{
    "profile": {
        "uuid": "5babcd77-6d33-4087-aa4e-bf48c4ae67bd",
        "name": "CRI Profile v2.2 — Supply Chain",
        "confidentiality": "Moderate",
        "integrity": "High",
        "availability": "Moderate",
        "category": "High",
        "isPublic": true
    },
    "mappings": [
        {
            "profileMappingId": 0,
            "controlId": 0,
            "controlIdentifier": "GV.OC-04.04",
            "controlGuid": "9f66739a-312c-448a-9c33-d8974c0aa326",
            "controlTitle": "GV.OC-04.04 - Resilience prioritization",
            "catalogId": 0,
            "catalogGuid": "f506e4c5-074c-4556-90ad-caefd610fa2a",
            "catalogTitle": "CRI Profile v2.2",
            "catalogUrl": "https://cyberriskinstitute.org/the-profile/"
        },
        {
            "profileMappingId": 0,
            "controlId": 0,
            "controlIdentifier": "GV.OC-05.01",
            "controlGuid": "3c1a93dd-c4d3-4393-a449-5a8d95c2fb94",
            "controlTitle": "GV.OC-05.01 - Critical service dependencies",
            "catalogId": 0,
            "catalogGuid": "f506e4c5-074c-4556-90ad-caefd610fa2a",
            "catalogTitle": "CRI Profile v2.2",
            "catalogUrl": "https://cyberriskinstitute.org/the-profile/"
        },
        {
            "profileMappingId": 0,
            "controlId": 0,
            "controlIdentifier": "GV.OC-05.02",
            "controlGuid": "ba8b8f2c-1759-4c73-821e-a06cbeb6ca5c",
            "controlTitle": "GV.OC-05.02 - External dependency prioritization",
            "catalogId": 0,
            "catalogGuid": "f506e4c5-074c-4556-90ad-caefd610fa2a",
            "catalogTitle": "CRI Profile v2.2",
            "catalogUrl": "https://cyberriskinstitute.org/the-profile/"
        },
        {
            "profileMappingId": 0,
            "controlId": 0,
            "controlIdentifier": "GV.RM-01.05",
            "controlGuid": "2e8cd6ce-d8c9-40ea-9451-da496ef86df0",
            "controlTitle": "GV.RM-01.05 - Risk management program alignment",
            "catalogId": 0,
            "catalogGuid": "f506e4c5-074c-4556-90ad-caefd610fa2a",
            "catalogTitle": "CRI Profile v2.2",
            "catalogUrl": "https://cyberriskinstitute.org/the-profile/"
        },
        {
            "profileMappingId": 0,
            "controlId": 0,
            "controlIdentifier": "GV.RM-03.04",
            "controlGuid": "ec2b992d-78d0-4162-a756-6d13cbff411c",
            "controlTitle": "GV.RM-03.04 - Daily operations risk consideration",
            "catalogId": 0,
            "catalogGuid": "f506e4c5-074c-4556-90ad-caefd610fa2a",
            "catalogTitle": "CRI Profile v2.2",
            "catalogUrl": "https://cyberriskinstitute.org/the-profile/"
        },
        {
            "profileMappingId": 0,
            "controlId": 0,
            "controlIdentifier": "GV.RM-05.02",
            "controlGuid": "31fafe95-c431-437a-ba5d-7d17817875e0",
            "controlTitle": "GV.RM-05.02 - Third-party incident coordination",
            "catalogId": 0,
            "catalogGuid": "f506e4c5-074c-4556-90ad-caefd610fa2a",
            "catalogTitle": "CRI Profile v2.2",
            "catalogUrl": "https://cyberriskinstitute.org/the-profile/"
        },
        {
            "profileMappingId": 0,
            "controlId": 0,
            "controlIdentifier": "GV.RM-08.04",
            "controlGuid": "ef2f3632-91d1-4f4c-9452-328351a290ff",
            "controlTitle": "GV.RM-08.04 - Technology architecture governance",
            "catalogId": 0,
            "catalogGuid": "f506e4c5-074c-4556-90ad-caefd610fa2a",
            "catalogTitle": "CRI Profile v2.2",
            "catalogUrl": "https://cyberriskinstitute.org/the-profile/"
        },
        {
            "profileMappingId": 0,
            "controlId": 0,
            "controlIdentifier": "GV.RR-01.02",
            "controlGuid": "59fd4edd-9484-4b4e-8619-30f704257029",
            "controlTitle": "GV.RR-01.02 - Third-party risk management accountability",
            "catalogId": 0,
            "catalogGuid": "f506e4c5-074c-4556-90ad-caefd610fa2a",
            "catalogTitle": "CRI Profile v2.2",
            "catalogUrl": "https://cyberriskinstitute.org/the-profile/"
        },
        {
            "profileMappingId": 0,
            "controlId": 0,
            "controlIdentifier": "GV.RR-02.01",
            "controlGuid": "dedb4060-05d5-4e9c-a237-bdba7acfd701",
            "controlTitle": "GV.RR-02.01 - Cybersecurity roles and responsibilities",
            "catalogId": 0,
            "catalogGuid": "f506e4c5-074c-4556-90ad-caefd610fa2a",
            "catalogTitle": "CRI Profile v2.2",
            "catalogUrl": "https://cyberriskinstitute.org/the-profile/"
        },
        {
            "profileMappingId": 0,
            "controlId": 0,
            "controlIdentifier": "GV.RR-02.04",
            "controlGuid": "7bb63f6d-7782-4dd8-a652-c357bd694fcf",
            "controlTitle": "GV.RR-02.04 - Third-party risk management roles and responsibilities",
