Compliance frameworks supported by GRCLens

Protective Security Requirements (NZ)

The New Zealand Government's protective security framework: security governance, personnel, information and physical security, with annual assurance reporting.

• GOVSEC & security leadership
• PERSEC personnel security
• INFOSEC & NZISM alignment
• PHYSEC & annual reporting

Minimum Cyber Security Standards (NZ)

The NCSC's mandatory cyber baseline for mandated agencies, assessed on the CS-CMM maturity model at minimum level CMM2, reported through PSR assurance.

• Business-critical & external systems
• CS-CMM maturity evidence
• Minimum level CMM2 Planned & Tracked
• Reports via PSR assurance

Health Information Security Framework (NZ)

Te Whatu Ora's standard for protecting health information across the NZ health and disability sector, including Māori data governance obligations.

• Plan, identify & protect
• Detect & respond
• Te Tiriti & Māori data governance
• Board-level visibility

Protective Security Policy Framework (AU)

The Australian Government's protective security requirements across governance, information, personnel and physical security: 2025 Annual Release structure.

• Security governance & risk
• Information & technology security
• Personnel & physical security
• Annual maturity reporting

IRAP (Australian ISM Assessments)

Run Australian ISM assessments the IRAP way, scoped engagements, control-by-control evaluation, connector-collected evidence and findings registers.

• Engagement workspaces
• ISM catalogue pinned per revision
• Automated evidence collection
• Findings & assurance loop

ASD Essentials (Essential Eight successor)

ASD's principles, actions and domains for enterprise IT, OT and cloud: scoped by chapter, rated per domain and reported to the board by domain.

• Scoping wizard by chapter and environment
• Indicators of good practice
• Dashboards for each audience
• Essential Eight carry-over

ASD Essential Eight Maturity Model

Self-assess the eight mitigation strategies against the Essential Eight Maturity Model, set a target maturity level, and carry the result into ASD Essentials when you move.

AESCSF & SOCI CIRMP

Energy-sector cyber maturity (AESCSF) and SOCI Act risk-management obligations: maturity evidence and the annual board-approved CIRMP report.

• AESCSF maturity assessment
• SOCI CIRMP obligations
• Recognised framework options
• Board-ready reporting

CPS 234 Information Security

APRA's information security standard for banks, insurers and super trustees: 32 obligations across nine sections, with the 72-hour incident and 10-business-day control-weakness notifications tracked as indicators.

• 32 controls, 9 sections
• 72-hour and 10-business-day clocks
• Third-party assurance in scope
• In force since 2019, unamended

CPS 230 Operational Risk Management

APRA's operational resilience standard, in force from 1 July 2026: critical operations, tolerance levels, BCP testing and the material service provider register as 86 controls, with every APRA clock tracked.

• 86 controls, 7 domains
• 24-hour tolerance-breach notification
• Material service provider register
• Deemed lists by sector

Victorian Protective Data Security Standards

OVIC's data security standards for the Victorian public sector: governance, information, personnel, ICT and physical security with PDSP attestation.

• Five security standards
• Information asset context
• ISM-aligned ICT security
• PDSP & executive attestation

PCI DSS v4.0.1

The payment card industry standard for any organization that stores, processes or transmits cardholder data, including the v4.0.1 future-dated requirements now in force.

• 12 core requirements
• Scope & segmentation
• Customised approach
• QSA-ready evidence

ISA/IEC 62443 (OT / ICS Security)

Industrial control system security, the asset-owner security programme and the seven foundational requirements, with zones, conduits and security levels.

• Security programme (62443-2-1)
• Foundational requirements FR1–FR7
• Zones & conduits
• Security levels SL1–SL4

HIPAA (Security & Privacy Rules)

The US healthcare regulation protecting electronic protected health information, documented risk analysis plus administrative, physical and technical safeguards.

• Security Rule safeguards
• Privacy Rule & PHI
• Risk analysis & management
• Breach notification

GDPR (EU 2016/679)

The EU's data protection regulation: lawful basis, data subject rights, records of processing, transfers and breach readiness, evidenced for accountability.

• Lawful basis & subject rights
• Records of processing (RoPA)
• DPIA & cross-border transfers
• 72-hour breach notification

NIS2 Directive (EU) 2022/2555

The EU's cybersecurity directive for essential and important entities, assessed per group or legal entity: Article 20 accountability, the ten Article 21 measures, the reporting clock and 27 national transpositions.

