Compliance command center | Compliancify

CMP-026: Regulation (EU) 2022/2554 → Maintain an ICT third-party information register with governed scope and changes. → TPR-01 · Third-party register governance → Register extract · provider inventory · contract map → Third-party risk reviewer

CMP-031: NIST CSWP 29 → Understand and manage legal, regulatory, and contractual cybersecurity requirements. → GOV-03 · Requirement ownership and change routing → Requirement register · owner review · change log → Enterprise risk reviewer

CMP-044: AICPA SOC resource perimeter → Keep the service-system boundary and material dependencies current for readiness work. → SYS-01 · System boundary and change review → System description · architecture · dependency inventory → Readiness reviewer

CMP-052: ISO/IEC 27001:2022 reference → Operate an approved information-security risk assessment and treatment workflow. → RSK-02 · Information-security risk assessment → Methodology · risk register · treatment approval → Compliance reviewer

CMP-067: Regulation (EU) 2016/679 → Govern processor instructions, contract, subprocessor, transfer, monitoring, and exit decisions. → PRV-08 · Processor and transfer governance → DPA · transfer assessment · monitoring record → Privacy counsel

CMP-074: SEC ICFR reporting rules → Preserve scope, evidence, deficiency evaluation, management review, and disclosure decisions. → ICFR-12 · Deficiency evaluation and reporting → Issue record · aggregation · committee approval → Disclosure committee reviewer

Interpret: Establish authority, version, jurisdiction, entity, product, system, data, and effective-period context before proposing an obligation. Retained: Source snapshot, applicability facts, assumptions, interpretation owner, reviewer, and unresolved questions.

Map: Relate an accepted obligation to policies, risks, controls, procedures, evidence expectations, and overlapping frameworks. Retained: Requirement decomposition, mapping rationale, relationship type, conflicts, gaps, and human approval.

Implement: Assign accountable performers and reviewers, define the operating cadence, and preserve approved design decisions. Retained: Control design, procedure, role assignment, system boundary, approval, implementation evidence, and effective date.

Collect: Request or connect evidence with source lineage, period, completeness, access, retention, and confidentiality context. Retained: Evidence object, source system, collection parameters, custodian, period, freshness, completeness, and access history.

Review: Evaluate design, operation, evidence, exceptions, and limitations without allowing automation to make the final conclusion. Retained: Reviewer decision, challenge, rejected support, exception, remediation request, approval boundary, and timestamp.

Reassess: Reopen scope when a source, organization, system, vendor, product, risk, control, or effective period changes. Retained: Trigger signal, impact assessment, changed and unchanged records, supersession link, owner, and next review.

NIST CSF 2.0: NIST CSF 2.0 resource center continues to expand — 2026-03-23 — https://www.nist.gov/cyberframework/quick-start-guides

SOC 2: AICPA published an updated SOC service-organization overview — 2026-04-23 — https://www.aicpa-cima.com/soc4so

DORA: European Commission updated DORA-related transposition monitoring — 2026-05-04 — https://finance.ec.europa.eu/regulation-and-supervision/financial-services-legislation/enforcement-and-infringements-banking-and-finance-law/monitoring-banking-and-finance-directives/digital-operational-resilience-financial-sector-directive_en

SOX: SEC cybersecurity disclosure requirements remain a governance input — 2023-07-26 — https://www.sec.gov/rules-regulations/2023/07/s7-09-22

This public product preview organizes source, applicability, mapping, evidence, exception, and review records. It does not reproduce licensed standards, certify an organization, determine legal sufficiency, or establish compliance.

No source signal changes a mapped control, evidence state, or conclusion automatically.