Protected Framework
This framework is protected under CC BY-NC-ND 4.0 — patent pending. See Multitier Licensing.
1. Purpose and Scope
This matrix mapping document, lists the specific International Standards, Governance Codes & Corporate Regulations, Data Protection & Privacy Laws, Cybersecurity & Cybercrime Laws, and Best-Practice Frameworks that show be considered towards a more comprehensive Information Compliance Universe.
It also includes a mapping of specific clauses per regulation or framework to the CIAO Standard and Essential policies.
2. The CIAO ICU Matrix
Here below are snaphots of the CIAO Essential ICU matrix, you can right-click; save image as, screenshot, open this image in a new tab or save this directly from here to your device to zoom in or see under the CIAO Essential resources to download this in PDF format. As these are much more comprehensive that the CIAO Standard ICU matrix, these are now in separate sections below per domain.
2.1. CIAOs.IS0: INTERNATIONAL STANDARDS
| Standard / Framework | InfoSec Policy | Privacy Policy | Awareness & Training | Incident Response | Business Continuity & DR | Vendor / 3rd Party Risk | Acceptable Use | Cryptography & Encryption | Physical Security | HR Security |
|---|---|---|---|---|---|---|---|---|---|---|
| ISO/IEC 27001:2022 | A.5.1, A.5.2, A.5.4 | A.18.1, A.18.2 | A.7.2.2, A.18.2 | A.16.1 (Incident Mgmt) | A.17.1 (Continuity) | A.15.1 (Supplier Security) | A.8.1 (Acceptable Use) | A.10.1 (Cryptographic Controls) | A.11.1 (Physical Security) | A.7.1 (HR Security) |
| ISO/IEC 27018:2019 | Cloud security controls | Shared responsibility for PII | — | Breach response obligations | — | Cloud supplier agreements | — | Encryption for cloud PII | — | Workforce training for cloud |
| ISO 22301:2019 | Clause 8.4 (Procedures) | — | — | Incident response integration | Clause 8.4, 9.1 | Supplier continuity obligations | — | — | Facility resilience | Workforce continuity roles |
| ISO/IEC 38500:2015 | Governance principles | — | — | Governance of incident escalation | Governance of continuity | Supplier governance | — | — | Governance of facilities | Governance of workforce |
| ISO/IEC 42001:2023 (AI Mgmt) | Clause 5.1, 6.3, 7.3 | Clause 8.2 (Transparency) | Clause 7.4 (AI Training) | AI incident response | AI resilience planning | AI vendor oversight | — | AI data encryption | AI facility controls | AI workforce roles |
| ISO 44001:2017 | Clause 5.4, 6.3, 7.4 | Clause 7.3, 8.2 | Clause 7.2, 5.3 | Joint incident response | Collaborative continuity | Supplier collaboration | — | — | Shared facility controls | Joint workforce training |
| COSO ERM (2017) | Principle 17 (Risk Reporting) | Principle 9 (Risk Response) | Principle 3, 8 (Culture) | Risk incident response | Risk continuity | Supplier risk oversight | — | — | Risk facility controls | Risk culture |
| SOC 2 (TSC 2017) | CC1–CC9 (Security criteria) | P1–P9 (Privacy) | CC6.3 (Awareness) | CC7 (Incident Response) | Availability criteria | CC9 (Vendor Mgmt) | CC6 (Acceptable Use) | Confidentiality criteria | CC6 (Physical Security) | CC2 (HR Security) |
| NIST CSF v2.0 (2024) | ID.AM, ID.RA, PR.AC | PR.DS, PR.IP | PR.AT | RS.RP, RS.MI | RC.IM, RS.MI | ID.SC (Supply Chain Risk) | PR.AC (Use policies) | PR.DS (Encryption) | PR.PT (Physical Protection) | ID.AM (Roles & HR) |
2.2. CIAOs.GC0: GOVERNANCE CODES
| Standard / Framework | InfoSec Policy | Privacy Policy | Awareness & Training | Incident Response | Business Continuity & DR | Vendor / 3rd Party Risk | Acceptable Use | Cryptography & Encryption | Physical Security | HR Security |
|---|---|---|---|---|---|---|---|---|---|---|
| UK Corporate Governance Code (2018) | Governance & accountability | Board oversight of privacy | Board oversight of training culture | Incident escalation governance | Continuity oversight | Supplier governance | — | — | Facility governance | Workforce governance |
| SOX 404 (2002/2010) | Internal control reporting | Privacy controls in financial reporting | Training controls | Incident reporting obligations | Continuity of financial reporting | Vendor oversight in financial systems | — | Encryption for financial data | Facility access for financial systems | Workforce training for compliance |
