{
  "total": 328,
  "frameworks": 18,
  "catalogue": [
    {
      "framework": "euaiact",
      "label": "EU AI Act",
      "count": 40,
      "controls": [
        {
          "name": "sebbi_euaiact_001",
          "title": "EU AI Act Art.9 - risk management system recorded"
        },
        {
          "name": "sebbi_euaiact_002",
          "title": "EU AI Act Art.9 - residual risk documented"
        },
        {
          "name": "sebbi_euaiact_003",
          "title": "EU AI Act Art.10 - training data governance"
        },
        {
          "name": "sebbi_euaiact_004",
          "title": "EU AI Act Art.10 - training data source documented"
        },
        {
          "name": "sebbi_euaiact_005",
          "title": "EU AI Act Art.10 - data bias examined"
        },
        {
          "name": "sebbi_euaiact_006",
          "title": "EU AI Act Art.11 - technical documentation present"
        },
        {
          "name": "sebbi_euaiact_007",
          "title": "EU AI Act Art.12 - automatic event logging enabled"
        },
        {
          "name": "sebbi_euaiact_008",
          "title": "EU AI Act Art.12 - logs retained >= 180 days"
        },
        {
          "name": "sebbi_euaiact_009",
          "title": "EU AI Act Art.13 - transparency: user informed"
        },
        {
          "name": "sebbi_euaiact_010",
          "title": "EU AI Act Art.13 - instructions for use provided"
        },
        {
          "name": "sebbi_euaiact_011",
          "title": "EU AI Act Art.14 - human oversight assigned"
        },
        {
          "name": "sebbi_euaiact_012",
          "title": "EU AI Act Art.14 - stop / override control exists"
        },
        {
          "name": "sebbi_euaiact_013",
          "title": "EU AI Act Art.15 - accuracy metric recorded"
        },
        {
          "name": "sebbi_euaiact_014",
          "title": "EU AI Act Art.15 - robustness tested"
        },
        {
          "name": "sebbi_euaiact_015",
          "title": "EU AI Act Art.15 - cybersecurity measures recorded"
        },
        {
          "name": "sebbi_euaiact_016",
          "title": "EU AI Act Art.16 - provider obligations acknowledged"
        },
        {
          "name": "sebbi_euaiact_017",
          "title": "EU AI Act Art.17 - quality management system"
        },
        {
          "name": "sebbi_euaiact_018",
          "title": "EU AI Act Art.18 - documentation kept 10 years"
        },
        {
          "name": "sebbi_euaiact_019",
          "title": "EU AI Act Art.26 - deployer oversight owner named"
        },
        {
          "name": "sebbi_euaiact_020",
          "title": "EU AI Act Art.27 - fundamental-rights impact assessment"
        },
        {
          "name": "sebbi_euaiact_021",
          "title": "EU AI Act Art.43 - conformity assessment recorded"
        },
        {
          "name": "sebbi_euaiact_022",
          "title": "EU AI Act Art.47 - EU declaration of conformity"
        },
        {
          "name": "sebbi_euaiact_023",
          "title": "EU AI Act Art.49 - registered in EU database"
        },
        {
          "name": "sebbi_euaiact_024",
          "title": "EU AI Act Art.50 - AI interaction disclosed"
        },
        {
          "name": "sebbi_euaiact_025",
          "title": "EU AI Act Art.50 - synthetic content labelled"
        },
        {
          "name": "sebbi_euaiact_026",
          "title": "EU AI Act Art.72 - post-market monitoring plan"
        },
        {
          "name": "sebbi_euaiact_027",
          "title": "EU AI Act Art.73 - serious-incident reporting path"
        },
        {
          "name": "sebbi_euaiact_028",
          "title": "EU AI Act Art.6 - risk classification recorded"
        },
        {
          "name": "sebbi_euaiact_029",
          "title": "EU AI Act Art.5 - prohibited-practice screen passed"
        },
        {
          "name": "sebbi_euaiact_030",
          "title": "EU AI Act Annex IV - documentation reference"
        },
        {
          "name": "sebbi_euaiact_031",
          "title": "EU AI Act Art.4 - staff AI literacy ensured"
        },
        {
          "name": "sebbi_euaiact_032",
          "title": "EU AI Act Art.51 - GPAI systemic-risk classification"
        },
        {
          "name": "sebbi_euaiact_033",
          "title": "EU AI Act Art.53 - GPAI technical documentation"
        },
        {
          "name": "sebbi_euaiact_034",
          "title": "EU AI Act Art.53 - training copyright policy"
        },
        {
          "name": "sebbi_euaiact_035",
          "title": "EU AI Act Art.53 - training-content summary published"
        },
        {
          "name": "sebbi_euaiact_036",
          "title": "EU AI Act Art.55 - systemic-model evaluation"
        },
        {
          "name": "sebbi_euaiact_037",
          "title": "EU AI Act Art.55 - adversarial red-team testing"
        },
        {
          "name": "sebbi_euaiact_038",
          "title": "EU AI Act Art.55 - GPAI serious-incident tracking"
        },
        {
          "name": "sebbi_euaiact_039",
          "title": "EU AI Act Art.55 - model cybersecurity protection"
        },
        {
          "name": "sebbi_euaiact_040",