• 303 requirements, 14 domains
• 24 h / 72 h / one-month reporting clock
• 27-Member-State transposition overlay
• Group roll-up & risk heat map

Digital Operational Resilience Act (DORA)

The EU's operational resilience regulation for financial entities and their ICT providers, applicable since 17 January 2025: ICT risk, incident reporting, resilience testing, third-party risk and information sharing.

• 230 requirements, 11 domains
• 4 h / 72 h / one-month incident clock
• Register of information & Article 30 clauses
• TLPT every 3 years tracked

NCSC Cyber Assessment Framework (CAF) v4.0

The UK's common cyber assessment method for NIS operators, central and local government and the NHS: 41 contributing outcomes scored Achieved, Partially achieved or Not achieved against the target profile.

• 373 indicators, 41 outcomes, 14 principles
• Achieved / Partially / Not achieved scoring
• NIS, GovAssure, local government & DSPT profiles
• Group roll-up & risk heat map

Cyber Essentials & Cyber Essentials Plus (v3.3)

The UK government-backed certification for five technical controls, under v3.3 and the Danzell question set from 27 April 2026: readiness per certified entity, automatic fails surfaced and CE+ technical verification prepared.

• 115 requirements, 8 domains
• 18 automatic-fail checks
• Cloud MFA & 14-day patching
• CE+ technical verification readiness

UK Operational Resilience (FCA / PRA)

The FCA and PRA operational resilience rules for banks, insurers, payment firms and other regulated firms: important business services, impact tolerances, mapping, scenario testing, SS2/21 outsourcing, critical third parties and PS26/2 reporting from 18 March 2027.

• 218 requirements, 11 domains
• Impact tolerances & scenario testing
• SS2/21 outsourcing & critical third parties
• PS26/2 incident & third-party reporting

UK GDPR, DPA 2018 & Data (Use and Access) Act 2025

UK data protection law as amended by the Data (Use and Access) Act 2025, with PECR: lawful basis and recognised legitimate interests, individuals' rights, DPIAs, breaches, international transfers and the Information Commission from 30 September 2026.

• 178 requirements, 10 domains
• 72-hour breach notification
• IDTA, UK Addendum & data protection test
• PECR fines aligned (£17.5m or 4%)

NIST Cybersecurity Framework 2.0

The outcome framework boards and regulators read: a Current Profile against a Target Profile across Govern, Identify, Protect, Detect, Respond and Recover, with each outcome crosswalked to SP 800-53 controls.

• 6 Functions, 22 Categories, 106 outcomes
• Current vs Target Profile
• CSF Tiers declared and indicated
• SP 800-53 crosswalk

NIST SP 800-53 Rev. 5

The US federal catalogue of security and privacy controls for information systems, widely adopted as a comprehensive control baseline.

• 20 control families
• Baseline tailoring
• Privacy controls
• Assessment procedures

SOC 2 (Trust Services Criteria)

The assurance framework for service organizations, evidencing controls across the five Trust Services Criteria.

• Security
• Availability
• Confidentiality
• Processing integrity & privacy

ISO/IEC 27001:2022 (ISMS)

The international standard for an Information Security Management System: clauses 4–10 plus all 93 Annex A controls, with a full Statement of Applicability.

• ISMS scoping & context
• Risk assessment & treatment
• 93 Annex A controls
• Statement of Applicability

ISO 9001:2026 (Quality)

The quality management system standard, sixth edition (September 2026): process approach, quality culture and ethical behaviour, risks and opportunities addressed separately, and continual improvement across clauses 4–10. Transition from 2015 by 30 September 2029.

• QMS scope & context
• Quality culture & ethics
• Risks & opportunities
• 2026 transition tracking

ISO 14001:2026 (Environmental)

The environmental management system standard, fourth edition (April 2026): named environmental conditions (climate, biodiversity, pollution, resources), risks and opportunities separated from aspects, planning of changes, and a life-cycle perspective across the value chain. Transition from 2015 by April 2029.

• Environmental aspects & conditions
• Compliance obligations
• Risks, opportunities & change
• Emergency preparedness

ISO 45001:2018 (OH&S)

The occupational health and safety management system standard: hazard identification, worker participation and incident management.

