › CAO-4222 Control connectivity between trusted and untrusted networks › CAO-42223 Anti-spoofing measures implemented to detect and block forged source IP addresses.

CAO-422231 · Test that anti-spoofing measures detect and block forged source addresses.

Method: Test · Expected evidence: Anti-spoofing configuration

Operational controls: CAO-4222311 Anti-Spoofing Configuration Standard

CAO-400 Cybersecurity › CAO-420 Network Security Policy › CAO-423 Web and Content Filtering › CAO-4231 Filter and control access to external web content › CAO-42311 Outbound web access filtered and controlled to block access to malicious or unauthorised content.

CAO-423111 · Examine web-filtering configuration to confirm malicious and unauthorised categories are blocked.

Method: Examine, test · Expected evidence: Web-filtering policy and configuration

Operational controls: CAO-4231112 Blocked Categories Register · CAO-4231111 Web Filtering Standard

CAO-400 Cybersecurity › CAO-420 Network Security Policy › CAO-423 Web and Content Filtering › CAO-4231 Filter and control access to external web content › CAO-42312 Web-filtering activity logged and exceptions managed through an approval process.

CAO-423121 · Examine web-filter logs and exception approvals to confirm logging and controlled exceptions.

Method: Examine · Expected evidence: Web-filter logs and exception approvals

Operational controls: CAO-4231211 Web Filter Exception Form

CAO-400 Cybersecurity › CAO-420 Network Security Policy › CAO-424 Cloud Network Security › CAO-4241 Secure the use of cloud services › CAO-42411 Cloud services acquired, used and managed in line with security requirements, with shared-responsibility boundaries defined.

CAO-424111 · Examine cloud-service agreements and configurations to confirm security requirements and shared-responsibility boundaries are defined and met.

Method: Examine · Expected evidence: Cloud security requirements and responsibility matrix

Operational controls: CAO-4241112 Shared Responsibility Matrix · CAO-4241111 Cloud Security Requirements Standard

CAO-400 Cybersecurity › CAO-420 Network Security Policy › CAO-424 Cloud Network Security › CAO-4242 Secure cloud administration and virtual network configuration › CAO-42421 Cloud administrative access secured with strong authentication and least privilege, with virtual network controls restricting traffic.

CAO-424211 · Examine cloud administrative access and virtual network configuration to confirm strong authentication, least privilege and traffic restriction.

Method: Examine, test · Expected evidence: Cloud admin and virtual network configuration

Operational controls: CAO-4242111 Cloud Configuration Baseline Standard

CAO-400 Cybersecurity › CAO-420 Network Security Policy › CAO-424 Cloud Network Security › CAO-4242 Secure cloud administration and virtual network configuration › CAO-42422 Cloud security posture monitored, with misconfigurations detected and remediated.

CAO-424221 · Examine cloud security-posture monitoring to confirm misconfigurations are detected and remediated.

Method: Examine · Expected evidence: CSPM findings and remediation records

Operational controls: CAO-4242211 Cloud Posture Monitoring Register

CAO-400 Cybersecurity › CAO-420 Network Security Policy › CAO-425 Infrastructure Resilience and Availability › CAO-4251 Protect infrastructure from environmental threats › CAO-42511 Physical and environmental protections implemented for infrastructure against fire, flood, power and climate threats.

CAO-425111 · Examine environmental controls at facilities to confirm protection against environmental threats.

Method: Examine, observe · Expected evidence: Environmental control and inspection records

Operational controls: CAO-4251111 Environmental Controls Register

CAO-400 Cybersecurity › CAO-420 Network Security Policy › CAO-425 Infrastructure Resilience and Availability › CAO-4251 Protect infrastructure from environmental threats › CAO-42512 Supporting utilities such as power and cooling protected and provided with redundancy.

CAO-425121 · Examine supporting utilities to confirm protection and redundancy such as UPS and generators.

Method: Examine, observe · Expected evidence: Utility redundancy evidence

Operational controls: CAO-4251211 Utility and Redundancy Register

CAO-400 Cybersecurity › CAO-420 Network Security Policy › CAO-425 Infrastructure Resilience and Availability › CAO-4252 Implement resilience mechanisms and capacity to maintain availability › CAO-42521 Redundancy and resilience mechanisms implemented for critical infrastructure to meet availability requirements.

CAO-425211 · Examine redundancy and failover mechanisms and test results to confirm availability requirements are met.

Method: Examine, test · Expected evidence: Redundancy design and failover test records

Operational controls: CAO-4252111 Redundancy and Failover Test Register

CAO-400 Cybersecurity › CAO-420 Network Security Policy › CAO-425 Infrastructure Resilience and Availability › CAO-4252 Implement resilience mechanisms and capacity to maintain availability › CAO-42522 Capacity monitored, forecast and managed to maintain required performance and availability.

CAO-425221 · Examine capacity monitoring and forecasts to confirm capacity is managed to meet demand.

Method: Examine · Expected evidence: Capacity monitoring and forecast records

Operational controls: CAO-4252211 Capacity Management Register

CAO-400 Cybersecurity › CAO-430 Cryptography and Data Encryption Policy › CAO-431 Cryptographic Controls › CAO-4311 Establish and apply cryptographic controls appropriate to risk › CAO-43111 Policy on the use of cryptographic controls established, defining approved algorithms, key strengths and use cases based on risk.

CAO-431111 · Examine the cryptographic policy to confirm approved algorithms and key strengths are defined according to risk.

Method: Examine · Expected evidence: Cryptographic controls policy

Operational controls: CAO-4311111 Cryptographic Controls Policy — template

CAO-400 Cybersecurity › CAO-430 Cryptography and Data Encryption Policy › CAO-432 Cryptographic Key Management › CAO-4321 Protect cryptographic keys › CAO-43211 Cryptographic keys protected against unauthorised access, modification, loss and disclosure throughout storage and use.

CAO-432111 · Examine key-protection controls to confirm keys are secured against unauthorised access and disclosure.

Method: Examine · Expected evidence: Key-protection configuration and access records

Operational controls: CAO-4321111 Key Protection Standard

CAO-400 Cybersecurity › CAO-430 Cryptography and Data Encryption Policy › CAO-432 Cryptographic Key Management › CAO-4322 Operate the cryptographic key management lifecycle › CAO-43221 Cryptographic keys managed across the full lifecycle: generation, distribution, storage, rotation, retirement and destruction.

CAO-432211 · Examine key-management procedures and records to confirm lifecycle activities are performed and authorised.

Method: Examine · Expected evidence: Key lifecycle records

Operational controls: CAO-4322112 Cryptographic Key Inventory Register · CAO-4322111 Key Management Lifecycle Work Instruction

CAO-400 Cybersecurity › CAO-430 Cryptography and Data Encryption Policy › CAO-433 Data Encryption at Rest › CAO-4331 Render stored data unreadable through encryption or equivalent measures › CAO-43311 Stored sensitive data rendered unreadable using strong cryptography or equivalent measures such as tokenisation or truncation.