| SEBI LODR (2015/2021) | Risk disclosure | Privacy compliance disclosure | Training compliance disclosure | Incident disclosure obligations | Continuity disclosure | Supplier disclosure | — | — | Facility disclosure | Workforce disclosure |
| King IV (South Africa, 2016) | Governance principles | Data protection governance | Awareness & culture | Incident governance | Continuity governance | Supplier governance | — | — | Facility governance | Workforce governance |
| Mauritius Code of Corporate Governance (2016) | Governance & accountability | Privacy governance | Training oversight | Incident governance | Continuity governance | Supplier governance | — | — | Facility governance | Workforce governance |
| OECD Principles of Corporate Governance (2015) | Transparency & accountability | Privacy governance | Risk culture | Incident governance | Continuity governance | Supplier governance | — | — | Facility governance | Workforce governance |
2.3. CIAOs.DP0: DATA PROTECTION
| Standard / Framework | InfoSec Policy | Privacy Policy | Awareness & Training | Incident Response | Business Continuity & DR | Vendor / 3rd Party Risk | Acceptable Use | Cryptography & Encryption | Physical Security | HR Security |
|---|---|---|---|---|---|---|---|---|---|---|
| GDPR (EU 2016/679) | Art. 32 (Security of Processing) | Arts. 5–6, 15–22, 32–34 | Art. 39 (DPO responsibilities) | Arts. 33–34 (Breach Notification) | Art. 32 (Resilience of Processing) | Art. 28 (Processor Contracts) | Art. 29 (Employee Instructions) | Art. 32 (Encryption) | Art. 32 (Physical Security) | Art. 39 (Training & HR obligations) |
| POPIA (South Africa, 2013) | Sec. 19 (Security safeguards) | Sec. 22 (Breach notification) | Sec. 19(2) (Training obligations) | Sec. 22 (Breach response) | Sec. 19 (Continuity safeguards) | Sec. 21 (Operator contracts) | Sec. 19 (Employee obligations) | Sec. 19 (Encryption) | Sec. 19 (Physical safeguards) | Sec. 19(2) (HR training) |
| Mauritius Data Protection Act (2017) | Sec. 23 (Security measures) | Sec. 36 (Processing & breach) | — | Sec. 36 (Breach response) | Sec. 23 (Continuity safeguards) | Sec. 23 (Processor obligations) | — | Sec. 23 (Encryption) | Sec. 23 (Physical safeguards) | Workforce obligations implied |
| AU Convention on Cybersecurity (2014) | Security obligations | Security obligations | Training obligations | Incident response obligations | Continuity obligations | Supplier obligations | — | Encryption obligations | Facility obligations | Workforce obligations |
| Singapore PDPA (2012/2020) | Security obligations | Processing & breach notification | Training obligations | Breach response obligations | Continuity obligations | Vendor obligations | — | Encryption obligations | Facility obligations | Workforce obligations |
| India DPDP Act (2023) | Security obligations | Processing & breach notification | Training obligations | Breach response obligations | Continuity obligations | Vendor obligations | — | Encryption obligations | Facility obligations | Workforce obligations |
| Brazil LGPD (2018) | Security obligations | Processing & breach notification | Training obligations | Breach response obligations | Continuity obligations | Vendor obligations | — | Encryption obligations | Facility obligations | Workforce obligations |
| California CCPA/CPRA (2018/2020) | Security obligations | Consumer rights & breach | — | Breach response obligations | Continuity obligations | Vendor obligations | — | Encryption obligations | Facility obligations | Workforce obligations |
| Mauritius Cybercrime Act (2003) | Incident response obligations | Breach obligations | Awareness obligations | Incident response obligations | Continuity obligations | Vendor obligations | — | Encryption obligations | Facility obligations | Workforce obligations |
| South Africa Cybercrimes Act (2020) | Incident response obligations | Breach obligations | Awareness obligations | Incident response obligations | Continuity obligations | Vendor obligations | — | Encryption obligations | Facility obligations | Workforce obligations |
2.4. CIAOs.CL0: CYBERSECURITY LAWS
