OBL-02 · Obligations and Compliance
Scope decided and documented
What is in scope for each framework or certification is decided, justified and recorded, including deliberate exclusions.
5frameworks fully address it
3partially
0leave it out
SOC 2 ISO 27001 NIST CSF PCI DSS HIPAA GDPR EU AI Act NIST AI RMF
1Where each framework asks for it
- SOC 2FullCC1.5
- ISO 27001Full4.3
- NIST CSFFullGV.OC-04
- PCI DSSFull12.5.2
- HIPAAPartial164.306(a) Scope follows ePHI wherever it exists.
- GDPRPartialArt. 3 Territorial scope is set by law, not chosen.
- EU AI ActPartialArt. 6 Scope follows the risk classification of the system.
- NIST AI RMFFullMAP 1.1
Build the control once against this objective and cite the clause each auditor asks about. A partial mapping says what the framework leaves out; an absence is a finding about the framework, not a gap in your program.
2What usually proves it
Scope statement, exclusion justifications, reopening triggers.
?Why it exists
Undecided scope expands until the team drowns.
For a smaller organizationOne product, one cloud, written down in a page.