          "title": "EU AI Act Art.56 - code of practice adherence"
        }
      ]
    },
    {
      "framework": "gdpr",
      "label": "GDPR",
      "count": 33,
      "controls": [
        {
          "name": "sebbi_gdpr_001",
          "title": "GDPR Art.5 - processing purpose stated"
        },
        {
          "name": "sebbi_gdpr_002",
          "title": "GDPR Art.5 - data minimisation applied"
        },
        {
          "name": "sebbi_gdpr_003",
          "title": "GDPR Art.5 - storage limitation set"
        },
        {
          "name": "sebbi_gdpr_004",
          "title": "GDPR Art.6 - lawful basis recorded"
        },
        {
          "name": "sebbi_gdpr_005",
          "title": "GDPR Art.7 - consent is recorded"
        },
        {
          "name": "sebbi_gdpr_006",
          "title": "GDPR Art.9 - special-category safeguard"
        },
        {
          "name": "sebbi_gdpr_007",
          "title": "GDPR Art.12 - transparent information provided"
        },
        {
          "name": "sebbi_gdpr_008",
          "title": "GDPR Art.13 - privacy notice shown"
        },
        {
          "name": "sebbi_gdpr_009",
          "title": "GDPR Art.15 - right of access supported"
        },
        {
          "name": "sebbi_gdpr_010",
          "title": "GDPR Art.16 - rectification supported"
        },
        {
          "name": "sebbi_gdpr_011",
          "title": "GDPR Art.17 - erasure supported"
        },
        {
          "name": "sebbi_gdpr_012",
          "title": "GDPR Art.18 - restriction supported"
        },
        {
          "name": "sebbi_gdpr_013",
          "title": "GDPR Art.20 - data portability supported"
        },
        {
          "name": "sebbi_gdpr_014",
          "title": "GDPR Art.21 - right to object supported"
        },
        {
          "name": "sebbi_gdpr_015",
          "title": "GDPR Art.22 - human review of automated decision"
        },
        {
          "name": "sebbi_gdpr_016",
          "title": "GDPR Art.25 - data protection by design"
        },
        {
          "name": "sebbi_gdpr_017",
          "title": "GDPR Art.28 - processor contract in place"
        },
        {
          "name": "sebbi_gdpr_018",
          "title": "GDPR Art.30 - records of processing referenced"
        },
        {
          "name": "sebbi_gdpr_019",
          "title": "GDPR Art.32 - encryption in place"
        },
        {
          "name": "sebbi_gdpr_020",
          "title": "GDPR Art.32 - access controls in place"
        },
        {
          "name": "sebbi_gdpr_021",
          "title": "GDPR Art.33 - 72-hour breach process"
        },
        {
          "name": "sebbi_gdpr_022",
          "title": "GDPR Art.35 - DPIA referenced"
        },
        {
          "name": "sebbi_gdpr_023",
          "title": "GDPR Art.37 - DPO appointed where required"
        },
        {
          "name": "sebbi_gdpr_024",
          "title": "GDPR Art.44 - international transfer mechanism"
        },
        {
          "name": "sebbi_gdpr_025",
          "title": "GDPR Art.46 - appropriate safeguards (SCCs)"
        },
        {
          "name": "sebbi_gdpr_026",
          "title": "GDPR Art.5 - accuracy principle upheld"
        },
        {
          "name": "sebbi_gdpr_027",
          "title": "GDPR Art.5 - integrity & confidentiality"
        },
        {
          "name": "sebbi_gdpr_028",
          "title": "GDPR Art.5 - accountability demonstrable"
        },
        {
          "name": "sebbi_gdpr_029",
          "title": "GDPR Art.24 - controller responsibility evidenced"
        },
        {
          "name": "sebbi_gdpr_030",
          "title": "GDPR Art.26 - joint-controller arrangement"
        },
        {
          "name": "sebbi_gdpr_031",
          "title": "GDPR Art.34 - data-subject breach notification"
        },
        {
          "name": "sebbi_gdpr_032",
          "title": "GDPR Art.40 - code of conduct adhered"
        },
        {
          "name": "sebbi_gdpr_033",
          "title": "GDPR Art.42 - certification held"
        }
      ]
    },
    {
      "framework": "dora",
      "label": "EU DORA",
      "count": 18,
      "controls": [
        {
          "name": "sebbi_dora_001",
          "title": "DORA Art.5 - ICT risk management framework"
        },
        {
          "name": "sebbi_dora_002",
          "title": "DORA Art.6 - ICT governance responsibility"
        },
        {
          "name": "sebbi_dora_003",
          "title": "DORA Art.8 - ICT asset inventory"
        },
        {
          "name": "sebbi_dora_004",
          "title": "DORA Art.9 - protection & prevention controls"
        },
        {
          "name": "sebbi_dora_005",
          "title": "DORA Art.10 - anomaly detection in place"
        },
        {
          "name": "sebbi_dora_006",
          "title": "DORA Art.11 - response & recovery plan"
        },
        {
          "name": "sebbi_dora_007",
          "title": "DORA Art.11 - RTO objective set"
        },
        {
          "name": "sebbi_dora_008",
          "title": "DORA Art.12 - backup policy recorded"
        },
        {
          "name": "sebbi_dora_009",
          "title": "DORA Art.13 - learning & evolving process"
        },
        {