• Hazard identification
• Worker consultation
• Incident investigation
• OH&S performance

ISO 22301:2019 (Business Continuity)

The certifiable BCMS standard: business impact analysis, risk assessment, continuity strategies, plans and a validated exercise programme.

• BIA with RTO/MTPD
• Strategies & solutions
• Plans & response structure
• Exercise programme

ISO 22000:2018 (Food Safety)

The certifiable FSMS standard assessed per branch and rolled up to the group: clauses 4–10, the HACCP plan, ISO/TS 22002-1 PRPs and the food law of 16 countries.

• HACCP hazard control plan
• 14 PRP topics (ISO/TS 22002-1)
• 16-country legislation overlay
• Branch roll-up & risk heat map

ISO 22361:2022 (Crisis Management)

Crisis management capability for executive teams: leadership, strategic decision-making, crisis communication and organisational learning.

• CMT structure & activation
• Strategic decision-making
• Crisis communication
• Training, validation & learning

ISO/IEC 20000-1:2018 (ITSM)

The service-management standard for planning, delivering, and continually improving IT services: clauses 4–10 with the full SMS process set.

• Service management system
• Service levels & reporting
• Incident, problem & change
• Continual improvement

ISO/IEC 42001:2023 (AI Management)

The first management-system standard for artificial intelligence, with an AI System Register, Statement of Applicability and AI-specific registers.

• AI systems inventory
• AI risk & impact
• 38 Annex A controls
• Legal, data & ADM registers

NCA Essential Cybersecurity Controls

Saudi Arabia's baseline cybersecurity controls for government entities, critical infrastructure, and their providers.

• Cyber Governance
• Cyber Defense
• Cyber Resilience
• Third-Party & Cloud

Personal Data Protection Law

The Kingdom's data-privacy law governing how personal data of individuals in KSA is collected, processed, and transferred.

• Lawful basis & consent
• Data subject rights
• Cross-border transfer
• Breach notification & RoPA

CST CRF (KSA ICT Sector)

The Communications, Space & Technology Commission's cybersecurity framework for Saudi ICT-sector licensees: 215 controls across six domains.

• Governance & risk
• Asset & logical security
• Physical security
• Third-party security

Non-CNI Private Sector Entities Cybersecurity Controls

NCA's baseline for Saudi private sector entities outside critical national infrastructure: 112 controls across 3 components, scoped to Category A or Category B applicability.

• 112 controls, 3 components
• Category A / Category B scoping
• Mandatory set inside Defense
• Sector picker built in

Cloud Cybersecurity Controls (CCC-2:2024)

NCA's cloud-specific controls for providers and tenants: 175 controls across 4 domains, each population seeing only the text NCA wrote for it.

• 175 controls, 4 domains
• Provider 131 · Tenant 44
• Annex A classification levels
• Supersedes CCC-1:2020

SAMA Cyber Security Framework

Rate all 32 subdomains of the SAMA Cyber Security Framework on its six-level maturity model, see every subdomain below level 3 as a finding, and reuse NCA ECC evidence through a crosswalk a person confirms.

NCA Operational Technology Cybersecurity Controls (OTCC-1:2022)

Assess the Kingdom's operational technology controls facility by facility, with each site's level beside its score and the weakest site leading the group view.

NDMO Data Management and Personal Data Protection Standards

Assess the National Data Management Office's standards specification by specification, in priority order, beside the PDPL and the NCA controls the standards leave data security to.

UAE Information Assurance Standard

The UAE's national information security baseline: six management and nine technical families, prioritised P1 to P4, mandatory for federal entities and critical infrastructure.

• 15 control families (M1–M6, T1–T9)
• P1–P4 priority-tier dashboard
• Risk-based applicability statement
• Arabic & English operation

Dubai Information Security Regulation (ISR v3)

DESC's regulation for Dubai Government entities and their suppliers, strengthened in v3 for cloud and data residency, IoT/OT and supply-chain security.

• 13 security domains
• Cloud & data residency evidence
• IoT / OT security
• Supply-chain requirements

DFSA Cyber Risk Management Rules

The DFSA's cyber rules for every DIFC Authorised Firm, in force since 1 January 2024: framework, governance, ICT asset protection, resilience testing, response, and the 72-hour notification as a rule of its own.

