Framework Adoption Guide (Layers L01 to L03)

Layers L01 Business & Use Cases, L02 Governance & Risk Mgmt and L03 Legal, Privacy & Compliance are written to be framework-neutral. They test whether a platform can support a requirement, not which clause of which framework creates it, so the same cases can be used for an ISO/IEC 27001 information security management system, India's DPDP Act, UAE NESA and information assurance requirements, the UAE PDPL, or any other framework.

How to adopt the cases for a framework

Choose the framework or frameworks in scope. Record their names, versions and the dates of the version in force.
Before testing each case, complete the Applicable Requirement field: the framework and clause, the requirement text, and any numeric parameter the case refers to (response timelines, notification periods, retention periods, review intervals, thresholds). The test steps refer to 'the timeline set by the assessor' so that no framework-specific figure is hard-coded in the library.
After testing, complete the Framework Crosswalk row for each case, or complete the crosswalk template below once per control theme and let the cases inherit it.
Where two frameworks set different parameters for the same case, run the case once and record the stricter parameter, or run it twice with each parameter set.
Do not rely on this library for clause numbers, deadlines or legal conclusions. Obtain those from the framework text and from legal counsel.

Reviewer cautions

Control themes are groupings for convenience, not legal categories. Different frameworks place the same topic under different headings.
NIST AI RMF mappings are at function level only. Subcategory references are left to the assessor.
Numeric thresholds (detection rates, counts, times) are starting values to tune. Time limits tied to law or regulation are deliberately left blank.
Cases marked Evidence rely on live-product inspection; documentation alone scores no higher than 3. Cases marked Attestation rely on vendor written statements and score below demonstrated evidence.
Vendor applicability uses code W for governance, risk and compliance workflow capability. A vendor without such a workflow should be scored N/A on W-only cases, and the buyer should note which tool covers the gap.

Crosswalk template

Complete once per adoption. Leave a cell blank where the framework has no corresponding requirement. Enter references exactly as they appear in the framework text.

Code	Control theme	Cases	Other
GOV	Governance and accountability	15
RSK	Risk management	9
POL	Policy and standards	2
INV	Inventory and classification	4
PRV	Privacy and data protection principles	9
OVS	Human oversight and transparency	11	, TC-L03-040, TC-L03-041
XBT	Cross-border transfer, residency and jurisdiction	4
RET	Retention, deletion and preservation	3
VND	Third-party and supplier management	4	, TC-L03-042
INC	Incident and breach management	1
AUD	Audit, evidence and assurance	14
TRN	Training and awareness	3
CHG	Change and lifecycle management	3
BCP	Resilience and continuity	2

Case index by control theme

Code	Control theme	Cases
GOV	Governance and accountability	TC-L01-002, TC-L01-003, TC-L01-006, TC-L01-014, TC-L01-020, TC-L02-004, TC-L02-005, TC-L02-010, TC-L02-011, TC-L02-012, TC-L02-019, TC-L02-020, TC-L02-024, TC-L03-028, TC-L03-039
RSK	Risk management	TC-L01-005, TC-L01-016, TC-L02-006, TC-L02-007, TC-L02-008, TC-L02-009, TC-L03-010, TC-L03-011, TC-L03-034
POL	Policy and standards	TC-L02-001, TC-L02-002
INV	Inventory and classification	TC-L01-001, TC-L01-004, TC-L01-008, TC-L03-037
PRV	Privacy and data protection principles	TC-L01-007, TC-L03-001, TC-L03-002, TC-L03-004, TC-L03-005, TC-L03-006, TC-L03-015, TC-L03-017, TC-L03-018
OVS	Human oversight and transparency	TC-L01-010, TC-L01-011, TC-L01-012, TC-L03-003, TC-L03-008, TC-L03-029, TC-L03-031, TC-L03-032, TC-L03-033, TC-L03-035, TC-L03-036
XBT	Cross-border transfer, residency and jurisdiction	TC-L03-012, TC-L03-013, TC-L03-014, TC-L03-030
RET	Retention, deletion and preservation	TC-L03-007, TC-L03-016, TC-L03-027
VND	Third-party and supplier management	TC-L01-017, TC-L02-021, TC-L03-020, TC-L03-021
INC	Incident and breach management	TC-L03-019
AUD	Audit, evidence and assurance	TC-L02-003, TC-L02-013, TC-L02-014, TC-L02-015, TC-L02-016, TC-L02-017, TC-L02-018, TC-L02-025, TC-L03-009, TC-L03-022, TC-L03-023, TC-L03-024, TC-L03-025, TC-L03-026
TRN	Training and awareness	TC-L02-022, TC-L02-023, TC-L03-038
CHG	Change and lifecycle management	TC-L01-013, TC-L01-015, TC-L01-019
BCP	Resilience and continuity	TC-L01-009, TC-L01-018

Regional instruments by control theme

The regional compliance sections list laws, policies and guidance for the GCC, the EU and ten countries. This table groups those instruments by control theme, so that the cases in the index above can be run against them. Each ID is a row in the region's crosswalk, which gives the instrument's name and verification status. The GCC and EU crosswalks state the themes for each row. For the other regions the themes are derived from the controls on the row, so check them when you complete the crosswalk template. No instrument listed here has been verified against primary legal text.