          "name": "sebbi_dora_010",
          "title": "DORA Art.14 - crisis communication plan"
        },
        {
          "name": "sebbi_dora_011",
          "title": "DORA Art.17 - incident management process"
        },
        {
          "name": "sebbi_dora_012",
          "title": "DORA Art.19 - major incident reporting path"
        },
        {
          "name": "sebbi_dora_013",
          "title": "DORA Art.24 - digital resilience testing"
        },
        {
          "name": "sebbi_dora_014",
          "title": "DORA Art.25 - vulnerability assessments"
        },
        {
          "name": "sebbi_dora_015",
          "title": "DORA Art.28 - third-party ICT risk register"
        },
        {
          "name": "sebbi_dora_016",
          "title": "DORA Art.28 - concentration risk assessed"
        },
        {
          "name": "sebbi_dora_017",
          "title": "DORA Art.30 - key contractual provisions"
        },
        {
          "name": "sebbi_dora_018",
          "title": "DORA Art.45 - threat intelligence sharing"
        }
      ]
    },
    {
      "framework": "iso42001",
      "label": "ISO/IEC 42001",
      "count": 16,
      "controls": [
        {
          "name": "sebbi_iso42001_001",
          "title": "ISO/IEC 42001 Cl.5 - AI policy present"
        },
        {
          "name": "sebbi_iso42001_002",
          "title": "ISO/IEC 42001 Cl.5 - leadership commitment"
        },
        {
          "name": "sebbi_iso42001_003",
          "title": "ISO/IEC 42001 A.3 - AI roles defined"
        },
        {
          "name": "sebbi_iso42001_004",
          "title": "ISO/IEC 42001 A.4 - AI resources documented"
        },
        {
          "name": "sebbi_iso42001_005",
          "title": "ISO/IEC 42001 A.5 - AI system impact assessment"
        },
        {
          "name": "sebbi_iso42001_006",
          "title": "ISO/IEC 42001 A.6 - life-cycle stage recorded"
        },
        {
          "name": "sebbi_iso42001_007",
          "title": "ISO/IEC 42001 A.6 - responsible development process"
        },
        {
          "name": "sebbi_iso42001_008",
          "title": "ISO/IEC 42001 A.7 - data for AI documented"
        },
        {
          "name": "sebbi_iso42001_009",
          "title": "ISO/IEC 42001 A.7 - data provenance recorded"
        },
        {
          "name": "sebbi_iso42001_010",
          "title": "ISO/IEC 42001 A.8 - information to interested parties"
        },
        {
          "name": "sebbi_iso42001_011",
          "title": "ISO/IEC 42001 A.9 - intended use documented"
        },
        {
          "name": "sebbi_iso42001_012",
          "title": "ISO/IEC 42001 A.9 - foreseeable misuse considered"
        },
        {
          "name": "sebbi_iso42001_013",
          "title": "ISO/IEC 42001 A.10 - third-party & supplier register"
        },
        {
          "name": "sebbi_iso42001_014",
          "title": "ISO/IEC 42001 Cl.9 - performance monitoring"
        },
        {
          "name": "sebbi_iso42001_015",
          "title": "ISO/IEC 42001 Cl.9 - internal audit evidence"
        },
        {
          "name": "sebbi_iso42001_016",
          "title": "ISO/IEC 42001 Cl.10 - continual improvement log"
        }
      ]
    },
    {
      "framework": "nistai",
      "label": "NIST AI RMF",
      "count": 18,
      "controls": [
        {
          "name": "sebbi_nistai_001",
          "title": "NIST AI RMF GOVERN-1.1 - legal/reg requirements mapped"
        },
        {
          "name": "sebbi_nistai_002",
          "title": "NIST AI RMF GOVERN-2.1 - accountable owner named"
        },
        {
          "name": "sebbi_nistai_003",
          "title": "NIST AI RMF GOVERN-3.2 - diverse team / review"
        },
        {
          "name": "sebbi_nistai_004",
          "title": "NIST AI RMF GOVERN-4.1 - risk culture / policy"
        },
        {
          "name": "sebbi_nistai_005",
          "title": "NIST AI RMF GOVERN-6.1 - third-party risk policy"
        },
        {
          "name": "sebbi_nistai_006",
          "title": "NIST AI RMF MAP-1.1 - use context established"
        },
        {
          "name": "sebbi_nistai_007",
          "title": "NIST AI RMF MAP-2.3 - system categorised"
        },
        {
          "name": "sebbi_nistai_008",
          "title": "NIST AI RMF MAP-3.1 - benefits documented"
        },
        {
          "name": "sebbi_nistai_009",
          "title": "NIST AI RMF MAP-5.1 - impacts characterised"
        },
        {
          "name": "sebbi_nistai_010",
          "title": "NIST AI RMF MEASURE-1.1 - metrics identified"
        },
        {
          "name": "sebbi_nistai_011",
          "title": "NIST AI RMF MEASURE-2.3 - performance evaluated"
        },
        {
          "name": "sebbi_nistai_012",
          "title": "NIST AI RMF MEASURE-2.7 - security & resilience tested"
        },
        {
          "name": "sebbi_nistai_013",
          "title": "NIST AI RMF MEASURE-2.11 - fairness assessed"
        },
        {
          "name": "sebbi_nistai_014",
          "title": "NIST AI RMF MEASURE-4.1 - feedback channel"
        },
        {
          "name": "sebbi_nistai_015",
          "title": "NIST AI RMF MANAGE-1.1 - risks prioritised"
