Reference

Every framework, control by control

705 frameworks. For each one: every control it asks for, how many other frameworks carry the same control, and the evidence an auditor wants.

Page built . This page is derived from the framework corpus, which changes when the corpus is extended rather than daily.

Sorted by size. The last column marks the ones with an implementation kit.

FrameworkJurisdictionControls
Australian Information Security ManualAustralia1081kit
FFIEC Cybersecurity Assessment Tool (CAT)United States (FFIEC member agencies; voluntary self-assessment for financial institutions)595kit
FFIEC IT Examination HandbookUnited States (FRB, FDIC, NCUA, OCC and state banking supervisors)538kit
BRCGS Global Standard for Food Safety Issue 9International (BRCGS, GFSI-benchmarked; sites in over 130 countries)455kit
FedRAMP HighUnited States410kit
PCI P2PEGlobal (PCI Security Standards Council; P2PE solution providers, component providers, application vendors and merchants operating merchant-managed solutions)407
IEC 62443International (IEC TC 65/WG 10 with ISA99); adopted as EN IEC 62443399kit
PCI PIN SecurityGlobal (PCI Security Standards Council; acquirers and their agents processing PINs, key-injection facilities and certification authorities)399kit
Fair Labor Association (FLA) Workplace Code of ConductGlobal (facilities of FLA-affiliated companies and their suppliers)380
FBI CJIS Security PolicyUnited States (FBI CJIS Division; every CJIS Systems Agency, criminal and noncriminal justice agency and contractor with CJI access)376kit
COBIT 2019Global (ISACA)342kit
FedRAMP ModerateUnited States323
NIST SP 800-53 Rev 5United States320kit
Automotive SPICE (ASPICE) v4.1Global (VDA QMC; automotive OEMs and their suppliers, intacs assessment scheme)318
NIST SP 800-53 Revision 5.1 HIGHUnited States317
SSAE 18United States (AICPA attestation standards; every CPA attestation engagement, including SOC 1, SOC 2 and SOC 3)308kit
IAIS Insurance Core Principles (ICPs)International (IAIS members; assessed by the IMF and World Bank under the FSAP)280kit
NIST SP 800-53 Rev 5 MODERATEUnited States275
GLOBALG.A.P. Integrated Farm Assurance (IFA) Standard v6International (GLOBALG.A.P. c/o FoodPLUS GmbH, Cologne)275
ISO 19650International (ISO/TC 59/SC 13); adopted as EN ISO 19650 with national annexes, BS EN ISO 19650 (UK), AS ISO 19650 and others256kit
PCI DSS 4.0International249kit
IATA Operational Safety Audit (IOSA) Standards ManualInternational (IATA member and non-member airlines, IOSA Registry)223
NFPA 1600United States (ANSI-accredited; used internationally)220kit
ISO 26262:2018International (ISO/TC 22/SC 32); adopted as GB/T 34590 (China, MOD), BS ISO 26262 and others217
EN 50126 / EN 50128 / EN 50129European Union (CENELEC), applied internationally210
Cloud Security Alliance Cloud Controls Matrix (CCM) v4.0.1International197
ISO 15189:2022International (ISO/TC 212); adopted as EN ISO 15189:2022, AS ISO 15189:2023, I.S. EN ISO 15189:2022 and others195
GLI-33International (adopted by state and national gaming regulators)195kit
NIST SP 800-161 Rev 1United States191kit
ISO/SAE 21434International (ISO/TC 22/SC 32 with SAE International)183
BSI IT-GrundschutzGermany (used across the German-speaking countries and by German public bodies under the UP Bund)180kit
MTCS (Singapore)Singapore175
NIST SP 800-53 Rev 5 LOWUnited States173
ISO 22313:2020International (ISO/TC 292); adopted as EN ISO 22313:2020 and nationally (BS EN, DIN EN, UNE-EN, SIST EN, I.S. EN, AS ISO, DSTU EN ISO 22313:2021 and others)163
API 1164United States (API; referenced by the TSA Pipeline Security Guidelines and used internationally)163kit
IEC 62304:2015 Medical Device Software Lifecycle ProcessesInternational (IEC); harmonised as EN 62304 under the EU MDR; FDA recognised consensus standard; adopted as ANSI/AAMI/IEC 62304 and nationally158
PCI SSFGlobal (PCI Security Standards Council; payment software vendors seeking validation and listing)156
IEC 60601-1International (IEC); adopted as EN 60601-1, ANSI/AAMI ES60601-1, CSA C22.2 No. 60601-1 and nationally156kit
ISO 26000:2010International (ISO/TMB WG SR; adopted as NF, SIST, NEN, BS, AS and other national standards)155
CIS Controls v8International153kit
ISO 14064International (ISO/TC 207/SC 7); adopted as EN ISO 14064, CSA ISO 14064, JIS Q 14064, AS ISO 14064 and others150kit
GAMP 5International (pharmaceutical, biotechnology and medical device industry guidance)147
ISO 27001:2013International140
ISO 27701:2019International139kit
ISO 37000:2021International (ISO/TC 309); adopted as BS ISO 37000:2021, SIST ISO 37000:2021 and others139
