Compliance Mapping

Regulatory Anchors

• 45 CFR —164.530 — Workforce training & documentation requirements
• 45 CFR —164.308(a)(5) — Security awareness and training

What We Provide

• Policy version history with effective dates
• Workforce training documentation
• Attestation tracking (who acknowledged which version)
• Date-range evidence export for audits

?? What We Do NOT Provide

Does not replace BAAs, DLP systems, breach response programs, or HIPAA compliance software.

Regulatory Anchors

• FINRA Rule 3110 — Supervision and written supervisory procedures
• GLBA Safeguards Rule — Administrative safeguards requirements
• SEC compliance program expectations — Training & policy documentation

What We Provide

• Written AI policy documentation
• Training completion records
• Employee acknowledgment logs
• Supervisory review evidence

?? What We Do NOT Provide

Does not replace communication archiving, surveillance systems, or model risk validation programs.

Framework Requirements

• SOC 2 Trust Services Criteria — Security awareness and control documentation
• ISO 27001 Annex A — Information security awareness & training controls
• Communication of security responsibilities
• Control evidence retention

What We Provide

• AI policy version control
• Training completion tracking
• Attestation documentation
• Control evidence for auditor review

?? What We Do NOT Provide

We are not a certification body and do not issue SOC 2 or ISO certifications.