Compliance and Regulatory attributes for the Services Inventory - Services Inventory and Attributes

Compliance and Regulatory attributes for the Services Inventory

(Chapter 28 of Services Inventory and Attributes)

Executive Summary: Chapter Overview

IF4IT

The Bottom Line

Three compliance attributes — Service Compliance Status, Applicable Regulations, and Regulatory Obligations — connect the Services Inventory to the compliance discipline. Compliance Status reports the Service’s posture against applicable regulations; Applicable Regulations and Regulatory Obligations connect to the planned Regulations and Regulatory Obligations inventories for traversal from regulation to affected Services.

Core Concepts

Concept	Definition & Strategic Role
Service Compliance Status	Compliant, Partially Compliant, Non-Compliant, or Not Assessed — provides compliance visibility at the Service level and supports remediation prioritization.
Applicable Regulations	The regulations that apply to this Service — GDPR, HIPAA, PCI DSS, SOX, DORA — referencing the planned Regulations Inventory.
Regulatory Obligations	Specific regulatory obligations the Service must satisfy — referencing the planned Regulatory Obligations Inventory for specific obligation-level governance.

Quick Q&A

Question: Why distinguish Applicable Regulations from Regulatory Obligations when they seem related?

Answer: Because they operate at different granularities. Applicable Regulations is the regulation as a whole — “GDPR applies to this Service.” Regulatory Obligations are the specific obligations within a regulation — “this Service must implement Data Subject Access Request handling per GDPR Article 15.” A Service subject to GDPR has many specific Regulatory Obligations under it; the two attributes enable both regulation-level and obligation-level compliance traversal.

Question: How is Service Compliance Status used operationally?

Answer: It surfaces Services requiring compliance remediation, supports audit-preparation reporting (“show all Tier 1 Services with Compliance Status: Non-Compliant”), and drives prioritization of compliance investment. A Service with Compliance Status: Not Assessed is a different remediation case than one with Compliance Status: Partially Compliant — the first needs assessment, the second needs targeted remediation.

Compliance and Regulatory attributes capture each Service’s compliance status, the regulations that apply, and the specific regulatory obligations. These attributes connect the Services Inventory to the compliance discipline.

Attribute Name	Maturity	Description and Notes
Service Compliance Status	Walk	Description — The current compliance status of the Service against applicable regulations and policies. Benefit(s) — Provides compliance visibility at the Service level. Enables remediation prioritization. Supports regulatory reporting. Source — Manual. Examples — Compliant, Partially Compliant, Non-Compliant, Not Assessed Notes — Valid values: Compliant, Partially Compliant, Non-Compliant, Not Assessed. Should be paired with the applicable regulations attribute for context.
Applicable Regulations [Multi-Value]	Walk	Description — The regulations and frameworks that apply to this Service. References the planned Regulations Inventory by Semantic ID. Benefit(s) — Connects Services to regulatory obligations. Enables compliance teams to traverse from regulation to affected Services. Source — Manual. Examples — GDPR, HIPAA, PCI DSS, SOX, DORA Notes — Refer to the planned Regulations Inventory for regulation governance.
Regulatory Obligations [Multi-Value]	Walk	Description — Specific regulatory obligations associated with this Service. References the planned Regulatory Obligations Inventory by Semantic ID. Benefit(s) — Connects Services to specific regulatory obligations. Supports compliance evidence management. Source — Manual. Examples — OBL-GDPR-DATA-SUBJECT-ACCESS, OBL-PCI-CARDHOLDER-DATA-PROTECTION Notes — Refer to the planned Regulatory Obligations Inventory.

Attribute Name

Maturity

Description and Notes

Service Compliance Status

Walk

Description — The current compliance status of the Service against applicable regulations and policies.

Benefit(s) — Provides compliance visibility at the Service level. Enables remediation prioritization. Supports regulatory reporting.

Source — Manual.

Examples — Compliant, Partially Compliant, Non-Compliant, Not Assessed

Notes — Valid values: Compliant, Partially Compliant, Non-Compliant, Not Assessed. Should be paired with the applicable regulations attribute for context.

Applicable Regulations

[Multi-Value]

Walk

Description — The regulations and frameworks that apply to this Service. References the planned Regulations Inventory by Semantic ID.

Benefit(s) — Connects Services to regulatory obligations. Enables compliance teams to traverse from regulation to affected Services.

Source — Manual.

Examples — GDPR, HIPAA, PCI DSS, SOX, DORA

Notes — Refer to the planned Regulations Inventory for regulation governance.

Regulatory Obligations

[Multi-Value]

Walk

Description — Specific regulatory obligations associated with this Service. References the planned Regulatory Obligations Inventory by Semantic ID.

Benefit(s) — Connects Services to specific regulatory obligations. Supports compliance evidence management.

Source — Manual.

Examples — OBL-GDPR-DATA-SUBJECT-ACCESS, OBL-PCI-CARDHOLDER-DATA-PROTECTION

Notes — Refer to the planned Regulatory Obligations Inventory.

How to cite this page

When referencing this page in academic work, internal standards, or external publications, include the page title, IF4IT as author and publisher (The International Foundation for Information Technology (IF4IT), LLC), the URL, and your access date.

Example (informal web citation):

The International Foundation for Information Technology (IF4IT), LLC. Compliance and Regulatory attributes for the Services Inventory | Services Inventory and Attributes. https://if4it.org/best-practices/services-inventory-and-attributes/compliance-and-regulatory-attributes-for-the-services-inventory/ (accessed 2026-09-11).

See About Us for content governance and site-wide citation guidance.

Legal Disclaimers