DAMA-DMBOK2Global (DAMA International; data management profession)136kit
ISO 56002International (ISO/TC 279); adopted as EN ISO 56002:2021, AS ISO 56002:2020, I.S. EN ISO 56002:2021 and others130kit
ISO 27799:2025International (ISO/TC 215)130
IATF 16949:2016Global (IATF member OEM supply chains; organizations manufacturing automotive products for automotive customers)130
ISO/IEC 29115:2013International (ISO/IEC JTC 1/SC 27 with ITU-T SG 17)130
ISO 8000International (ISO/TC 184/SC 4)126
C5 (Germany)Germany121
ISO 27001:2022International121kit
AS9100DGlobal (IAQG member companies' supply chains; organizations designing, developing or providing aviation, space and defense products and services)121kit
ITIL 4Global (PeopleCert; IT service management)117kit
ISO/IEC 27701:2025International117
BREEAMInternational (BRE Global; UK origin; national scheme operators in Sweden, the Netherlands, Norway, Spain, Germany, Austria and the USA)115
ISAE 3402International (IAASB); adopted identically in Australia, New Zealand, Singapore, India, Brazil, Thailand, Japan and elsewhere114
ISO 27018:2019International113kit
CMMC 2.0United States110
ISO/IEC 23894:2023International110kit
ISO/IEC 29147:2018International (ISO/IEC JTC 1/SC 27); adopted as EN ISO/IEC 29147:2020 and nationally110
ISO/IEC 27006-1:2024International110
ISO 37002:2021International (ISO/TC 309); adopted as BS ISO 37002:2021 and others109
IEC 62351International (IEC TC 57 WG15); adopted as EN IEC 62351109kit
ISO/IEC 27007:2020International107
NIST Cybersecurity Framework 2.0United States106kit
ISO 20400:2017International (ISO/PC 277); adopted as AS ISO 20400:2018, BS ISO 20400:2017 and others106
Egypt Personal Data Protection Law (Law No. 151 of 2020)Egypt (with extraterritorial reach to processing of Egyptians' and Egyptian residents' data)105kit
ISO/IEC 20000-1:2018International (ISO/IEC JTC 1/SC 40); adopted nationally (JIS Q 20000-1, EN ISO/IEC 20000-1 and others)101
ISO/IEC 27043:2015International (ISO/IEC JTC 1/SC 27)100
ISO/IEC 27010:2015International99
China Personal Information Protection Law (PIPL)People's Republic of China (with extraterritorial reach under Article 3(2))98kit
HKMA SPMHong Kong SAR98
NIST SP 800-171 Rev 3United States97kit
NIST SP 800-171AUnited States97
ISO 27002:2022International96kit
ISO/IEC 27011:2024International96
EU Batteries Regulation (Regulation (EU) 2023/1542)European Union96
ISO/IEC 27004:2016International94
ISO 37003:2025International94
ISO 22320:2018International (ISO/TC 292); adopted as BS ISO, DIN ISO, SS ISO (Singapore, 2022), SSB ISO, GTC ISO (Panama) and GB/T (China)91
NIST SP 800-171United States88kit
ISO 41001:2018International (ISO/TC 267); adopted as EN ISO 41001:2018 (BS, DIN, SIST, I.S.) and others86
ISO 27017:2015International86kit
Azure Security BenchmarkInternational85
ISO 39001:2012International (ISO/TC 241); adopted as IRAM-ISO 39001:2015, BS ISO 39001:2012, UNE-ISO 39001 and others83
ISO/IEC 29134:2023International (ISO/IEC JTC 1/SC 27); adopted as CSA ISO/IEC 29134:24 and nationally83
ISO 28001:2007 Supply Chain Security ManagementInternational (ISO/TC 8, now ISO/TC 292); adopted as BS ISO 28001:2007, SIST ISO 28001:2008 and others82
ISO/IEC 42001:2023International79kit
ISO 10006:2003International79
ISO 30401International (ISO/TC 260); adopted as DIN ISO 30401:2021, BS ISO 30401:2018 and others78kit
21 CFR Part 211United States78kit
ASIS SPC.1-2009United States (ANSI-accredited standard, used internationally; adopted under DHS PS-Prep in 2010)77
ISO 10006:2017International77
ISO/IEC 42006:2025International77
ISO/TS 22318:2021International (ISO/TC 292); adopted as PD ISO/TS 22318 (UK) and by other national bodies76
SOC 1 (SSAE 18 / ISAE 3402)United States (AICPA) and international (IAASB); used worldwide by service organisations serving audited user entities76
DO-178C / ED-12CInternational (civil aviation; FAA, EASA and other authorities)76
ISO 27018International75kit
EASA Part-ISEuropean Union (EASA Member States)74kit
ISO/IEC 27557:2022International (ISO/IEC JTC 1/SC 27)74
ISO 13485:2016International73kit
ISO/IEC 17025:2017International73kit
NIST AI Risk Management Framework (AI RMF 1.0)United States (NIST)72
COSO Internal ControlGlobal (COSO; used for SOX 404 ICFR assessments in the United States and for internal control generally)72kit
ISO/TS 22317:2021International (ISO/TC 292); adopted as PD ISO/TS 22317 (UK) and by other national bodies72
DISA Security Technical Implementation Guides (STIGs)United States (Department of Defense; used by other federal agencies and adopters)72