            "catalogId": 0,
            "catalogGuid": "f506e4c5-074c-4556-90ad-caefd610fa2a",
            "catalogTitle": "CRI Profile v2.2",
            "catalogUrl": "https://cyberriskinstitute.org/the-profile/"
        },
        {
            "profileMappingId": 0,
            "controlId": 0,
            "controlIdentifier": "GV.RR-02.05",
            "controlGuid": "fc847802-8aa2-49f8-bda3-d935ec589f47",
            "controlTitle": "GV.RR-02.05 - Physical security roles and responsibilities",
            "catalogId": 0,
            "catalogGuid": "f506e4c5-074c-4556-90ad-caefd610fa2a",
            "catalogTitle": "CRI Profile v2.2",
            "catalogUrl": "https://cyberriskinstitute.org/the-profile/"
        },
        {
            "profileMappingId": 0,
            "controlId": 0,
            "controlIdentifier": "GV.RR-04.01",
            "controlGuid": "474a6838-7bc1-418a-bb41-accc62e93066",
            "controlTitle": "GV.RR-04.01 - Background checks",
            "catalogId": 0,
            "catalogGuid": "f506e4c5-074c-4556-90ad-caefd610fa2a",
            "catalogTitle": "CRI Profile v2.2",
            "catalogUrl": "https://cyberriskinstitute.org/the-profile/"
        },
        {
            "profileMappingId": 0,
            "controlId": 0,
            "controlIdentifier": "GV.RR-04.03",
            "controlGuid": "5871bab0-03a4-4966-828d-61beb1043453",
            "controlTitle": "GV.RR-04.03 - Insider threat management",
            "catalogId": 0,
            "catalogGuid": "f506e4c5-074c-4556-90ad-caefd610fa2a",
            "catalogTitle": "CRI Profile v2.2",
            "catalogUrl": "https://cyberriskinstitute.org/the-profile/"
        },
        {
            "profileMappingId": 0,
            "controlId": 0,
            "controlIdentifier": "GV.PO-01.04",
            "controlGuid": "2f66a468-86c3-4f4a-97bd-4ce625aaff89",
            "controlTitle": "GV.PO-01.04 - Acceptable use policies",
            "catalogId": 0,
            "catalogGuid": "f506e4c5-074c-4556-90ad-caefd610fa2a",
            "catalogTitle": "CRI Profile v2.2",
            "catalogUrl": "https://cyberriskinstitute.org/the-profile/"
        },
        {
            "profileMappingId": 0,
            "controlId": 0,
            "controlIdentifier": "GV.PO-01.08",
            "controlGuid": "c191dfdb-09a6-44f7-810e-3e8a238bd194",
            "controlTitle": "GV.PO-01.08 - Third-party risk management policies",
            "catalogId": 0,
            "catalogGuid": "f506e4c5-074c-4556-90ad-caefd610fa2a",
            "catalogTitle": "CRI Profile v2.2",
            "catalogUrl": "https://cyberriskinstitute.org/the-profile/"
        },
        {
            "profileMappingId": 0,
            "controlId": 0,
            "controlIdentifier": "GV.SC-01.01",
            "controlGuid": "6be430ed-113f-46cd-a737-a5538307c026",
            "controlTitle": "GV.SC-01.01 - Third-party risk management strategy and program",
            "catalogId": 0,
            "catalogGuid": "f506e4c5-074c-4556-90ad-caefd610fa2a",
            "catalogTitle": "CRI Profile v2.2",
            "catalogUrl": "https://cyberriskinstitute.org/the-profile/"
        },
        {
            "profileMappingId": 0,
            "controlId": 0,
            "controlIdentifier": "GV.SC-01.02",
            "controlGuid": "9d6489ea-fe24-490f-832a-0a7139f729cf",
            "controlTitle": "GV.SC-01.02 - Aggregate third-party risk",
            "catalogId": 0,
            "catalogGuid": "f506e4c5-074c-4556-90ad-caefd610fa2a",
            "catalogTitle": "CRI Profile v2.2",
            "catalogUrl": "https://cyberriskinstitute.org/the-profile/"
        },
        {
            "profileMappingId": 0,
            "controlId": 0,
            "controlIdentifier": "GV.SC-02.01",
            "controlGuid": "ea63eade-34ca-4db2-9034-b506429c5acf",
            "controlTitle": "GV.SC-02.01 - Designated organization and third-party responsibilities",
            "catalogId": 0,
            "catalogGuid": "f506e4c5-074c-4556-90ad-caefd610fa2a",
            "catalogTitle": "CRI Profile v2.2",
            "catalogUrl": "https://cyberriskinstitute.org/the-profile/"
        },
        {
            "profileMappingId": 0,
            "controlId": 0,
            "controlIdentifier": "GV.SC-03.01",
            "controlGuid": "bfb1344a-c773-45a2-bc3e-f4b7102b280f",
            "controlTitle": "GV.SC-03.01 - Third-party risk management alignment",
            "catalogId": 0,
            "catalogGuid": "f506e4c5-074c-4556-90ad-caefd610fa2a",
            "catalogTitle": "CRI Profile v2.2",
            "catalogUrl": "https://cyberriskinstitute.org/the-profile/"
        },
        {
            "profileMappingId": 0,
            "controlId": 0,
            "controlIdentifier": "GV.SC-04.01",
            "controlGuid": "329abf0a-78a8-4bd3-b2f6-8d8a88868373",
            "controlTitle": "GV.SC-04.01 - Third-party inventory and risk-ranking",
            "catalogId": 0,