CAO-433111 · Examine storage configuration to confirm sensitive data at rest is rendered unreadable.

Method: Examine, test · Expected evidence: Encryption-at-rest configuration

Operational controls: CAO-4331111 Data-at-Rest Encryption Standard

CAO-400 Cybersecurity › CAO-430 Cryptography and Data Encryption Policy › CAO-434 Data Protection in Transit › CAO-4341 Protect data in transit against interception and alteration › CAO-43411 Data in transit protected against interception and alteration using strong cryptography and integrity controls.

CAO-434111 · Examine transmission configuration to confirm data in transit is encrypted and integrity-protected.

Method: Examine, test · Expected evidence: Transit encryption and integrity configuration

Operational controls: CAO-4341111 Data-in-Transit Protection Standard

CAO-400 Cybersecurity › CAO-430 Cryptography and Data Encryption Policy › CAO-435 Data Masking and Minimisation › CAO-4351 Mask sensitive data on display › CAO-43511 Sensitive data masked on display so that only the minimum necessary is shown, based on need-to-know.

CAO-435111 · Examine display configurations to confirm sensitive data is masked except where a documented need exists.

Method: Examine, test · Expected evidence: Data-masking configuration

Operational controls: CAO-4351111 Data Masking Standard

CAO-400 Cybersecurity › CAO-430 Cryptography and Data Encryption Policy › CAO-435 Data Masking and Minimisation › CAO-4352 Minimise the storage of sensitive data › CAO-43521 Storage of sensitive data minimised to that required for business, legal or regulatory purposes.

CAO-435211 · Examine data inventory and storage practices to confirm sensitive-data storage is minimised to defined needs.

Method: Examine · Expected evidence: Data inventory and minimisation records

Operational controls: CAO-4352111 Data Minimisation Standard

CAO-400 Cybersecurity › CAO-430 Cryptography and Data Encryption Policy › CAO-436 Data Leakage Prevention › CAO-4361 Prevent unauthorised leakage of data › CAO-43611 Data leakage prevention measures applied to systems, networks and devices that store, process or transmit sensitive data.

CAO-436111 · Examine DLP configuration to confirm monitoring and blocking of unauthorised data egress.

Method: Examine, test · Expected evidence: DLP policy and alerts

Operational controls: CAO-4361112 DLP Alert Register · CAO-4361111 Data Leakage Prevention Standard

CAO-400 Cybersecurity › CAO-430 Cryptography and Data Encryption Policy › CAO-437 Data Retention and Secure Deletion › CAO-4371 Retain data only as required and securely delete it when no longer needed › CAO-43711 Data retained only for defined retention periods and securely deleted or destroyed when no longer required.

CAO-437111 · Examine retention schedules and deletion records to confirm data is retained per policy and securely deleted.

Method: Examine · Expected evidence: Retention schedule and deletion records

Operational controls: CAO-4371112 Secure Deletion Work Instruction · CAO-4371111 Data Retention Schedule

CAO-400 Cybersecurity › CAO-430 Cryptography and Data Encryption Policy › CAO-438 Data Security Management › CAO-4381 Govern the security of data processing and lawful safeguards › CAO-43811 Security and lawful-processing safeguards applied to personal and sensitive data, including documented records of processing.

CAO-438111 · Examine records of processing and safeguards to confirm lawful and secure data processing.

Method: Examine · Expected evidence: Records of processing and applied safeguards

Operational controls: CAO-4381111 Records of Processing Register

CAO-400 Cybersecurity › CAO-430 Cryptography and Data Encryption Policy › CAO-438 Data Security Management › CAO-4382 Maintain the integrity of data › CAO-43821 Integrity controls applied to detect and prevent unauthorised or accidental alteration of data.

CAO-438211 · Examine integrity controls such as change-detection to confirm unauthorised alterations are detected.

Method: Examine, test · Expected evidence: Integrity-monitoring configuration and alerts

Operational controls: CAO-4382111 Integrity Monitoring Register

CAO-400 Cybersecurity › CAO-430 Cryptography and Data Encryption Policy › CAO-438 Data Security Management › CAO-4383 Protect data in use › CAO-43831 Data in use protected through access controls, memory protection and, where applicable, confidential-computing measures.

CAO-438311 · Examine controls over data in use to confirm access restriction and protection during processing.

Method: Examine · Expected evidence: Data-in-use protection configuration

Operational controls: CAO-4383111 Data-in-Use Protection Standard

CAO-400 Cybersecurity › CAO-430 Cryptography and Data Encryption Policy › CAO-438 Data Security Management › CAO-4384 Back up and protect the resilience of data › CAO-43841 Data backed up, protected and tested for restoration in line with defined recovery requirements.

CAO-438411 · Examine backup configuration and restoration tests to confirm data is backed up and recoverable.

Method: Examine, test · Expected evidence: Backup configuration and restore-test records

Operational controls: CAO-4384112 Restoration Test Register · CAO-4384111 Backup and Restore Standard

CAO-400 Cybersecurity › CAO-450 Operations Security Policy › CAO-451 Operating Procedures › CAO-4511 Establish and maintain documented operating procedures › CAO-45111 Documented operating procedures for IT and security operations maintained and available to those who need them.

CAO-451111 · Examine operating procedures to confirm they are documented, current and available to relevant personnel.

Method: Examine · Expected evidence: Documented operating procedures

Operational controls: CAO-4511111 Operating Procedures Library

CAO-400 Cybersecurity › CAO-450 Operations Security Policy › CAO-452 Threat Intelligence › CAO-4521 Acquire and act on threat intelligence › CAO-45211 Threat intelligence collected, analysed and used to inform protective measures.

CAO-452111 · Examine threat-intelligence sources and outputs to confirm intelligence is gathered and acted upon.

Method: Examine · Expected evidence: Threat-intelligence reports and actions

Operational controls: CAO-4521111 Threat Intelligence Register

CAO-400 Cybersecurity › CAO-450 Operations Security Policy › CAO-453 Endpoint Protection › CAO-4531 Protect endpoints and operational systems › CAO-45311 Endpoints and operational systems protected through hardening, configuration management and endpoint security tooling.

CAO-453111 · Examine endpoint configurations and security tooling to confirm hardening and protection are applied.

Method: Examine, test · Expected evidence: Endpoint hardening and protection configuration

Operational controls: CAO-4531111 Endpoint Hardening Standard

CAO-400 Cybersecurity › CAO-450 Operations Security Policy › CAO-454 Logging › CAO-4541 Generate logs of security-relevant events › CAO-45411 Logs generated for security-relevant events across systems, applications and network devices.

CAO-454111 · Examine logging configuration to confirm security-relevant events are captured.

Method: Examine, test · Expected evidence: Logging configuration and sample logs

Operational controls: CAO-4541111 Audit Logging Standard

CAO-400 Cybersecurity › CAO-450 Operations Security Policy › CAO-454 Logging › CAO-4542 Protect and retain log information › CAO-45421 Log information protected against tampering and unauthorised access, and retained for a defined period.

