Understand the standards that shape your work.

Framework guides

34 framework guides are available.

• ISO 27001 — The world's leading information security management system standard. Manage 93 Annex A controls across organisational, people, physical, and technological domains.
• SOC 2 — AICPA Trust Service Criteria for service organisations. Track CC1–CC9 criteria, manage auditor requests, and maintain perpetual SOC 2 readiness.
• NIST CSF — NIST Cybersecurity Framework 2.0 — the six-function framework (Govern, Identify, Protect, Detect, Respond, Recover) adopted across US government and global enterprises.
• NIST 800-171 — Protecting Controlled Unclassified Information (CUI) in non-federal systems. 110 security requirements across 14 families — mandatory for US federal contractors.
• Cyber Essentials — UK government-backed certification scheme for baseline cyber hygiene. Five technical controls that protect against the most common cyber attacks.
• Essential Eight — Australian Signals Directorate's eight mitigation strategies to protect organisations from cyber threats. Tiered maturity model (0–3) adopted across Australian government.
• IRAP — Information Security Registered Assessors Program for Australian government cloud services. Based on the ASD Information Security Manual (ISM).
• CSA STAR — Cloud Security Alliance STAR — the gold standard for cloud security assurance. Based on the Cloud Controls Matrix (CCM) with 197 control specifications.
• InfoSec Governance — Executive-level information security governance framework. Policy management, security awareness, risk oversight, and CISO-level reporting.
• GDPR — EU General Data Protection Regulation — the world's most comprehensive data privacy law. Applies to any organisation processing personal data of EU residents.
• UK GDPR — UK General Data Protection Regulation — the post-Brexit UK data protection framework. Largely mirrors EU GDPR with UK-specific adaptations and ICO oversight.
• CCPA / CPRA — California Consumer Privacy Act and California Privacy Rights Act — the strictest US state privacy law. Gives California consumers rights over their personal data.
• HIPAA — Health Insurance Portability and Accountability Act — the US healthcare privacy and security standard protecting Protected Health Information (PHI).
• LGPD — Lei Geral de Proteção de Dados — Brazil's comprehensive data protection law, inspired by GDPR. Applies to processing personal data of individuals in Brazil.
• FERPA — Family Educational Rights and Privacy Act — protects the privacy of student education records in US educational institutions receiving federal funding.
• PDPA (Singapore) — Singapore Personal Data Protection Act — Singapore's data protection law governing collection, use, and disclosure of personal data by organisations.
• GLBA — Gramm-Leach-Bliley Act — US financial privacy law requiring financial institutions to protect customer financial information and control its disclosure.
• NIST Privacy Framework — NIST Privacy Framework — voluntary tool for organisations to better identify and manage privacy risk. Five functions: Identify-P, Govern-P, Control-P, Communicate-P, Protect-P.
• PCI DSS — Payment Card Industry Data Security Standard — mandatory for all organisations handling cardholder data. 12 requirements protecting payment card ecosystems worldwide.
• SOX IT Controls — Sarbanes-Oxley Act IT General Controls — technology controls over financial reporting systems required for US-listed companies and their subsidiaries.
• ICIF / COSO — Internal Controls Integrated Framework (COSO 2013). 17 principles across 5 components — Control Environment, Risk Assessment, Control Activities, Information & Communication, Monitoring.
• DORA — EU Digital Operational Resilience Act — mandatory for EU financial entities from January 2025. Covers ICT risk management, incident reporting, resilience testing, and third-party risk.
• MAS TRM — MAS Technology Risk Management Guidelines — MAS requirements for financial institutions in Singapore to manage technology risk and ensure IT resilience.
• APRA CPS 234 — APRA CPS 234 Information Security — mandatory for all APRA-regulated entities (banks, insurers, superannuation) in Australia. Requires information security capability and incident notification.
• IEC 62443 — IEC/ISA 62443 — international standard for industrial automation and control systems (IACS) security. Covers OT/ICS cybersecurity for critical infrastructure sectors.
• FedRAMP — Federal Risk and Authorization Management Program — mandatory for cloud service providers supplying the US federal government. Based on NIST 800-53 with FedRAMP-specific controls.
• CMMC 2.0 — Cybersecurity Maturity Model Certification 2.0 — mandatory for US Department of Defense contractors. Level 2 covers 110 controls from NIST 800-171.
• EU AI Act — World's first comprehensive AI regulation — mandatory for AI systems deployed in the EU. Risk-based approach: Unacceptable, High, Limited, and Minimal risk tiers.
• ISO 42001 — International standard for AI Management Systems (AIMS) — equivalent to ISO 27001 but for AI. Provides governance, risk management, and ethics controls for AI development and deployment.
• NIST AI RMF — NIST AI Risk Management Framework — voluntary US framework for managing AI risks. Four core functions: Govern, Map, Measure, and Manage.
• UK AI Regulation — UK's pro-innovation, context-specific AI regulatory approach. Principles-based framework issued by existing UK regulators (ICO, CMA, FCA, Ofcom) for their sectors.
• ISO 22301 — International standard for Business Continuity Management Systems (BCMS). Ensures organisations can continue critical operations during disruptions, disasters, and crises.
• TISAX — Trusted Information Security Assessment Exchange — mandatory for automotive suppliers working with major OEMs (BMW, Volkswagen, Mercedes-Benz). VDA ISA-based assessment.
• NIS2 — EU Network and Information Systems Directive 2 — expanded cybersecurity requirements for essential and important entities in critical sectors across the EU.