{"id":3516,"date":"2026-08-13T09:09:43","date_gmt":"2026-08-13T08:09:43","guid":{"rendered":"https:\/\/icomply.pm\/documentation\/governance-domains\/"},"modified":"2026-08-16T22:53:07","modified_gmt":"2026-08-16T21:53:07","slug":"governance-domains","status":"publish","type":"page","link":"https:\/\/icomply.pt\/en\/documentation\/governance-domains\/","title":{"rendered":"Governance Domains"},"content":{"rendered":"\t\t<div data-elementor-type=\"wp-page\" data-elementor-id=\"3516\" class=\"elementor elementor-3516 elementor-3302\" data-elementor-post-type=\"page\">\n\t\t\t\t<div class=\"elementor-element elementor-element-d148689 e-flex e-con-boxed e-con e-parent\" data-id=\"d148689\" data-element_type=\"container\" data-e-type=\"container\" data-settings=\"{&quot;background_background&quot;:&quot;gradient&quot;}\">\n\t\t\t\t\t<div class=\"e-con-inner\">\n\t\t<div class=\"elementor-element elementor-element-6028f78 e-con-full e-flex e-con e-child\" data-id=\"6028f78\" data-element_type=\"container\" data-e-type=\"container\">\n\t\t\t\t<div class=\"elementor-element elementor-element-05d92e2 elementor-icon-list--layout-inline elementor-align-start elementor-list-item-link-full_width elementor-widget elementor-widget-icon-list\" data-id=\"05d92e2\" data-element_type=\"widget\" data-e-type=\"widget\" data-widget_type=\"icon-list.default\">\n\t\t\t\t\t\t\t<ul class=\"elementor-icon-list-items elementor-inline-items\">\n\t\t\t\t\t\t\t<li class=\"elementor-icon-list-item elementor-inline-item\">\n\t\t\t\t\t\t\t\t\t\t\t<a href=\"\/\">\n\n\t\t\t\t\t\t\t\t\t\t\t<span class=\"elementor-icon-list-text\">Documentation<\/span>\n\t\t\t\t\t\t\t\t\t\t\t<\/a>\n\t\t\t\t\t\t\t\t\t<\/li>\n\t\t\t\t\t\t\t\t<li class=\"elementor-icon-list-item elementor-inline-item\">\n\t\t\t\t\t\t\t\t\t\t<span class=\"elementor-icon-list-text\">\/<\/span>\n\t\t\t\t\t\t\t\t\t<\/li>\n\t\t\t\t\t\t\t\t<li class=\"elementor-icon-list-item elementor-inline-item\">\n\t\t\t\t\t\t\t\t\t\t<span class=\"elementor-icon-list-text\"><span style=\"color: #c3ccd8\">Governance domains<\/span><\/span>\n\t\t\t\t\t\t\t\t\t<\/li>\n\t\t\t\t\t\t<\/ul>\n\t\t\t\t\t\t<\/div>\n\t\t\t\t<div class=\"elementor-element elementor-element-e504073 elementor-icon-list--layout-traditional elementor-list-item-link-full_width elementor-widget elementor-widget-icon-list\" data-id=\"e504073\" data-element_type=\"widget\" data-e-type=\"widget\" data-widget_type=\"icon-list.default\">\n\t\t\t\t\t\t\t<ul class=\"elementor-icon-list-items\">\n\t\t\t\t\t\t\t<li class=\"elementor-icon-list-item\">\n\t\t\t\t\t\t\t\t\t\t\t<span class=\"elementor-icon-list-icon\">\n\t\t\t\t\t\t\t<svg aria-hidden=\"true\" class=\"e-font-icon-svg e-fas-circle\" viewBox=\"0 0 512 512\" xmlns=\"http:\/\/www.w3.org\/2000\/svg\"><path d=\"M256 8C119 8 8 119 8 256s111 248 248 248 248-111 248-248S393 8 256 8z\"><\/path><\/svg>\t\t\t\t\t\t<\/span>\n\t\t\t\t\t\t\t\t\t\t<span class=\"elementor-icon-list-text\">Reference \u00b7 12 mins<\/span>\n\t\t\t\t\t\t\t\t\t<\/li>\n\t\t\t\t\t\t<\/ul>\n\t\t\t\t\t\t<\/div>\n\t\t\t\t<div class=\"elementor-element elementor-element-c9ff6e2 elementor-widget__width-initial elementor-widget elementor-widget-image-box\" data-id=\"c9ff6e2\" data-element_type=\"widget\" data-e-type=\"widget\" data-widget_type=\"image-box.default\">\n\t\t\t\t\t<div class=\"elementor-image-box-wrapper\"><div class=\"elementor-image-box-content\"><div class=\"elementor-image-box-title\">Governance Domains<\/div><p class=\"elementor-image-box-description\">How to enable and configure Security, Privacy, AI and all the other domains \u2014 and why the second domain costs a fraction of the first.