SASB StandardsInternational69
NAIC Insurance Data Security Model Law (MDL-668)United States (NAIC model, enacted by states)68kit
HIPAA Security RuleUnited States67kit
ISO/IEC 38500:2024International67kit
ISO/IEC 27019:2024International (ISO/IEC JTC 1/SC 27)67
EU ESPR (Regulation (EU) 2024/1781)European Union67
ISO/IEC 30111:2019International (ISO/IEC JTC 1/SC 27); adopted as EN ISO/IEC 30111:2020 and nationally (DIN EN ISO/IEC 30111:2020 held)66
Aged Care Quality Standards (Australia)Australia66kit
NIST SP 800-66 Rev 2United States65kit
ISO/IEC TR 24028:2020International65kit
FedRAMP Rev 5United States federal government65
FISMAUnited States federal government65kit
EU AI ActEuropean Union64kit
NIS2 DirectiveEuropean Union64kit
EU Better Internet for Kids (BIK+) StrategyEuropean Union64kit
ISO/IEC 29100:2024International (ISO/IEC JTC 1/SC 27)64
FATF 40 RecommendationsGlobal (FATF members, FATF-style regional body members; more than 200 jurisdictions committed)64kit
ISO/IEC 27040:2024International64
AWS Well-Architected Security PillarInternational63kit
IFRS 17International (IFRS Foundation)63kit
SOC 2United States61kit
ISO 50001:2018International61kit
EMV 3-D Secure (3DS)Global (payment systems participating in EMVCo)61
Cyber Security Act 2024 (Australia)Australia (Commonwealth)61kit
ISO 37500:2014International61
EDPB Guidelines 1/2026 on processing of personal data for scientific research purposesEuropean Union and EEA60
ISO/IEC 27014:2020International60
APEC Cross-Border Privacy Rules (CBPR) SystemAsia-Pacific (APEC)59kit
ISO/IEC 27031:2025International59
ISO 9001:2015International58kit
ISO/IEC 25012:2008International (ISO/IEC JTC 1/SC 7); adopted as JIS X 25012:2013 and as national standards58
ISO 22316International (ISO/TC 292); adopted as BS ISO 22316:2017 (UK), UNE-ISO 22316:2020 (Spain) and by other national bodies58
Switzerland New Federal Act on Data Protection (nFADP/nDSG, 2023)Switzerland56
ISO 22361:2022International56
ISO 30414:2018International (ISO)56
ISO 22000:2018International55kit
ISO 19011:2026International55
Rwanda DPLRwanda55
eIDAS 2.0European Union53
ISO/IEC 27400:2022International (ISO/IEC JTC 1/SC 27)53
IEEE 7000International53kit
FATF Recommendation 16Global (FATF members and FSRB members; transposed by national law)53
ISO 28000:2022International53
NIST SP 800-181United States52kit
NIST SP 800-207United States51kit
AASB S2 Climate-related DisclosuresAustralia51kit
Philippines Data Privacy ActPhilippines51
ESRB Privacy CertifiedUnited States (COPPA safe harbor; participants worldwide)50kit
Nigeria Data Protection Act 2023 (NDPA)Nigeria50
ISO 37101:2016International50
ISO 22301:2019International49kit
ISO 19011:2018International49kit
ISO 37301:2021International49kit
ISO/IEC 27003:2017International49
NIST SP 800-160United States49kit
Senge Fifth DisciplineInternational49
Heifetz Adaptive Leadership FrameworkInternational49
ISO 37001:2025International49
ISO 37009:2025International49
ISO 9001International48kit
Administrative Measures for the Security Assessment of Generative AI Services (2023) and Algorithmic Recommendation Management Provisions (2022)China48
NIST SP 800-82 Rev 3United States48kit
COSO Enterprise Risk Management (ERM) Framework (2017)Global (COSO; entities of every type and size)48
China Cybersecurity Law (CSL)People's Republic of China (with overseas liability under Article 77 as amended)47kit
FTC GLBA Safeguards Rule (16 CFR Part 314)United States (FTC-jurisdiction financial institutions)47
ISO/IEC 27017:2026International47
ISO/IEC 27050-1:2019International47
ISO 14004:2016International46kit
CISA Zero Trust Maturity ModelUnited States46kit
ISO/IEC 27018:2025International46
DoD Zero Trust Reference ArchitectureUnited States45kit
NIST SP 800-190United States45kit
SQF Code Edition 9International (GFSI-benchmarked)45
South Korea Korea Internet Self-Governance Organisation (KISO) Code of EthicsSouth Korea (KISO — self-regulatory)45
Belgium CyberFundamentalsBelgium44kit
Bank Secrecy Act / Anti-Money Laundering (BSA/AML)United States44
NIST SP 1800-32United States44kit
Act on the Implementation of the General Data Protection Regulation (OG 42/2018)Croatia44
Singapore Government Instruction Manual on ICT&SS Management (IM8)Singapore (GovTech)44
Automotive SPICE for Cybersecurity PAM v2.0International (VDA QMC, Germany; automotive supply chain)44
3GPP 5G Security Architecture (TS 33.501)International (3GPP)43kit
APRA CPS 230 Operational Risk ManagementAustralia43kit
ISO 45001:2018International43kit
ISO 37301International43kit
ISO 31000International43kit
