Home / Rules by market
Rules by market
The architecture practice this standard describes is governed, in each market, by the firm own financial, resilience and control rules. This page names the frameworks the estate holds for the buyer activity in the United States, the European Union, the United Kingdom and Australia, in that order, so a reader can see the context the vocabulary lands in.
United States
| Framework | Controls | Why it matters here |
|---|---|---|
| COSO Internal Control, Integrated Framework (2013) | 71 | The internal control frame a SOX 404 programme uses; architecture decisions that change a control are evidence questions. |
| FTC GLBA Safeguards Rule (16 CFR Part 314) | 47 | The safeguards rule for financial institutions; the architecture record is part of the evidence that safeguards are designed and monitored. |
| SOC for Cybersecurity (AICPA) | 55 | A examination frame for a cybersecurity risk management programme; architecture descriptions often feed the control evidence. |
European Union
| Framework | Controls | Why it matters here |
|---|---|---|
| DORA RTS on ICT Risk Management Framework (EU 2024/1774) | 42 | The ICT risk management framework for financial entities; architecture governance is part of the control environment. |
| EBA Guidelines on ICT and Security Risk Management (EBA/GL/2019/04) | 43 | The EBA expectations for ICT and security risk; architecture decisions and their records are in scope. |
| EIOPA Guidelines on ICT Security and Governance (EIOPA-BoS-20/600) | 25 | The insurance sector expectations for ICT governance, including the architecture of critical systems. |
United Kingdom
| Framework | Controls | Why it matters here |
|---|---|---|
| UK FCA/PRA Operational Resilience Framework | 32 | The operational resilience regime for firms and market infrastructure; important business services depend on architecture decisions. |
| Financial Services and Markets Act 2000 | 15 | The statutory frame for UK regulated activity; the named obligation is the Act, and the architecture record supports the firm own evidence. |
Australia
| Framework | Controls | Why it matters here |
|---|---|---|
| APRA CPS 230 Operational Risk Management | 99 | The prudential standard for operational risk; service providers, critical operations and change are architecture questions. |
| APRA CPS 220 Risk Management | 40 | The risk management standard for APRA regulated entities; architecture governance sits inside it. |
| ASIC Market Integrity Rules (Securities Markets) 2017 | 35 | The market integrity rules for securities markets; system change and records are part of the obligations. |
How to use this page
Read the market section for the firm regulator, then return to the terms. The vocabulary work is the same in every market; the evidence pack is not. A committee in Australia will ask about CPS 230 service providers; a committee in the European Union will ask about the DORA ICT risk framework; a committee in the United Kingdom will ask which important business service an architecture decision touches.
Where a regime is not covered
Where the estate does not cover a framework, this page names the obligation and does not state its text. The four market sections above list only frameworks with a published control set, so the counts are real. A market with no relevant framework would say so rather than borrowing another market's rule.
Last updated: 2026-10-21