\n\n<\/p><\/div><\/div>\t\t\t\t<\/div>\n\t\t\t\t<\/div>\n\t\t\t\t\t<\/div>\n\t\t\t\t<\/div>\n\t\t<div class=\"elementor-element elementor-element-8a9f396 e-flex e-con-boxed e-con e-parent\" data-id=\"8a9f396\" data-element_type=\"container\" data-e-type=\"container\" data-settings=\"{&quot;background_background&quot;:&quot;classic&quot;}\">\n\t\t\t\t\t<div class=\"e-con-inner\">\n\t\t\t\t<div class=\"elementor-element elementor-element-e7f3788 content_34535345 elementor-widget elementor-widget-text-editor\" data-id=\"e7f3788\" data-element_type=\"widget\" data-e-type=\"widget\" data-widget_type=\"text-editor.default\">\n\t\t\t\t\t\t\t\t\t<div class=\"icbody\" style=\"min-width: 0;\"><p>A g<strong>overnance domain <\/strong>is an area of responsibility within the organisation \u2014 security, privacy, AI, ethics, people, third parties, ESG, quality, audit and regulatory change. They all run on the same controls engine, which means that the domains are not silos: they share controls, risks and evidence with one another. <\/p><h2 id=\"modelo\">The model: domains based on a common engine<\/h2><p>Each domain has its own library of controls, its own workflows and its own reports. However, the control itself is a single, shared object. When you activate a second domain, the platform recognises the controls you have already implemented and automatically reuses them.  <\/p><p>Practical implication: the first area is a project; the second is a mapping exercise. That is why organisations that start with Security are able to add Privacy within weeks rather than months. <\/p><h2 id=\"ativar\">Activate a domain<\/h2><ol><li>Go to <code>Dom\u00ednios \u2192 Cat\u00e1logo<\/code>.<\/li><li>Select the domain and the <strong>relevant frameworks<\/strong> (you may select more than one).<\/li><li>Define the <strong>scope<\/strong>: which legal entities and units are covered.<\/li><li>Confirm. The control library is generated and the platform flags any controls that already exist in other domains. <\/li><\/ol><p>Your subscription plan determines how many domains you can have active at the same time \u2014 see <a href=\"https:\/\/icomply.pt\/en\/pricing\/\">Pricing<\/a>.<\/p><h2 id=\"catalogo\">The ten domains<\/h2><h3>Security Governance<\/h3><p>SGSI and the statement of applicability, risk register, access reviews, vulnerabilities, incidents, assets, and ICT continuity and resilience. This is the area that overlaps most with all the others \u2014 which is why it is the most common starting point. <\/p><p><strong>Frameworks:<\/strong> ISO 27001, ISO 27002, NIS2, DORA, CIS Controls, SOC 2, TISAX, ISO 20000. Focus on <a href=\"https:\/\/icomply.pt\/en\/governance\/security-governance\/\">Security Governance<\/a>. <\/p><h3>Privacy Governance<\/h3><p>ROPA (record of processing activities), personal data, data subjects\u2019 requests, consent and legal bases, retention, data breaches, data processors and international transfers.