        },
        {
          "name": "sebbi_nistai_016",
          "title": "NIST AI RMF MANAGE-2.2 - mitigation plan"
        },
        {
          "name": "sebbi_nistai_017",
          "title": "NIST AI RMF MANAGE-3.1 - third-party risks managed"
        },
        {
          "name": "sebbi_nistai_018",
          "title": "NIST AI RMF MANAGE-4.1 - post-deployment monitoring"
        }
      ]
    },
    {
      "framework": "osa",
      "label": "UK Online Safety Act",
      "count": 14,
      "controls": [
        {
          "name": "sebbi_osa_001",
          "title": "OSA s.9 - illegal content risk assessment"
        },
        {
          "name": "sebbi_osa_002",
          "title": "OSA s.10 - illegal content safety duties met"
        },
        {
          "name": "sebbi_osa_003",
          "title": "OSA s.11 - children's access assessment"
        },
        {
          "name": "sebbi_osa_004",
          "title": "OSA s.12 - children's safety duties met"
        },
        {
          "name": "sebbi_osa_005",
          "title": "OSA s.12 - age assurance in place"
        },
        {
          "name": "sebbi_osa_006",
          "title": "OSA s.20 - reporting mechanism live"
        },
        {
          "name": "sebbi_osa_007",
          "title": "OSA s.21 - complaints procedure"
        },
        {
          "name": "sebbi_osa_008",
          "title": "OSA s.22 - freedom of expression safeguards"
        },
        {
          "name": "sebbi_osa_009",
          "title": "OSA - CSEA detection measures"
        },
        {
          "name": "sebbi_osa_010",
          "title": "OSA - grooming-pattern flagging (no false 'safe')"
        },
        {
          "name": "sebbi_osa_011",
          "title": "OSA - terms of service clarity"
        },
        {
          "name": "sebbi_osa_012",
          "title": "OSA s.77 - transparency report"
        },
        {
          "name": "sebbi_osa_013",
          "title": "OSA - senior manager accountable"
        },
        {
          "name": "sebbi_osa_014",
          "title": "OSA - record of safety measures kept"
        }
      ]
    },
    {
      "framework": "dsa",
      "label": "EU Digital Services Act",
      "count": 14,
      "controls": [
        {
          "name": "sebbi_dsa_001",
          "title": "DSA Art.14 - terms & conditions published"
        },
        {
          "name": "sebbi_dsa_002",
          "title": "DSA Art.16 - notice-and-action mechanism"
        },
        {
          "name": "sebbi_dsa_003",
          "title": "DSA Art.17 - statement of reasons recorded"
        },
        {
          "name": "sebbi_dsa_004",
          "title": "DSA Art.20 - internal complaint system"
        },
        {
          "name": "sebbi_dsa_005",
          "title": "DSA Art.21 - out-of-court dispute route"
        },
        {
          "name": "sebbi_dsa_006",
          "title": "DSA Art.22 - trusted flaggers honoured"
        },
        {
          "name": "sebbi_dsa_007",
          "title": "DSA Art.24 - transparency reporting"
        },
        {
          "name": "sebbi_dsa_008",
          "title": "DSA Art.25 - no dark patterns"
        },
        {
          "name": "sebbi_dsa_009",
          "title": "DSA Art.26 - advertising transparency"
        },
        {
          "name": "sebbi_dsa_010",
          "title": "DSA Art.27 - recommender transparency"
        },
        {
          "name": "sebbi_dsa_011",
          "title": "DSA Art.28 - protection of minors"
        },
        {
          "name": "sebbi_dsa_012",
          "title": "DSA Art.34 - systemic risk assessment (VLOP)"
        },
        {
          "name": "sebbi_dsa_013",
          "title": "DSA Art.35 - risk mitigation measures (VLOP)"
        },
        {
          "name": "sebbi_dsa_014",
          "title": "DSA Art.37 - independent audit (VLOP)"
        }
      ]
    },
    {
      "framework": "iso27001",
      "label": "ISO/IEC 27001",
      "count": 26,
      "controls": [
        {
          "name": "sebbi_iso27001_001",
          "title": "ISO 27001 A.5.1 - information security policy"
        },
        {
          "name": "sebbi_iso27001_002",
          "title": "ISO 27001 A.5.7 - threat intelligence"
        },
        {
          "name": "sebbi_iso27001_003",
          "title": "ISO 27001 A.5.9 - inventory of assets"
        },
        {
          "name": "sebbi_iso27001_004",
          "title": "ISO 27001 A.5.10 - acceptable use of assets"
        },
        {
          "name": "sebbi_iso27001_005",
          "title": "ISO 27001 A.5.15 - access control policy"
        },
        {
          "name": "sebbi_iso27001_006",
          "title": "ISO 27001 A.5.23 - cloud services security"
        },
        {
          "name": "sebbi_iso27001_007",
          "title": "ISO 27001 A.5.30 - ICT readiness for continuity"
        },
        {
          "name": "sebbi_iso27001_008",
          "title": "ISO 27001 A.6.3 - security awareness training"
        },
        {
          "name": "sebbi_iso27001_009",
          "title": "ISO 27001 A.8.1 - user endpoint devices secured"
        },
        {
          "name": "sebbi_iso27001_010",
          "title": "ISO 27001 A.8.2 - privileged access managed"