            "catalogGuid": "f506e4c5-074c-4556-90ad-caefd610fa2a",
            "catalogTitle": "CRI Profile v2.2",
            "catalogUrl": "https://cyberriskinstitute.org/the-profile/"
        },
        {
            "profileMappingId": 0,
            "controlId": 0,
            "controlIdentifier": "GV.SC-08.01",
            "controlGuid": "8e16617a-6ca4-4e8b-a65e-88f2be19c1f5",
            "controlTitle": "GV.SC-08.01 - Resilience program and external dependencies",
            "catalogId": 0,
            "catalogGuid": "f506e4c5-074c-4556-90ad-caefd610fa2a",
            "catalogTitle": "CRI Profile v2.2",
            "catalogUrl": "https://cyberriskinstitute.org/the-profile/"
        },
        {
            "profileMappingId": 0,
            "controlId": 0,
            "controlIdentifier": "GV.SC-09.01",
            "controlGuid": "f9a45f5e-7fed-4a51-adc7-181f18bbf85f",
            "controlTitle": "GV.SC-09.01 - Third-party dependence consideration",
            "catalogId": 0,
            "catalogGuid": "f506e4c5-074c-4556-90ad-caefd610fa2a",
            "catalogTitle": "CRI Profile v2.2",
            "catalogUrl": "https://cyberriskinstitute.org/the-profile/"
        },
        {
            "profileMappingId": 0,
            "controlId": 0,
            "controlIdentifier": "GV.AU-01.04",
            "controlGuid": "ded4d622-56eb-4a14-b629-d3a88e4739ae",
            "controlTitle": "GV.AU-01.04 - Independent audit third-party risk management program evaluation",
            "catalogId": 0,
            "catalogGuid": "f506e4c5-074c-4556-90ad-caefd610fa2a",
            "catalogTitle": "CRI Profile v2.2",
            "catalogUrl": "https://cyberriskinstitute.org/the-profile/"
        },
        {
            "profileMappingId": 0,
            "controlId": 0,
            "controlIdentifier": "ID.AM-03.01",
            "controlGuid": "d5f11675-f9ec-48d7-b4db-dfefd662312b",
            "controlTitle": "ID.AM-03.01 - Network diagrams",
            "catalogId": 0,
            "catalogGuid": "f506e4c5-074c-4556-90ad-caefd610fa2a",
            "catalogTitle": "CRI Profile v2.2",
            "catalogUrl": "https://cyberriskinstitute.org/the-profile/"
        },
        {
            "profileMappingId": 0,
            "controlId": 0,
            "controlIdentifier": "ID.AM-04.01",
            "controlGuid": "4dce95d4-f44c-4125-bf7e-869c30507ee9",
            "controlTitle": "ID.AM-04.01 - Third-party location asset inventory",
            "catalogId": 0,
            "catalogGuid": "f506e4c5-074c-4556-90ad-caefd610fa2a",
            "catalogTitle": "CRI Profile v2.2",
            "catalogUrl": "https://cyberriskinstitute.org/the-profile/"
        },
        {
            "profileMappingId": 0,
            "controlId": 0,
            "controlIdentifier": "ID.AM-07.01",
            "controlGuid": "ee050c64-33b4-4af1-a013-0363d6e843a9",
            "controlTitle": "ID.AM-07.01 - Data inventory",
            "catalogId": 0,
            "catalogGuid": "f506e4c5-074c-4556-90ad-caefd610fa2a",
            "catalogTitle": "CRI Profile v2.2",
            "catalogUrl": "https://cyberriskinstitute.org/the-profile/"
        },
        {
            "profileMappingId": 0,
            "controlId": 0,
            "controlIdentifier": "ID.AM-08.06",
            "controlGuid": "e35a0a3a-17fa-4c57-a8ab-54e56cd66865",
            "controlTitle": "ID.AM-08.06 - Third-party data risk coverage",
            "catalogId": 0,
            "catalogGuid": "f506e4c5-074c-4556-90ad-caefd610fa2a",
            "catalogTitle": "CRI Profile v2.2",
            "catalogUrl": "https://cyberriskinstitute.org/the-profile/"
        },
        {
            "profileMappingId": 0,
            "controlId": 0,
            "controlIdentifier": "ID.RA-02.02",
            "controlGuid": "9dad72f7-8208-4fa6-92f1-3c546084682b",
            "controlTitle": "ID.RA-02.02 - Security information sharing",
            "catalogId": 0,
            "catalogGuid": "f506e4c5-074c-4556-90ad-caefd610fa2a",
            "catalogTitle": "CRI Profile v2.2",
            "catalogUrl": "https://cyberriskinstitute.org/the-profile/"
        },
        {
            "profileMappingId": 0,
            "controlId": 0,
            "controlIdentifier": "ID.RA-03.01",
            "controlGuid": "d90368b6-54f8-4c86-ad31-a2335a6f5533",
            "controlTitle": "ID.RA-03.01 - Threat identification and analysis",
            "catalogId": 0,
            "catalogGuid": "f506e4c5-074c-4556-90ad-caefd610fa2a",
            "catalogTitle": "CRI Profile v2.2",
            "catalogUrl": "https://cyberriskinstitute.org/the-profile/"
        },
        {
            "profileMappingId": 0,
            "controlId": 0,
            "controlIdentifier": "ID.RA-08.01",
            "controlGuid": "4f13b6da-ec00-4253-9332-6e852bc61b0b",
            "controlTitle": "ID.RA-08.01 - Vulnerability disclosure receipt",
            "catalogId": 0,
            "catalogGuid": "f506e4c5-074c-4556-90ad-caefd610fa2a",