CAO-454211 · Examine log-protection and retention controls to confirm logs are secured and retained per policy.

Method: Examine · Expected evidence: Log-protection configuration and retention records

Operational controls: CAO-4542111 Log Retention and Protection Standard

CAO-400 Cybersecurity › CAO-450 Operations Security Policy › CAO-455 Security Monitoring and Detection › CAO-4551 Monitor systems, networks and environments for anomalies › CAO-45511 Systems, networks and environments monitored to detect anomalous activity and potential incidents.

CAO-455111 · Examine monitoring and alerting to confirm anomalous activity is detected and reviewed.

Method: Examine · Expected evidence: Monitoring alerts and review records

Operational controls: CAO-4551111 Security Monitoring Register

CAO-400 Cybersecurity › CAO-450 Operations Security Policy › CAO-455 Security Monitoring and Detection › CAO-4552 Detect and respond to security control failures › CAO-45521 Failures of critical security controls detected, alerted and responded to promptly.

CAO-455211 · Examine control-failure detection to confirm failures are detected and addressed promptly.

Method: Examine, test · Expected evidence: Control-failure alerts and response records

Operational controls: CAO-4552111 Control Failure Response Register

CAO-400 Cybersecurity › CAO-450 Operations Security Policy › CAO-456 Clock Synchronisation › CAO-4561 Synchronise clocks across systems › CAO-45611 Clocks across systems synchronised to an accurate, agreed time source.

CAO-456111 · Examine time-synchronisation configuration to confirm clocks are synchronised to an authorised source.

Method: Examine, test · Expected evidence: Time-synchronisation configuration

Operational controls: CAO-4561111 Time Synchronisation Standard

CAO-400 Cybersecurity › CAO-460 Threat and Vulnerability Management Policy › CAO-461 Malware Protection › CAO-4611 Protect against malware › CAO-46111 Anti-malware solutions deployed and kept current on all applicable systems.

CAO-461111 · Examine anti-malware deployment and update status to confirm coverage and currency.

Method: Examine, test · Expected evidence: Anti-malware configuration and update logs

Operational controls: CAO-4611111 Anti-Malware Standard

CAO-400 Cybersecurity › CAO-460 Threat and Vulnerability Management Policy › CAO-462 Technical Vulnerability Management › CAO-4621 Identify and remediate technical vulnerabilities › CAO-46211 Technical vulnerabilities identified, assessed, prioritised and remediated within defined timeframes.

CAO-462111 · Examine vulnerability scans and remediation records to confirm vulnerabilities are identified and remediated within timeframes.

Method: Examine · Expected evidence: Vulnerability scan reports and remediation records

Operational controls: CAO-4621111 Vulnerability Management Register

CAO-400 Cybersecurity › CAO-460 Threat and Vulnerability Management Policy › CAO-463 Security and Penetration Testing › CAO-4631 Test for unauthorised wireless and conduct security testing › CAO-46311 Unauthorised wireless access points detected and security testing performed at a defined frequency.

CAO-463111 · Examine wireless-detection and security-testing records to confirm unauthorised wireless is detected and testing performed.

Method: Examine · Expected evidence: Wireless scan and security-test records

Operational controls: CAO-4631111 Wireless and Security Testing Register

CAO-400 Cybersecurity › CAO-460 Threat and Vulnerability Management Policy › CAO-463 Security and Penetration Testing › CAO-4632 Conduct penetration testing › CAO-46321 Penetration testing performed at a defined frequency and after significant change, with findings remediated.

CAO-463211 · Examine penetration-test reports and remediation to confirm testing is performed and findings addressed.

Method: Examine · Expected evidence: Penetration-test reports and remediation

Operational controls: CAO-4632111 Penetration Test Register

CAO-400 Cybersecurity › CAO-460 Threat and Vulnerability Management Policy › CAO-464 Intrusion Detection › CAO-4641 Detect and respond to intrusions › CAO-46411 Intrusion-detection and prevention mechanisms deployed to detect and respond to network intrusions.

CAO-464111 · Examine intrusion-detection configuration and alerts to confirm intrusions are detected and responded to.

Method: Examine, test · Expected evidence: IDS and IPS configuration and alerts

Operational controls: CAO-4641111 Intrusion Detection Register

CAO-400 Cybersecurity › CAO-460 Threat and Vulnerability Management Policy › CAO-465 Integrity and Change Detection › CAO-4651 Detect unauthorised changes and tampering › CAO-46511 Change-detection and anti-tampering mechanisms deployed to detect unauthorised modification of critical files and devices.

CAO-465111 · Examine change-detection and tamper controls to confirm unauthorised modifications are detected.

Method: Examine, test · Expected evidence: Change and tamper detection alerts

Operational controls: CAO-4651111 Change and Tamper Detection Register

CAO-400 Cybersecurity › CAO-470 Incident Response Policy › CAO-471 Incident Management Planning › CAO-4711 Establish and maintain incident management arrangements › CAO-47111 Incident management policy, plan, roles and responsibilities established and maintained.

CAO-471111 · Examine the incident response plan and roles to confirm arrangements are documented and maintained.

Method: Examine · Expected evidence: Incident response plan and roles

Operational controls: CAO-4711111 Incident Response Plan — template

CAO-400 Cybersecurity › CAO-470 Incident Response Policy › CAO-472 Incident Detection and Assessment › CAO-4721 Detect, assess and classify security events › CAO-47211 Security events detected, assessed and classified by severity to identify incidents.

CAO-472111 · Examine event-triage records to confirm events are assessed and classified consistently.

Method: Examine · Expected evidence: Event assessment and classification records

Operational controls: CAO-4721111 Incident Classification Matrix

CAO-400 Cybersecurity › CAO-470 Incident Response Policy › CAO-473 Incident Response › CAO-4731 Respond to and contain security incidents › CAO-47311 Security incidents responded to and contained according to documented procedures.

CAO-473111 · Examine incident records to confirm incidents are responded to and contained per procedure.

Method: Examine · Expected evidence: Incident response records

Operational controls: CAO-4731111 Incident Response Work Instruction

CAO-400 Cybersecurity › CAO-470 Incident Response Policy › CAO-473 Incident Response › CAO-4732 Mitigate and recover from incident impact › CAO-47321 Incident impact mitigated and affected services restored in line with recovery priorities.

CAO-473211 · Examine recovery records to confirm impact is mitigated and services restored.

Method: Examine · Expected evidence: Incident recovery records

Operational controls: CAO-4732111 Incident Recovery Register

CAO-400 Cybersecurity › CAO-470 Incident Response Policy › CAO-474 Incident Reporting and Communication › CAO-4741 Report incidents to required parties within mandated timeframes › CAO-47411 Incidents reported to required internal and external parties within mandated timeframes.

CAO-474111 · Examine incident-reporting records to confirm reporting to required parties within timeframes.

Method: Examine · Expected evidence: Incident-reporting records and notifications

Operational controls: CAO-4741111 Incident Notification Register

CAO-400 Cybersecurity › CAO-470 Incident Response Policy › CAO-475 Incident Recovery › CAO-4751 Recover normal operations after an incident › CAO-47511 Normal operations recovered and verified after an incident.

