--- schema_version: "1" id: c35af3c474769b6263b2add08d92f4623c5e29c607aeae7dccb8950f9790ba9a title: Regulation Management in IT Compliance collection: admin version: current locale: en-us portal_url: https://docs.salesforce.com/admin/current/en-us/service/264-0-0/it_srvcs_grc_regmgmt_workflow.md canonical_url: https://help.salesforce.com/s/articleView?id=service.it_srvcs_grc_regmgmt_workflow.htm&release=264.0.0&type=5 source_site: help.salesforce.com content_type: documentation content_hash: a7eb8dbda4902121e2dd5ba81fd2d9ff32d862ee5d2cb5e38ffc807d8ad7739e description: Follow how a compliance team captures an external framework, such as SOC 2, as structured records, maps each clause to internal policies and controls, and keeps the framework current as the regulatory authority publishes amendments. products: - Service Cloud - Agentforce IT Service release: "264" --- # Regulation Management in IT Compliance Follow how a compliance team captures an external framework, such as SOC 2, as structured records, maps each clause to internal policies and controls, and keeps the framework current as the regulatory authority publishes amendments. ### Required Editions
Available in: Lightning Experience
Available in: Enterprise, Performance, and Unlimited Editions with Agentforce IT Service.
## Regulation Records To manage regulations effectively, review the records involved in the lifecycle. | Record Type | Description | | --- | --- | | Regulatory Authority | The body that issues a regulation, such as a government agency or industry standards organization. | | Regulation | A specific framework or mandate issued by a regulatory authority (for example, SOC 2 or NIST CSF). | | Regulation Version | A specific iteration of a regulation. Versions provide an audit trail of which requirements were in effect at a specific time. | | Regulation Clause | A specific provision within a regulation (for example, Least Privilege within Logical and Physical Access). | | Regulation Clause Version | The version-controlled text of a specific provision. | ## The End-to-End Workflow: A SOC 2 Example Follow the lifecycle of the SOC 2 framework to see how regulation records connect with policies, controls, and issues across IT Compliance. ## Centralizing Regulatory Content The workflow begins when a Compliance Lead, Sarah, identifies an external framework that the organization must comply with, such as SOC 2, for a customer contract. She creates a regulatory authority record for SOC 2, and then captures each regulation issued by the authority along with its underlying clauses. For SOC 2, this can include core regulations aligned with the Common Criteria, such as Logical and Physical Access, and the clauses within each one, such as Least Privilege, Physical Security, and Asset Disposal. To avoid manually creating each clause, Sarah uploads the SOC 2 regulation document and uses generative AI to extract the clauses for her. She reviews the extracted clauses and saves them as regulation clause records associated with the SOC 2 regulation version. ## Versioning and Amendments When Sarah creates a regulation or a clause, a version record is automatically created in Draft status. She publishes the version when its content is final, and activates the version on its effective date to enforce it across the organization. When the regulatory authority publishes an amendment, Sarah clones the active version to create a new version. The new version inherits all clause mappings from the active version, so Sarah only has to update the clauses the amendment changed. After the new version takes effect, Sarah retires the previous active version. This pattern keeps a full audit trail of which requirements were in effect at any point in time. ## Mapping to Internal Policies, Controls, and Risks The compliance team maps each regulation clause version to the internal policy clauses that translate it into organizational standards, to the compliance controls that enforce it technically, and to the risks it mitigates. For example, they map the Least Privilege regulation clause to a Principle of Least Privilege policy clause, to a Data Leakage Prevention control that enforces it technically, and to the Unauthorized Data Access risk that the control mitigates. To create these downstream mappings, see: - [Map IT Compliance Policy Clause Versions to Policy Versions and Regulation Clause Versions](https://help.salesforce.com/s/articleView?id=service.it_srvcs_cmpl_map_policy_reg_clauses.htm&release=264.0.0&type=5 "Map policy clauses to parent policy versions and external regulatory requirements. Linking a clause to a policy version ensures the document is complete and ready for distribution. Linking an internal clause to an external regulation clause provides verifiable proof for auditors and also helps you quickly identify which internal policies need updates when an external law changes.") to link internal policy clauses to the regulation clauses they implement. - [Controls Management Workflow for IT Compliance](https://help.salesforce.com/s/articleView?id=service.it_srvcs_controls_mgmt_workflow.htm&release=264.0.0&type=5 "Follow how a compliance team creates, tests, and maintains compliance controls that enforce policies, satisfy regulations, and mitigate risks. See how controls are mapped to risks, business operations processes, and assets, and how control testing feeds into evidence collection and remediation workflows.") to link compliance controls to the regulation clauses they enforce. - [Map Risks to Policy Clauses and Controls for IT Compliance](https://help.salesforce.com/s/articleView?id=service.it_srvcs_map_risks.htm&release=264.0.0&type=5 "Link risks to the policy clauses they could violate and the controls that mitigate them. Mapping policy clauses to risks helps teams track which corporate rules are threatened by each risk, while mapping controls to risks helps teams track how effective your safeguards are.") to link risks to the policy clauses they could violate and the controls that mitigate them. ## Identifying and Resolving Compliance Gaps When a control test fails or an audit finding identifies a gap against a regulation clause, the compliance team logs a compliance issue and links it to the regulation clause as the source. The issue moves through remediation and closes only after the issue owner validates the fix. To track issues against regulations, see [Issue Management for IT Compliance](https://help.salesforce.com/s/articleView?id=service.it_srvcs_cmpl_issue_mgmt_parent.htm&release=264.0.0&type=5 "Log, track, and resolve compliance gaps that surface from failed control tests, asset misconfigurations, missed policy acknowledgments, or audit findings. Link each issue to the source record, assign an owner, and confirm remediation through an action plan governed by SLA policies."). ## Traceability This structured workflow creates a traceable map of interconnected records. If an auditor asks for proof of compliance with a SOC 2 requirement, your organization can show a complete chain of evidence: - The regulation clause that captures the external requirement. - The internal policy clause that translates the requirement into an organizational standard. - The compliance control that enforces the standard technically. - The compliance issues raised against the clause and how each one was resolved.