You are here:
Regulation Management in IT Compliance
Follow how a compliance team captures an external framework, such as SOC 2, as structured records, maps each clause to internal policies and controls, and keeps the framework current as the regulatory authority publishes amendments.
Required Editions
| Available in: Lightning Experience |
| Available in: Enterprise, Performance, and Unlimited Editions with Agentforce IT Service. |
Regulation Records
To manage regulations effectively, review the records involved in the lifecycle.
| Record Type | Description |
|---|---|
| Regulatory Authority | The body that issues a regulation, such as a government agency or industry standards organization. |
| Regulation | A specific framework or mandate issued by a regulatory authority (for example, SOC 2 or NIST CSF). |
| Regulation Version | A specific iteration of a regulation. Versions provide an audit trail of which requirements were in effect at a specific time. |
| Regulation Clause | A specific provision within a regulation (for example, Least Privilege within Logical and Physical Access). |
| Regulation Clause Version | The version-controlled text of a specific provision. |
The End-to-End Workflow: A SOC 2 Example
Follow the lifecycle of the SOC 2 framework to see how regulation records connect with policies, controls, and issues across IT Compliance.
Centralizing Regulatory Content
The workflow begins when a Compliance Lead, Sarah, identifies an external framework that the organization must comply with, such as SOC 2, for a customer contract. She creates a regulatory authority record for SOC 2, and then captures each regulation issued by the authority along with its underlying clauses. For SOC 2, this can include core regulations aligned with the Common Criteria, such as Logical and Physical Access, and the clauses within each one, such as Least Privilege, Physical Security, and Asset Disposal.
To avoid manually creating each clause, Sarah uploads the SOC 2 regulation document and uses generative AI to extract the clauses for her. She reviews the extracted clauses and saves them as regulation clause records associated with the SOC 2 regulation version.
Versioning and Amendments
When Sarah creates a regulation or a clause, a version record is automatically created in Draft status. She publishes the version when its content is final, and activates the version on its effective date to enforce it across the organization. When the regulatory authority publishes an amendment, Sarah clones the active version to create a new version. The new version inherits all clause mappings from the active version, so Sarah only has to update the clauses the amendment changed. After the new version takes effect, Sarah retires the previous active version. This pattern keeps a full audit trail of which requirements were in effect at any point in time.
Mapping to Internal Policies, Controls, and Risks
The compliance team maps each regulation clause version to the internal policy clauses that translate it into organizational standards, to the compliance controls that enforce it technically, and to the risks it mitigates. For example, they map the Least Privilege regulation clause to a Principle of Least Privilege policy clause, to a Data Leakage Prevention control that enforces it technically, and to the Unauthorized Data Access risk that the control mitigates.
To create these downstream mappings, see:
- Map IT Compliance Policy Clause Versions to Policy Versions and Regulation Clause Versions to link internal policy clauses to the regulation clauses they implement.
- Controls Management Workflow for IT Compliance to link compliance controls to the regulation clauses they enforce.
- Map Risks to Policy Clauses and Controls for IT Compliance to link risks to the policy clauses they could violate and the controls that mitigate them.
Identifying and Resolving Compliance Gaps
When a control test fails or an audit finding identifies a gap against a regulation clause, the compliance team logs a compliance issue and links it to the regulation clause as the source. The issue moves through remediation and closes only after the issue owner validates the fix. To track issues against regulations, see Issue Management for IT Compliance.
Traceability
This structured workflow creates a traceable map of interconnected records. If an auditor asks for proof of compliance with a SOC 2 requirement, your organization can show a complete chain of evidence:
- The regulation clause that captures the external requirement.
- The internal policy clause that translates the requirement into an organizational standard.
- The compliance control that enforces the standard technically.
- The compliance issues raised against the clause and how each one was resolved.