        },
        {
          "name": "sebbi_iso27001_011",
          "title": "ISO 27001 A.8.5 - secure authentication (MFA)"
        },
        {
          "name": "sebbi_iso27001_012",
          "title": "ISO 27001 A.8.8 - vulnerability management"
        },
        {
          "name": "sebbi_iso27001_013",
          "title": "ISO 27001 A.8.12 - data leakage prevention"
        },
        {
          "name": "sebbi_iso27001_014",
          "title": "ISO 27001 A.8.13 - information backup"
        },
        {
          "name": "sebbi_iso27001_015",
          "title": "ISO 27001 A.8.15 - logging enabled"
        },
        {
          "name": "sebbi_iso27001_016",
          "title": "ISO 27001 A.8.16 - monitoring activities"
        },
        {
          "name": "sebbi_iso27001_017",
          "title": "ISO 27001 A.8.24 - use of cryptography"
        },
        {
          "name": "sebbi_iso27001_018",
          "title": "ISO 27001 A.8.25 - secure development lifecycle"
        },
        {
          "name": "sebbi_iso27001_019",
          "title": "ISO 27001 A.8.28 - secure coding"
        },
        {
          "name": "sebbi_iso27001_020",
          "title": "ISO 27001 A.5.24 - incident management planning"
        },
        {
          "name": "sebbi_iso27001_021",
          "title": "ISO 27001 A.5.19 - supplier relationships security"
        },
        {
          "name": "sebbi_iso27001_022",
          "title": "ISO 27001 A.5.31 - legal & contractual requirements"
        },
        {
          "name": "sebbi_iso27001_023",
          "title": "ISO 27001 A.5.34 - privacy & PII protection"
        },
        {
          "name": "sebbi_iso27001_024",
          "title": "ISO 27001 A.8.9 - configuration management"
        },
        {
          "name": "sebbi_iso27001_025",
          "title": "ISO 27001 A.8.20 - network security"
        },
        {
          "name": "sebbi_iso27001_026",
          "title": "ISO 27001 A.8.23 - web filtering"
        }
      ]
    },
    {
      "framework": "soc2",
      "label": "SOC 2",
      "count": 20,
      "controls": [
        {
          "name": "sebbi_soc2_001",
          "title": "SOC 2 CC1 - control environment / integrity"
        },
        {
          "name": "sebbi_soc2_002",
          "title": "SOC 2 CC2 - information & communication"
        },
        {
          "name": "sebbi_soc2_003",
          "title": "SOC 2 CC3 - risk assessment process"
        },
        {
          "name": "sebbi_soc2_004",
          "title": "SOC 2 CC4 - monitoring of controls"
        },
        {
          "name": "sebbi_soc2_005",
          "title": "SOC 2 CC5 - control activities defined"
        },
        {
          "name": "sebbi_soc2_006",
          "title": "SOC 2 CC6.1 - logical access controls"
        },
        {
          "name": "sebbi_soc2_007",
          "title": "SOC 2 CC6.6 - boundary protection"
        },
        {
          "name": "sebbi_soc2_008",
          "title": "SOC 2 CC6.7 - data transmission encrypted"
        },
        {
          "name": "sebbi_soc2_009",
          "title": "SOC 2 CC7.1 - vulnerability detection"
        },
        {
          "name": "sebbi_soc2_010",
          "title": "SOC 2 CC7.2 - security incident monitoring"
        },
        {
          "name": "sebbi_soc2_011",
          "title": "SOC 2 CC7.3 - incident response evaluated"
        },
        {
          "name": "sebbi_soc2_012",
          "title": "SOC 2 CC8.1 - change management"
        },
        {
          "name": "sebbi_soc2_013",
          "title": "SOC 2 A1.2 - availability / capacity monitoring"
        },
        {
          "name": "sebbi_soc2_014",
          "title": "SOC 2 C1.1 - confidential data identified"
        },
        {
          "name": "sebbi_soc2_015",
          "title": "SOC 2 PI1.1 - processing integrity controls"
        },
        {
          "name": "sebbi_soc2_016",
          "title": "SOC 2 P1 - privacy notice & consent"
        },
        {
          "name": "sebbi_soc2_017",
          "title": "SOC 2 CC9.1 - risk mitigation for disruptions"
        },
        {
          "name": "sebbi_soc2_018",
          "title": "SOC 2 CC9.2 - vendor & third-party management"
        },
        {
          "name": "sebbi_soc2_019",
          "title": "SOC 2 A1.1 - capacity planning"
        },
        {
          "name": "sebbi_soc2_020",
          "title": "SOC 2 C1.2 - confidential data disposal"
        }
      ]
    },
    {
      "framework": "fca",
      "label": "FCA conduct",
      "count": 14,
      "controls": [
        {
          "name": "sebbi_fca_001",
          "title": "FCA PRIN - acting with integrity"
        },
        {
          "name": "sebbi_fca_002",
          "title": "FCA Consumer Duty - good outcomes evidenced"
        },
        {
          "name": "sebbi_fca_003",
          "title": "FCA Consumer Duty - vulnerable customer care"
        },
        {
          "name": "sebbi_fca_004",
          "title": "FCA - fair, clear, not misleading comms"
        },
        {
          "name": "sebbi_fca_005",
          "title": "FCA SYSC - senior manager accountable (SMCR)"
        },
        {
          "name": "sebbi_fca_006",