<\/p><p><strong>Frameworks:<\/strong> RGPD, ISO 27701, ePrivacy, ISO 27018. Detalhe em <a href=\"https:\/\/icomply.pt\/en\/governance\/privacy-governance\/\">Governance de Privacidade<\/a>. <\/p><h3>AI Governance<\/h3><p>Inventory of AI systems, risk classification under the AI Act, human oversight, bias assessment, explainability, AIDF and performance monitoring. Covers both ISO 42001 and the AI Act as a single suite. <\/p><p><strong>Frameworks:<\/strong> EU AI Act, ISO 42001, ISO 23894, NIST AI RMF. Focus on <a href=\"https:\/\/icomply.pt\/en\/governance\/ai-governance\/\">AI governance<\/a>. <\/p><h3>Ethics &#038; Integrity<\/h3><p>Whistleblowing channel in accordance with the law, case management and investigations, anti-bribery, conflicts of interest, code of conduct, corruption risk prevention plan and protection against retaliation.<\/p><p><strong>Frameworks:<\/strong> RGPC, Law 93\/2021, Whistleblowing Directive, ISO 37001, ISO 37301. Further details in <a href=\"https:\/\/icomply.pt\/en\/governance\/ethics-integrity-governance\/\">Ethics &#038; Integrity<\/a>. <\/p><h3>Workforce Governance<\/h3><p>Pay bands and pay gap analysis, health and safety at work, the compulsory training matrix, HR policies with compliance targets, equality, and AI governance applied to recruitment and career progression.<\/p><p><strong>Frameworks:<\/strong> Pay Transparency Directive, ISO 45001, Labour Code, CSRD. Focus on <a href=\"https:\/\/icomply.pt\/en\/governance\/workforce-governance\/\">Workforce Governance<\/a>. <\/p><h3>Third-Party Governance<\/h3><p>Supplier inventory and criticality, due diligence and onboarding, security assessments, DPAs and data transfers, ICT supplier registration and concentration risk, ongoing monitoring and audits.<\/p><p><strong>Frameworks:<\/strong> TPRM, DORA ICT, ISO 27036, RGPD Art. 28. Detalhe em <a href=\"https:\/\/icomply.pt\/en\/governance\/third-party-governance\/\">Governance de Terceiros<\/a>. <\/p><h3>ESG &#038; Sustainability<\/h3><p>CSRD disclosures mapped to ESRS data points, dual materiality, environmental KPIs, social and governance metrics, EU Taxonomy eligibility and assurance-ready evidence.<\/p><p><strong>Frameworks:<\/strong> CSRD, ESRS, ISO 14001, GRI, EU Taxonomy. Focus on <a href=\"https:\/\/icomply.pt\/en\/governance\/esg-governance-sustainability\/\">ESG &#038; Sustainability<\/a>. <\/p><h3>Quality &#038; Operations<\/h3><p>Procedures and SOPs relating to controls, non-conformities, the CAPA cycle, supplier quality, internal quality audits and document control with approvals.<\/p><p><strong>Frameworks:<\/strong> ISO 9001, ISO 13485, ISO 22000, ISO 20000. Specialising in <a href=\"https:\/\/icomply.pt\/en\/governance\/quality-operations-governance\/\">Quality &#038; Operations<\/a>. <\/p><h3>Audit &#038; Assurance<\/h3><p>Risk-based audit framework, planning and timetable, execution and working papers, categorised findings, CAPA, ongoing assurance between audits and management review.<\/p><p><strong>Frameworks:<\/strong> applies across all active frameworks. See the<a href=\"https:\/\/icomply.pt\/en\/governance\/audit-governance-compliance-assurance\/\"> Audit &#038; Assurance<\/a> section for further details. <\/p><h3>Regulatory Change<\/h3><p>Central register of legal obligations, compliance calendar, horizon scanning of European regulations, mapping of obligations to controls, monitoring of jurisdictions and automatic alerts.