CAO-475111 · Examine post-incident restoration records to confirm normal operations are recovered and verified.

Method: Examine · Expected evidence: Operations restoration verification

Operational controls: CAO-4751111 Service Restoration Register

CAO-400 Cybersecurity › CAO-470 Incident Response Policy › CAO-476 Forensics and Learning › CAO-4761 Collect evidence and learn from incidents › CAO-47611 Evidence collected and lessons learned captured and used to improve controls.

CAO-476111 · Examine post-incident reviews and evidence handling to confirm lessons learned are captured and applied.

Method: Examine · Expected evidence: Post-incident review records and evidence log

Operational controls: CAO-4761112 Evidence Collection Work Instruction · CAO-4761111 Lessons Learned Register

CAO-400 Cybersecurity › CAO-480 Secure Software Development Policy › CAO-481 Secure Development Lifecycle › CAO-4811 Apply a secure development lifecycle › CAO-48111 Secure development lifecycle defined and applied across all software development.

CAO-481111 · Examine the secure development lifecycle to confirm security is integrated across development phases.

Method: Examine · Expected evidence: Secure development lifecycle documentation

Operational controls: CAO-4811111 Secure Development Lifecycle Standard

CAO-400 Cybersecurity › CAO-480 Secure Software Development Policy › CAO-481 Secure Development Lifecycle › CAO-4812 Manage secure changes and releases › CAO-48121 Changes and releases managed through authorised, tested and documented change control.

CAO-481211 · Examine change records to confirm changes are authorised, tested and documented before release.

Method: Examine · Expected evidence: Change control records

Operational controls: CAO-4812111 Change Management Work Instruction

CAO-400 Cybersecurity › CAO-480 Secure Software Development Policy › CAO-481 Secure Development Lifecycle › CAO-4813 Protect public-facing applications › CAO-48131 Public-facing applications protected against attacks through secure controls such as web application firewalls or automated vulnerability detection.

CAO-481311 · Examine protections for public-facing applications to confirm attacks are detected and prevented.

Method: Examine, test · Expected evidence: Web application protection configuration

Operational controls: CAO-4813111 Web Application Protection Standard

CAO-400 Cybersecurity › CAO-480 Secure Software Development Policy › CAO-482 Secure Coding › CAO-4821 Develop software using secure coding practices › CAO-48211 Software developed using secure coding practices that prevent common vulnerabilities.

CAO-482111 · Examine coding standards and reviews to confirm secure coding practices are applied.

Method: Examine · Expected evidence: Secure coding standard and review records

Operational controls: CAO-4821111 Secure Coding Standard

CAO-400 Cybersecurity › CAO-480 Secure Software Development Policy › CAO-483 Security Requirements and Architecture › CAO-4831 Define security requirements and secure architecture › CAO-48311 Security requirements and secure architecture defined for new and changed systems.

CAO-483111 · Examine requirements and architecture artifacts to confirm security is specified by design.

Method: Examine · Expected evidence: Security requirements and architecture documents

Operational controls: CAO-4831111 Security Requirements Template

CAO-400 Cybersecurity › CAO-480 Secure Software Development Policy › CAO-484 Security Testing in Development › CAO-4841 Test software security throughout development › CAO-48411 Software security tested throughout development, including code review and vulnerability testing.

CAO-484111 · Examine security-testing records to confirm testing is performed across development.

Method: Examine · Expected evidence: Application security test results

Operational controls: CAO-4841111 Application Security Testing Register

CAO-400 Cybersecurity › CAO-480 Secure Software Development Policy › CAO-485 Development Environment Security › CAO-4851 Secure development environments and source code › CAO-48511 Development environments and source code secured and access-controlled, with separation of development, test and production environments.

CAO-485111 · Examine development environments and source-code controls to confirm separation and access control.

Method: Examine · Expected evidence: Environment separation and source-access configuration

Operational controls: CAO-4851111 Development Environment Security Standard

CAO-400 Cybersecurity › CAO-490 People and Physical Security Policy › CAO-491 Human Resources Security › CAO-4911 Secure human resources across the employment lifecycle › CAO-49111 Human-resource security applied across the employment lifecycle, including screening, terms of employment and exit.

CAO-491111 · Examine HR security controls to confirm screening, terms and exit procedures are applied.

Method: Examine · Expected evidence: HR screening and exit records

Operational controls: CAO-4911111 Personnel Security Work Instruction

CAO-400 Cybersecurity › CAO-490 People and Physical Security Policy › CAO-492 Security Awareness and Training › CAO-4921 Build security awareness and competence › CAO-49211 Security awareness, education and training delivered and competence maintained.

CAO-492111 · Examine awareness and training records to confirm delivery and competence.

Method: Examine · Expected evidence: Training completion records

Operational controls: CAO-4921111 Security Awareness Training Register

CAO-400 Cybersecurity › CAO-490 People and Physical Security Policy › CAO-493 Physical Security Perimeter and Entry › CAO-4931 Establish physical security perimeters › CAO-49311 Physical security perimeters defined and protected for areas containing sensitive information and systems.

CAO-493111 · Examine physical perimeters to confirm protected areas are defined and secured.

Method: Examine, observe · Expected evidence: Physical perimeter and zoning records

Operational controls: CAO-4931111 Physical Security Zones Register

CAO-400 Cybersecurity › CAO-490 People and Physical Security Policy › CAO-493 Physical Security Perimeter and Entry › CAO-4932 Control physical entry and visitor access › CAO-49321 Physical entry controlled and visitor access authorised, logged and escorted as required.

CAO-493211 · Examine entry and visitor controls to confirm access is authorised, logged and escorted.

Method: Examine, observe · Expected evidence: Access logs and visitor register

Operational controls: CAO-4932111 Visitor Access Register

CAO-400 Cybersecurity › CAO-490 People and Physical Security Policy › CAO-494 Physical Monitoring and Protection › CAO-4941 Monitor and protect physical environments › CAO-49411 Physical environments monitored and protected against unauthorised access and environmental threats.

CAO-494111 · Examine physical monitoring such as CCTV and intrusion detection to confirm environments are monitored.

Method: Examine, observe · Expected evidence: Physical monitoring records

Operational controls: CAO-4941111 Physical Monitoring Register

CAO-400 Cybersecurity › CAO-490 People and Physical Security Policy › CAO-495 Equipment and Media Security › CAO-4951 Secure equipment and supporting utilities › CAO-49511 Equipment sited, protected and maintained, and supporting utilities secured.

CAO-495111 · Examine equipment security and maintenance to confirm equipment is protected and maintained.

Method: Examine, observe · Expected evidence: Equipment maintenance and protection records

Operational controls: CAO-4951111 Equipment Security Register

CAO-400 Cybersecurity › CAO-490 People and Physical Security Policy › CAO-495 Equipment and Media Security › CAO-4952 Securely manage storage media and its disposal › CAO-49521 Storage media managed, protected and securely disposed of across its lifecycle.