Code	Control theme	Instruments by region
GOV	Governance and accountability	GCC: U3, U5, U9, S4, Q3, Q4, B2, O1; EU: E1, E1a, E17, E18; Australia: AU1, AU4, AU7; Brazil: BR3; Canada: CA5, CA8; China: CN1, CN5; India: IN4; Japan: JP1, JP2, JP3; Singapore: SG1, SG5; South Korea: KR5, KR6; UK: UK1, UK5; US: US9, US12
RSK	Risk management	GCC: U6, S5, Q4, O1; EU: E1, E1c, E8, E17; Australia: AU4; Brazil: BR1; Canada: CA4, CA6; China: CN5; India: IN5, IN6; Japan: JP3, JP6; Singapore: SG1, SG2, SG5; South Korea: KR3, KR4; UK: UK5, UK6; US: US5, US8, US12
POL	Policy and standards	GCC: U3, U4, U8, U12, S2, S3, S9, Q3, B2; EU: E1, E1a, E1e, E11, E12; Australia: AU1, AU4, AU7; Brazil: BR3; Canada: CA5, CA8; China: CN1, CN5; India: IN4; Japan: JP1, JP2, JP3, JP5; Singapore: SG1; South Korea: KR5, KR6; UK: UK1, UK5, UK8; US: US6, US9, US12
INV	Inventory and classification	GCC: U9, S5, Q4, O1; EU: E1, E14; Brazil: BR1; Canada: CA4, CA6; China: CN2; India: IN5, IN6, IN7, IN8; Singapore: SG5; UK: UK6, UK11; US: US6
PRV	Privacy and data protection principles	GCC: U1, U6, U7, S1, Q1, B1, O2; EU: E1c, E2, E3, E4; Australia: AU2, AU3, AU3a; Brazil: BR2, BR3; Canada: CA2, CA3, CA7; China: CN1, CN2, CN7, CN9; India: IN1, IN2, IN3, IN11; Japan: JP4; Singapore: SG4, SG5; South Korea: KR7; UK: UK2, UK3, UK4; US: US5, US8, US9
OVS	Human oversight and transparency	GCC: U3, U4, U6, U9, S2, S3, Q3, Q4, B2; EU: E1, E1c, E1d, E10, E16; Australia: AU2, AU4, AU6; Brazil: BR1, BR4; Canada: CA3, CA4, CA5, CA7; China: CN1, CN2, CN3, CN4, CN5, CN6; India: IN4, IN5, IN9; Japan: JP3; Singapore: SG1, SG2, SG3, SG5, SG6, SG7; South Korea: KR2, KR3; UK: UK1, UK3, UK4, UK5, UK7, UK11, UK12; US: US5, US7, US8, US10, US11, US12
XBT	Cross-border transfer, residency and jurisdiction	GCC: U1, U7, S1, S10, Q1, B1; EU: E2, E9; Brazil: BR2; Canada: CA2; China: CN7; India: IN1, IN2; Japan: JP4; Singapore: SG4; South Korea: KR7; UK: UK2
RET	Retention, deletion and preservation	GCC: U1, S1, Q1, B1, O2; EU: E2; Brazil: BR2; India: IN1; Singapore: SG4; UK: UK2
VND	Third-party and supplier management	GCC: U9, S8, Q2, B4; EU: E1e, E5, E6, E9, E13, E15; Australia: AU8; Brazil: BR4; India: IN5, IN7; Japan: JP6; Singapore: SG5
INC	Incident and breach management	GCC: U1, U2, S1, S6, Q1, Q2, B1; EU: E1, E1c, E2, E5, E6, E7; Australia: AU3, AU3a, AU8; Brazil: BR2; Canada: CA2; China: CN7; India: IN1, IN2, IN3, IN10; Japan: JP4; Singapore: SG5, SG8; South Korea: KR7; UK: UK2
AUD	Audit, evidence and assurance	GCC: U5, U8, U11, U12, S6, S7, S8, Q2, O1; EU: E1, E1c, E7, E17, E18; Australia: AU8; Canada: CA6; China: CN7; India: IN6, IN7, IN8, IN10, IN11; Singapore: SG2, SG3, SG5, SG7, SG8; South Korea: KR4; UK: UK6, UK10; US: US3, US6
TRN	Training and awareness	GCC: U3, S2, Q3, O1; EU: E1b; Singapore: SG5
CHG	Change and lifecycle management	GCC: U6, S5, Q4, O1; EU: E1, E1c; Singapore: SG5
BCP	Resilience and continuity	GCC: U8, U11, S6, S8, Q2; EU: E5, E6