OBL-01 · Obligations and Compliance
Obligation inventory
Legal, regulatory and contractual obligations that apply are identified, owned and kept current.
4frameworks fully address it
4partially
0leave it out
SOC 2 ISO 27001 NIST CSF PCI DSS HIPAA GDPR EU AI Act NIST AI RMF
1Where each framework asks for it
- SOC 2FullCC2.3
- ISO 27001FullA.5.31
- NIST CSFFullGV.OC-03
- PCI DSSPartial12.1 Scoped to PCI DSS obligations.
- HIPAAPartial164.316 Documentation duty rather than an inventory.
- GDPRPartialArt. 30 Records of processing rather than obligations.
- EU AI ActPartialArt. 16 Provider obligations are enumerated by the Act itself.
- NIST AI RMFFullGOVERN 1.1
Build the control once against this objective and cite the clause each auditor asks about. A partial mapping says what the framework leaves out; an absence is a finding about the framework, not a gap in your program.
2What usually proves it
Obligation register with source, owner and evidence link.
?Why it exists
You cannot meet an obligation you have not written down.
For a smaller organizationOne register, reviewed when a contract or law changes.