<\/p><p><strong>Frameworks:<\/strong> the EU AI Act, NIS2, DORA, CSRD, the GDPR and national legislation. See \u2018<a href=\"https:\/\/icomply.pt\/en\/governance\/regulatory-change-governance\/\">Regulatory Changes Governance<\/a>\u2019 for further details. <\/p><h2 id=\"sequencia\">Which sequence should I follow?<\/h2><p>There is no universal order, but there are patterns that work:<\/p><ul><li><strong>Organisation subject to certification requirements <\/strong>\u2192 Safety, then Audit, then Third Parties.<\/li><li><strong>Organisation with significant exposure to personal data<\/strong> \u2192 Privacy, then Security, then AI.<\/li><li><strong>Organisation to adopt AI <\/strong>\u2192 AI, then Privacy (there is significant overlap), then Ethics.<\/li><li><strong>Financial institution<\/strong> \u2192 Security (DORA), then Third parties (IT suppliers), then Audit.<\/li><li><strong>Group with mandatory sustainability reporting <\/strong>\u2192 ESG, then People, then Ethics.<\/li><\/ul><h2 id=\"ambito\">Scope and multi-entity<\/h2><p>A domain may have a different scope for each entity. A group may, for example, apply Security Governance to all entities but ESG only to the holding company to which it reports. In <code>Dom\u00ednios \u2192 \u00c2mbito<\/code>, this matrix is defined, and the reports automatically comply with it.  <\/p><h2 id=\"desativar\">Deactivate a domain<\/h2><p>Deactivating a domain does not delete any data. The controls, records and history remain and continue to serve the other domains that reference them \u2014 you simply no longer see the flows and reports for that domain. This means you can reactivate it without losing anything.  <\/p><\/div>\t\t\t\t\t\t\t\t<\/div>\n\t\t<div class=\"elementor-element elementor-element-29e8b8c e-con-full max_w_280 e-flex e-con e-child\" data-id=\"29e8b8c\" data-element_type=\"container\" data-e-type=\"container\">\n\t\t\t\t<div class=\"elementor-element elementor-element-faf94d9 elementor-widget__width-inherit elementor-widget elementor-widget-table-of-contents\" data-id=\"faf94d9\" data-element_type=\"widget\" data-e-type=\"widget\" data-settings=\"{&quot;headings_by_tags&quot;:[&quot;h2&quot;],&quot;exclude_headings_by_selector&quot;:[],&quot;marker_view&quot;:&quot;bullets&quot;,&quot;icon&quot;:{&quot;value&quot;:&quot;&quot;,&quot;library&quot;:&quot;&quot;},&quot;min_height&quot;:{&quot;unit&quot;:&quot;px&quot;,&quot;size&quot;:0,&quot;sizes&quot;:[]},&quot;min_height_tablet_extra&quot;:{&quot;unit&quot;:&quot;px&quot;,&quot;size&quot;:&quot;&quot;,&quot;sizes&quot;:[]},&quot;min_height_tablet&quot;:{&quot;unit&quot;:&quot;px&quot;,&quot;size&quot;:&quot;&quot;,&quot;sizes&quot;:[]},&quot;min_height_mobile&quot;:{&quot;unit&quot;:&quot;px&quot;,&quot;size&quot;:&quot;&quot;,&quot;sizes&quot;:[]}}\" data-widget_type=\"table-of-contents.default\">\n\t\t\t\t\t\t\t\t\t<div class=\"elementor-toc__header\">\n\t\t\t\t\t\t<h4 class=\"elementor-toc__header-title\">\n\t\t\t\tOn this page\t\t\t<\/h4>\n\t\t\t\t\t\t\t\t<\/div>\n\t\t\t\t<div id=\"elementor-toc__faf94d9\" class=\"elementor-toc__body\">\n\t\t\t<div class=\"elementor-toc__spinner-container\">\n\t\t\t\t<svg class=\"elementor-toc__spinner eicon-animation-spin e-font-icon-svg e-eicon-loading\" aria-hidden=\"true\" viewBox=\"0 0 1000 1000\" xmlns=\"http:\/\/www.w3.org\/2000\/svg\"><path d=\"M500 975V858C696 858 858 696 858 500S696 142 500 142 142 304 142 500H25C25 237 238 25 500 25S975 237 975 500 763 975 500 