Ever have to work in a regulatory environment as an IT person? This document is probably one of the most exhaustive Information Technology regulatory requirement documents I have found: https://www.securecontrolsframework.com/

You can filter out the blanks in your selected environment to see the referenced rule and measures/requirements.

I hope this helps someone as technology security is paramount.
-TURFPTAx