          "title": "FCA SYSC - audit trail retained"
        },
        {
          "name": "sebbi_fca_007",
          "title": "FCA - financial promotion approved"
        },
        {
          "name": "sebbi_fca_008",
          "title": "FCA - conflicts of interest managed"
        },
        {
          "name": "sebbi_fca_009",
          "title": "FCA - AML / KYC checks completed"
        },
        {
          "name": "sebbi_fca_010",
          "title": "FCA - suitability / appropriateness assessed"
        },
        {
          "name": "sebbi_fca_011",
          "title": "FCA - complaints handling (DISP)"
        },
        {
          "name": "sebbi_fca_012",
          "title": "FCA - operational resilience impact tolerance"
        },
        {
          "name": "sebbi_fca_013",
          "title": "FCA - model risk governance"
        },
        {
          "name": "sebbi_fca_014",
          "title": "FCA - record of advice / decision kept"
        }
      ]
    },
    {
      "framework": "hipaa",
      "label": "HIPAA Security Rule",
      "count": 16,
      "controls": [
        {
          "name": "sebbi_hipaa_001",
          "title": "HIPAA 164.308 - security management process"
        },
        {
          "name": "sebbi_hipaa_002",
          "title": "HIPAA 164.308 - risk analysis performed"
        },
        {
          "name": "sebbi_hipaa_003",
          "title": "HIPAA 164.308 - workforce access authorisation"
        },
        {
          "name": "sebbi_hipaa_004",
          "title": "HIPAA 164.308 - security awareness training"
        },
        {
          "name": "sebbi_hipaa_005",
          "title": "HIPAA 164.308 - contingency plan"
        },
        {
          "name": "sebbi_hipaa_006",
          "title": "HIPAA 164.310 - facility access controls"
        },
        {
          "name": "sebbi_hipaa_007",
          "title": "HIPAA 164.312 - unique user identification"
        },
        {
          "name": "sebbi_hipaa_008",
          "title": "HIPAA 164.312 - automatic logoff"
        },
        {
          "name": "sebbi_hipaa_009",
          "title": "HIPAA 164.312 - encryption of ePHI"
        },
        {
          "name": "sebbi_hipaa_010",
          "title": "HIPAA 164.312 - audit controls / logs"
        },
        {
          "name": "sebbi_hipaa_011",
          "title": "HIPAA 164.312 - integrity controls"
        },
        {
          "name": "sebbi_hipaa_012",
          "title": "HIPAA 164.312 - transmission security"
        },
        {
          "name": "sebbi_hipaa_013",
          "title": "HIPAA 164.314 - business associate agreement"
        },
        {
          "name": "sebbi_hipaa_014",
          "title": "HIPAA 164.404 - breach notification process"
        },
        {
          "name": "sebbi_hipaa_015",
          "title": "HIPAA 164.502 - minimum necessary use"
        },
        {
          "name": "sebbi_hipaa_016",
          "title": "HIPAA 164.524 - patient right of access"
        }
      ]
    },
    {
      "framework": "pcidss",
      "label": "PCI DSS",
      "count": 22,
      "controls": [
        {
          "name": "sebbi_pcidss_001",
          "title": "PCI DSS Req.1 - network security controls"
        },
        {
          "name": "sebbi_pcidss_002",
          "title": "PCI DSS Req.2 - no vendor default passwords"
        },
        {
          "name": "sebbi_pcidss_003",
          "title": "PCI DSS Req.3 - stored account data protected"
        },
        {
          "name": "sebbi_pcidss_004",
          "title": "PCI DSS Req.3 - PAN masked when displayed"
        },
        {
          "name": "sebbi_pcidss_005",
          "title": "PCI DSS Req.3 - cryptographic key management"
        },
        {
          "name": "sebbi_pcidss_006",
          "title": "PCI DSS Req.4 - encrypt transmission over open nets"
        },
        {
          "name": "sebbi_pcidss_007",
          "title": "PCI DSS Req.5 - anti-malware protection"
        },
        {
          "name": "sebbi_pcidss_008",
          "title": "PCI DSS Req.6 - secure systems & software"
        },
        {
          "name": "sebbi_pcidss_009",
          "title": "PCI DSS Req.6 - security patching current"
        },
        {
          "name": "sebbi_pcidss_010",
          "title": "PCI DSS Req.6 - change control process"
        },
        {
          "name": "sebbi_pcidss_011",
          "title": "PCI DSS Req.7 - access on need-to-know"
        },
        {
          "name": "sebbi_pcidss_012",
          "title": "PCI DSS Req.8 - unique user IDs"
        },
        {
          "name": "sebbi_pcidss_013",
          "title": "PCI DSS Req.8 - MFA for access"
        },
        {
          "name": "sebbi_pcidss_014",
          "title": "PCI DSS Req.9 - physical access restricted"
        },
        {
          "name": "sebbi_pcidss_015",
          "title": "PCI DSS Req.10 - logging & audit trails"
        },
        {
          "name": "sebbi_pcidss_016",
          "title": "PCI DSS Req.10 - daily log review"
        },
        {
          "name": "sebbi_pcidss_017",
          "title": "PCI DSS Req.10 - time synchronisation"
        },
        {
          "name": "sebbi_pcidss_018",
          "title": "PCI DSS Req.11 - vulnerability scanning"