            "catalogTitle": "CRI Profile v2.2",
            "catalogUrl": "https://cyberriskinstitute.org/the-profile/"
        },
        {
            "profileMappingId": 0,
            "controlId": 0,
            "controlIdentifier": "ID.IM-01.05",
            "controlGuid": "5fff1b86-b949-4ac1-aea2-e14ddf658dce",
            "controlTitle": "ID.IM-01.05 - Third-party risk management program assessment",
            "catalogId": 0,
            "catalogGuid": "f506e4c5-074c-4556-90ad-caefd610fa2a",
            "catalogTitle": "CRI Profile v2.2",
            "catalogUrl": "https://cyberriskinstitute.org/the-profile/"
        },
        {
            "profileMappingId": 0,
            "controlId": 0,
            "controlIdentifier": "ID.IM-02.03",
            "controlGuid": "e7f95314-bf35-458f-a3e3-ed7b4e5ebb34",
            "controlTitle": "ID.IM-02.03 - Incident management effectiveness testing",
            "catalogId": 0,
            "catalogGuid": "f506e4c5-074c-4556-90ad-caefd610fa2a",
            "catalogTitle": "CRI Profile v2.2",
            "catalogUrl": "https://cyberriskinstitute.org/the-profile/"
        },
        {
            "profileMappingId": 0,
            "controlId": 0,
            "controlIdentifier": "ID.IM-02.04",
            "controlGuid": "f188a5cb-351f-447b-8de0-2d32ff7549e3",
            "controlTitle": "ID.IM-02.04 - Resilience strategy and plan testing",
            "catalogId": 0,
            "catalogGuid": "f506e4c5-074c-4556-90ad-caefd610fa2a",
            "catalogTitle": "CRI Profile v2.2",
            "catalogUrl": "https://cyberriskinstitute.org/the-profile/"
        },
        {
            "profileMappingId": 0,
            "controlId": 0,
            "controlIdentifier": "ID.IM-02.05",
            "controlGuid": "bea6132d-4f8f-4b23-9872-cd38a1d4a1ad",
            "controlTitle": "ID.IM-02.05 - Resilience testing scenarios",
            "catalogId": 0,
            "catalogGuid": "f506e4c5-074c-4556-90ad-caefd610fa2a",
            "catalogTitle": "CRI Profile v2.2",
            "catalogUrl": "https://cyberriskinstitute.org/the-profile/"
        },
        {
            "profileMappingId": 0,
            "controlId": 0,
            "controlIdentifier": "ID.IM-02.08",
            "controlGuid": "f85bb175-24eb-4617-a6fe-e49a311101f5",
            "controlTitle": "ID.IM-02.08 - Sector resilience testing",
            "catalogId": 0,
            "catalogGuid": "f506e4c5-074c-4556-90ad-caefd610fa2a",
            "catalogTitle": "CRI Profile v2.2",
            "catalogUrl": "https://cyberriskinstitute.org/the-profile/"
        },
        {
            "profileMappingId": 0,
            "controlId": 0,
            "controlIdentifier": "ID.IM-04.05",
            "controlGuid": "1b9b24bd-1926-4f83-8f62-48e536ce0d54",
            "controlTitle": "ID.IM-04.05 - Long term loss contingency planning",
            "catalogId": 0,
            "catalogGuid": "f506e4c5-074c-4556-90ad-caefd610fa2a",
            "catalogTitle": "CRI Profile v2.2",
            "catalogUrl": "https://cyberriskinstitute.org/the-profile/"
        },
        {
            "profileMappingId": 0,
            "controlId": 0,
            "controlIdentifier": "ID.IM-04.06",
            "controlGuid": "5211773e-4861-4290-9e87-f7b97c7966f9",
            "controlTitle": "ID.IM-04.06 - Interconnected partner risk mitigation",
            "catalogId": 0,
            "catalogGuid": "f506e4c5-074c-4556-90ad-caefd610fa2a",
            "catalogTitle": "CRI Profile v2.2",
            "catalogUrl": "https://cyberriskinstitute.org/the-profile/"
        },
        {
            "profileMappingId": 0,
            "controlId": 0,
            "controlIdentifier": "ID.IM-04.07",
            "controlGuid": "41487a41-b59a-42ca-a3e4-bf53f03f7573",
            "controlTitle": "ID.IM-04.07 - Incident management support resources",
            "catalogId": 0,
            "catalogGuid": "f506e4c5-074c-4556-90ad-caefd610fa2a",
            "catalogTitle": "CRI Profile v2.2",
            "catalogUrl": "https://cyberriskinstitute.org/the-profile/"
        },
        {
            "profileMappingId": 0,
            "controlId": 0,
            "controlIdentifier": "ID.IM-04.08",
            "controlGuid": "0e165381-f1f0-45de-bec5-1b60aecad762",
            "controlTitle": "ID.IM-04.08 - Response program improvement",
            "catalogId": 0,
            "catalogGuid": "f506e4c5-074c-4556-90ad-caefd610fa2a",
            "catalogTitle": "CRI Profile v2.2",
            "catalogUrl": "https://cyberriskinstitute.org/the-profile/"
        },
        {
            "profileMappingId": 0,
            "controlId": 0,
            "controlIdentifier": "PR.AA-03.02",
            "controlGuid": "07a688bf-959f-4dec-9f7f-1a5d251db660",
            "controlTitle": "PR.AA-03.02 - Access authorization",
            "catalogId": 0,
            "catalogGuid": "f506e4c5-074c-4556-90ad-caefd610fa2a",
            "catalogTitle": "CRI Profile v2.2",
