Standards
What your teams work with regularly.
Mapped into one framework.
That includes frameworks, standards, laws, regulations, audit checklists and contracts. Below is a selection of the sources we map regularly, each with the version or scope we map to. Client-specific sources, such as contracts and audit checklists, are added for each engagement.
ISO and IEC standards
Management systems, controls and guidance from ISO and IEC.
- ISO/IEC 270012022
- ISO/IEC 270022022
- ISO/IEC 270042016
- ISO/IEC 270052022
- ISO/IEC 27014Governance of information security
- ISO/IEC 270172026
- ISO/IEC 270182025
- ISO/IEC 270192024
- ISO/IEC 270312025
- ISO/IEC 27033-12015
- ISO/IEC 27034Application security
- ISO/IEC 27035Incident management
- ISO/IEC 27036Parts 2, 3 and 4
- ISO/IEC 277012025
- ISO/IEC 29100Privacy framework
- ISO/IEC 29151PII protection controls
- ISO/IEC 420012023
- ISO/IEC 420052025
- ISO/IEC 420062025
- ISO/IEC 238942023
- ISO/IEC 22989AI concepts
- ISO/IEC 5338AI system life cycle
- ISO/IEC 52592024
- ISO/IEC 385002024
- ISO/IEC 20000-1Service management
- ISO/IEC 170212015
- ISO 223012019
- ISO 310002018
- ISO 373012021
- ISO 370012025
- ISO 190112026
- ISO 9001Quality management
- ISO 280002022
- ISO 280012007
- ISO 154892016
- ISO 500012018
NIST publications
Frameworks, control catalogues and guidance from the US National Institute of Standards and Technology.
- NIST CSF2.0
- NIST AI RMF1.0
- NIST AI 600-1Generative AI Profile
- NIST AI 100-2Adversarial machine learning
- NIST AI 100-4Synthetic content
- NIST Privacy Framework1.0
- NIST SP 800-53Rev. 5
- NIST SP 800-53ARev. 5
- NIST SP 800-37Risk Management Framework
- NIST SP 800-30Rev. 1
- NIST SP 800-39Managing information security risk
- NIST SP 800-171Protecting CUI
- NIST SP 800-161Rev. 1
- NIST SP 800-218SSDF 1.1
- NIST SP 800-218ASSDF for generative AI
- NIST SP 800-207Zero trust architecture
- NIST SP 800-207AZero trust for cloud-native applications
- NIST SP 800-63BRev. 4
- NIST SP 800-61Rev. 3
- NIST SP 800-34Rev. 1
- NIST SP 800-40Rev. 4
- NIST SP 800-50Rev. 1
- NIST SP 800-181Rev. 1 (NICE)
- NIST SP 800-82Rev. 3
- NIST SP 800-88Rev. 2
- NIST SP 800-92Log management
- NIST SP 800-128Configuration management
- NIST SP 800-137Continuous monitoring
- NIST SP 800-185SHA-3 derived functions
- NIST SP 800-208Stateful hash-based signatures
- NIST FIPS 198-1HMAC
- NIST IR 8011Vol. 2
- NIST SP 1900 seriesCyber-physical systems
Industry frameworks and assurance
Control frameworks, governance models and audit criteria used across industries.
- CSA Cloud Controls Matrix (CCM)v4.1
- CSA AI Controls Matrix (AICM)v1.1
- CSA STARAssurance registry
- COBIT2019
- AICPA Trust Services Criteria (SOC 2)2017, revised 2022
- CIS Critical Security Controlsv8.1
- PCI DSS4.0.1
- HITRUST CSFAssurance framework
- FAIRQuantitative risk analysis
- CISA Zero Trust Maturity Model2.0
- DoD Zero Trust Reference ArchitectureZero trust pillars
- CAN/DGSI 101:2025Data governance
- IEEE 28832022
- ETSI EN 304 223V2.1.1
- ETSI TR 104 128V1.1.1
- SANS Critical AI Security Guidelinesv1.4
- Google Secure AI Framework (SAIF)2.0
Threat, attack and testing frameworks
Catalogues of attacks, weaknesses and test methods for applications and AI systems.
- MITRE ATT&CKv19.2
- MITRE ATLASv2026.07
- OWASP Top 102025
- OWASP Top 10 for LLM Applications2026
- OWASP Top 10 for Agentic Applications2026
- OWASP MCP Top 102025 (beta)
- OWASP GenAI Red Teaming Guide1.0
- OWASP GenAI Security ProjectContinuous
- OWASP ASVS5.0.0
- OWASP SAMM2.2.0
- STRIDEThreat modelling
- LINDDUNPrivacy threat modelling
- AI Vulnerability Database (AVID)Continuous
- MLCommons AILuminatev1.0
- HarmBenchContinuous
- UK AISI Inspect evaluationsContinuous
- Meta CyberSecEvalv4
Software supply chain
Provenance, bills of materials and build integrity.
- SLSAv1.2
- CycloneDX1.7
- SPDX3.0.1
Operational technology and sector standards
Industrial control, building systems, energy, pipelines and finance.