CAO-495211 · Examine media handling and disposal records to confirm media is protected and securely disposed.

Method: Examine · Expected evidence: Media inventory and disposal records

Operational controls: CAO-4952112 Secure Media Disposal Work Instruction · CAO-4952111 Media Handling Register

CAO-500 Emerging Technology Governance › CAO-510 AI Policy › CAO-511 AI Governance › CAO-5111 Govern artificial intelligence systems › CAO-51111 AI management system established to govern the responsible development and use of AI systems.

CAO-511111 · Examine the AI management system to confirm AI governance is established and maintained.

Method: Examine · Expected evidence: AI management system documentation

Operational controls: CAO-5111111 AI Management System — template

CAO-500 Emerging Technology Governance › CAO-510 AI Policy › CAO-511 AI Governance › CAO-5111 Govern artificial intelligence systems › CAO-51112 AI system resources identified and documented across the life cycle

CAO-511121 · Examine resource documentation to confirm all AI system resources are identified and current

Method: examine · Expected evidence: AI resource documentation and register

Operational controls: CAO-5111211 AI Resource Register

CAO-500 Emerging Technology Governance › CAO-510 AI Policy › CAO-511 AI Governance › CAO-5111 Govern artificial intelligence systems › CAO-51113 Objectives and processes for responsible AI development defined and applied

CAO-511131 · Examine development process records to confirm responsible-AI objectives are applied

Method: examine · Expected evidence: responsible AI development process records

Operational controls: CAO-5111311 Responsible AI Development Procedure — work instruction

CAO-500 Emerging Technology Governance › CAO-510 AI Policy › CAO-511 AI Governance › CAO-5111 Govern artificial intelligence systems › CAO-51114 AI system life-cycle documentation maintained from requirements to operation

CAO-511141 · Examine life-cycle documentation to confirm requirements, design and technical records are complete

Method: examine · Expected evidence: AI system life-cycle documentation

Operational controls: CAO-5111411 AI System Technical File — template

CAO-500 Emerging Technology Governance › CAO-510 AI Policy › CAO-511 AI Governance › CAO-5111 Govern artificial intelligence systems › CAO-51115 Responsible use of AI systems defined, communicated and enforced

CAO-511151 · Examine use policies and usage records to confirm responsible-use objectives are enforced

Method: examine · Expected evidence: AI acceptable-use policy and usage records

Operational controls: CAO-5111511 AI Acceptable Use Policy — template

CAO-500 Emerging Technology Governance › CAO-510 AI Policy › CAO-511 AI Governance › CAO-5111 Govern artificial intelligence systems › CAO-51116 Automatic event logging operated and retained across the AI system lifetime

CAO-511161 · Examine automatically generated logs and their retention against the logging design

Method: examine / test · Expected evidence: AI event logs; retention records

Operational controls: CAO-5111611 AI Event Log Register

CAO-500 Emerging Technology Governance › CAO-510 AI Policy › CAO-511 AI Governance › CAO-5112 Meet general-purpose AI model provider obligations › CAO-51121 GPAI model documentation, downstream information and copyright measures maintained

CAO-511211 · Examine GPAI model documentation, downstream information packs and copyright policy

Method: examine · Expected evidence: model documentation; downstream information; copyright policy

Operational controls: CAO-5112111 GPAI Model Documentation Register

CAO-500 Emerging Technology Governance › CAO-510 AI Policy › CAO-512 Human Oversight › CAO-5121 Ensure human oversight of AI › CAO-51211 Human oversight designed into AI systems so that decisions can be reviewed and overridden.

CAO-512111 · Examine AI system design to confirm human oversight mechanisms are in place.

Method: Examine · Expected evidence: Human oversight design records

Operational controls: CAO-5121111 Human Oversight Design Record

CAO-500 Emerging Technology Governance › CAO-520 AI Risk Management Policy › CAO-521 AI Risk and Impact › CAO-5211 Manage AI risk and impact › CAO-52111 AI risks and impacts assessed and managed across the AI lifecycle.

CAO-521111 · Examine AI impact and risk assessments to confirm risks are assessed and managed.

Method: Examine · Expected evidence: AI impact and risk assessments

Operational controls: CAO-5211111 AI Impact Assessment Template

CAO-500 Emerging Technology Governance › CAO-520 AI Risk Management Policy › CAO-521 AI Risk and Impact › CAO-5211 Manage AI risk and impact › CAO-52112 AI systems verified and validated against defined criteria before deployment

CAO-521121 · Examine verification and validation results to confirm release criteria were met before deployment

Method: examine · Expected evidence: verification and validation results

Operational controls: CAO-5211211 AI Verification and Validation Report — template

CAO-500 Emerging Technology Governance › CAO-520 AI Risk Management Policy › CAO-521 AI Risk and Impact › CAO-5211 Manage AI risk and impact › CAO-52113 Post-market monitoring operated with serious-incident reporting

CAO-521131 · Examine the post-market monitoring plan, collected data and incident reports

Method: examine · Expected evidence: post-market monitoring plan; incident reports

Operational controls: CAO-5211311 Post-Market Monitoring Plan – template

CAO-500 Emerging Technology Governance › CAO-530 AI Transparency and Explainability Policy › CAO-531 AI Transparency › CAO-5311 Ensure AI transparency and explainability › CAO-53111 AI transparency and explainability provided to affected parties.

CAO-531111 · Examine AI documentation and disclosures to confirm transparency and explainability.

Method: Examine · Expected evidence: AI transparency documentation

Operational controls: CAO-5311111 AI Transparency Notice — template

CAO-500 Emerging Technology Governance › CAO-540 AI Data Governance Policy › CAO-541 AI Data and Fairness › CAO-5411 Address AI bias and ensure fairness in data and outcomes › CAO-54111 AI bias identified and mitigated to ensure fairness in data and outcomes.

CAO-541111 · Examine data governance and bias testing to confirm fairness in data and outcomes.

Method: Examine, test · Expected evidence: Bias testing and data governance records

Operational controls: CAO-5411111 AI Bias and Fairness Test Register

CAO-500 Emerging Technology Governance › CAO-540 AI Data Governance Policy › CAO-541 AI Data and Fairness › CAO-5411 Address AI bias and ensure fairness in data and outcomes › CAO-54112 AI data acquired, prepared and managed for quality and provenance across its life cycle

CAO-541121 · Examine data management records to confirm data quality, provenance and preparation controls operate

Method: examine · Expected evidence: data quality and provenance records

Operational controls: CAO-5411211 AI Data Provenance Register

CAO-600 Technology Platform Operations › CAO-610 Operational Resilience Policy › CAO-611 Availability and Capacity › CAO-6111 Manage service availability, capacity and performance › CAO-61111 Service availability, capacity and performance managed to meet defined requirements.

CAO-611111 · Examine capacity and availability management to confirm performance requirements are met.