EBA Guidelines on ICT and Security Risk Management (EBA/GL/2019/04)European Union (EBA)43
POPIASouth Africa43
ANSSI Guide d'hygiene informatique (42 mesures, v2.0)France42
NIST SP 800-218United States42kit
EN 301 549European Union42kit
ISO 37001International42kit
Authorised Economic Operator (AEO) ProgrammesInternational (97+ countries)42
ISO 27005:2022International42kit
WHO Global Competency ModelInternational42
WHO Global Strategy on Digital Health 2020-2025International (WHO)42
ISO 37004:2023International42
ISO/IEC 42005:2025International42
ISO 37001:2016International41kit
China Data Security Law (DSL)People's Republic of China (with extraterritorial liability under Article 2)41kit
Critical Infrastructure Risk Management Program (CIRMP) Rules 2023Australia (Commonwealth)41
HITECH ActUnited States (federal)41kit
Illinois Biometric Information Privacy Act (BIPA)United States (Illinois)41kit
ISO 30414:2025International41
ISO 37303:2025International41
GDPREuropean Union40kit
APRA CPS 220 Risk ManagementAustralia40kit
Australia My Health Records Act 2012Australia40kit
ISO 55001:2024International40
ISO 55001International40kit
SANS Incident Handler's Handbook and PICERL MethodologyInternational (SANS Institute)40
PDPA SingaporeSingapore40kit
Space ISAC (Information Sharing and Analysis Center)International (Space Industry)40
Goleman Emotional Intelligence Leadership FrameworkInternational40
ISO 14001:2026International40
CFTC System Safeguards (17 CFR 37, 38, 39, 49)United States (CFTC)39
AML/CTF Act 2006 (Australia)Australia39kit
ISO 22000International39kit
ISO 45001International39kit
NIST SP 800-128United States39kit
ISO 22739:2024International (ISO/TC 307)39
Uruguay DPLUruguay39
Texas Data Privacy ActUnited States - Texas39kit
Turkey KVKKTurkey39kit
ETSI Industry Specification Group (ISG) on Quantum Key Distribution (QKD)Global (ETSI deliverables)39
ISO 10005:2018International39
ISO 22398:2013International39
ISO 37302:2025International39
ISO 10005:2005International38
UNESCO Recommendation on the Ethics of AIInternational38
ISO/IEC 38500:2024International (ISO/IEC)38kit
Commercial National Security Algorithm Suite (CNSA) 2.0United States (National Security Systems)38
PDPA ThailandThailand38kit
ISO 46001:2019International38
ASD Strategies to Mitigate Cyber Security IncidentsAustralia37kit
ASEAN Guide on AI Governance and EthicsASEAN37kit
ISO 27017International37kit
AWWA Cybersecurity Guidance for the Water Sector (American Water Works Association)United States (AWWA)37
Saudi Arabia PDPLSaudi Arabia37kit
Peru DPLPeru37
BSIMMInternational36
ISO 14001:2015International36kit
UK Cyber EssentialsUnited Kingdom36kit
Digital Services Act (DSA)European Union36
VUCA Leadership FrameworkInternational36
Qatar DPLQatar36kit
ISO/IEC 23837International (ISO/IEC)36
Vietnam PDPDVietnam36
Hersey & Blanchard Situational Leadership ModelInternational36
NIST SP 800-172United States35kit
Virginia CDPAUnited States - Virginia35
CISA Cross-Sector Cybersecurity Performance Goals (CPG) 2.0United States35kit
FSSC 22000International (FSSC Foundation)35kit
NIST SP 800-150United States35kit
Security of Critical Infrastructure Act 2018 (SOCI)Australia35
Israel Protection of Privacy Law (5741-1981)Israel35
DO-326A / ED-202AInternational (civil aviation; EASA, FAA, UK MAA and other authorities)35
UK Product Security and Telecommunications Infrastructure Act (PSTI)United Kingdom35
ISO 31000:2018International34kit
NIST SP 800-124 Revision 2United States34
Argentina Law 25.326 (Personal Data Protection Law)Argentina34
US Foreign Corrupt Practices Act (FCPA)United States (Federal — DOJ/SEC)34
NIST SP 800-161United States34kit
Solvency IIEuropean Union34
SWIFT CSCFInternational34kit
Digital Economy Partnership Agreement (DEPA)International - Parties: New Zealand, Singapore, Chile (signatories); South Korea (acceded 2023). Applicants: China, Canada (accession process ongoing).34kit
NRC 10 CFR 73.54United States33
US Maritime Transportation Security Act (MTSA) and USCG Cybersecurity RequirementsUnited States (USCG)33
Consumer Data Right (CDR) Framework (Australia)Australia33kit
ISO 37005:2024International33
NIST SP 800-187United States32kit
CCPA/CPRAUnited States - California32
Australian Energy Sector Cyber Security Framework (AESCSF)Australia32kit
Botswana Data Protection Act (2024)Botswana32kit
BS 65000:2014United Kingdom (BSI; used internationally)32
FAA Aircraft Systems Information Security Protection (ASISP)United States (FAA design approvals and operators)32
W3C Verifiable Credentials (VC) Data Model 2.0International (W3C)32
Canadian PIPEDACanada31
