GOV-02 · Governance and Accountability
Approved policy set
Policies covering the organization's obligations are approved, dated, owned and reviewed on a stated cycle.
6frameworks fully address it
1partially
1leave it out
SOC 2 ISO 27001 NIST CSF PCI DSS HIPAA GDPR EU AI Act NIST AI RMF
1Where each framework asks for it
- SOC 2FullCC5.3
- ISO 27001FullA.5.1
- NIST CSFFullGV.PO-01
- PCI DSSFull12.1
- HIPAAFull164.316(a)
- GDPRPartialArt. 24(2) Policies are required only where proportionate.
- EU AI ActAbsent The Act imposes system-level obligations and quality management for providers; it does not require an organizational policy set.
- NIST AI RMFFullGOVERN 1.1
Build the control once against this objective and cite the clause each auditor asks about. A partial mapping says what the framework leaves out; an absence is a finding about the framework, not a gap in your program.
2What usually proves it
Policy register with owner, approval date, next review; approval record.
?Why it exists
An unapproved policy is a draft; an unreviewed one is a claim about the past.
For a smaller organizationA dozen policies, approved once a year, with the founder as owner.