# ISO 42024 rules by market

## Published contents

Contents1 Scope2 Normative references3 Terms and definitions4 Architecture concepts4.1 Overview4.2 Architecture and architecting4.3 Architecture design and solution design4.4 Architecture definition and communication4.5 Stakeholder concerns and architectural aspects4.6 Architecture viewpoints and architecture views4.7 Architecture frameworks and architecture description languages4.8 Architecture descriptions and architecture models4.9 Reference architectures and reference models4.10 Life cycle and life history4.11 Architecting precepts5 Architecting principles5.1 Introduction to the principles5.2 Principles about the purpose of an architecture5.3 Principles about the focus of an architecture5.4 Principles about architecting outcomesTerms
3.2 Architecting concepts
3.2.1 Architecture3.2.2 Architecture feature3.2.3 Architecting3.2.4 Architecting principle3.2.5 Architecture principle3.2.6 Architecture framework3.2.7 Reference architecture3.3 Entity related concepts
3.3.1 Entity of interest3.3.2 Solution entity3.3.3 Environment3.3.4 Context3.3.5 Enterprise3.3.6 System3.3.7 Aspect3.3.8 Dimension3.4 Architecture design concepts
3.4.1 Design (noun)3.4.2 Architecture design3.4.3 Architecture information package3.4.4 Engineering effort3.4.5 Solution design3.4.6 Solution information package3.4.7 Stakeholder3.4.8 Stakeholder perspective3.4.9 Concern3.5 Architecture description concepts
3.5.1 Architecture description3.5.2 Solution description3.5.3 Architecture view3.5.4 Architecture viewpoint3.5.5 Model3.5.6 Metamodel3.5.7 Reference model3.6 Entity life cycle concepts
3.6.1 Life cycle3.6.2 Life cycle phase3.6.3 Life cycle stage3.6.4 Life historyAnnexes
A.1 Architecture design and solution related entitiesA.2 Architecture expressed as a set of modelsA.3 Life cycle and life history conceptsA.4 Enterprise and system conceptsA.5 Duality of architectural decomposition and architectural synthesisB.1 BackgroundB.2 Aligning architecture in designB.3 Duality of architectureB.4 Pursuit of opportunities

Home / Rules by market

# Rules by market

The architecture practice this standard describes is governed, in each market, by the firm own financial, resilience and control rules. This page names the frameworks the estate holds for the buyer activity in the United States, the European Union, the United Kingdom and Australia, in that order, so a reader can see the context the vocabulary lands in.

The standard itself is not public in full. ISO sells the draft and the public preview carries clauses 1 to 3 and the contents. No architecture specific framework is held for these markets, so this page names the financial and resilience frameworks that apply to the buyer and states plainly that the clauses of 42024 are read from the public record only.

## United States

Held frameworks in this market that touch the buyer activityFrameworkControlsWhy it matters here
COSO Internal Control, Integrated Framework (2013)71The internal control frame a SOX 404 programme uses; architecture decisions that change a control are evidence questions.
FTC GLBA Safeguards Rule (16 CFR Part 314)47The safeguards rule for financial institutions; the architecture record is part of the evidence that safeguards are designed and monitored.
SOC for Cybersecurity (AICPA)55A examination frame for a cybersecurity risk management programme; architecture descriptions often feed the control evidence.

## European Union

Held frameworks in this market that touch the buyer activityFrameworkControlsWhy it matters here
DORA RTS on ICT Risk Management Framework (EU 2024/1774)42The ICT risk management framework for financial entities; architecture governance is part of the control environment.
EBA Guidelines on ICT and Security Risk Management (EBA/GL/2019/04)43The EBA expectations for ICT and security risk; architecture decisions and their records are in scope.
EIOPA Guidelines on ICT Security and Governance (EIOPA-BoS-20/600)25The insurance sector expectations for ICT governance, including the architecture of critical systems.

## United Kingdom

Held frameworks in this market that touch the buyer activityFrameworkControlsWhy it matters here
UK FCA/PRA Operational Resilience Framework32The operational resilience regime for firms and market infrastructure; important business services depend on architecture decisions.
Financial Services and Markets Act 200015The statutory frame for UK regulated activity; the named obligation is the Act, and the architecture record supports the firm own evidence.

## Australia

Held frameworks in this market that touch the buyer activityFrameworkControlsWhy it matters here
APRA CPS 230 Operational Risk Management99The prudential standard for operational risk; service providers, critical operations and change are architecture questions.
APRA CPS 220 Risk Management40The risk management standard for APRA regulated entities; architecture governance sits inside it.
ASIC Market Integrity Rules (Securities Markets) 201735The market integrity rules for securities markets; system change and records are part of the obligations.

## How to use this page

Read the market section for the firm regulator, then return to the terms. The vocabulary work is the same in every market; the evidence pack is not. A committee in Australia will ask about CPS 230 service providers; a committee in the European Union will ask about the DORA ICT risk framework; a committee in the United Kingdom will ask which important business service an architecture decision touches.

## Where a regime is not covered

Where the estate does not cover a framework, this page names the obligation and does not state its text. The four market sections above list only frameworks with a published control set, so the counts are real. A market with no relevant framework would say so rather than borrowing another market's rule.

Last updated: 2026-10-21

Source: https://iso-42024-revision-checker.theartofservice.com/rules/