17% of IAIS Insurance Core Principles (ICPs) you already have
NIST Cybersecurity Framework 2.0 already covers about 17% of IAIS Insurance Core Principles (ICPs), leaving
39 of 47 controls as genuinely new work.
Already covered 4
Likely covered 4
New work 39
What is genuinely new work
Nothing in NIST Cybersecurity Framework 2.0 reaches these. This is the list to scope.
ICP-10Preventive Measures, Corrective Measures and Sanctions
ICP-12Exit from the Market and Resolution
ICP-19Conduct of Business
ICP-21Countering Fraud in Insurance
ICP-22Anti-Money Laundering and Combating the Financing of Terrorism
ICP-23Group-wide Supervision
ICP-3Information Sharing and Confidentiality Requirements
ICP-5Suitability of Persons
ICP-6Changes in Control and Portfolio Transfers
ICP-7Corporate Governance
ICP-9Supervisory Review and Reporting
ICP1Objectives, Powers and Responsibilities of the Supervisor
ICP10Preventive Measures, Corrective Measures and Sanctions
ICP12Exit from the Market and Resolution
ICP13Reinsurance and Other Forms of Risk Transfer
ICP16Enterprise Risk Management and ORSA
ICP2Supervisor Independence and Resources
ICP21Countering Fraud in Insurance
ICP22Anti Money Laundering and Combating the Financing of Terrorism
ICP23Group Wide Supervision
ICP24Macroprudential Supervision
ICP3Information Exchange and Confidentiality
ICP5Suitability of Persons
ICP6Changes in Control and Portfolio Transfers
ICP8Risk Management and Internal Controls
ICP9Supervisory Review and Reporting
Show the 8 you already have
ICP-1Objectives, Powers and Responsibilities of the Supervisor
ICP-16Enterprise Risk Management for Solvency Purposes
ICP-24Macroprudential Surveillance and Insurance Supervision
ICP-8Risk Management and Internal Controls
ICP-13Reinsurance and Other Forms of Risk Transfer
ICP-25Supervisory Cooperation and Coordination
How this is calculated
Already covered means a mapping runs from a control in NIST Cybersecurity Framework 2.0 to that control. Likely
covered means no direct mapping exists but both frameworks map to the same control in a third
standard. New work means neither. We keep those separate rather than adding them into one
friendlier number, because blending them would present a two-hop inference as a verified
fact.
Coverage is not symmetric.
Run it the other way and you will get a
different number; both are correct.
From 332,959 cross-framework control
mappings across 723 frameworks, 531 of them verified against
their source documents. It does not tell you that you are compliant: a mapped control means
the two standards ask for the same thing, not that you have done it.
Try another pair ยท
Today's edition