975Z\"><\/path><\/svg>\t\t\t<\/div>\n\t\t<\/div>\n\t\t\t\t\t\t<\/div>\n\t\t<div class=\"elementor-element elementor-element-710804e e-con-full e-flex e-con e-child\" data-id=\"710804e\" data-element_type=\"container\" data-e-type=\"container\" data-settings=\"{&quot;background_background&quot;:&quot;classic&quot;}\">\n\t\t\t\t<div class=\"elementor-element elementor-element-a161216 elementor-widget__width-inherit elementor-widget elementor-widget-image-box\" data-id=\"a161216\" data-element_type=\"widget\" data-e-type=\"widget\" data-widget_type=\"image-box.default\">\n\t\t\t\t\t<div class=\"elementor-image-box-wrapper\"><div class=\"elementor-image-box-content\"><div class=\"elementor-image-box-title\">Which domain should I start with?<\/div><p class=\"elementor-image-box-description\">Tell us which frameworks you use and your deadlines \u2014 we\u2019ll map out the right approach for your organisation.\n\n<\/p><\/div><\/div>\t\t\t\t<\/div>\n\t\t\t\t<div class=\"elementor-element elementor-element-a67cb0c elementor-align-justify elementor-widget__width-inherit elementor-widget elementor-widget-button\" data-id=\"a67cb0c\" data-element_type=\"widget\" data-e-type=\"widget\" data-widget_type=\"button.default\">\n\t\t\t\t\t\t\t\t\t\t<a class=\"elementor-button elementor-button-link elementor-size-sm\" href=\"https:\/\/icomply.pt\/en\/contact\/\">\n\t\t\t\t\t\t<span class=\"elementor-button-content-wrapper\">\n\t\t\t\t\t\t\t\t\t<span class=\"elementor-button-text\">Talk to the team<br \/><\/span>\n\t\t\t\t\t<\/span>\n\t\t\t\t\t<\/a>\n\t\t\t\t\t\t\t\t<\/div>\n\t\t\t\t<\/div>\n\t\t\t\t<\/div>\n\t\t\t\t\t<\/div>\n\t\t\t\t<\/div>\n\t\t<div class=\"elementor-element elementor-element-31629a3 e-flex e-con-boxed e-con e-parent\" data-id=\"31629a3\" data-element_type=\"container\" data-e-type=\"container\" data-settings=\"{&quot;background_background&quot;:&quot;classic&quot;}\">\n\t\t\t\t\t<div class=\"e-con-inner\">\n\t\t\t\t<div class=\"elementor-element elementor-element-3096f2c elementor-widget elementor-widget-heading\" data-id=\"3096f2c\" data-element_type=\"widget\" data-e-type=\"widget\" data-widget_type=\"heading.default\">\n\t\t\t\t\t<h3 class=\"elementor-heading-title elementor-size-default\">Continue reading\n<\/h3>\t\t\t\t<\/div>\n\t\t<div class=\"elementor-element elementor-element-e272f44 e-con-full e-grid e-con e-child\" data-id=\"e272f44\" data-element_type=\"container\" data-e-type=\"container\">\n\t\t<a class=\"elementor-element elementor-element-9194c55 e-con-full e-flex e-con e-child\" data-id=\"9194c55\" data-element_type=\"container\" data-e-type=\"container\" data-settings=\"{&quot;background_background&quot;:&quot;classic&quot;}\" href=\"https:\/\/icomply.pt\/en\/documentation\/controls-mapping\/\">\n\t\t\t\t<div class=\"elementor-element elementor-element-685ab1e elementor-widget__width-inherit elementor-widget elementor-widget-image-box\" data-id=\"685ab1e\" data-element_type=\"widget\" data-e-type=\"widget\" data-widget_type=\"image-box.default\">\n\t\t\t\t\t<div class=\"elementor-image-box-wrapper\"><div class=\"elementor-image-box-content\"><div class=\"elementor-image-box-title\">Controls &amp; mapping<\/div><p class=\"elementor-image-box-description\">Map controls once and reuse them across all frameworks.