Frameworks

The criteria an organisation's privacy programme is built and examined against in AICPA practice, replacing the older Generally Accepted Privacy Principles. It …

A maturity model from the CERT Division of Carnegie Mellon's SEI that treats security, business continuity and IT operations as one discipline …

Technical configuration guidelines for operating systems, cloud platforms, and containers. Distinct from CIS Controls — these are system-hardening baselines assessed at the …

Prioritized set of Controls and Safeguards for defending against the most common cyber attacks, grouped into three Implementation Groups so that smaller …

Framework of cloud-specific security controls across security domains, mapped to other standards. It says which controls fall to the cloud provider and …

CSA's control set for enterprise IoT systems that mix connected devices, cloud services and networks, from low-value data systems to systems supporting …

The cyber rules a ship is built to. E26 covers the resilience of the vessel as a whole, E27 the on-board systems …

The companion to ISO 31000: where ISO 31000 states the principles of risk management, this one catalogues the techniques an assessment may …

Series covering security of industrial automation and control systems, addressed separately to asset owners, integrators and product suppliers; the usual reference for …

The technical report that specifies security features for medical devices with external data interfaces, by capability security level, building on the IEC …

Evaluation criteria under which security products are certified and mutually recognised across countries through the Common Criteria arrangement. The EU cybersecurity certification …

Internationally recognized certifiable standard for information security management systems (ISMS), used by organizations of any type and size to show a systematic …

Companion controls catalog to ISO 27001, providing implementation guidance for the security controls in its Annex A.

Guidance for the information security risk management process that ISO 27001 requires but does not describe; auditors reach for it when asking …

Guidance on information security controls for cloud services, building on ISO 27002 and addressed to both cloud providers and their customers.

Guidelines for protecting personally identifiable information in public clouds, addressed to cloud providers acting as processors of that information.

Standard for privacy information management systems (PIMS), setting requirements and guidance for PII controllers and PII processors. It certifies the management system …

The vocabulary layer of the ISO privacy family: it names the actors (PII principal, controller, processor) and the privacy principles that ISO …

The principles-and-process standard the rest of the risk world points at when it says "a risk management framework": context, assessment, treatment, monitoring. …

Certifiable management system standard for artificial intelligence, structured like ISO 27001 but aimed at AI-specific risks: data governance, impact assessment, and human …

The engineering standard for automotive cybersecurity: risk management across concept, development, production, operation, maintenance and decommissioning of electrical and electronic systems in …

The reference taxonomy of adversary behaviour, used by security operations, threat intelligence and security architecture teams and mapped to by other frameworks …

The security baseline every vendor in the film and television supply chain is assessed against — post-production houses, VFX studios, dubbing and …

Voluntary framework for managing risks throughout the AI lifecycle, organized around four functions: Govern, Map, Measure, Manage. Sector- and use-case-specific profiles, such …

Voluntary framework for managing cybersecurity risk, organized around six functions: Govern, Identify, Protect, Detect, Respond, Recover. Written for organizations of every size …

Supply chain risk management for federal systems and everyone selling into them. Its controls and practices are the source of the flow-down …

Security requirements for protecting Controlled Unclassified Information (CUI) in non-federal systems and organizations, effectively mandatory for US DoD contractors.

Enhanced requirements for controlled unclassified information, applied on top of SP 800-171 where the threat is an advanced persistent adversary. Selected requirements …

The definition of zero trust architecture that US federal zero-trust mandates and most vendor claims point back to. Guidance rather than a …

The process that binds the rest of the NIST catalogue together: categorise, select, implement, assess, authorise, monitor. Federal systems are authorised to …

Comprehensive catalog of security and privacy controls for US federal information systems, de-facto global reference for government and regulated industries.

Identity proofing, authentication and federation requirements expressed as assurance levels, used well beyond the US government as the common vocabulary for how …

Operational technology security: the document that does for industrial control systems what SP 800-53 does for IT. It covers OT broadly, including …

Practices for building software securely, and the document software producers are asked to follow when selling to US federal agencies. Also the …

The eight privacy principles — collection limitation, data quality, purpose specification, use limitation, security safeguards, openness, individual participation and accountability — from …

Open standard for application-level security controls, covering authentication, session management, cryptography, and more, with verification levels that set how deep an assessment …

Contractual security requirements for any entity that stores, processes, or transmits payment card data.