        },
        {
          "name": "sebbi_pcidss_019",
          "title": "PCI DSS Req.11 - penetration testing"
        },
        {
          "name": "sebbi_pcidss_020",
          "title": "PCI DSS Req.11 - file integrity monitoring"
        },
        {
          "name": "sebbi_pcidss_021",
          "title": "PCI DSS Req.12 - information security policy"
        },
        {
          "name": "sebbi_pcidss_022",
          "title": "PCI DSS Req.12 - incident response plan"
        }
      ]
    },
    {
      "framework": "ccpa",
      "label": "CCPA / CPRA",
      "count": 14,
      "controls": [
        {
          "name": "sebbi_ccpa_001",
          "title": "CCPA/CPRA - notice at collection"
        },
        {
          "name": "sebbi_ccpa_002",
          "title": "CCPA/CPRA - right to know honoured"
        },
        {
          "name": "sebbi_ccpa_003",
          "title": "CCPA/CPRA - right to delete honoured"
        },
        {
          "name": "sebbi_ccpa_004",
          "title": "CCPA/CPRA - right to correct honoured"
        },
        {
          "name": "sebbi_ccpa_005",
          "title": "CCPA/CPRA - opt-out of sale"
        },
        {
          "name": "sebbi_ccpa_006",
          "title": "CCPA/CPRA - opt-out of sharing"
        },
        {
          "name": "sebbi_ccpa_007",
          "title": "CCPA/CPRA - limit sensitive PI use"
        },
        {
          "name": "sebbi_ccpa_008",
          "title": "CCPA/CPRA - non-discrimination for rights"
        },
        {
          "name": "sebbi_ccpa_009",
          "title": "CCPA/CPRA - data minimisation"
        },
        {
          "name": "sebbi_ccpa_010",
          "title": "CCPA/CPRA - purpose limitation"
        },
        {
          "name": "sebbi_ccpa_011",
          "title": "CCPA/CPRA - retention period disclosed"
        },
        {
          "name": "sebbi_ccpa_012",
          "title": "CCPA/CPRA - service-provider contract"
        },
        {
          "name": "sebbi_ccpa_013",
          "title": "CCPA/CPRA - authorised agent honoured"
        },
        {
          "name": "sebbi_ccpa_014",
          "title": "CCPA/CPRA - Do-Not-Sell/Share link"
        }
      ]
    },
    {
      "framework": "cra",
      "label": "EU Cyber Resilience Act",
      "count": 12,
      "controls": [
        {
          "name": "sebbi_cra_001",
          "title": "EU CRA - secure by design"
        },
        {
          "name": "sebbi_cra_002",
          "title": "EU CRA - no known exploitable vulns at release"
        },
        {
          "name": "sebbi_cra_003",
          "title": "EU CRA - security updates provided"
        },
        {
          "name": "sebbi_cra_004",
          "title": "EU CRA - software bill of materials (SBOM)"
        },
        {
          "name": "sebbi_cra_005",
          "title": "EU CRA - vulnerability disclosure policy"
        },
        {
          "name": "sebbi_cra_006",
          "title": "EU CRA - active-exploitation notification"
        },
        {
          "name": "sebbi_cra_007",
          "title": "EU CRA - support period defined"
        },
        {
          "name": "sebbi_cra_008",
          "title": "EU CRA - secure default configuration"
        },
        {
          "name": "sebbi_cra_009",
          "title": "EU CRA - data minimisation by design"
        },
        {
          "name": "sebbi_cra_010",
          "title": "EU CRA - integrity protection"
        },
        {
          "name": "sebbi_cra_011",
          "title": "EU CRA - authentication mechanism"
        },
        {
          "name": "sebbi_cra_012",
          "title": "EU CRA - conformity assessment (CE)"
        }
      ]
    },
    {
      "framework": "nis2",
      "label": "EU NIS2",
      "count": 12,
      "controls": [
        {
          "name": "sebbi_nis2_001",
          "title": "NIS2 Art.21 - risk-management measures"
        },
        {
          "name": "sebbi_nis2_002",
          "title": "NIS2 Art.21 - incident handling"
        },
        {
          "name": "sebbi_nis2_003",
          "title": "NIS2 Art.21 - business continuity & backup"
        },
        {
          "name": "sebbi_nis2_004",
          "title": "NIS2 Art.21 - supply-chain security"
        },
        {
          "name": "sebbi_nis2_005",
          "title": "NIS2 Art.21 - vulnerability handling"
        },
        {
          "name": "sebbi_nis2_006",
          "title": "NIS2 Art.21 - cryptography policy"
        },
        {
          "name": "sebbi_nis2_007",
          "title": "NIS2 Art.21 - access control"
        },
        {
          "name": "sebbi_nis2_008",
          "title": "NIS2 Art.21 - multi-factor authentication"
        },
        {
          "name": "sebbi_nis2_009",
          "title": "NIS2 Art.23 - 24-hour early warning"
        },
        {
          "name": "sebbi_nis2_010",
          "title": "NIS2 Art.20 - management-body accountability"
        },
        {
          "name": "sebbi_nis2_011",
          "title": "NIS2 Art.20 - security training"
        },
        {
          "name": "sebbi_nis2_012",
          "title": "NIS2 Art.21 - network & systems security"
        }
      ]
    },
    {