<\/p><\/div><\/div>\t\t\t\t<\/div>\n\t\t\t\t<\/a>\n\t\t<a class=\"elementor-element elementor-element-9e6bf97 e-con-full e-flex e-con e-child\" data-id=\"9e6bf97\" data-element_type=\"container\" data-e-type=\"container\" data-settings=\"{&quot;background_background&quot;:&quot;classic&quot;}\" href=\"https:\/\/icomply.pt\/en\/documentation\/evidence-audits\/\">\n\t\t\t\t<div class=\"elementor-element elementor-element-46fcef4 elementor-widget__width-inherit elementor-widget elementor-widget-image-box\" data-id=\"46fcef4\" data-element_type=\"widget\" data-e-type=\"widget\" data-widget_type=\"image-box.default\">\n\t\t\t\t\t<div class=\"elementor-image-box-wrapper\"><div class=\"elementor-image-box-content\"><div class=\"elementor-image-box-title\">Evidence &amp; audits<\/div><p class=\"elementor-image-box-description\">Collect reusable evidence and carry out audit and CAPA workflows.<\/p><\/div><\/div>\t\t\t\t<\/div>\n\t\t\t\t<\/a>\n\t\t<a class=\"elementor-element elementor-element-6d19a86 e-con-full e-flex e-con e-child\" data-id=\"6d19a86\" data-element_type=\"container\" data-e-type=\"container\" data-settings=\"{&quot;background_background&quot;:&quot;classic&quot;}\" href=\"https:\/\/icomply.pt\/en\/documentation\/first-steps\/\">\n\t\t\t\t<div class=\"elementor-element elementor-element-c79477c elementor-widget__width-inherit elementor-widget elementor-widget-image-box\" data-id=\"c79477c\" data-element_type=\"widget\" data-e-type=\"widget\" data-widget_type=\"image-box.default\">\n\t\t\t\t\t<div class=\"elementor-image-box-wrapper\"><div class=\"elementor-image-box-content\"><div class=\"elementor-image-box-title\">First steps<\/div><p class=\"elementor-image-box-description\">Set up your organisation, invite users and launch your first domain.<\/p><\/div><\/div>\t\t\t\t<\/div>\n\t\t\t\t<\/a>\n\t\t\t\t<\/div>\n\t\t\t\t\t<\/div>\n\t\t\t\t<\/div>\n\t\t\t\t<\/div>\n\t\t","protected":false},"excerpt":{"rendered":"<p>Documentation \/ Governance domains Reference \u00b7 12 mins Governance Domains How to enable and configure Security, Privacy, AI and all the other domains \u2014 and why the second domain costs a fraction of the first. A governance domain is an area of responsibility within the organisation \u2014 security, privacy, AI, ethics, people, third parties, ESG, [&hellip;]<\/p>\n","protected":false},"author":1,"featured_media":0,"parent":2895,"menu_order":2,"comment_status":"closed","ping_status":"closed","template":"elementor_header_footer","meta":{"_ice_seo_score":0,"_ice_review":"","footnotes":""},"class_list":["post-3516","page","type-page","status-publish","hentry"],"_links":{"self":[{"href":"https:\/\/icomply.pt\/en\/wp-json\/wp\/v2\/pages\/3516","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/icomply.pt\/en\/wp-json\/wp\/v2\/pages"}],"about":[{"href":"https:\/\/icomply.pt\/en\/wp-json\/wp\/v2\/types\/page"}],"author":[{"embeddable":true,"href":"https:\/\/icomply.pt\/en\/wp-json\/wp\/v2\/users\/1"}],"replies":[{"embeddable":true,"href":"https:\/\/icomply.pt\/en\/wp-json\/wp\/v2\/comments?post=3516"}],"version-history":[{"count":2,"href":"https:\/\/icomply.pt\/en\/wp-json\/wp\/v2\/pages\/3516\/revisions"}],"predecessor-version":[{"id":3526,"href":"https:\/\/icomply.pt\/en\/wp-json\/wp\/v2\/pages\/3516\/revisions\/3526"}],"up":[{"embeddable":true,"href":"https:\/\/icomply.pt\/en\/wp-json\/wp\/v2\/pages\/2895"}],"wp:attachment":[{"href":"https:\/\/icomply.pt\/en\/wp-json\/wp\/v2\/media?parent=3516"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}