Audit framework for service organizations, built on the AICPA Trust Services Criteria for security, availability, processing integrity, confidentiality, and privacy. Widely requested …

The ATT&CK-shaped matrix for spacecraft: tactics, techniques and countermeasures for space vehicles and their ground segment, published by The Aerospace Corporation. Countermeasures …

The mandatory security controls framework for every user of the SWIFT network. Users attest against its mandatory controls; advisory controls are introduced …

The questionnaire most third-party risk programmes send their vendors. Its answer set is what buyers compare against.

Automotive industry standard for information security assessments, exchanged via the ENX portal. Suppliers and service providers in the automotive supply chain use …

The US and Canadian standard for the security of network-connectable products: Part 1 sets general requirements for vendor vulnerability management, software weakness …

The UN regulation that makes vehicle cybersecurity a condition of type approval. A manufacturer must hold a certified Cyber Security Management System …

The companion regulation to UN R155: a vehicle type is approved only if the manufacturer runs a certified Software Update Management System, …

The physical twin of NIS2, adopted the same day and aimed at the same operators: where NIS2 governs their networks, this governs …

EU regulation requiring cybersecurity-by-design for products with digital elements sold in the EU. Manufacturers, importers, and distributors must meet essential security requirements, …

Establishes the European Cybersecurity Alert System and a reserve of incident response services that member states can call on. Matters to private …

EU regulation on digital operational resilience for the financial sector. Requires ICT risk management, incident reporting, resilience testing, and third-party risk oversight …

Information security management required of approved aviation organisations such as air operators, maintenance organisations, training organisations and air traffic services, so that …

The EBA's guidelines on ICT and security risk management. After DORA took over ICT risk management, only Guideline 3.8 remains: how payment …

Rules for sharing electronic health data across the EU, with security and logging duties for every system that handles it.

Publications, threat landscape reports, and technical guidelines issued by the EU Agency for Cybersecurity. ENISA is the issuing body for guidance under …

EU regulation classifying AI systems by risk level and imposing requirements on providers and deployers, with separate duties for general-purpose AI models.

EU regulation strengthening ENISA's mandate and establishing the EU cybersecurity certification framework for ICT products, services, and processes. The EUCC scheme (product …

Access to data generated by connected products, and the switching rules that force cloud providers to let customers leave. Security enters through …

The first certification scheme adopted under the Cybersecurity Act, giving ICT products an EU-wide certificate based on Common Criteria. The route by …

Sector-specific cybersecurity rules for cross-border electricity flows: risk assessment, common minimum requirements and information sharing for electricity- sector entities once a competent …

EU regulation on data protection and privacy for all individuals within the European Union and European Economic Area. Compliance is shaped by …

EU directive on cybersecurity risk management and incident reporting for essential and important entities in critical and other sectors, replacing NIS1. Member …

Strong customer authentication and secure communication requirements for payment services. Tracked as one subject across two acts, because the security obligations live …

Cybersecurity requirements for internet-connected radio equipment sold in the EU. The first EU rule to make network security a condition of placing …

EU regulation requiring member states to offer citizens a European Digital Identity Wallet, which public bodies and regulated private-sector relying parties must …

A prescriptive state security regulation: anyone holding personal information about a Massachusetts resident must run a written information security programme, encrypt that …

The rule that decides when an electronic record or signature is as good as paper and ink for the FDA: validated systems, …

The clause that carries health-insurance Exchange privacy down the contracting chain. An Exchange may only create, collect, use or disclose personally identifiable …

Alaska's personal-information statute: whoever holds personal information about an Alaska resident, in any form, must disclose a breach of it to every …

A free self-assessment model from the US Department of Energy covering ten domains of cybersecurity practice, scored on maturity indicator levels MIL1 …

The statute that started breach notification in the United States: an agency or business that owns, licenses or maintains computerised personal data …

California's connected-device security law: a manufacturer selling an internet-connected device in California must equip it with security features appropriate to what the …

Binding Operational Directives, Emergency Directives, and cross-sector guidance from the US federal cyber defence agency. The directives bind federal civilian agencies directly; …

The short, voluntary baseline CISA wrote for critical-infrastructure owners too small or too specialised to adopt a full framework: a prioritised set …

The single form on which a software producer tells a federal buying agency, over a signature, that it follows the secure development …

The security rules that bind anyone who touches US criminal justice information — police forces, courts, and every contractor and cloud provider …

US DoD program under which defense contractors demonstrate cybersecurity maturity, by self-assessment at the lower levels and third-party assessment at the higher …

