GOV-01 · Governance and Accountability
Accountable owner for digital trust
A named individual is accountable for the digital trust program, with the authority and budget to direct it.
5frameworks fully address it
3partially
0leave it out
SOC 2 ISO 27001 NIST CSF PCI DSS HIPAA GDPR EU AI Act NIST AI RMF
1Where each framework asks for it
- SOC 2FullCC1.3
- ISO 27001FullA.5.2
- NIST CSFFullGV.RR-02
- PCI DSSPartial12.1.3 Scoped to cardholder data responsibilities only.
- HIPAAFull164.308(a)(2)
- GDPRPartialArt. 24 Accountability sits with the controller as an entity; no named individual is required except where Art. 37 applies.
- EU AI ActPartialArt. 26 Deployer duties imply an accountable person without naming the role.
- NIST AI RMFFullGOVERN 2.1
Build the control once against this objective and cite the clause each auditor asks about. A partial mapping says what the framework leaves out; an absence is a finding about the framework, not a gap in your program.
2What usually proves it
Appointment record, role description, board or leadership minute naming the owner.
?Why it exists
Programs without a name attached become everybody's intention and nobody's work.
For a smaller organizationOne founder or manager, named in writing, is enough.