| Standard / Framework | InfoSec Policy | Privacy Policy | Awareness & Training | Incident Response | Business Continuity & DR | Vendor / 3rd Party Risk | Acceptable Use | Cryptography & Encryption | Physical Security | HR Security |
|---|---|---|---|---|---|---|---|---|---|---|
| Mauritius Cybercrime Act (2003) | Security obligations | Breach obligations | Awareness obligations | Incident response obligations | Continuity obligations | Vendor obligations | — | Encryption obligations | Facility obligations | Workforce obligations |
| South Africa Cybercrimes Act (2020) | Security obligations | Breach obligations | Awareness obligations | Incident response obligations | Continuity obligations | Vendor obligations | — | Encryption obligations | Facility obligations | Workforce obligations |
| AU Convention on Cybersecurity (2014) | Security obligations | Security obligations | Training obligations | Incident response obligations | Continuity obligations | Supplier obligations | — | Encryption obligations | Facility obligations | Workforce obligations |
2.5. CIAOs.BP0: BEST-PRACTICES
| Standard / Framework | InfoSec Policy | Privacy Policy | Awareness & Training | Incident Response | Business Continuity & DR | Vendor / 3rd Party Risk | Acceptable Use | Cryptography & Encryption | Physical Security | HR Security |
|---|---|---|---|---|---|---|---|---|---|---|
| COBIT 2019 | EDM, APO domains (Governance, Risk, Security) | MEA domain (Privacy compliance) | DSS domain (Training & awareness) | DSS05 (Incident Mgmt) | DSS04 (Continuity) | APO10 (Supplier Mgmt) | DSS01 (Use policies) | DSS05 (Encryption controls) | DSS01 (Facility security) | APO07 (HR Mgmt) |
| ITIL v4 (2019) | Change, Incident, Problem Mgmt | Service Design, Service Transition | Continual Improvement (Training) | Incident Mgmt practice | Service Continuity Mgmt | Supplier Mgmt practice | Acceptable Use in Service Ops | Security Mgmt practice | Facility Mgmt practice | Workforce Mgmt practice |
| SIAM v4 (2020) | Supplier Integration (Governance, Service Mgmt) | Supplier Integration for data sharing | Supplier Integration for joint training | Supplier Incident Response | Supplier Continuity Planning | Supplier Risk Mgmt | Supplier Acceptable Use | Supplier Encryption obligations | Supplier Facility controls | Supplier Workforce training |
| SOC 2 (AICPA, 2017) | CC1–CC9 (Security criteria) | P1–P9 (Privacy criteria) | CC6.3 (Awareness) | CC7 (Incident Response) | Availability criteria | CC9 (Vendor Mgmt) | CC6 (Acceptable Use) | Confidentiality criteria | CC6 (Physical Security) | CC2 (HR Security) |
| CSA CCM (Cloud Controls Matrix) | IAM, ISV domains | Privacy & Compliance domains | Awareness & Training domain | Incident Response domain | Business Continuity domain | Third-Party Risk domain | Acceptable Use domain | Cryptography domain | Physical Security domain | HR Security domain |
| PCI DSS v4.0 (2022) | Req. 1–2 (Network Security) | Req. 3–4 (Protect Cardholder Data) | Req. 12.6 (Security Awareness Training) | Req. 12.10 (Incident Response Plan) | Req. 12.11 (Continuity Testing) | Req. 12.8 (Vendor Mgmt) | Req. 12.3 (Acceptable Use) | Req. 3–4 (Encryption) | Req. 9 (Physical Security) | Req. 12.6 (HR Training) |
| HIPAA Security Rule (45 CFR 164) | §164.308(a)(1) (Security Mgmt Process) | §164.308(a)(3–4), §164.312 (Privacy safeguards) | §164.308(a)(5) (Awareness & Training) | §164.308(a)(6) (Incident Response) | §164.308(a)(7) (Contingency Plan) | §164.308(b)(1) (Vendor Contracts) | Workforce Acceptable Use (§164.308) | §164.312(a)(2)(iv) (Encryption) | §164.310 (Facility Access Controls) | §164.308(a)(2) (HR Security) |
3. How to Use the CIAO ICU Matrix
The CIAO ICU Matrix is a fairly comprehensive Information Assurance reference mapping to essential frameworks and regulations.
Start with what is most pertinent in your region and decide what is compulsory vs nice-to-haves. Thinks about the size of the organisation and the target market. Use the CIAO organisation size and scope guidelines to determine approximate membership needs and values to be gained.
Enterprise and Conglomerate implementation content will be added here.
● LIVE CONTENT
· Verified 16 October 2026 at 23:09 UTC · Version 1.1.3.7
· Always current at
c-ao.com
· © CIAO Standard Secretariat 2026