Method: Examine · Expected evidence: Capacity and availability monitoring records

Operational controls: CAO-6111111 Capacity and Availability Plan

CAO-600 Technology Platform Operations › CAO-610 Operational Resilience Policy › CAO-612 Operational Resilience › CAO-6121 Ensure operational resilience › CAO-61211 Operational resilience maintained so that critical services withstand and recover from disruption.

CAO-612111 · Examine resilience arrangements to confirm critical services can withstand and recover from disruption.

Method: Examine · Expected evidence: Resilience assessment and test records

Operational controls: CAO-6121111 Operational Resilience Register

CAO-600 Technology Platform Operations › CAO-610 Operational Resilience Policy › CAO-613 Backup and Redundancy › CAO-6131 Back up and ensure redundancy of information › CAO-61311 Information backed up and redundancy provided to ensure recoverability.

CAO-613111 · Examine backup and redundancy configuration and tests to confirm information is recoverable.

Method: Examine, test · Expected evidence: Backup and redundancy records

Operational controls: CAO-6131111 Backup and Redundancy Register

CAO-600 Technology Platform Operations › CAO-620 Business Continuity and Disaster Recovery Policy › CAO-621 Business Continuity Management › CAO-6211 Establish a business continuity management system › CAO-62111 Business continuity management system established and maintained.

CAO-621111 · Examine the business continuity management system to confirm it is established, documented and maintained.

Method: Examine · Expected evidence: BCMS documentation

Operational controls: CAO-6211111 Business Continuity Management System — template

CAO-600 Technology Platform Operations › CAO-620 Business Continuity and Disaster Recovery Policy › CAO-622 Disaster Recovery › CAO-6221 Plan and test disaster recovery › CAO-62211 Disaster recovery plans established and tested to restore services within recovery objectives.

CAO-622111 · Examine disaster-recovery plans and test results to confirm recovery objectives are met.

Method: Examine, test · Expected evidence: DR plan and test records

Operational controls: CAO-6221112 DR Test Register · CAO-6221111 Disaster Recovery Plan — template

CAO-600 Technology Platform Operations › CAO-620 Business Continuity and Disaster Recovery Policy › CAO-623 Continuity of Security › CAO-6231 Ensure continuity of security during disruption › CAO-62311 Information security maintained during disruption and continuity activities.

CAO-623111 · Examine continuity arrangements to confirm security controls remain effective during disruption.

Method: Examine · Expected evidence: Continuity security assessment

Operational controls: CAO-6231111 Security Continuity Register

CAO-600 Technology Platform Operations › CAO-630 Configuration, Change and Asset Management Policy › CAO-631 Configuration and Change Management › CAO-6311 Manage secure configuration and change › CAO-63111 Secure configuration and change managed across systems through controlled processes.

CAO-631111 · Examine configuration baselines and change records to confirm secure configuration and change control.

Method: Examine · Expected evidence: Configuration baselines and change records

Operational controls: CAO-6311112 Change Management Register · CAO-6311111 Configuration Management Standard

CAO-600 Technology Platform Operations › CAO-630 Configuration, Change and Asset Management Policy › CAO-632 Asset Management › CAO-6321 Manage and acceptably use information assets › CAO-63211 Information assets inventoried, owned and used acceptably.

CAO-632111 · Examine the asset inventory and acceptable-use controls to confirm assets are managed.

Method: Examine · Expected evidence: Asset inventory and acceptable-use records

Operational controls: CAO-6321112 Acceptable Use Policy — template · CAO-6321111 Information Asset Register

CAO-600 Technology Platform Operations › CAO-640 Service Management Policy › CAO-641 Incident and Request Management › CAO-6411 Manage IT service incidents and service requests › CAO-64111 IT service incidents and service requests managed through defined processes.

CAO-641111 · Examine incident and request records to confirm they are managed through defined processes.

Method: Examine · Expected evidence: Incident and request records

Operational controls: CAO-6411111 Incident and Request Management Work Instruction

CAO-600 Technology Platform Operations › CAO-640 Service Management Policy › CAO-642 Problem Management › CAO-6421 Manage problems › CAO-64211 Problems identified, analysed and resolved to prevent recurring incidents.

CAO-642111 · Examine problem records to confirm problems are analysed and resolved.

Method: Examine · Expected evidence: Problem records

Operational controls: CAO-6421111 Problem Management Register

CAO-600 Technology Platform Operations › CAO-640 Service Management Policy › CAO-643 Service Level Management › CAO-6431 Manage service levels and the service catalogue › CAO-64311 Service levels and the service catalogue defined, agreed and monitored.

CAO-643111 · Examine service-level agreements and the catalogue to confirm services are defined and monitored.

Method: Examine · Expected evidence: SLAs and service catalogue

Operational controls: CAO-6431111 Service Catalogue and SLA Register

CAO-600 Technology Platform Operations › CAO-640 Service Management Policy › CAO-644 Service Operation › CAO-6441 Operate, monitor and administer IT services › CAO-64411 IT services operated, monitored and administered to meet agreed requirements.

CAO-644111 · Examine service-operation records to confirm services are operated and monitored per requirements.

Method: Examine · Expected evidence: Service operation and monitoring records

Operational controls: CAO-6441111 Service Operations Register

CAO-700 Supply Chain › CAO-710 Vendor and Third-Party Risk Management Policy › CAO-711 Supplier and Supply-Chain Security › CAO-7111 Govern supplier and ICT supply-chain security › CAO-71111 Supplier and ICT supply-chain security risks governed through assessment, agreements and monitoring.

CAO-711111 · Examine supplier risk assessments and agreements to confirm supply-chain security is governed.

Method: Examine · Expected evidence: Supplier risk assessments and security agreements

Operational controls: CAO-7111112 Supplier Security Agreement Template · CAO-7111111 Supplier Security Register

CAO-700 Supply Chain › CAO-710 Vendor and Third-Party Risk Management Policy › CAO-712 Supply-Chain Risk Management Programme › CAO-7121 Establish and operate a supply-chain risk management programme › CAO-71211 Supply-chain risk management plan established, maintained and applied

CAO-712111 · Examine the supply-chain risk management plan and programme records to confirm it operates

Method: examine · Expected evidence: C-SCRM plan and programme records

Operational controls: CAO-7121111 Supply-Chain Risk Management Plan — template

CAO-700 Supply Chain › CAO-710 Vendor and Third-Party Risk Management Policy › CAO-712 Supply-Chain Risk Management Programme › CAO-7121 Establish and operate a supply-chain risk management programme › CAO-71212 Provenance, authenticity and integrity of components ensured across the supply chain

CAO-712121 · Examine provenance records and component inspections to confirm authenticity and integrity

Method: examine · Expected evidence: provenance and inspection records

Operational controls: CAO-7121211 Component Provenance Register

CAO-700 Supply Chain › CAO-710 Vendor and Third-Party Risk Management Policy › CAO-712 Supply-Chain Risk Management Programme › CAO-7121 Establish and operate a supply-chain risk management programme › CAO-71213 Suppliers assessed, monitored and bound by security notification agreements

CAO-712131 · Examine supplier assessments, inventories and agreements to confirm ongoing assurance