The FTC rule that puts the Children's Online Privacy Protection Act into practice: verifiable parental consent before collecting data from a child …

Colorado's comprehensive consumer privacy statute: controllers owe residents access, correction, deletion and portability, must honour a universal opt-out signal for targeted advertising …

The contract clause that makes NIST SP 800-171 binding on defense suppliers and requires a cyber incident affecting covered defense information to …

The executive order that reset US federal cybersecurity expectations: software bills of materials and secure development attestations from suppliers, zero trust architecture …

Fifteen basic safeguards — access control, authentication, media sanitisation, boundary protection — required of any contractor whose systems hold federal contract information. …

The clause implementing Section 889 of the 2019 NDAA: a federal contractor may neither supply nor itself use covered telecommunications or video …

Bars TikTok and any other ByteDance covered application from devices used to perform a federal contract, including personal devices where contract work …

Obliges every institution of the US Farm Credit System to run a documented cyber risk management programme proportionate to its size and …

The security half of the FCRA as amended by FACTA: a creditor or financial institution holding covered accounts must run a written …

US federal law over student education records: who may see them, when consent is required, and what a school must do when …

What FINRA expects of a US broker-dealer on cybersecurity: the supervisory and books-and-records rules it reads as security obligations, plus the Regulatory …

Enforceable security programme requirements for financial institutions under FTC jurisdiction, meaning those not covered by another regulator under the Gramm-Leach- Bliley Act, …

US federal program standardizing security authorization for cloud services used by federal agencies. Its rules set what a cloud provider must document, …

The authorisation programme US state and local governments use where FedRAMP applies only to federal agencies. One programme with three impact levels …

US federal law protecting the privacy and security of individually identifiable health information. The Security Rule (45 CFR 164) governs electronic PHI …

A strict biometric statute with a private right of action: a private entity may not collect a fingerprint, face or voice template …

Illinois's breach notification and data security statute: a data collector must notify Illinois residents of a breach of unencrypted personal information in …

Mandatory safeguards for agencies that receive Federal Tax Information, and for their contractors and agents. Audited by the IRS Safeguards programme.

The first cybersecurity rule the Coast Guard wrote for the Maritime Transportation Security Act estate: US-flagged vessels, waterfront facilities and outer continental …

Mandatory and enforceable cybersecurity standards for the US bulk power system. A standard becomes binding only once FERC approves it, which is …

The operating rulebook for every licensed gaming establishment in Nevada: surveillance system standards, minimum internal control procedures, information a licensee must furnish …

The rules a cleared US contractor follows to protect classified information: facility clearances, insider threat programmes, foreign ownership and control reporting, and …

Nevada's online privacy statute: an operator of a website or online service that collects personal information from Nevada residents, and a data …

New York's data security statute: anyone holding private information about a New York resident must maintain reasonable administrative, technical and physical safeguards, …

New York State regulation binding DFS-licensed banks, insurers, and other financial services companies to a documented cybersecurity program — risk assessment, access …

Oregon's comprehensive privacy statute: rights of access, correction, deletion and portability for residents, an opt-out of targeted advertising, sale and profiling, a …

US disclosure regime for public companies: material cybersecurity incidents are reported on Form 8-K, and risk management, strategy, and board governance are …

The US financial reporting law whose Section 404 makes management and its auditor assess internal control over financial reporting each year. Security …

The architecture federal civilian agencies are held to when they connect anything to anything: a Security Capabilities Catalog of universal and policy …

Tennessee's consumer privacy statute, notable for the safe harbour it writes into the law: a controller that documents a privacy programme reasonably …

The performance-based cybersecurity duty TSA placed on freight railroads and passenger rail after Colonial Pipeline: a network segmentation plan that keeps operational …

Texas's identity theft and breach statute: a business must implement reasonable procedures to protect sensitive personal information, destroy records that hold it, …

The control baseline every Texas state agency and public institution of higher education is measured against under 1 TAC 202: the NIST …

Texas's comprehensive privacy statute, and the one with the widest reach: it binds any entity that does business in Texas and processes …

A limitation on civil liability rather than a duty: a Texas business that keeps a written cybersecurity programme conforming to a recognised …

Every Texas school district must adopt a cybersecurity policy, designate a cybersecurity coordinator as liaison to the state education agency, and report …

The certification a cloud service must hold before a Texas state agency may contract for it, modelled on FedRAMP: Level 2 for …

The self-certification programme US organisations join to receive personal data from the EU, the UK and Switzerland: a set of principles on …

The assessment framework the UK Civil Aviation Authority uses to oversee cyber security in aviation. It adapts the NCSC Cyber Assessment Framework …

The baseline certification named in UK public sector contracts and increasingly asked for by private buyers.