Brunei Personal Data Protection Order 2022 (PDPO)Brunei Darussalam31kit
SIG (Shared Assessments)International31
Full Range Leadership Model (Bass & Avolio)International (academic and practitioner leadership theory)31
APPIJapan30
Chile Personal Data Protection Law (Law No. 21.719)Chile30kit
EU Clinical Trials Regulation (CTR 536/2014)European Union30kit
ISO 19011International30kit
21 CFR Part 58United States30kit
SEC Cybersecurity Disclosure RuleUnited States30
NIST SP 800-53A Rev. 5United States30kit
NIST SP 800-183United States30kit
Section 508United States30
Brazil Open Finance (Resolução Conjunta No. 1/2020)Brazil30
EU Audiovisual Media Services Directive (AVMSD, Directive 2010/13/EU as amended by Directive 2018/1808 and Directive (EU) 2023/2586)European Union30
UAE Virtual Asset Regulatory Authority (VARA) RegulationsUnited Arab Emirates — Dubai30
UK Defence Standard 05-138United Kingdom (MOD)30
EU CSDDD (Directive (EU) 2024/1760)European Union30
ISO 31022:2020International30
ASIC Cyber Resilience Good PracticesAustralia29kit
ISO/IEC 17025:2017International (ISO/IEC)29
Bahrain PDPLBahrain29
NSA Guidance for Transition to Quantum-Resistant CryptographyUnited States (National Security Agency)29
PTESInternational29
TEFCAUnited States (ONC)29
NIST SP 800-88 Rev 1United States29kit
APRA SPS 220 Risk Management (Superannuation)Australia28kit
ISO 55001:2014International28kit
ENISA Data Protection EngineeringEuropean Union (ENISA)28
WELL Building Standard v2 (International WELL Building Institute)International (IWBI — 104 countries)28
US Gramm-Leach-Bliley Act (GLBA)United States (Federal / FTC)28
African Union Malabo ConventionAfrica (AU)28kit
Romania Law No. 190/2018 on Data Protection Measures (GDPR Implementation)Romania28
TNFD RecommendationsInternational28
TISAXInternational (Automotive)28
Brazil AI FrameworkBrazil28kit
PSD2 SCAEuropean Union28
Basel III International Banking FrameworkInternational28kit
ISO/IEC 27050International (ISO/IEC)28kit
Protective Security Policy Framework (PSPF) Release 2024Australia28
Russia Federal Law on Personal Data (152-FZ)Russia28kit
Samoa Telecommunications Act (2005)Samoa28
Cyber Essentials PlusUnited Kingdom28kit
ASEAN Data Management FrameworkASEAN27kit
Colombia Data Protection Law (Law 1581 of 2012)Colombia27kit
Bermuda Monetary Authority (BMA) Cyber Risk Management Code of ConductBermuda (BMA)27kit
AS9100D:2016International (IAQG/SAE)27
Connecticut Data Privacy Act (CTDPA)United States — Connecticut27kit
Australia NHMRC National Statement on Ethical Conduct in Human ResearchAustralia (NHMRC)27
ISO/IEC 27031:2011International27
ISO/IEC 27701:2019International27kit
EU Data ActEuropean Union27kit
Argyris Double-Loop LearningInternational27
EDM Council DCAMInternational (EDM Council)27
GLBAUnited States (federal)27
Singapore Cybersecurity Act 2018Singapore27kit
AICPA Privacy Management Framework (PMF)United States (AICPA)26kit
BIMCO Cyber SecurityInternational26kit
DORAEuropean Union26kit
Canada ITSG-33Canada (Canadian Centre for Cyber Security)26kit
Utah Consumer Privacy ActUnited States - Utah26
TSA Pipeline Cybersecurity DirectivesUnited States26
ISO 27005International26kit
EU In Vitro Diagnostic Medical Devices Regulation (IVDR)European Union26kit
EU Medical Devices Regulation (MDR 2017/745)European Union26kit
ISO 37000:2021International (ISO)26kit
UN Guiding Principles on Business and Human Rights (UNGPs)International (United Nations)26
Secure by Design: A Guide for Manufacturers (CISA)United States (Federal)26
IEEE 1686International (power sector)26kit
UK Building Safety Act 2022United Kingdom (England)26
UK Construction (Design and Management) Regulations 2015 (CDM 2015)United Kingdom (HSE)26
EU Digital Markets ActEuropean Union26kit
EU Chips Act (Regulation (EU) 2023/1781)European Union26
Vermont Artificial Intelligence and Consumer Data Act (AICDA)United States — Vermont26
ICC Incoterms 2020International (ICC)26kit
Senegal Law on Personal Data Protection (Law No. 2008-12)Senegal26
Serbia Law on Personal Data Protection (2018)Serbia26kit
South Korea Credit Information ActSouth Korea25
Zimbabwe Data Protection Act (2021)Zimbabwe25
CWE Top 25 Most Dangerous Software Weaknesses (2024)International25kit
EIOPA Guidelines on ICT Security and Governance (EIOPA-BoS-20/600)European Union (EIOPA)25kit
South Korea ISMS-PSouth Korea25
Union Customs Code (UCC)European Union25
UK Open Banking StandardUnited Kingdom25
Estonia Personal Data Protection Act (Isikuandmete kaitse seadus, 2019)Estonia25kit
Science Based Targets Initiative (SBTi)International (SBTi)25
