Stop guessing which regulations apply to your stack. Filter 250+ global standards by domain, geography, and industry to instantly map your compliance landscape—and open plain-English breakdowns of the rules that actually matter.
New York's cybersecurity regulation for financial services firms licensed by the state's DFS, in force since 2017.
ASD's baseline of eight mitigation strategies and a four-level maturity model for internet-connected IT networks.
A certification standard for AI agent security, safety and reliability, published by AIUC and updated quarterly.
APRA's mandatory prudential standard on information security for deposit-takers, insurers and superannuation trustees.
Australia's federal privacy law setting 13 Australian Privacy Principles for handling personal information.
The Building Security in Maturity Model: a descriptive benchmark of real-world software security programmes.
A voluntary U.S. Department of Energy model for evaluating cybersecurity capability maturity across IT and OT.
California's privacy law giving residents rights over personal information that businesses collect, sell or share.
Prioritised set of 18 cybersecurity Controls and 153 Safeguards from the Center for Internet Security, currently v8.1.
The US defence programme that sets cybersecurity levels for contractors handling government information.
ISACA's framework for governing and managing enterprise information and technology; COBIT 2019 is the current version.
The COSO framework for managing enterprise risk alongside strategy and performance, last updated in 2017.
The Cloud Security Alliance's control framework for cloud computing: 207 controls across 17 security domains.
The UK Government-recommended minimum cyber security standard, built on five technical controls from the NCSC.
UK statute supplementing the UK GDPR, with law enforcement and intelligence regimes, enforced by the Information Commission.
OWASP's DevSecOps Maturity Model: a framework for assessing and prioritising security activities in software delivery.
The ETSI European Standard setting baseline cyber security and data protection requirements for consumer IoT devices.
The EU's risk-based regulation on artificial intelligence, Regulation (EU) 2024/1689, binding on in-scope AI operators.
The Open Group's standard taxonomy and analysis process for quantitative information risk analysis.
The US federal programme that certifies cloud services for federal agency use, run by GSA.
The EU regulation on processing personal data, and the UK's own amended version, the UK GDPR.
The IoT Security Foundation's voluntary framework of graded security requirements for IoT products and services.
The IAASB standard for assurance engagements other than audits or reviews of historical financial information.
The IAASB's international standard for assurance reports on controls at a service organisation.
The ISO standard for business continuity management systems, used to protect against and recover from disruption.
The ISO standard for a security management system, including supply chain aspects, for any type and size of organisation.
The international guidelines for risk management: principles, a framework and a process any organisation can use.
The ISO/IEC/IEEE standard describing system life cycle processes for human-made systems, from conception to retirement.
The ISO/IEC standard, known as the Common Criteria, for evaluating the security properties of IT products.
The ISO/IEC standard family for IT asset management; Part 1 sets requirements for an IT asset management system.
The international standard for IT service management; ISO/IEC 20000-1 sets requirements for a certifiable SMS.
The ISO/IEC guidance standard that explains how to apply the ISO/IEC 27001 ISMS requirements.
ISO/IEC guidance on measuring information security performance and ISMS effectiveness, supporting ISO 27001 clause 9.1.
The ISO/IEC guidance standard for managing information security risks, supporting an ISMS built on ISO/IEC 27001.
The ISO/IEC standard giving information security control guidance for cloud services, for customers and providers.
The ISO/IEC guidance for protecting personal data in public cloud services run by providers acting as PII processors.
The ISO/IEC guidance standard on Internet security, explaining how Internet, web, network and cyber security relate.
ISO/IEC guidelines for identifying, collecting, acquiring and preserving potential digital evidence.
ISO/IEC guidelines on the risks, principles and controls for the security and privacy of IoT solutions.
The ISO/IEC standard for a Privacy Information Management System, for organisations that handle personal data.
The international software testing standard series: general concepts and test processes for any organisation.
The ISO/IEC standard for processing and remediating vulnerabilities reported in a vendor's product or service.
The ISO/IEC standard of guiding principles for governing bodies on the effective, efficient and acceptable use of IT.
The international standard for an AI management system, published by ISO and IEC, with voluntary certification.
The ISO/SAE standard for cybersecurity engineering and risk management across the lifecycle of road vehicles.
IT general controls: the controls over systems, access, change and operations that auditors test before relying on IT.
An open knowledge base of adversary tactics and techniques, published by The MITRE Corporation.
NIST's enhanced security requirements for CUI tied to critical programmes, supplementing SP 800-171.
A voluntary NIST framework for managing AI risks to individuals, organisations and society across the AI lifecycle.
The voluntary NIST framework for managing cybersecurity risk through six Functions, from Govern to Recover.
NIST guidance on planning and conducting technical security tests, analysing findings and developing mitigations.
NIST guidance on building an information security continuous monitoring programme for federal information systems.
The OWASP list of security requirements for building and verifying web applications, at three levels.
Canada's federal private-sector privacy law on consent, use, disclosure and safeguarding of personal information.
The AICPA examination of a service organisation's controls that are relevant to its customers' financial reporting.
Get a SOC 2 report from a UK base: criteria, Type 1 vs Type 2, readiness, the audit and bridge letters.
US nonprofit cloud security verification programme, now GovRAMP, for state, local, tribal and education governments.
The automotive industry's shared information security assessment, run by ENX and built on the VDA ISA catalogue.
Texas programme that assesses and certifies cloud services used by state agencies, universities and community colleges.
Try a broader region or industry, clear the search, or reset everything.
The Navigator tells you what a framework demands — GRCMANA's playbooks and services get you through it without stalling your roadmap.