ASR-01 · Assurance and Evidence
Controls have owners
Every control has one accountable owner and named performers for its tasks.
5frameworks fully address it
1partially
2leave it out
SOC 2 ISO 27001 NIST CSF PCI DSS HIPAA GDPR EU AI Act NIST AI RMF
1Where each framework asks for it
- SOC 2FullCC1.3
- ISO 27001FullA.5.2
- NIST CSFFullGV.RR-02
- PCI DSSFull12.4.2
- HIPAAPartial164.308(a)(2) Security official responsibility.
- GDPRAbsent No control ownership concept.
- EU AI ActAbsent Not addressed.
- NIST AI RMFFullGOVERN 2.1
Build the control once against this objective and cite the clause each auditor asks about. A partial mapping says what the framework leaves out; an absence is a finding about the framework, not a gap in your program.
2What usually proves it
Control ownership matrix, attestations.
?Why it exists
Shared ownership is the reliable route to nothing happening.
For a smaller organizationOne person, twelve controls, written down.