            "catalogUrl": "https://cyberriskinstitute.org/the-profile/"
        },
        {
            "profileMappingId": 0,
            "controlId": 0,
            "controlIdentifier": "PR.AA-05.04",
            "controlGuid": "db882f16-aaa0-42f8-8c3f-73974c20f7cd",
            "controlTitle": "PR.AA-05.04 - Third-party access management",
            "catalogId": 0,
            "catalogGuid": "f506e4c5-074c-4556-90ad-caefd610fa2a",
            "catalogTitle": "CRI Profile v2.2",
            "catalogUrl": "https://cyberriskinstitute.org/the-profile/"
        },
        {
            "profileMappingId": 0,
            "controlId": 0,
            "controlIdentifier": "PR.AT-01.02",
            "controlGuid": "f3433af7-21f8-4f27-bede-6167e3956646",
            "controlTitle": "PR.AT-01.02 - Cybersecurity awareness training content",
            "catalogId": 0,
            "catalogGuid": "f506e4c5-074c-4556-90ad-caefd610fa2a",
            "catalogTitle": "CRI Profile v2.2",
            "catalogUrl": "https://cyberriskinstitute.org/the-profile/"
        },
        {
            "profileMappingId": 0,
            "controlId": 0,
            "controlIdentifier": "PR.AT-02.02",
            "controlGuid": "1d9116d9-a3cf-413e-8a26-0b75a5ca700c",
            "controlTitle": "PR.AT-02.02 - Training of high-risk groups",
            "catalogId": 0,
            "catalogGuid": "f506e4c5-074c-4556-90ad-caefd610fa2a",
            "catalogTitle": "CRI Profile v2.2",
            "catalogUrl": "https://cyberriskinstitute.org/the-profile/"
        },
        {
            "profileMappingId": 0,
            "controlId": 0,
            "controlIdentifier": "PR.AT-02.03",
            "controlGuid": "cf5b5c36-8e8f-4d32-af46-9cbc1ade6b96",
            "controlTitle": "PR.AT-02.03 - Response and recovery plan training",
            "catalogId": 0,
            "catalogGuid": "f506e4c5-074c-4556-90ad-caefd610fa2a",
            "catalogTitle": "CRI Profile v2.2",
            "catalogUrl": "https://cyberriskinstitute.org/the-profile/"
        },
        {
            "profileMappingId": 0,
            "controlId": 0,
            "controlIdentifier": "PR.AT-02.05",
            "controlGuid": "d44e142c-4247-4dbb-b916-e2a14410b955",
            "controlTitle": "PR.AT-02.05 - Third-party awareness training",
            "catalogId": 0,
            "catalogGuid": "f506e4c5-074c-4556-90ad-caefd610fa2a",
            "catalogTitle": "CRI Profile v2.2",
            "catalogUrl": "https://cyberriskinstitute.org/the-profile/"
        },
        {
            "profileMappingId": 0,
            "controlId": 0,
            "controlIdentifier": "PR.IR-01.01",
            "controlGuid": "6a519803-05c3-4a4f-a3c5-adae4549d8f8",
            "controlTitle": "PR.IR-01.01 - Network segmentation",
            "catalogId": 0,
            "catalogGuid": "f506e4c5-074c-4556-90ad-caefd610fa2a",
            "catalogTitle": "CRI Profile v2.2",
            "catalogUrl": "https://cyberriskinstitute.org/the-profile/"
        },
        {
            "profileMappingId": 0,
            "controlId": 0,
            "controlIdentifier": "DE.CM-06.01",
            "controlGuid": "e67135e6-dc4e-4c5a-a0c9-153a14a7e0e3",
            "controlTitle": "DE.CM-06.01 - Third-party connection authorization",
            "catalogId": 0,
            "catalogGuid": "f506e4c5-074c-4556-90ad-caefd610fa2a",
            "catalogTitle": "CRI Profile v2.2",
            "catalogUrl": "https://cyberriskinstitute.org/the-profile/"
        },
        {
            "profileMappingId": 0,
            "controlId": 0,
            "controlIdentifier": "DE.CM-06.02",
            "controlGuid": "a8c888b8-4ca0-4463-a044-07210dde9de9",
            "controlTitle": "DE.CM-06.02 - Third-party access monitoring",
            "catalogId": 0,
            "catalogGuid": "f506e4c5-074c-4556-90ad-caefd610fa2a",
            "catalogTitle": "CRI Profile v2.2",
            "catalogUrl": "https://cyberriskinstitute.org/the-profile/"
        },
        {
            "profileMappingId": 0,
            "controlId": 0,
            "controlIdentifier": "DE.AE-03.02",
            "controlGuid": "fe51bf4c-ef50-4cbd-8a5e-6a3e829ecacc",
            "controlTitle": "DE.AE-03.02 - Event aggregation, correlation, and analysis",
            "catalogId": 0,
            "catalogGuid": "f506e4c5-074c-4556-90ad-caefd610fa2a",
            "catalogTitle": "CRI Profile v2.2",
            "catalogUrl": "https://cyberriskinstitute.org/the-profile/"
        },
        {
            "profileMappingId": 0,
            "controlId": 0,
            "controlIdentifier": "DE.AE-04.01",
            "controlGuid": "efab59c4-83f8-4854-aafd-263b8d3daaa8",
            "controlTitle": "DE.AE-04.01 - Event triage",
            "catalogId": 0,
            "catalogGuid": "f506e4c5-074c-4556-90ad-caefd610fa2a",
            "catalogTitle": "CRI Profile v2.2",
            "catalogUrl": "https://cyberriskinstitute.org/the-profile/"
        },
        {
            "profileMappingId": 0,