The cyber security controls UK defence suppliers are contractually required to meet. The standard defines four sets of controls, one for each …

Guidance and assurance schemes from the UK's national cyber authority: Cyber Essentials, the Cyber Assessment Framework used by regulators of essential services, …

The UK data protection regime, read as two documents at once: the assimilated General Data Protection Regulation and the Data Protection Act …

Security and incident reporting duties for operators of essential services and relevant digital service providers in the UK. The British counterpart to …

Named technical security measures for UK public telecoms network and service providers, with staged compliance deadlines and Ofcom enforcement backed by penalties …

Ukrainian government resolution establishing general cybersecurity requirements for critical infrastructure operators. It sets out a catalogue of cyber-protection measures and baseline measures …

Ukrainian information-security authorization regime under Law No. 80/94-VR "On the Protection of Information in Information and Telecommunication Systems". It replaced KSZI ("comprehensive …

Ukrainian national adoption of ISO/IEC 27001, designated DSTU ISO/IEC 27001. The text is paywalled; adoption and withdrawal are recorded in the public …

Sector-specific cybersecurity baseline profiles for Ukrainian public-sector and critical infrastructure systems, replacing legacy KSZI requirements. Under CMU Resolution No. 712, baseline profiles …

Resolution No. 143 brings non-bank financial service providers — insurers, credit unions, finance companies, pawnshops — under an information security regime for …

NBU regulations on cybersecurity for banks, anchored in Resolution No. 95; its Section III on cryptographic protection also reaches non-bank institutions that …

Ukrainian law on cloud services (No. 2075-IX). It covers all relations in cloud services, adds particular rules for public bodies and state …

Ukrainian law establishing the legal framework for national cybersecurity: cyber protection requirements for critical infrastructure and critical information infrastructure objects, state information …

Ukrainian law on electronic communications (No. 1089-IX). Two of its articles are what a security officer is here for: Article 31, "Ensuring …

Law No. 1591-IX governs the Ukrainian payment market, and it reaches well past banks: non-bank payment service providers, payment system operators and …

Ukrainian law on the protection of personal data, setting out the rights of data subjects and the duties of controllers and processors, …

Order No. 1/02-14 of the Ukrainian Parliament Commissioner for Human Rights approves three binding documents: the Typical Procedure for Processing Personal Data, …

The family of French state qualification schemes — SecNumCloud for cloud providers, PASSI for audit firms, PDIS and PRIS for incident response, …

Australia's operational resilience standard: an APRA-regulated entity must identify its critical operations, set tolerance levels for how long they may be disrupted, …

The binding information security standard for every APRA-regulated bank, insurer and superannuation fund in Australia. It makes the Board accountable for information …

Australia's government control catalogue: a cyber security framework of individually numbered controls that entities apply through a risk management framework. It is …

The Australian data protection regime, built on thirteen Australian Privacy Principles and a notifiable data breach scheme. It carries a statutory tort …

The mandatory security standard for consumer smart devices, made under the Cyber Security Act 2024. Consumer-grade connectable products acquired in Australia (with …

Austria's national data protection statute, which supplements the EU General Data Protection Regulation in Austrian law. It carries the constitutional right to …

British Columbia's private-sector privacy act, the provincial counterpart to PIPEDA: it displaces the federal act for organisations operating inside the province, covers …

Germany's own information security methodology from BSI: 200-1 defines the management system, 200-2 the IT-Grundschutz method, 200-3 risk analysis and 200-4 business …

The Bahamian data protection statute, short by modern standards and closer to the pre-GDPR European model: fair-processing rules, a right of access …

Belgium's national data protection act, the statute that fills in what the GDPR leaves to member states and that gives the Belgian …

The code of conduct every Bermuda-registered insurer, insurance manager and intermediary must follow for operational cyber risk: a board-approved cyber risk policy, …

Canada's national security guidance, published as numbered series: ITSG for the long-lived documents, ITSP for requirements, ITSM and ITSAP for shorter advice. …

The federal public-sector counterpart of PIPEDA: it governs how Canadian government institutions collect, use, disclose and retain personal information, and gives people …

Chile's data protection statute. It governs the processing of personal data in public and private registers and databases, and is the act …