Rhode Island Data Transparency and Privacy Protection Act (RIDTPPA)United States — Rhode Island25
SEC Climate Disclosure RuleUnited States25
ACSC Essential EightAustralia24kit
APRA CPS 234Australia24kit
Australia Consumer Data RightAustralia24kit
CNCF Security Technical Advisory Group (TAG)International (CNCF/Linux Foundation)24
Uzbekistan Law on Personal Data (No. ZRU-547)Uzbekistan24
CSA STAR (Security, Trust, Assurance, and Risk)International24
ISO 13485International24kit
Ethiopia Personal Data Protection Proclamation (No. 1321/2024)Ethiopia24kit
Bermuda Personal Information Protection Act 2016 (PIPA)Bermuda24
Costa Rica Personal Data Protection Law (Law No. 8968) as amended by Executive Decree No. 42089-MGPCosta Rica24
EU Carbon Border Adjustment Mechanism (CBAM)European Union24kit
EU Cyber Resilience ActEuropean Union24kit
US OFAC Sanctions Compliance FrameworkUnited States (Treasury/OFAC)24kit
USMCA Chapter 19United States, Mexico, Canada24
EARUnited States (Commerce/BIS)24kit
SA8000:2014International (SAI)24kit
SLSAInternational24
Voluntary Principles on Security and Human Rights (VPs)International (VP Initiative)24
Spain Organic Law 3/2018 on Data Protection and Digital Rights (LOPDGDD)Spain24
Ukraine Law on Personal Data Protection (Law No. 2297-VI)Ukraine24
WCO SAFE Framework of Standards to Secure and Facilitate Global Trade (2021)International (WCO — 184 members)24
Wisconsin Data Privacy Act (SB 670)United States — Wisconsin24
NY DFS 23 NYCRR 500United States23kit
Angola Personal Data Protection Law (Law No. 22/11)Angola23kit
Barbados Data Protection Act 2019Barbados23kit
US Automated Commercial Environment (ACE)United States (CBP)23
US Consumer Product Safety Commission (CPSC)United States (CPSC)23
Bosnia and Herzegovina Law on Protection of Personal Data (2006, amended 2011)Bosnia and Herzegovina23
Tanzania Personal Data Protection Act (Draft)Tanzania23
South Africa Promotion of Access to Information Act (PAIA)South Africa23
South Korea Cloud Security Assurance Program (CSAP)South Korea23
ISO/IEC 27035-1:2023International23
Tunisia Organic Law on Personal Data Protection (Law No. 2004-63)Tunisia23
UK Concordat on Open Research Data (UKRI)United Kingdom (UKRI)23
C2M2United States22
Cayman Islands Data Protection Act 2017 (DPA)Cayman Islands22kit
AICPA SOC 3United States22kit
CIRCIA (Cyber Incident Reporting for Critical Infrastructure Act)United States22
Data Protection Act 2017Mauritius22kit
SOC for CybersecurityUnited States (AICPA)22
Canada's Anti-Spam Legislation (CASL)Canada22
CSRDEuropean Union22
Danish Data Protection Act (Databeskyttelsesloven)Denmark22
Directive (EU) 2023/970 on pay transparencyEuropean Union22
EU General Product Safety Regulation (GPSR, Regulation 2023/988)European Union22kit
UNICEF Policy Guidance on AI for Children (2021)International (UNICEF)22
EU Markets in Crypto-Assets Regulation (MiCA)European Union22
Critical Raw Materials Act (Proposed Regulation COM(2023) 192)European Union22
Colorado Privacy ActUnited States - Colorado21kit
Singapore AI Governance FrameworkSingapore21kit
COPPAUnited States21
Czech Republic Act on the Protection of Personal Data (Act No. 110/2019 Coll.)Czech Republic21
Defence Security Principles Framework (DSPF)Australia21kit
Directive (EU) 2019/1937 on the protection of persons who report breaches of Union lawEuropean Union21
EU European Media Freedom Act (EMFA)European Union21kit
EU Energy Performance of Buildings Directive (EPBD Recast)European Union21
Canada Artificial Intelligence and Data Act (AIDA)Canada20kit
TCFD RecommendationsInternational20
Cambodia Sub-Decree on Personal Data Protection (Sub-Decree No. 134)Cambodia20kit
Albania Law on Protection of Personal Data (Law No. 9887, 2008, amended 2014)Albania20
Belgium Data Protection Act (Wet van 30 juli 2018, Loi du 30 juillet 2018)Belgium20
UK Age Appropriate Design Code (Children's Code)United Kingdom20
UK Security and Emergency Measures Direction (SEMD)United Kingdom20
EU Machinery Regulation (Regulation (EU) 2023/1230)European Union20
Regional Comprehensive Economic Partnership (RCEP)Asia-Pacific (15 RCEP members)20
UK Bribery Act 2010United Kingdom (SFO)20kit
ECB TIBER-EU FrameworkEuropean Union (coordinated by ENISA, adopted by national authorities and the ECB)20
US ITAR and EARUnited States (State Dept/BIS)20
6th Anti-Money Laundering Directive (AMLD6, Directive (EU) 2018/1673)European Union20kit
Science Based Targets initiative (SBTi) Corporate StandardInternational (SBTi)20
Colorado Artificial Intelligence Act (proposed SB 24-205)Colorado, United States19