            "controlId": 0,
            "controlIdentifier": "DE.AE-06.01",
            "controlGuid": "1535b040-5059-4867-b4a6-0118db891b29",
            "controlTitle": "DE.AE-06.01 - Event alerting",
            "catalogId": 0,
            "catalogGuid": "f506e4c5-074c-4556-90ad-caefd610fa2a",
            "catalogTitle": "CRI Profile v2.2",
            "catalogUrl": "https://cyberriskinstitute.org/the-profile/"
        },
        {
            "profileMappingId": 0,
            "controlId": 0,
            "controlIdentifier": "DE.AE-08.01",
            "controlGuid": "4ca042b2-b1c2-4939-94fc-4542d4c292c8",
            "controlTitle": "DE.AE-08.01 - Event classification",
            "catalogId": 0,
            "catalogGuid": "f506e4c5-074c-4556-90ad-caefd610fa2a",
            "catalogTitle": "CRI Profile v2.2",
            "catalogUrl": "https://cyberriskinstitute.org/the-profile/"
        },
        {
            "profileMappingId": 0,
            "controlId": 0,
            "controlIdentifier": "RS.CO-02.03",
            "controlGuid": "5500b25f-b0cc-4c38-82b3-c3e3e9b6b01d",
            "controlTitle": "RS.CO-02.03 - Incident response communication procedures",
            "catalogId": 0,
            "catalogGuid": "f506e4c5-074c-4556-90ad-caefd610fa2a",
            "catalogTitle": "CRI Profile v2.2",
            "catalogUrl": "https://cyberriskinstitute.org/the-profile/"
        },
        {
            "profileMappingId": 0,
            "controlId": 0,
            "controlIdentifier": "RS.MI-01.01",
            "controlGuid": "5ec02102-f167-4b02-96ac-25889eb6cfa2",
            "controlTitle": "RS.MI-01.01 - Incident containment",
            "catalogId": 0,
            "catalogGuid": "f506e4c5-074c-4556-90ad-caefd610fa2a",
            "catalogTitle": "CRI Profile v2.2",
            "catalogUrl": "https://cyberriskinstitute.org/the-profile/"
        },
        {
            "profileMappingId": 0,
            "controlId": 0,
            "controlIdentifier": "RC.CO-03.02",
            "controlGuid": "fe462d2c-ff54-4739-85fe-0f5b7062b78b",
            "controlTitle": "RC.CO-03.02 - Recovery activity external communications",
            "catalogId": 0,
            "catalogGuid": "f506e4c5-074c-4556-90ad-caefd610fa2a",
            "catalogTitle": "CRI Profile v2.2",
            "catalogUrl": "https://cyberriskinstitute.org/the-profile/"
        },
        {
            "profileMappingId": 0,
            "controlId": 0,
            "controlIdentifier": "RC.CO-04.01",
            "controlGuid": "b51ba3de-cc76-4c0a-a97d-a25f41347d0d",
            "controlTitle": "RC.CO-04.01 - Incident communications planning and coordination",
            "catalogId": 0,
            "catalogGuid": "f506e4c5-074c-4556-90ad-caefd610fa2a",
            "catalogTitle": "CRI Profile v2.2",
            "catalogUrl": "https://cyberriskinstitute.org/the-profile/"
        },
        {
            "profileMappingId": 0,
            "controlId": 0,
            "controlIdentifier": "EX.DD-02.01",
            "controlGuid": "dd8c2c57-2f60-44e8-a35e-5f901437c13c",
            "controlTitle": "EX.DD-02.01 - Due diligence resource allocation",
            "catalogId": 0,
            "catalogGuid": "f506e4c5-074c-4556-90ad-caefd610fa2a",
            "catalogTitle": "CRI Profile v2.2",
            "catalogUrl": "https://cyberriskinstitute.org/the-profile/"
        },
        {
            "profileMappingId": 0,
            "controlId": 0,
            "controlIdentifier": "EX.DD-02.03",
            "controlGuid": "691459e8-d7c7-41dd-ba3e-91b6a145c9de",
            "controlTitle": "EX.DD-02.03 - Third-party business profile due diligence",
            "catalogId": 0,
            "catalogGuid": "f506e4c5-074c-4556-90ad-caefd610fa2a",
            "catalogTitle": "CRI Profile v2.2",
            "catalogUrl": "https://cyberriskinstitute.org/the-profile/"
        },
        {
            "profileMappingId": 0,
            "controlId": 0,
            "controlIdentifier": "EX.DD-02.04",
            "controlGuid": "7f570265-70fe-4f97-bd3f-5e0fee9baf88",
            "controlTitle": "EX.DD-02.04 - Third-party internal controls due diligence",
            "catalogId": 0,
            "catalogGuid": "f506e4c5-074c-4556-90ad-caefd610fa2a",
            "catalogTitle": "CRI Profile v2.2",
            "catalogUrl": "https://cyberriskinstitute.org/the-profile/"
        },
        {
            "profileMappingId": 0,
            "controlId": 0,
            "controlIdentifier": "EX.DD-03.01",
            "controlGuid": "54ff1f63-09be-4268-b1ca-b1e17d4f0724",
            "controlTitle": "EX.DD-03.01 - Third-party cybersecurity program due diligence",
            "catalogId": 0,
            "catalogGuid": "f506e4c5-074c-4556-90ad-caefd610fa2a",
            "catalogTitle": "CRI Profile v2.2",
            "catalogUrl": "https://cyberriskinstitute.org/the-profile/"
        },
        {
            "profileMappingId": 0,
            "controlId": 0,
            "controlIdentifier": "EX.DD-03.02",
