← Back to tracker
CHG26-VEND-EXCEPTION-043
Extended
Requested item
Control topic
Evidence link
Date requested
Domain
—
GOV — Governance
AC — Access Control
CHG — Change Management
OPS — Operations
SEC — Security
VM — Vulnerability Management
IR — Incident Response
BCP — Business Continuity
DR — Disaster Recovery
VEND — Third-Party Risk
PRIV — Privacy
AI — Artificial Intelligence
DATA — Data Management
APP — Application Controls
INF — Infrastructure
CLOUD — Cloud Controls
Pattern
—
DOC — Policies / Procedures / Standards
RACI — Roles and Responsibilities
TRAIN — Training Evidence
LIST — System-Generated Population Listing
INVENT — Asset or Account Inventory
CONFIG — Configuration Population
APPROVAL — Access / Change Approval Evidence
EXCEPTION — Exception, Waiver, or Risk Acceptance
REVIEW — Periodic Review Evidence
ATTEST — Management Attestation / Certification
MONITOR — Monitoring Activities
CHANGE — Change Population
RELEASE — Release and Deployment Evidence
SAMPLE — Sample Selection Evidence
TRAN — Transaction Support Evidence
LOG — Logs / Monitoring Evidence
ARCH — Architecture / Diagrams
DATAFLOW — Data Flow Evidence
CONFIGTEST — Configuration Validation Evidence
TEST — Testing Evidence
PERF — Reperformance Evidence
ASSESS — Assessment Results
INCIDENT — Incident Evidence
TICKET — Workflow / Ticket Evidence
REMED — Remediation / Issue Tracking
ISSUE — Issue Management Evidence
SOC — Independent Assurance Reports
CONTRACT — Contractual Documentation
Auditor
—
Test Admin
Val Viewer
Morgan Manager
IA comments
Save