The short decision that first put personal electronic information under statutory protection in China: collection only with consent and for a stated …

Three statutes read together — the Cybersecurity Law, the Data Security Law and the Personal Information Protection Law — plus the departmental …

Eight mitigation strategies the Australian Signals Directorate treats as the baseline against targeted intrusion, graded across four maturity levels from zero to …

BaFin's supervisory requirements for IT in German financial institutions: the circular that tells banks what their IT strategy, access management, outsourcing and …

The German federal data protection act that accompanies the GDPR: it sets the national derogations, the rules for public bodies and for …

The criteria catalogue that independent auditors use to attest German cloud providers, and the attestation German law requires, or accepts an equivalent …

The Greek personal data regime supervised by the Hellenic Data Protection Authority, from the act that first implemented the European data protection …

Hong Kong's data protection statute, one of the oldest in Asia, built on six data protection principles covering collection, accuracy, retention, use, …

Hungary's information act, known as Infotv.: it carries both the national data protection rules that sit alongside the GDPR and the freedom …

Japan's FedRAMP: a cloud service must be on the ISMAP register before a government body may procure it, and registration is granted …

India's first standalone data protection statute, built around consent notices, a duty to report personal data breaches, and a Data Protection Board …

The rules made under section 43A of India's Information Technology Act that define what "reasonable security practices" means for any body corporate …

Israel's general data protection statute. It governs the registration and operation of databases holding personal information, the duties of database owners and …

Italy's consolidated data protection statute, substantially rewritten to align national law with the EU General Data Protection Regulation. It governs processing by …

Japan's data protection law, and the reason Japan holds a European Commission adequacy decision. It carries breach notification, pseudonymised data and heavier …

Turkey's general personal data protection statute. It sets the lawful bases for processing, separate conditions for special categories of personal data and …

South Korea's data protection law, one of the strictest in Asia: consent-based by default, with breach notification, a data protection officer, restrictions …

Brazil's data protection statute, close enough to the GDPR in shape that most programmes answer both together: ten lawful bases, data subject …

Legally binding baseline cyber security measures for financial institutions in Singapore: securing administrative accounts, applying security patches, establishing baseline security standards, deploying …

What the Singapore financial regulator expects of technology risk at the firms it supervises: board and senior management accountability, third-party and cloud …

Malaysia's data protection statute, built on seven principles and a registration regime that makes certain classes of data user register with the …

The mandatory control sets Saudi Arabia's National Cybersecurity Authority issues for government bodies, critical national infrastructure and their suppliers. The Essential Cybersecurity …

Nigeria's data protection regulation, issued by NITDA under the NITDA Act. It sets the lawful bases for processing personal data, the rights …

New Zealand's data protection law, built on fourteen information privacy principles, a mandatory notifiable privacy breach scheme and restrictions on disclosing personal …

The information security manual New Zealand government agencies are expected to follow and, in practice, the one anyone selling them a system …

The information security standard every organisation handling New Zealand health information is expected to meet, issued as HISO 10029 with separate guidance …

The prudential expectations OSFI sets for technology and cyber risk at federally regulated financial institutions in Canada, in three domains: governance and …

A voluntary questionnaire OSFI publishes so that a federally regulated financial institution can measure its own technology and cyber risk practices against …

Canada's federal private-sector privacy law. It binds any organisation that collects, uses or discloses personal information in the course of commercial activity, …

South Africa's general data protection statute. It sets eight conditions for the lawful processing of personal information by public and private bodies, …

Poland's national data protection statute, enacted to apply the EU General Data Protection Regulation in Polish law. It establishes the President of …

Quebec's private-sector privacy regime, rebuilt by Law 25. It reaches any organisation holding personal information about people in Quebec and goes further …

One cyber framework for every entity SEBI regulates — exchanges, depositories, brokers, mutual funds, registrars — graded into five categories by size …

Australia's critical infrastructure regime, and the most demanding of its kind in the English-speaking world: it obliges owners of assets across eleven …

Serbia's personal data protection law, built on the GDPR template. It sets the lawful bases for processing, the rights of data subjects, …

Singapore's data protection regime, under which organisations must notify the Commission and affected individuals of notifiable data breaches. The Act sets the …

Spain's national security framework: the mandatory security categories, principles and controls for the Spanish public sector and for any supplier serving it. …

The Swiss federal data protection act. Matters far beyond Switzerland because the country sits outside the EU while holding an adequacy decision: …