            "controlGuid": "0d3626eb-741f-4171-9050-e24e6c0086d9",
            "controlTitle": "EX.DD-03.02 - Third-party business continuity program due diligence",
            "catalogId": 0,
            "catalogGuid": "f506e4c5-074c-4556-90ad-caefd610fa2a",
            "catalogTitle": "CRI Profile v2.2",
            "catalogUrl": "https://cyberriskinstitute.org/the-profile/"
        },
        {
            "profileMappingId": 0,
            "controlId": 0,
            "controlIdentifier": "EX.DD-03.03",
            "controlGuid": "bffbcdfe-6657-4d0b-929a-0abd10292683",
            "controlTitle": "EX.DD-03.03 - Third-party incident response program due diligence",
            "catalogId": 0,
            "catalogGuid": "f506e4c5-074c-4556-90ad-caefd610fa2a",
            "catalogTitle": "CRI Profile v2.2",
            "catalogUrl": "https://cyberriskinstitute.org/the-profile/"
        },
        {
            "profileMappingId": 0,
            "controlId": 0,
            "controlIdentifier": "EX.DD-04.01",
            "controlGuid": "692882c0-bfb2-42cb-b8b4-350af6a3b621",
            "controlTitle": "EX.DD-04.01 - Third-party systems and software evaluation",
            "catalogId": 0,
            "catalogGuid": "f506e4c5-074c-4556-90ad-caefd610fa2a",
            "catalogTitle": "CRI Profile v2.2",
            "catalogUrl": "https://cyberriskinstitute.org/the-profile/"
        },
        {
            "profileMappingId": 0,
            "controlId": 0,
            "controlIdentifier": "EX.DD-04.02",
            "controlGuid": "5771bd0e-f129-44e2-912f-2a8542b52fe4",
            "controlTitle": "EX.DD-04.02 - Third-party support systems evaluation",
            "catalogId": 0,
            "catalogGuid": "f506e4c5-074c-4556-90ad-caefd610fa2a",
            "catalogTitle": "CRI Profile v2.2",
            "catalogUrl": "https://cyberriskinstitute.org/the-profile/"
        },
        {
            "profileMappingId": 0,
            "controlId": 0,
            "controlIdentifier": "EX.CN-01.02",
            "controlGuid": "91603a2a-48b7-40a7-ae34-c26bf7a3d3be",
            "controlTitle": "EX.CN-01.02 - Third-party management of suppliers",
            "catalogId": 0,
            "catalogGuid": "f506e4c5-074c-4556-90ad-caefd610fa2a",
            "catalogTitle": "CRI Profile v2.2",
            "catalogUrl": "https://cyberriskinstitute.org/the-profile/"
        },
        {
            "profileMappingId": 0,
            "controlId": 0,
            "controlIdentifier": "EX.CN-01.03",
            "controlGuid": "6b92b14c-3e36-427a-a3aa-d5a3980daf5e",
            "controlTitle": "EX.CN-01.03 - Third-party management of foreign operations",
            "catalogId": 0,
            "catalogGuid": "f506e4c5-074c-4556-90ad-caefd610fa2a",
            "catalogTitle": "CRI Profile v2.2",
            "catalogUrl": "https://cyberriskinstitute.org/the-profile/"
        },
        {
            "profileMappingId": 0,
            "controlId": 0,
            "controlIdentifier": "EX.CN-02.01",
            "controlGuid": "e27b2e15-fb7b-44b9-bcb0-90746f38e644",
            "controlTitle": "EX.CN-02.01 - Third-party cybersecurity requirements",
            "catalogId": 0,
            "catalogGuid": "f506e4c5-074c-4556-90ad-caefd610fa2a",
            "catalogTitle": "CRI Profile v2.2",
            "catalogUrl": "https://cyberriskinstitute.org/the-profile/"
        },
        {
            "profileMappingId": 0,
            "controlId": 0,
            "controlIdentifier": "EX.CN-02.02",
            "controlGuid": "ec557aa1-629f-456c-a6ea-5505c97d6e20",
            "controlTitle": "EX.CN-02.02 - Third-party incident and vulnerability notification requirements",
            "catalogId": 0,
            "catalogGuid": "f506e4c5-074c-4556-90ad-caefd610fa2a",
            "catalogTitle": "CRI Profile v2.2",
            "catalogUrl": "https://cyberriskinstitute.org/the-profile/"
        },
        {
            "profileMappingId": 0,
            "controlId": 0,
            "controlIdentifier": "EX.MM-01.01",
            "controlGuid": "9cd130bd-e2c3-4125-9a5a-989c9ecfbdb0",
            "controlTitle": "EX.MM-01.01 - Third-party monitoring and management resources",
            "catalogId": 0,
            "catalogGuid": "f506e4c5-074c-4556-90ad-caefd610fa2a",
            "catalogTitle": "CRI Profile v2.2",
            "catalogUrl": "https://cyberriskinstitute.org/the-profile/"
        },
        {
            "profileMappingId": 0,
            "controlId": 0,
            "controlIdentifier": "EX.MM-01.02",
            "controlGuid": "1139d5e6-2298-40c8-bab0-ef159b1adaa6",
            "controlTitle": "EX.MM-01.02 - Third-party relationship re-evaluation",
            "catalogId": 0,
            "catalogGuid": "f506e4c5-074c-4556-90ad-caefd610fa2a",
            "catalogTitle": "CRI Profile v2.2",
            "catalogUrl": "https://cyberriskinstitute.org/the-profile/"
        },
        {
            "profileMappingId": 0,
            "controlId": 0,
