VRC ASSURANCE
Pairs with: Secure AI adoption →ServicesVRC AssuranceControl set
VRC Assurance · Control set
The VRC Control Set
One published set of controls that VRC Assurance reviews you against. It pulls from the frameworks you already hear about, so one assessment shows where you stand across all of them.
Fifteen domains, one review
The control set covers the security and privacy basics small and mid-size businesses need, including regulated ones, plus a dedicated AI governance domain. Each control has a plain statement, examples of the evidence that shows it's working, and a defined test method.
VRC-GV
Governance & Risk
4 controls
VRC-PL
Policies
2 controls
VRC-HR
Workforce & Training
5 controls
VRC-AC
Access Control & MFA
7 controls
VRC-AM
Asset Inventory
3 controls
VRC-VM
Vendor & BAA Management
3 controls
VRC-DP
Data Protection & Encryption
4 controls
VRC-LM
Logging & Monitoring
3 controls
VRC-VP
Vulnerability & Patch Management
3 controls
VRC-CF
Secure Configuration
4 controls
VRC-IR
Incident Response
4 controls
VRC-BC
Backup, business continuity & DR
4 controls
VRC-PS
Physical & Device Security
4 controls
VRC-EM
Email Security
3 controls
VRC-AI
AI Governance
5 controls
The crosswalk, domain by domain
Every domain maps to the security and privacy frameworks below. The AI governance domain also maps to NIST AI RMF and ISO/IEC 42001.
| Domain | HIPAA | NIST CSF 2.0 | SOC 2 | ISO 27001 | HITRUST e1 | NIST AI RMF | ISO 42001 |
|---|---|---|---|---|---|---|---|
| Governance & Risk | ● | ● | ● | ● | ○ | – | – |
| Policies | ● | ● | ● | ● | ○ | – | – |
| Workforce & Training | ● | ● | ● | ● | ○ | – | – |
| Access Control & MFA | ● | ● | ● | ● | ○ | – | – |
| Asset Inventory | ● | ● | ● | ● | ○ | – | – |
| Vendor & BAA Management | ● | ● | ● | ● | ○ | – | – |
| Data Protection & Encryption | ● | ● | ● | ● | ○ | – | – |
| Logging & Monitoring | ● | ● | ● | ● | ○ | – | – |
| Vulnerability & Patch Management | ● | ● | ● | ● | ○ | – | – |
| Secure Configuration | ● | ● | ● | ● | ○ | – | – |
| Incident Response | ● | ● | ● | ● | ○ | – | – |
| Backup, BC/DR | ● | ● | ● | ● | ○ | – | – |
| Physical & Device Security | ● | ● | ● | ● | ○ | – | – |
| Email Security | ● | ● | ● | ● | ○ | – | – |
| AI Governance | ● | ● | ● | ● | ○ | ● | ● |
● Mapped at the control level · ○ Aligned at the topic level · – Not applicable. Licensed standards are cited by identifier and short title only. The crosswalk is alignment evidence, not a certification or attestation under any of these frameworks.
The AI governance domain
Five controls that answer the questions partners now ask about AI: what you use, what it can see, and who checks its work.
VRC-AI-01
AI use inventory.
The organization maintains an inventory of AI tools, features, and agents in use, with owner, purpose, data types processed, and vendor.
VRC-AI-02
AI acceptable use policy.
The organization maintains a leadership-approved AI acceptable use policy that defines approved tools, prohibited uses, and data handling rules.
VRC-AI-03
Human review of AI output.
The organization requires a qualified person to review AI-generated output before it is used in operational, financial, compliance, or client-facing decisions or communications.
VRC-AI-04
No PHI in AI tools without a BAA.
The organization prohibits entering PHI into any AI tool unless the vendor has signed a BAA and the tool is approved and configured to exclude the organization's data from model training.
VRC-AI-05
Least-privilege, read-only AI access.
The organization grants AI tools and agents only the minimum access needed for their approved purpose, read-only by default, through dedicated identities whose activity is logged and reviewed.
Putting these controls in place? See Secure AI adoption →
How each control is tested, without touching PHI
Inspect.
We review the documents, configurations, and records that show a control is in place.
Inquire.
We talk with the people who own the control about how it actually runs.
Observe.
We watch the control operate, like an access change or a backup restore.
Re-perform.
We sample and re-run the control ourselves to confirm it works as described.
Evidence without PHI. Evidence is limited to items that shouldn't contain protected health information: configurations, policies, screenshots, and training and review records. Any AI used to organize evidence works read-only, and a VRC assessor reviews every finding.
Walk through the control set with us
We'll show you how your program lines up today and what Assurance would look like for your business.