IACS Unified Requirements E26/E27International (IACS — 12 classification societies)19
UK Online Safety Act 2023United Kingdom (Ofcom)19kit
Florida Digital Bill of Rights (FDBR)United States19kit
EU Data Governance Act (DGA)European Union19kit
EU Payment Services Directive (PSD2)European Union19
Singapore Protection from Online Falsehoods and Manipulation Act (POFMA, 2019)Singapore (MCI)19
SOX 404 / ICFRUnited States19kit
Armenia Law on Protection of Personal Data (2015)Armenia18kit
TSA Pipeline SecurityUnited States18
EU AI Liability DirectiveEuropean Union18
EU Product Liability Directive (Directive (EU) 2024/2853)European Union18
Responsible Minerals Initiative (RMI)International (RBA/RMI)18
EU SFDR (Sustainable Finance Disclosure Regulation)European Union18kit
Australia eSafety CommissionerAustralia (eSafety Commissioner)18
Data (Use and Access) Act 2025United Kingdom18kit
Defence Industry Security Program (DISP)Australia18
EU Cyber Solidarity Act (Regulation (EU) 2025/38)European Union18
Sweden Data Protection Act (Dataskyddslag, 2018:218)Sweden18
Tennessee Information Protection Act (TIPA)United States — Tennessee18kit
Washington My Health My Data Act (MHMD)United States — Washington18
Annex 11 to EU GMPEuropean Union (EMA/EC)17kit
CMMC 2.0 Level 1United States17kit
CCSDS 350.0-G-3International (CCSDS — 11 member agencies)17
Jamaica Data Protection Act 2020Jamaica17kit
ISO 10007:2017International17
Uganda Data Protection and Privacy Act (2019)Uganda17
SigstoreInternational (OpenSSF)17
EU Network Code on Cybersecurity for the Electricity SectorEuropean Union17kit
EU Seveso III Directive (Directive 2012/18/EU)European Union17kit
Cook Islands Electronic Transactions Act 2003Cook Islands17kit
UNECE WP.29 R156International17
CISA Industrial Control Systems (ICS) Security GuidanceUnited States (CISA)16
Australia IRAPAustralia (ASD)16
European Accessibility Act (Directive (EU) 2019/882)European Union16
EU Taxonomy RegulationEuropean Union16kit
FIDO2 / WebAuthnInternational (FIDO Alliance/W3C)16kit
Reserve Bank of Fiji Guideline 4Fiji16
NIST SP 800-171A Rev 3United States (NIST)15kit
Australia Online Safety Act 2021Australia (eSafety Commissioner)15kit
Azerbaijan Law on Personal Data (2010)Azerbaijan15kit
ETSI EN 303 645European Union15kit
Family Educational Rights and Privacy Act (FERPA)United States15
EU ePrivacy Directive (2002/58/EC)European Union15kit
Extractive Industries Transparency Initiative (EITI) Standard (2023)International (EITI)15kit
UNECE WP.29 R155International15
ISO/IEC 27036-1:2021International15
Austria Data Protection Act (Datenschutzgesetz, DSG, amended 2018)Austria14kit
BCBS 239International14kit
ISO 14001International14kit
EDM Council CDMCInternational (EDM Council)14
OWASP ASVSInternational14
DFARS 252.204-7012United States (DoD)14kit
EU Web Accessibility Directive (Directive 2016/2102)European Union14kit
French Sapin II Law (Law No. 2016-1691)France14
Australian Privacy Principles (APPs)Australia13kit
FDA 21 CFR Part 11United States13kit
FDA Quality Management System Regulation (QMSR)United States13
Japan AI GuidelinesJapan13kit
FCC Customer Proprietary Network Information (CPNI) and Data Breach Rules (47 CFR 64.2001-2011)United States (FCC)13
GS1 Global StandardsInternational (GS1 — 116 countries)13
CDP (formerly Carbon Disclosure Project)International13
ITU-T X.805International (ITU-T)13kit
Hong Kong Personal Data (Privacy) Ordinance (PDPO, Cap 486)Hong Kong13
ISO/IEC 17050-1:2004International13
US Americans with Disabilities Act (ADA)United States (Federal — DOJ)13
Federal Decree-Law No. 45 of 2021 on the Protection of Personal Data (UAE PDPL)United Arab Emirates12
C-TPATUnited States (CBP)12
Ghana Cybersecurity ActGhana12kit
ICN Leadership for Change ProgrammeInternational12
Telecommunications Sector Security Reforms (TSSR)Australia12
GHG ProtocolInternational12
GRI StandardsInternational12kit
UK Data Protection Act 2018United Kingdom12kit
FIRST CSIRT Services Framework and StandardsInternational (FIRST — 107 countries)12
Global Cross-Border Privacy Rules (Global CBPR) ForumInternational (Global CBPR Forum)12
Kuwait National Cybersecurity FrameworkKuwait12
Ghana Data Protection Act 2012 (Act 843)Ghana12kit
Greece Law 4624/2019Greece12kit
IAEA Nuclear Security SeriesInternational (IAEA)11kit
Regulation on the European Health Data Space (EHDS)European Union11
Modern Slavery Act 2018 (Australia)Australia11
German Supply Chain Due Diligence Act (LkSG)Germany11kit
EU NIS2 DirectiveEuropean Union11
HKMA Cyber Resilience Assessment Framework (C-RAF)Hong Kong11
Japan FSA Cybersecurity Guidelines for Financial InstitutionsJapan11kit