            "controlIdentifier": "EX.MM-01.03",
            "controlGuid": "5f725649-626f-4f54-b074-190bc143728f",
            "controlTitle": "EX.MM-01.03 - Third-party business posture monitoring",
            "catalogId": 0,
            "catalogGuid": "f506e4c5-074c-4556-90ad-caefd610fa2a",
            "catalogTitle": "CRI Profile v2.2",
            "catalogUrl": "https://cyberriskinstitute.org/the-profile/"
        },
        {
            "profileMappingId": 0,
            "controlId": 0,
            "controlIdentifier": "EX.MM-01.04",
            "controlGuid": "c647b09d-94f5-42af-a404-1f17d0196209",
            "controlTitle": "EX.MM-01.04 - Third-party contract compliance monitoring",
            "catalogId": 0,
            "catalogGuid": "f506e4c5-074c-4556-90ad-caefd610fa2a",
            "catalogTitle": "CRI Profile v2.2",
            "catalogUrl": "https://cyberriskinstitute.org/the-profile/"
        },
        {
            "profileMappingId": 0,
            "controlId": 0,
            "controlIdentifier": "EX.MM-01.05",
            "controlGuid": "cf78b426-6233-4ec1-996d-1db2b73e53a7",
            "controlTitle": "EX.MM-01.05 - Third-party supplier management monitoring",
            "catalogId": 0,
            "catalogGuid": "f506e4c5-074c-4556-90ad-caefd610fa2a",
            "catalogTitle": "CRI Profile v2.2",
            "catalogUrl": "https://cyberriskinstitute.org/the-profile/"
        },
        {
            "profileMappingId": 0,
            "controlId": 0,
            "controlIdentifier": "EX.MM-01.06",
            "controlGuid": "f0148bc0-8d60-47cc-a4f8-851247a63d8f",
            "controlTitle": "EX.MM-01.06 - Third-party foreign operations monitoring",
            "catalogId": 0,
            "catalogGuid": "f506e4c5-074c-4556-90ad-caefd610fa2a",
            "catalogTitle": "CRI Profile v2.2",
            "catalogUrl": "https://cyberriskinstitute.org/the-profile/"
        },
        {
            "profileMappingId": 0,
            "controlId": 0,
            "controlIdentifier": "EX.MM-02.01",
            "controlGuid": "c2cc2e21-9211-474d-a9f5-d424bd863984",
            "controlTitle": "EX.MM-02.01 - Third-party security program monitoring",
            "catalogId": 0,
            "catalogGuid": "f506e4c5-074c-4556-90ad-caefd610fa2a",
            "catalogTitle": "CRI Profile v2.2",
            "catalogUrl": "https://cyberriskinstitute.org/the-profile/"
        },
        {
            "profileMappingId": 0,
            "controlId": 0,
            "controlIdentifier": "EX.MM-02.02",
            "controlGuid": "4880051b-4772-401d-8a9d-7cf75de507f8",
            "controlTitle": "EX.MM-02.02 - Third-party business continuity program monitoring",
            "catalogId": 0,
            "catalogGuid": "f506e4c5-074c-4556-90ad-caefd610fa2a",
            "catalogTitle": "CRI Profile v2.2",
            "catalogUrl": "https://cyberriskinstitute.org/the-profile/"
        },
        {
            "profileMappingId": 0,
            "controlId": 0,
            "controlIdentifier": "EX.MM-02.03",
            "controlGuid": "f5ba5035-f97f-4abc-9383-b62827bef1dc",
            "controlTitle": "EX.MM-02.03 - Third-party security improvement collaboration",
            "catalogId": 0,
            "catalogGuid": "f506e4c5-074c-4556-90ad-caefd610fa2a",
            "catalogTitle": "CRI Profile v2.2",
            "catalogUrl": "https://cyberriskinstitute.org/the-profile/"
        },
        {
            "profileMappingId": 0,
            "controlId": 0,
            "controlIdentifier": "EX.TR-01.02",
            "controlGuid": "6a04ecd3-475d-4304-9129-a059525db863",
            "controlTitle": "EX.TR-01.02 - Third-party alternatives evaluation",
            "catalogId": 0,
            "catalogGuid": "f506e4c5-074c-4556-90ad-caefd610fa2a",
            "catalogTitle": "CRI Profile v2.2",
            "catalogUrl": "https://cyberriskinstitute.org/the-profile/"
        },
        {
            "profileMappingId": 0,
            "controlId": 0,
            "controlIdentifier": "EX.TR-01.03",
            "controlGuid": "08d2fdd6-1453-4012-a951-363804ac0fee",
            "controlTitle": "EX.TR-01.03 - Third-party termination plan",
            "catalogId": 0,
            "catalogGuid": "f506e4c5-074c-4556-90ad-caefd610fa2a",
            "catalogTitle": "CRI Profile v2.2",
            "catalogUrl": "https://cyberriskinstitute.org/the-profile/"
        },
        {
            "profileMappingId": 0,
            "controlId": 0,
            "controlIdentifier": "EX.TR-02.01",
            "controlGuid": "607b0860-0f68-46eb-9ebc-19621c9c5595",
            "controlTitle": "EX.TR-02.01 - Third-party relationship termination",
            "catalogId": 0,
            "catalogGuid": "f506e4c5-074c-4556-90ad-caefd610fa2a",
            "catalogTitle": "CRI Profile v2.2",
            "catalogUrl": "https://cyberriskinstitute.org/the-profile/"
        }
    ],
    "exportDate": "2026-04-20T16:57:02Z",
    "exportVersion": "1.0"
}