# Source Library This project prefers primary sources. The matrix text is original synthesis, but the domains and control logic are anchored to official frameworks, standards and public guidance. Current coverage intentionally spans ISO standards, NIST, CISA, ENISA, WHO, ILO, IFRC, UNODC, UNDRR, OECD, IFC and the World Bank. EK is retained as a supporting comparator, not as the governing source base. ## Geographic scope and interpretation - ISO, IFC, IFRC, ILO, OECD, UNDRR, UN Global Compact, UNODC, WHO and World Bank material is used as international guidance. - ENISA material represents a European Union perspective. - CISA, NIST and OSHA material is United States guidance. It is included for its practical and transferable control detail, not as a claim that United States law applies globally. - EK material is a Finland-specific comparator and is not treated as a universal or normative source. - Applicability, legal effect and local implementation must always be checked for the organization, sector and jurisdiction in question. ## Cross-cutting foundation - ISO 31000:2018 Risk management — Guidelines: - ISO 22301:2019 Security and resilience — Business continuity management systems — Requirements: - NIST Cybersecurity Framework 2.0: - WHO Health Emergency and Disaster Risk Management Framework: - United Nations Convention against Corruption: - ILO-OSH 2001 Guidelines: ## Supporting comparator - EK Corporate Security page: - EK official English PDF: ## Domain mappings ### People and Personnel Security Context: use these sources for travel risk, workplace conduct, psychosocial safety and targeted personal protection. - ISO 31030:2021 Travel risk management: - CISA Personal Security Considerations Action Guide: - ILO Violence and Harassment Convention, 2019 (No. 190): - WHO Guidelines on Mental Health at Work: ### Physical and Site Security Context: use these sources for protective design, site planning, access control and facility-level physical resilience. - CISA Physical Security: - IFC General Environmental, Health, and Safety Guidelines: - ISO 22341:2021 Security and resilience — Protective security — Guidelines for crime prevention through environmental design: - ISO 22342:2023 Security and resilience — Protective security — Guidelines for the development of a security plan for an organization: ### Emergency Preparedness and Life Safety Context: use these sources for emergency action planning, evacuation, first response and coordinated incident handling. - OSHA Emergency Preparedness and Response: - OSHA 29 CFR 1910.38 Emergency action plans: - IFC General Environmental, Health, and Safety Guidelines: - ISO 22320:2018 Security and resilience — Emergency management — Guidelines for incident management: - IFRC International First Aid, Resuscitation and Education Guidelines 2020: - WHO Mass Casualty Management: ### Operations, Supply Chain and Quality Context: use these sources for supply-chain dependence, quality control, continuity of delivery and operational risk treatment. - NIST Cybersecurity Supply Chain Risk Management publications: - ISO 28000:2022 Security and resilience — Security management systems — Requirements: - ISO 31000:2018 Risk management — Guidelines: - NIST SP 800-161 Rev. 1 Cybersecurity Supply Chain Risk Management Practices for Systems and Organizations: - ISO 9001:2015 Quality management systems — Requirements: ### Environmental and Hazardous Materials Safety Context: use these sources for environmental management systems, hazardous substances, emissions and incident containment. - ISO 14001:2015 Environmental management systems: - IFC General Environmental, Health, and Safety Guidelines: - ISO 50001:2018 Energy management systems: - WHO Chemical Incidents: - WHO Chemical Safety: ### Information and Cybersecurity Context: use these sources for cyber-risk governance, baseline controls, incident response and threat-informed defense. - NIST Cybersecurity Framework 2.0: - CISA Cross-Sector Cybersecurity Performance Goals: - NIST SP 800-61 Rev. 3 Incident Response Recommendations and Considerations for Cybersecurity Risk Management: - ISO/IEC 27001:2022: - NIST SP 800-53 Rev. 5 Security and Privacy Controls for Information Systems and Organizations: - ENISA Threat Landscape 2025: ### Integrity, Compliance and Investigations Context: use these sources for anti-corruption, integrity programmes, misconduct reporting and control governance. - United Nations Convention against Corruption: - UNODC Business Integrity Portal: - UN Global Compact Principle Ten: - 2021 OECD Anti-Bribery Recommendation Overview: - ISO 37001:2025 Anti-bribery management systems — Requirements with guidance for use: - World Bank Integrity Compliance Programs for SMEs: ### Business Continuity and Crisis Management Context: use these sources for continuity systems, crisis exercises, all-hazards resilience and coordinated recovery. - ISO 22301:2019 Security and resilience — Business continuity management systems — Requirements: - UNDRR Sendai Framework for Disaster Risk Reduction 2015-2030: - ISO 31000:2018 Risk management — Guidelines: - ISO 22398:2013 Societal security — Guidelines for exercises: - WHO Health Emergency and Disaster Risk Management Framework: ### Occupational Health and Safety Context: use these sources for occupational safety systems, worker health, preventive controls and safe work conditions. - ILO-OSH 2001 Guidelines: - ISO 45001:2018 Occupational health and safety management systems: - IFC General Environmental, Health, and Safety Guidelines: - ILO Occupational Safety and Health Convention, 1981 (No. 155): - WHO Occupational Health: