A control map for the people who need to challenge it.
This is a due-diligence navigation aid, not an audit opinion or a statement that Falcon Veritas or a customer is certified or compliant with every listed framework. Applicability, contractual scope and operating evidence must be reviewed for each engagement.
Framework to evidence
Each row names a control theme, the corresponding platform design area and the artifact a reviewer should request. It does not assert that the artifact has been independently tested or delivered for a particular customer.
Control and evidence map
| Framework | Control theme | FVI capability / design area | Evidence to request |
|---|---|---|---|
| DORA | ICT risk and third-party oversight | Tenant access, change and incident workflows | Scope-specific control and incident evidence |
| BCBS 239 | Risk-data accuracy and traceability | Source lineage, quality rules and reconciled outputs | Lineage and exception evidence pack |
| SR 11-7 | Model inventory and validation | Governed AI-assisted matching and human review | Model inventory, validation and decision record |
| PRA SS2/21 | Operational resilience | Dependency, change and recovery planning | Service map and exercise result |
| MAS TRM | Technology risk management | Access, cryptography and monitoring controls | Policy, configuration and test evidence |
| APRA CPS 234 | Information-security capability | Tenant boundary and security monitoring | Control assessment and incident record |
| ISO 22301 | Business continuity | Recovery planning and exercise workflow | Approved plan and dated exercise result |
| SOC 2 | Security and availability criteria | Access, change, logging and service controls | Control evidence; no FVI attestation claimed |
| ISO/IEC 27001 | Information-security management | Risk treatment and technology control design | Statement of Applicability and operating evidence |
| SEC 17a-4 | Applicable record preservation | Exportable reconciliation and audit evidence | Retention design and verified export sample |
How to use this page
Start with the frameworks relevant to your regulated entity and the reconciliation in scope. Request the corresponding current evidence, test the tenant and role boundaries with your own evaluation accounts, and agree the final shared-responsibility and retention schedule in the contract. Requirements imposed on the bank do not automatically become product certifications.
Request a scoped due-diligence discussion or read the Security overview.
Discuss a scoped evaluation with the Falcon Veritas team. Product outcomes and commercial commitments are agreed for each engagement.
Book a 30-min demo