Method: examine · Expected evidence: supplier assessment and inventory records

Operational controls: CAO-7121311 Supplier Assessment and Inventory Register

CAO-700 Supply Chain › CAO-710 Vendor and Third-Party Risk Management Policy › CAO-712 Supply-Chain Risk Management Programme › CAO-7122 Analyse and treat supply-chain threat scenarios and risk exposure › CAO-71221 Supply-chain threat scenarios developed, assessed and treated via the risk exposure framework

CAO-712211 · Examine documented threat scenarios, exposure assessments and treatment decisions

Method: examine · Expected evidence: threat scenario records; exposure assessments

Operational controls: CAO-7122111 Supply Chain Threat Scenario Register

CAO-700 Supply Chain › CAO-710 Vendor and Third-Party Risk Management Policy › CAO-712 Supply-Chain Risk Management Programme › CAO-7123 Determine and tier the criticality of suppliers, components and services › CAO-71231 Criticality of functions, suppliers, components and services determined and tiered

CAO-712311 · Examine criticality determinations and tiering against missions and business processes

Method: examine · Expected evidence: criticality analysis records

Operational controls: CAO-7123111 Supplier and Component Criticality Register

CAO-800 Regulatory Compliance › CAO-810 Legal and Regulatory Compliance Policy › CAO-811 Legal and Regulatory Obligations › CAO-8111 Meet legal, regulatory and IP obligations › CAO-81111 Legal, regulatory, statutory and intellectual-property obligations identified and met.

CAO-811111 · Examine the legal and regulatory register to confirm obligations are identified and met.

Method: Examine · Expected evidence: Legal and regulatory obligations register

Operational controls: CAO-8111112 PAIA Manual – template · CAO-8111111 Legal and Regulatory Obligations Register

CAO-800 Regulatory Compliance › CAO-810 Legal and Regulatory Compliance Policy › CAO-812 Cyber-Crime and Incident Reporting › CAO-8121 Comply with cyber-crime and incident-reporting law › CAO-81211 Cyber-crime and incident-reporting legal obligations complied with.

CAO-812111 · Examine incident-reporting compliance to confirm legal reporting obligations are met.

Method: Examine · Expected evidence: Regulatory incident-reporting records

Operational controls: CAO-8121112 Cyber Offence 72-hour Report – form · CAO-8121111 Regulatory Reporting Register

CAO-800 Regulatory Compliance › CAO-810 Legal and Regulatory Compliance Policy › CAO-813 Information Access Compliance › CAO-8131 Operate statutory information-access request handling › CAO-81311 Access-request receipt, decision and response operated within statutory timeframes and fees

CAO-813111 · Examine access-request records against statutory forms, fees and decision deadlines

Method: examine · Expected evidence: request register; decision notices

Operational controls: CAO-8131111 Information Access Request Register

CAO-900 Sustainability › CAO-910 Code of Ethics and Conduct › CAO-911 Ethics and Corporate Citizenship › CAO-9111 Govern ethics and responsible corporate citizenship › CAO-91111 Ethical conduct and responsible corporate citizenship governed across the organisation.

CAO-911111 · Examine the code of ethics and governance arrangements to confirm ethical conduct is governed.

Method: Examine · Expected evidence: Code of ethics and ethics oversight records

Operational controls: CAO-9111112 Ethics Oversight Register · CAO-9111111 Code of Ethics — template

CAO-900 Sustainability › CAO-910 Code of Ethics and Conduct › CAO-911 Ethics and Corporate Citizenship › CAO-9112 Prevent, detect and disclose corruption and bribery › CAO-91121 Anti-corruption prevention, detection, training and incident handling operated

CAO-911211 · Examine the anti-corruption programme, training coverage and incident records

Method: examine / interview · Expected evidence: training records; incident log

Operational controls: CAO-9112111 Anti-Corruption Programme Register

CAO-900 Sustainability › CAO-920 Sustainability Reporting and Disclosure › CAO-921 Reporting Governance and Oversight › CAO-9211 Govern sustainability reporting with defined body oversight, competence and incentives › CAO-92111 Sustainability reporting oversight roles, competence and incentive linkage documented and operated

CAO-921111 · Examine governance records to confirm body oversight, competence and incentive linkage for sustainability reporting

Method: examine / interview · Expected evidence: oversight minutes; competence matrix; incentive-scheme linkage records

Operational controls: CAO-9211111 Sustainability Governance Record

CAO-900 Sustainability › CAO-920 Sustainability Reporting and Disclosure › CAO-921 Reporting Governance and Oversight › CAO-9212 Embed sustainability due diligence in strategy and operations › CAO-92121 Sustainability due diligence embedded across strategy, business model and operations

CAO-921211 · Examine the due-diligence statement mapping to confirm coverage of the core due-diligence elements

Method: examine · Expected evidence: due-diligence statement; process records

Operational controls: CAO-9212111 Sustainability Due Diligence Record

CAO-900 Sustainability › CAO-920 Sustainability Reporting and Disclosure › CAO-921 Reporting Governance and Oversight › CAO-9213 Maintain risk management and internal controls over sustainability reporting › CAO-92131 Risk management and internal controls operated over the sustainability reporting process

CAO-921311 · Examine reporting-risk assessments and evidence of control operation over sustainability reporting

Method: examine / test · Expected evidence: reporting risk register; control test records

Operational controls: CAO-9213111 Sustainability Reporting Controls Register

CAO-900 Sustainability › CAO-920 Sustainability Reporting and Disclosure › CAO-922 Materiality and Strategy › CAO-9221 Conduct and maintain a double materiality assessment of impacts, risks and opportunities › CAO-92211 Double materiality assessment performed and maintained across own operations and the value chain

CAO-922111 · Examine the materiality assessment method, stakeholder inputs and resulting material IROs

Method: examine / interview · Expected evidence: materiality assessment record; IRO register

Operational controls: CAO-9221111 Double Materiality Assessment Register

CAO-900 Sustainability › CAO-920 Sustainability Reporting and Disclosure › CAO-922 Materiality and Strategy › CAO-9222 Disclose strategy, business model and stakeholder interests as they bear on sustainability › CAO-92221 Strategy, business-model and stakeholder-interest disclosures prepared and current

CAO-922211 · Examine strategic-context disclosures against the required elements

Method: examine · Expected evidence: strategy and stakeholder context records

Operational controls: CAO-9222111 Strategy and Stakeholder Context Record

CAO-900 Sustainability › CAO-920 Sustainability Reporting and Disclosure › CAO-923 Sustainability Statement Preparation › CAO-9231 Prepare and publish the sustainability statement, complete and comparable › CAO-92311 Sustainability statement prepared to the required structure, qualitative characteristics and time horizons

CAO-923111 · Inspect the sustainability statement for completeness, comparability and disclosure-requirement coverage

Method: examine · Expected evidence: sustainability statement; disclosure index

Operational controls: CAO-9231112 ESRS Disclosure Index · CAO-9231111 Sustainability Statement (template)

