OCC Heightened Standards (12 CFR Part 30, Appendix D): every control, and what you already have

8 controls 117 frameworks share controls with it United States (OCC) verified against its source document

Every control below is one this framework asks for. The right hand column counts how many other frameworks in our corpus carry the same control, which is the difference between doing this work once and doing it again for the next standard.

There is no implementation kit for this framework yet. The control list and the overlap above are free and complete.

What you already have

Frameworks whose controls overlap this one, most first. If you run any of them, the count is roughly what you have already evidenced.

If you run	Shared controls
Annex 11 to EU GMP	3	measure it →
FFIEC IT Examination Handbook	3	measure it →
ICH Q10	3	measure it →
IEC 60601-1	3	measure it →
IMO Maritime Cybersecurity Guidelines (MSC-FAL.1/Circ.3/Rev.2)	3	measure it →
ISO/IEC 27557:2022	3	measure it →
ISO/IEC 23837	3	measure it →
ISO/IEC 38500:2024	3	measure it →
Monetary Authority of Singapore Technology Risk Management Guidelines	3	measure it →
MTCS (Singapore)	3	measure it →
NIST SP 800-171A Rev 3	3	measure it →
NIST SP 800-82 Revision 3: Guide to Industrial Control Systems (ICS) Security	3	measure it →

Every control

Code	Control	Also in
`OCCHS-1`	Scope, Applicability, and Definitions of Heightened Standards	91
`OCCHS-2`	Risk Governance Framework: Three Lines of Defense, Scope, and Charter	0
`OCCHS-3`	Risk Appetite Statement, Risk Limits, Concentration Risk, and Limit Breach Protocols	41
`OCCHS-4`	Independent Risk Management: CRO, Charter, Authority, and Oversight	0
`OCCHS-5`	Internal Audit: Independence, Scope, Methodology, and Reporting	0
`OCCHS-6`	Board of Directors: Composition, Independence, Oversight, and Self-Assessment	0
`OCCHS-7`	Risk Data Aggregation, Reporting, Talent, Compensation, and Strategic Planning	41
`OCCHS-8`	Third-Party Risk Within Heightened Standards and Integration with Broader Regulation	0

Tell me when OCC Heightened Standards (12 CFR Part 30, Appendix D) files something new

One email when a public company newly discloses something this framework governs, naming the company and what our corpus says it puts in scope. Nothing else, and one click to stop.

What this page is

A control-level reference for OCC Heightened Standards (12 CFR Part 30, Appendix D), drawn from our framework corpus. Control codes and titles are references to the standard, not reproductions of it. The overlap counts and the auditor artefacts are our own work and are the part you will not find elsewhere.

Measure this against what you already run · All frameworks · Today's edition