The frameworks you answer to, on the same controls.
Turn on the rules you answer to. A check that passes once counts everywhere it applies.
- frameworks
- 18
- common controls
- 283
- regions
- 5
- set of evidence
- 1
Global
US
SOC 2The AICPA attestation over security, availability, confidentiality, processing integrity and privacy.
HIPAAThe US law protecting health information, with administrative, physical and technical safeguards.
NIST CSF 2.0The NIST Cybersecurity Framework: Govern, Identify, Protect, Detect, Respond, Recover.- NIST 800-53The US federal catalogue of security and privacy controls, revision 5.
- NIST 800-171 r2 and r3Requirements for protecting Controlled Unclassified Information outside federal systems, revisions 2 and 3.
CMMCThe US Department of Defense's Cybersecurity Maturity Model Certification.
FedRAMPThe US government's authorisation programme for cloud services, built on NIST 800-53.
NYDFS 500The New York Department of Financial Services cybersecurity regulation.
CCPA and CCPA 2026The California Consumer Privacy Act, as amended by the CPRA, including the 2026 regulations.
EU
GDPRThe EU regulation on how personal data of people in the EU is collected, used and protected.
NIS 2The EU directive that sets cybersecurity risk-management and incident-reporting duties.
DORAThe EU Digital Operational Resilience Act for ICT risk, incident handling and third-party risk.
TISAXThe automotive industry's information security assessment, based on the VDA ISA catalogue.
