{
  "schema": "compliance-crosswalk/v1",
  "tool": "roigen",
  "frameworks": [
    {
      "id": "DORA",
      "name": "Digital Operational Resilience Act (Reg. 2022/2554)",
      "controls": [
        { "ref": "Art. 28", "name": "General principles — ICT third-party risk", "how": "Register of Information is the machine-readable inventory of every ICT third-party provider.", "coverage": "evidences" },
        { "ref": "Art. 29", "name": "Preliminary assessment of ICT concentration risk", "how": "RT.02.01 provider table + RT.05.01 sub-outsourcing chain feed the concentration-risk analysis.", "coverage": "evidences" },
        { "ref": "Art. 30", "name": "Key contractual provisions", "how": "RT.03.01 contract table records the mandatory Art. 30 elements per relationship.", "coverage": "evidences" }
      ]
    },
    {
      "id": "ITS-2024-2956",
      "name": "Implementing Technical Standard on Register of Information",
      "controls": [
        { "ref": "RT.01.01", "name": "Maintaining entity",              "how": "Table generated verbatim.", "coverage": "evidences" },
        { "ref": "RT.02.01", "name": "ICT third-party service providers","how": "Table generated verbatim.", "coverage": "evidences" },
        { "ref": "RT.03.01", "name": "Contractual arrangements",        "how": "Table generated verbatim.", "coverage": "evidences" },
        { "ref": "RT.04.01", "name": "Functions supported",             "how": "Table generated verbatim.", "coverage": "evidences" },
        { "ref": "RT.05.01", "name": "Sub-outsourcing chain",           "how": "Table generated verbatim.", "coverage": "evidences" }
      ]
    }
  ]
}