- IEC 62443Parts 1-1, 2-1, 2-4, 3-2, 3-3, 4-1, 4-2
- IEC 615082010
- IEC 615112016
- NERC CIPCIP-002 to CIP-015
- TSA Pipeline Security DirectiveSD Pipeline-2021-02G
- ISO 16484Building automation
- ASHRAE 135 (BACnet)2020
- NFPA 722025
- EN 54Fire detection
- Basel III2017
Trade and transport security
Customs, aviation and maritime security programmes.
- WCO SAFE Framework2025 edition
- CTPAT Minimum Security Criteria2020
- BASC International Security Standard6.0.2 and 6.0.3
- BASC International NormV6-2022
- WTO Trade Facilitation Agreement2017
- ICAO Annex 17Edition 12
- ICAO Aviation Cybersecurity Strategy2019
- IMO MSC-FAL.1/Circ.3Rev. 4
AI laws, policy and guidance
Binding AI legislation and government AI frameworks.
- EU AI ActReg. 2024/1689, amended 2026
- Colorado AI ActSB 24-205 and SB 26-189
- Texas TRAIGAHB 149 (2025)
- Illinois HB 3773AI in employment
- NYC Local Law 144Automated employment decision tools
- California CCPA ADMT regulations2026
- US OMB M-25-21Federal agency use of AI
- US OMB M-25-22Federal acquisition of AI
- US OMB M-26-04Unbiased AI principles
- US Executive Order 143652025
- America's AI Action Plan2025
- Canada Directive on Automated Decision-MakingTreasury Board
- OSFI Guideline E-23Model risk, effective 2027
- Ontario Enhancing Digital Security and Trust Act2024
- UK AI regulation white paperCP 815 and CP 1019
- South Korea AI Basic ActIn force 2026
- Singapore Model AI Governance FrameworkGenerative AI and agentic AI
- Malaysia AI Governance and Ethics Guidelines2024
- Australia Voluntary AI Safety Standard2024
- Australia Guidance for AI Adoption2025
- Australia AI Ethics Principles2025
- Australia National AI Plan2025
- OECD AI Principles2024
Canadian privacy and access law
Federal, provincial and Treasury Board instruments.
- PIPEDAS.C. 2000, c. 5
- Breach of Security Safeguards RegulationsSOR/2018-64
- Quebec Law 25CQLR c. P-39.1
- Privacy ActR.S.C. 1985, c. P-21
- Ontario PHIPA2004
- Alberta PIPAPrivate sector
- British Columbia PIPAPrivate sector
- British Columbia FOIPPAPublic sector
- Access to Information ActR.S.C. 1985, c. A-1
- Access to Information RegulationsSOR/83-507
- TBS Policy on Privacy Protection2024
- TBS Policy on Access to Information2023
- TBS Directive on Access to Information Requests2022
- Bill C-36 (PPCDA)Proposed
International privacy and data protection law
Privacy and data protection law outside Canada.
- EU GDPRReg. 2016/679
- EU Standard Contractual Clauses2021/915
- UK GDPR and Data Protection Act 2018Amended 2025
- Switzerland nFADP2023
- US CCPA and CPRAWith 2026 regulations
- US HIPAA and HITECHHealth information
- Illinois BIPABiometric privacy
- US FTC ActSection 5
- Brazil LGPDWith ANPD resolutions
- Mexico LFPDPPP2025
- Argentina Ley 25.3262000
- Chile Ley 19.628 and Ley 21.719Transition 2026
- Peru Ley 29733DS 016-2024-JUS
- Colombia Ley 15812012
- Japan APPIPersonal information
- South Korea PIPA2023
- China PIPL2021
- China cross-border data provisions2024
- India DPDPA2023, Rules 2025
- Singapore PDPA2012, amended 2020
- Australia Privacy Act1988, amended 2024
- New Zealand Privacy Act2020
- Malaysia PDPA2010, amended 2024
- Thailand PDPA2019
- Indonesia UU PDP2022
- Philippines Data Privacy Act2012
- Vietnam PDPL91/2025
- Saudi Arabia PDPL2023
- UAE PDPLWith DIFC and ADGM
- South Africa POPIAPersonal information
- Turkey KVKKAmended 2024
- Nigeria NDPA2023
- Kenya Data Protection Act2019
- OECD Privacy Guidelines2013
- EDPB and Article 29 Working Party guidelinesGuidance documents
Other laws and regulations
Sector, resilience and government requirements.
- EU NIS 2 Directive2022/2555, with Implementing Reg. 2024/2690
- EU DORAReg. 2022/2554
- EU MiCAReg. 2023/1114, with RTS and ITS
- EU eIDASReg. 910/2014, amended 2024
- EU Data ActReg. 2023/2854
- EU Electronic Communications CodeDir. 2018/1972
- EU Medical Device RegulationReg. 2017/745
- EU In Vitro Diagnostic RegulationReg. 2017/746
- EU Union Customs CodeReg. 952/2013
- US Sarbanes-Oxley Act2002
- US FedRAMPRev. 5
- US CMMC2.0
Names and versions are provided for reference. Mapping to a standard is not a claim of certification or legal advice; applicability is confirmed for each engagement.
Need something that isn't listed?
Tell us which standards and obligations you answer to, and we will show you how they map.