CEPF — Compliance Estimation & Planning Framework

CEPF is a regulatory crossing catalogue: a mapping of regulatory regimes onto the operational obligations each one produces, and onto the points where those obligations overlap. It exists because organisations subject to several regimes at once do not face a sum of separate compliance programmes — they face one programme with shared controls, and the shared controls are where both the cost and the omissions concentrate.

The framework works on obligations, not on principles. Every regime is broken down into the deliverables it actually requires, the roles that produce them and the effort each one carries. Where two regimes demand the same control — access management, audit logging, change management, incident response — the control is stated once and documented against each regime, rather than built twice.

It is the instrument behind the exposure assessment.

CEPF v7 — 21 regimi — snapshot luglio 2026