CAO-900 Sustainability › CAO-920 Sustainability Reporting and Disclosure › CAO-923 Sustainability Statement Preparation › CAO-9232 Apply minimum disclosure quality to policies, actions, metrics and targets › CAO-92321 Minimum disclosure requirements applied to policies, actions, metrics and targets for material topics

CAO-923211 · Confirm each material topic's policies, actions, metrics and targets meet the minimum disclosure content

Method: examine · Expected evidence: disclosure quality checklist

Operational controls: CAO-9232111 Disclosure Quality Checklist

CAO-900 Sustainability › CAO-930 Environmental Sustainability › CAO-931 Climate Change › CAO-9311 Manage climate change mitigation and adaptation › CAO-93111 Climate transition plan, policies, actions, targets and carbon-pricing arrangements established and resourced

CAO-931111 · Examine the transition plan, action plans and target records against the climate disclosure requirements

Method: examine · Expected evidence: policy, action and target records

Operational controls: CAO-9311111 Climate Transition Plan and Targets Register

CAO-900 Sustainability › CAO-930 Environmental Sustainability › CAO-931 Climate Change › CAO-9312 Measure and disclose climate metrics and financial effects › CAO-93121 Energy, GHG (Scopes 1, 2, 3), removals and anticipated financial effects quantified per the required methodologies

CAO-931211 · Test the GHG inventory and energy metrics for boundary and methodology conformance

Method: examine / test · Expected evidence: metric derivations and source data

Operational controls: CAO-9312111 GHG Inventory

CAO-900 Sustainability › CAO-930 Environmental Sustainability › CAO-932 Pollution › CAO-9321 Manage pollution prevention and control › CAO-93211 Pollution policies, actions and targets established and resourced

CAO-932111 · Examine pollution policies, action plans and target records

Method: examine · Expected evidence: policy, action and target records

Operational controls: CAO-9321111 Pollution Management Register

CAO-900 Sustainability › CAO-930 Environmental Sustainability › CAO-932 Pollution › CAO-9322 Measure and disclose pollution metrics and financial effects › CAO-93221 Air, water and soil emissions and substances of concern quantified and disclosed

CAO-932211 · Examine emissions data and substances-of-concern inventories

Method: examine / test · Expected evidence: metric derivations and source data

Operational controls: CAO-9322111 Emissions and Substances-of-Concern Register

CAO-900 Sustainability › CAO-930 Environmental Sustainability › CAO-933 Water and Marine Resources › CAO-9331 Manage water and marine resource use › CAO-93311 Water and marine policies, actions and targets established and resourced

CAO-933111 · Examine water policies, action plans and target records

Method: examine · Expected evidence: policy, action and target records

Operational controls: CAO-9331111 Water Resources Register

CAO-900 Sustainability › CAO-930 Environmental Sustainability › CAO-933 Water and Marine Resources › CAO-9332 Measure and disclose water metrics and financial effects › CAO-93321 Water consumption and anticipated financial effects quantified and disclosed

CAO-933211 · Test water consumption metrics for methodology conformance

Method: examine / test · Expected evidence: metric derivations and source data

Operational controls: CAO-9332111 Water Consumption Register

CAO-900 Sustainability › CAO-930 Environmental Sustainability › CAO-934 Biodiversity and Ecosystems › CAO-9341 Manage biodiversity and ecosystem impacts › CAO-93411 Biodiversity transition consideration, policies, actions and targets established and resourced

CAO-934111 · Examine biodiversity plans, action records and targets

Method: examine · Expected evidence: policy, action and target records

Operational controls: CAO-9341111 Biodiversity Action Register

CAO-900 Sustainability › CAO-930 Environmental Sustainability › CAO-934 Biodiversity and Ecosystems › CAO-9342 Measure and disclose biodiversity metrics and financial effects › CAO-93421 Biodiversity impact metrics and anticipated financial effects quantified and disclosed

CAO-934211 · Examine biodiversity impact metrics and their derivation

Method: examine / test · Expected evidence: metric derivations and source data

Operational controls: CAO-9342111 Biodiversity Impact Metrics Register

CAO-900 Sustainability › CAO-930 Environmental Sustainability › CAO-935 Resource Use and Circular Economy › CAO-9351 Manage resource use and circular economy › CAO-93511 Circular-economy policies, actions and targets established and resourced

CAO-935111 · Examine circular-economy policies, action plans and target records

Method: examine · Expected evidence: policy, action and target records

Operational controls: CAO-9351111 Circular Economy Register

CAO-900 Sustainability › CAO-930 Environmental Sustainability › CAO-935 Resource Use and Circular Economy › CAO-9352 Measure and disclose resource-flow metrics and financial effects › CAO-93521 Resource inflows, outflows and anticipated financial effects quantified and disclosed

CAO-935211 · Examine resource-flow data and derivation methods

Method: examine / test · Expected evidence: metric derivations and source data

Operational controls: CAO-9352111 Resource Flows Register

CAO-900 Sustainability › CAO-940 Social Sustainability › CAO-941 Own Workforce › CAO-9411 Manage own-workforce conditions, rights, engagement and remediation › CAO-94111 Own-workforce policies, engagement processes, remediation channels, actions and targets established

CAO-941111 · Examine workforce policies, engagement and remediation records

Method: examine / interview · Expected evidence: workforce policies; engagement and remediation records

Operational controls: CAO-9411111 Workforce Policies and Engagement Record

CAO-900 Sustainability › CAO-940 Social Sustainability › CAO-941 Own Workforce › CAO-9412 Measure and disclose workforce characteristics and outcomes › CAO-94121 Workforce characteristics, diversity, wages, safety and development metrics quantified and disclosed

CAO-941211 · Test workforce metrics for methodology and coverage

Method: examine / test · Expected evidence: workforce metric derivations

Operational controls: CAO-9412111 Workforce Metrics Register

CAO-900 Sustainability › CAO-940 Social Sustainability › CAO-942 Value-Chain Workers › CAO-9421 Manage and disclose value-chain worker impacts › CAO-94211 Value-chain worker policies, engagement, remediation, actions and targets established and disclosed

CAO-942111 · Examine value-chain worker impact management records

Method: examine · Expected evidence: value-chain worker impact records

Operational controls: CAO-9421111 Value-Chain Worker Impact Register

CAO-900 Sustainability › CAO-940 Social Sustainability › CAO-943 Affected Communities › CAO-9431 Manage and disclose impacts on affected communities › CAO-94311 Affected-community policies, engagement, remediation, actions and targets established and disclosed

CAO-943111 · Examine community impact management records

Method: examine · Expected evidence: community impact records

Operational controls: CAO-9431111 Community Impact Register

CAO-900 Sustainability › CAO-940 Social Sustainability › CAO-944 Consumers and End-Users › CAO-9441 Manage and disclose impacts on consumers and end-users › CAO-94411 Consumer and end-user policies, engagement, remediation, actions and targets established and disclosed

CAO-944111 · Examine consumer impact management records

Method: examine · Expected evidence: consumer impact records

Operational controls: CAO-9441111 Consumer Impact Register