• 7 sections, 51 rule paragraphs
• 72-hour notification indicator
• Rulebook wording + DFSA Guidance
• Reads beside the FSRA catalogue

ADGM FSRA Cyber Risk Management

The FSRA's cyber rules for every ADGM Authorised Person, binding since 31 January 2026, with the UAE's strictest incident window: notify the Regulator within 24 hours.

• 7 sections, 43 rule paragraphs
• 24-hour notification readiness
• Third-party ICT risk incl. cloud
• Reads beside the DFSA catalogue

CBUAE Operational Risk, Technology & Cyber

The Central Bank's Operational Risk Management Regulation article by article for every licensed financial institution, plus the SVF and Retail Payment Services technology-risk articles scoped to the licences they bind.

• 15 domains, 220 obligations
• ORM Arts 2–13, 15 for all LFIs
• SVF Art 12 · RPS Art 13 by licence
• Notification readiness indicator

UAE Personal Data Protection Law

Federal Decree-Law 45/2021 article by article (lawful basis, controller and processor duties, breach reporting, DPO, the seven data subject rights, security and cross-border transfer) with Executive-Regulation dependencies flagged.

• 8 article groups, 43 controls
• Article cited on every control
• Pending Regulations marked as such
• Registers shared with ISO 27001 / 42001

Abu Dhabi Healthcare Information & Cyber Security Standard

DoH's mandatory standard for every licensed healthcare entity in Abu Dhabi: 11 domains and 131 controls graded Basic, Transitional and Advanced, generated from the 2024 PDF, with localisation, breach reporting and cloud security as their own indicators.

• 11 domains, 131 controls
• Basic / Transitional / Advanced scoping
• Service Provider rows flagged
• Arabic and English

UAE ICT Health Law

The federal health data law article by article (confidentiality, the Article 13 localisation prohibition and its ten MR 51/2021 exceptions, 25-year retention and Central System access) with the Law, Executive Regulation and Ministerial Resolution coded apart.

• 9 domains, 44 duties
• Three instruments, never confused
• Localisation exceptions with conditions
• Arabic and English

DIFC Data Protection Law

The DIFC's own privacy law consolidated to the 2025 amendments (registration, DPO and Annual Assessment, lawful basis, rights, breach notification, transfers, digital marketing and the Regulation 10 AI-systems rules) 79 obligations across 11 domains.

• 11 domains, 79 controls
• Commissioner-facing duties as one indicator
• Regulation 10 AI systems covered
• Reads beside DFSA and ADGM

ADGM Data Protection Regulations

Abu Dhabi Global Market's privacy law section by section, as amended to September 2025 (registration and fee, DPO, DPIA, lawful basis, rights, 72-hour breach notification, transfers and enforcement readiness) 78 obligations across 10 domains.

• 10 domains, 78 controls
• 72-hour breach clock pinned
• Annual fee and DPO deadlines tracked
• Same six indicators as DIFC

NCSC Baseline Cybersecurity Controls

Bahrain's national cybersecurity baseline: 81 controls across 7 domains, mandatory for critical national infrastructure under Royal Order 17/2025 and encouraged for every other organisation.

• 7 domains, 81 controls
• Mandatory for CNI entities
• Incident notification to NCSC
• Quarterly VA, annual pentest

CBB Cyber Security Risk Management (OM-5.5)

The Central Bank of Bahrain's binding cyber module for every bank licensee: 171 controls across 17 domains, with the 1-hour/2-hour incident reporting clock as its own indicator.

• 171 controls, 17 domains
• Board and Senior Management duties
• 1-hour call, 2-hour email to CBB
• Conventional and Islamic banks

Bahrain Personal Data Protection Law

Law No. 30 of 2018 with its ten 2022 Ministerial Orders: 82 controls across 12 domains, the Data Protection Guardian regime and the 72-hour breach clock tracked as their own indicators.

• 12 domains, 82 controls
• Data Protection Guardian regime
• 72-hour breach notification
• 83-country transfer whitelist

National Information Assurance Standard v2.1

NCSA's current certifiable standard, superseding NIA v2.0 for new applications and re-certification: 356 controls across 26 domains, 166 baseline controls tracked as mandatory.

• 356 controls, 26 domains
• 166 baseline controls
• 2-hour incident notification
• Supersedes NIA v2.0

Qatar Central Bank Technology Risk & Cyber Security

QCB's binding regulations for banks and for insurers, held as one framework with two licensee populations, each sees only the text written for it.