      "framework": "childrenscode",
      "label": "ICO Children's Code",
      "count": 15,
      "controls": [
        {
          "name": "sebbi_childrenscode_001",
          "title": "ICO Children's Code - best interests of the child"
        },
        {
          "name": "sebbi_childrenscode_002",
          "title": "ICO Children's Code - DPIA for children"
        },
        {
          "name": "sebbi_childrenscode_003",
          "title": "ICO Children's Code - age-appropriate application"
        },
        {
          "name": "sebbi_childrenscode_004",
          "title": "ICO Children's Code - transparency for children"
        },
        {
          "name": "sebbi_childrenscode_005",
          "title": "ICO Children's Code - detrimental use avoided"
        },
        {
          "name": "sebbi_childrenscode_006",
          "title": "ICO Children's Code - policies & standards upheld"
        },
        {
          "name": "sebbi_childrenscode_007",
          "title": "ICO Children's Code - high-privacy default"
        },
        {
          "name": "sebbi_childrenscode_008",
          "title": "ICO Children's Code - data minimisation"
        },
        {
          "name": "sebbi_childrenscode_009",
          "title": "ICO Children's Code - no data sharing by default"
        },
        {
          "name": "sebbi_childrenscode_010",
          "title": "ICO Children's Code - geolocation off by default"
        },
        {
          "name": "sebbi_childrenscode_011",
          "title": "ICO Children's Code - no nudge techniques"
        },
        {
          "name": "sebbi_childrenscode_012",
          "title": "ICO Children's Code - connected toys/devices safe"
        },
        {
          "name": "sebbi_childrenscode_013",
          "title": "ICO Children's Code - online tools to exercise rights"
        },
        {
          "name": "sebbi_childrenscode_014",
          "title": "ICO Children's Code - profiling off by default"
        },
        {
          "name": "sebbi_childrenscode_015",
          "title": "ICO Children's Code - parental controls transparent"
        }
      ]
    },
    {
      "framework": "usstateai",
      "label": "US state AI laws",
      "count": 12,
      "controls": [
        {
          "name": "sebbi_usstateai_001",
          "title": "NYC LL144 - bias audit completed"
        },
        {
          "name": "sebbi_usstateai_002",
          "title": "NYC LL144 - candidate notice given"
        },
        {
          "name": "sebbi_usstateai_003",
          "title": "Colorado AI Act - risk-management programme"
        },
        {
          "name": "sebbi_usstateai_004",
          "title": "Colorado AI Act - consumer notification"
        },
        {
          "name": "sebbi_usstateai_005",
          "title": "Colorado AI Act - impact assessment"
        },
        {
          "name": "sebbi_usstateai_006",
          "title": "Illinois AIVIA - video-interview consent"
        },
        {
          "name": "sebbi_usstateai_007",
          "title": "US state AI - right to human appeal"
        },
        {
          "name": "sebbi_usstateai_008",
          "title": "US state AI - adverse-action notice"
        },
        {
          "name": "sebbi_usstateai_009",
          "title": "US state AI - disparate-impact tested"
        },
        {
          "name": "sebbi_usstateai_010",
          "title": "US state AI - training-data provenance"
        },
        {
          "name": "sebbi_usstateai_011",
          "title": "US state AI - opt-out of profiling"
        },
        {
          "name": "sebbi_usstateai_012",
          "title": "US state AI - explanation provided"
        }
      ]
    },
    {
      "framework": "modelrisk",
      "label": "Model risk (SR 11-7)",
      "count": 12,
      "controls": [
        {
          "name": "sebbi_modelrisk_001",
          "title": "SR 11-7 - model inventory maintained"
        },
        {
          "name": "sebbi_modelrisk_002",
          "title": "SR 11-7 - model owner assigned"
        },
        {
          "name": "sebbi_modelrisk_003",
          "title": "SR 11-7 - independent validation"
        },
        {
          "name": "sebbi_modelrisk_004",
          "title": "SR 11-7 - conceptual soundness reviewed"
        },
        {
          "name": "sebbi_modelrisk_005",
          "title": "SR 11-7 - ongoing monitoring"
        },
        {
          "name": "sebbi_modelrisk_006",
          "title": "SR 11-7 - outcomes analysis / backtesting"
        },
        {
          "name": "sebbi_modelrisk_007",
          "title": "SR 11-7 - benchmarking performed"
        },
        {
          "name": "sebbi_modelrisk_008",
          "title": "SR 11-7 - documentation standard met"
        },
        {
          "name": "sebbi_modelrisk_009",
          "title": "SR 11-7 - limitations stated"
        },
        {
          "name": "sebbi_modelrisk_010",
          "title": "SR 11-7 - used within approved scope"
        },
        {
          "name": "sebbi_modelrisk_011",
          "title": "SR 11-7 - model change control"
        },
        {
          "name": "sebbi_modelrisk_012",
          "title": "SR 11-7 - model risk tiering"
        }
      ]
    }
  ]
}