GOV-04 · Governance and Accountability
Code of conduct and ethics affirmation
Expected conduct is published and affirmed by staff on joining and annually.
3frameworks fully address it
4partially
1leave it out
SOC 2 ISO 27001 NIST CSF PCI DSS HIPAA GDPR EU AI Act NIST AI RMF
1Where each framework asks for it
- SOC 2FullCC1.1
- ISO 27001PartialA.6.2 Covered through terms of employment rather than a separate code.
- NIST CSFPartialGV.RR-04 Addressed through workforce expectations.
- PCI DSSPartial12.6 Framed as security awareness acknowledgement.
- HIPAAFull164.308(a)(1)(ii)(C)
- GDPRAbsent No conduct code obligation; confidentiality of processing staff is required under Art. 28(3)(b) instead.
- EU AI ActPartialArt. 4 AI literacy duty touches conduct without a code.
- NIST AI RMFFullGOVERN 3.2
Build the control once against this objective and cite the clause each auditor asks about. A partial mapping says what the framework leaves out; an absence is a finding about the framework, not a gap in your program.
2What usually proves it
Code of conduct, affirmation records, disciplinary process.
?Why it exists
Culture is what people affirm and what leadership enforces.
For a smaller organizationSigned on joining, re-affirmed each year at review time.