• Banks and insurance populations
• 9 domains per population
• 712 controls, QCB's wording
• Group oversight across entities

QCB Cloud Computing Regulation

QCB's binding cloud regulation, in force since 15 April 2024: 141 controls across 19 domains, with QCB approval before any cloud arrangement and Qatar-only data processing.

• 141 controls, 19 domains
• QCB approval before any arrangement
• Qatar-only PII and financial data
• Exit and termination duties

QCB Data Handling & Protection Regulation

QCB's data protection regulation for its Financial Institutions: 126 controls across 10 domains, DPO governance, 10-year retention and breach notification to QCB, NCSA and the Ministry of Interior.

• 126 controls, 10 domains
• DPO, ROPA and PIA duties
• 10-year retention floor
• Breach to QCB, NCSA and MoI

Qatar Personal Data Privacy Protection Law

Law No. 13 of 2016, the Gulf's first data privacy law, grouped by the duty each article creates, from lawful basis and individual rights to breach notification and cross-border flows.

• 11 duty-based domains, 51 controls
• Article cited on every control
• Breach and request records
• Enforced by NCSA (NCGAA)

Kuwait National Basic Cybersecurity Controls

NCSC Decision 2/2026's mandatory minimum for government, security bodies and critical private-sector operators: 44 controls, due by 5 October 2027.

• Govern to Recover + cloud appendix
• 21 MUST controls tracked as mandatory
• Deadline 5 October 2027
• Arabic-first catalogue

CBK Cyber & Operational Resilience Framework

The Central Bank of Kuwait's resilience-first framework for banks and financial institutions: three baselines and 875 controls generated from CBK's own text.

• Cyber · Operational · Third-party baselines
• 875 controls, 25 domains
• Generated from the CBK document
• TPRM joined to the vendor register

CBO Cyber Security & Resilience Framework

The Central Bank of Oman's framework for banks, finance and leasing companies, exchanges and payment providers: six control domains, compliance due 31 July 2024.

• 6 domains, §3.1–§3.6
• 193 measures with section refs
• Compensating controls on record
• Online financial services evidenced

Oman Personal Data Protection Law

Royal Decree 6/2022 with its Executive Regulation, fully enforceable since 5 February 2026: lawful processing, sensitive data, rights, breach notification and transfers.

• 9 duty-based domains, 35 controls
• 45-day request and 72-hour breach clocks
• Sensitive and children's data permissions
• Regulated by MTCIT

PK-CTDISR (Critical Telecom Data & Infrastructure Security)

Pakistan Telecommunication Authority's regulation securing critical telecom data and infrastructure for licensees and operators.

• Security governance & risk
• Data & asset protection
• Network & infrastructure security
• Incident response & audits

PISF 2026 (Pakistan Information Security Framework)

Cabinet-approved national baseline of 234 controls across 13 domains, covering government bodies, autonomous bodies, corporations, CERTs and critical information infrastructure.

• Governance & risk
• Data protection & privacy
• CIIP & data centre security
• Incident response & supply chain

MAS Technology Risk Management

MAS's technology risk guidance plus the binding FSM-N05 and FSM-N06 Notices: critical systems, cyber hygiene and every MAS clock, as 289 controls across 15 domains.

• 289 controls, 15 domains
• 1-hour, 4-hour and 14-day MAS clocks
• Binding Cyber Hygiene Notice tracked
• 2026 amendments flagged as proposed

Cybersecurity Code of Practice for CII (2026)

CSA's mandatory code for critical information infrastructure owners, in force 29 July 2026: 220 controls across 11 sections, the 2027 compliance dates, OT-only clauses and the new interconnected-systems section tagged.

• 220 controls, 11 sections
• In force 29 Jul 2026; new duties by 29 Jul 2027
• Cyber Trust Advocate by 31 Dec 2027
• OT and IT CII tagged

Cyber Trust & Cyber Essentials

CSA's risk-based Cyber Trust mark and prescriptive Cyber Essentials mark, relaunched 15 Apr 2025 with cloud, OT and AI security: one catalogue of 250 controls in 22 domains, tagged by tier from Supporter to Advocate.

