lookup_control
Identify security/compliance controls by regulation, category, surface, or sector. Get control details, tooling options, and evidence expectations for auditors.
Instructions
Look up which security/compliance controls apply for a given regulation, control category, enforcement surface, and/or sector.
Each result includes: the named control, the regulations that mandate it, the tooling options that implement it (categorised as managed/oss/commercial/standard), the evidence shape an auditor would expect, sector relevance, and a practitioner note.
Sourced from the curated dataset at hellouchit.com/dataset/ (CC BY 4.0). Covers EU AI Act, NIST AI RMF, ISO/IEC 42001, APRA CPS 234/230, AU AI Safety Standard, ASD Essential Eight, IRAP, SLSA, NIST SSDF, OWASP LLM Top 10, MITRE ATLAS, BCBS 239, PCI DSS 4.0, HIPAA, GDPR, EU DORA, EU NIS2, CISA SSA, FDA SaMD, IEC 62443, and more.
Use this tool whenever you need to answer 'which tool closes X regulator's requirement on Y surface' or 'what evidence does Z compliance regime expect'.
Input Schema
| Name | Required | Description | Default |
|---|---|---|---|
| regulation | No | Regulation slug. One of: cps234, cps230, soci, ai_safety_au, privacy_au, e8, irap, eu_ai_act, dora, nis2, gdpr, circia, hipaa, fda_samd, cisa_ssa, ssdf, ai_rmf, sp80053, iso42001, iso27001, slsa, owasp_llm, atlas, bcbs239, pci, iec62443, iso13485, iec62304 | |
| surface | No | Enforcement surface keyword (case-insensitive substring match). Examples: 'Cloud', 'CI/CD', 'K8s', 'Network', 'Runtime', 'Source' | |
| category | No | Control category. Examples: 'Identity & access', 'Supply chain & provenance', 'AI evals & guardrails', 'Data governance', 'Cryptography & secrets', 'Resilience & continuity' | |
| sector | No | Sector filter. One of: banks, government, healthcare, critical-infrastructure, all | |
| search | No | Free-text search over control names + notes + evidence shape | |
| limit | No | Maximum number of matches to return (default 10) |