GOV-03 · Governance and Accountability
Roles and responsibilities defined
Security, privacy and compliance responsibilities are assigned and communicated to the people who hold them.
6frameworks fully address it
2partially
0leave it out
SOC 2 ISO 27001 NIST CSF PCI DSS HIPAA GDPR EU AI Act NIST AI RMF
1Where each framework asks for it
- SOC 2FullCC1.4
- ISO 27001FullA.5.3
- NIST CSFFullGV.RR-02
- PCI DSSFull12.4
- HIPAAFull164.308(a)(3)
- GDPRPartialArt. 32 Implied through appropriate measures rather than stated.
- EU AI ActPartialArt. 26(2) Human oversight must be assigned to competent persons.
- NIST AI RMFFullGOVERN 2.2
Build the control once against this objective and cite the clause each auditor asks about. A partial mapping says what the framework leaves out; an absence is a finding about the framework, not a gap in your program.
2What usually proves it
Role descriptions, RACI, acknowledgement records.
?Why it exists
People perform duties they know they hold.
For a smaller organizationA one-page list of who does what, acknowledged by each person.