• 250 controls, 22 domains
• Five preparedness tiers
• Cloud, OT & AI pillars
• CII owners need Advocate by 2027

Personal Data Protection Act (PDPA)

Singapore's data protection law, amended in 2020 and enforced in stages from 1 Feb 2021: consent, breach notification, access/correction and Do Not Call as 61 controls, with every PDPC clock tracked.

• 61 controls, 9 domains
• 3-day breach notification to PDPC
• Legitimate interests & business improvement
• Do Not Call register checks

National Cyber Security Baseline v1.4

NACSA's self-assessment for NCII entities under the Cyber Security Act 2024: 125 questions across 33 elements and the six NIST CSF 2.0 functions, reported on the four-level Initial-to-Advanced maturity scale.

• 125 questions, 33 elements
• Six NIST CSF 2.0 functions
• Maturity Initial → Advanced, no floor
• Eleven NCII sectors

Risk Management in Technology (RMiT)

Bank Negara Malaysia's technology risk policy, revised effective 28 November 2025: 173 controls across 14 domains, with the 90-day gap analysis and annual self-assessment tracked as an indicator.

• 173 controls, 14 domains
• 90-day gap analysis clock
• Standard and Guidance kept apart
• English only catalogue

Network Security Policy Management (NSPM)

See what your firewalls actually permit: multi-vendor rule analysis, path and exposure risk, governed change with rollback, and segmentation evidence taken from the live rulebase.

• Fortinet, Palo Alto, Cisco, Huawei, F5, NSX
• Rule hygiene, path tracing & exposure risk
• Change requests, approval, dry run, rollback
• Unauthorised-change detection
• Remote collectors for unreachable sites
• Segmentation evidence for ECC, ISO 27001, PCI DSS

PhishLens (Phishing Simulation)

Awareness testing with realistic campaigns: click analytics, repeat-clicker risk and executive reports that evidence awareness controls.

• Campaign engine & templates
• Click & repeat-clicker analytics
• Executive & ops dashboards
• Evidence for awareness controls

Supply Chain / Vendor Assessment

Structured third-party due diligence, tiering, questionnaires and evidence review, so supplier risk is assessed consistently and re-assessed on cadence.

• Vendor tiering
• Assessment questionnaires
• Evidence & findings
• Periodic re-assessment

Risk Management

An enterprise risk register with scoring, treatment plans and owner accountability, linked directly to the controls that mitigate each risk.

• Risk register & scoring
• Treatment & owners
• Control linkage
• Board-ready reporting

Policy Management (Controlled Policy Documents)

Adopt 22 ready security policies, route each through an approval chain, publish only when every step has approved this version, and let the review dates compute themselves.

Security Testing (Penetration Test and Threat Model Management)

Run every penetration test and threat model from a signed authorisation to a branded report: scoped engagements, findings with SLA clocks, scanner imports, retests and remediation tracking.

Protection of Personal Information Act 4 of 2013 (POPIA)

South Africa's data protection law with its 2018 Regulations as amended on 17 April 2025: 93 controls across 14 domains, from the Information Officer and the eight conditions for lawful processing to section 22 security compromise notices and an Assurance domain.

Joint Standard 2 of 2024: Cybersecurity and Cyber Resilience Requirements

The FSCA and Prudential Authority's cybersecurity and cyber resilience standard for South African financial institutions, effective 1 June 2025: 90 controls across 13 domains, with the 24-hour material incident notice under Joint Notice 2 of 2026 tracked.

Data Protection Act 2019 (Kenya)

Kenya's Data Protection Act 2019 with the General, Registration, and Complaints Handling and Enforcement Regulations of 2021: 94 controls across 12 domains, from ODPC registration and the 72-hour breach notice to an Assurance domain for audits, renewals and monitoring.

Data Protection Act No. 3 of 2021 (Zambia)

Zambia's Data Protection Act 2021 with the Data Protection (Registration and Licensing) Regulations, SI 58 of 2021: 89 controls across 12 domains, covering registration, the data protection officer, the 24-hour breach notice, in-country storage of sensitive personal data and the annual data audit.

Cyber and Data Protection Act [Chapter 12:07] (Zimbabwe)

Zimbabwe's Cyber and Data Protection Act with SI 155 of 2024 on licensing data controllers and appointing data protection officers: 84 controls across 12 domains, ready for the POTRAZ compliance inspections that began on 1 September 2026.