Georgia Law on Personal Data Protection (2012)Georgia11kit
Finland Data Protection Act (Tietosuojalaki, 1050/2018)Finland11kit
FTC Health Breach Notification RuleUnited States11kit
OWASP Top 10:2025International10kit
Indonesia PDP LawIndonesia10kit
Equator Principles (EP4, 2020)International (Equator Principles Association)10
ICAO Annex 17International (ICAO)10kit
UK Telecommunications (Security) Act 2021United Kingdom10
RICS Professional StandardsInternational (RICS — 146 countries)10
Hungary Act CXII of 2011 on Informational Self-Determination and Freedom of Information (Info Act)Hungary10
Singapore Payment Services Act (PSA)Singapore (MAS)10
ECSS-E-ST-40C: Space EngineeringEurope (ECSS)10kit
ICH E6(R3)International (ICH)9kit
PIC/S Guide to Good Manufacturing Practice for Medicinal ProductsInternational (PIC/S — 54 member authorities)9
Ethical Trading Initiative (ETI) Base CodeInternational (ETI — UK-based alliance)9
ISSB StandardsInternational9
UK Gambling CommissionUnited Kingdom (Gambling Commission)9
UK Modern Slavery Act 2015United Kingdom9kit
Australia AI Ethics FrameworkAustralia8kit
Kotter 8-Step Change ModelInternational8
NATO AQAP 2110International (NATO — 31 member nations)8kit
Nebraska Data Privacy ActUnited States - Nebraska8kit
NIST Privacy FrameworkUnited States8kit
NIST SP 800-82 Revision 3: Guide to Industrial Control Systems (ICS) SecurityUnited States8
OECD AI PrinciplesInternational8kit
OECD Recommendation on Artificial Intelligence (2024 Update)International (OECD)8
Iowa Consumer Data Protection ActUnited States - Iowa8kit
Malaysia PDPA 2010Malaysia8kit
MARS-EUnited States8
Mauritius DPAMauritius8
Montana Consumer Data Privacy ActUnited States - Montana8kit
NIST SP 800-144United States8kit
NIST SP 800-92United States8kit
OpenSSF ScorecardInternational8
OWASP MASVSInternational8
Privacy Act 1988 (Australia)Australia8kit
Indiana Consumer Data Protection ActUnited States - Indiana8kit
Liechtenstein DPALiechtenstein8
Mexico LFPDPPPMexico8
Minnesota Consumer Data Privacy ActUnited States - Minnesota8kit
MITRE ATT&CKInternational8
MITRE D3FENDInternational8
Monetary Authority of Singapore Technology Risk Management GuidelinesSingapore8
Nigeria Data Protection Regulation (NDPR)Nigeria8
NIST SP 800-122United States8kit
NIST SP 800-30United States8kit
NIST SP 800-63-4United States8kit
O-RAN WG11 Security SpecificationInternational (O-RAN Alliance)8kit
Oman National Cybersecurity FrameworkOman8
Oregon Consumer Privacy ActUnited States - Oregon8kit
Personal Data Act (personopplysningsloven)Norway8
Privacy Act 2020New Zealand8kit
Iceland Data Protection and Processing of Personal Data Act (Act No. 90/2018)Iceland8
ILO Declaration on Fundamental Principles and Rights at Work (Core Conventions)International (ILO — 187 member states)8kit
IMO Maritime Cybersecurity Guidelines (MSC-FAL.1/Circ.3/Rev.2)International (IMO)8
India DPDP ActIndia8kit
ISMAP (Japan)Japan8
Kentucky Consumer Data Protection ActUnited States - Kentucky8kit
Kolb Experiential Learning CycleInternational8
Law No. 172-13 on the Protection of Personal DataDominican Republic8
Ley Orgánica de Protección de Datos Personales (LOPDP)Ecuador8
LGPDBrazil8
Maryland Online Data Privacy Act of 2024United States - Maryland8
MDS2 (Medical Device)United States8kit
Nevada Gaming Control Board Cybersecurity RequirementsUnited States — Nevada8
New Hampshire Data Privacy ActUnited States - New Hampshire8kit
New Jersey Data Privacy ActUnited States - New Jersey8kit
NHS Healthcare Leadership ModelUnited Kingdom8
NIS2 Directive Implementing ActsEuropean Union8
NIST Post-Quantum Cryptography Standards (FIPS 203, 204, 205)United States (NIST)8
NIST SP 800-123United States8kit
NIST SP 800-137United States8kit
NIST SP 800-145United States8kit
NIST SP 800-61United States8kit
NIST SP 800-88United States8kit
NIST Special Publication 800-34 Revision 1, Contingency Planning Guide for Federal Information SystemsUnited States8
OECD Guidelines for Multinational Enterprises on Responsible Business Conduct (2023 Update)International (OECD — 51 adhering governments)8
OECD/G20 Principles of Corporate GovernanceInternational8kit
Open Banking SecurityUnited Kingdom8kit
OSFI B-13Canada8kit
OWASP Top 10 for LLM Applications 2025International8kit
Pakistan Personal Data Protection Bill 2023Pakistan8
South Korea PIPASouth Korea8
Delaware Online Privacy and Protection Act (proposed)United States - Delaware8
India CERT-In Cyber Security Directions 2022India8kit
Italy Personal Data Protection Code (Legislative Decree No. 196/2003, amended 2018)Italy8
ITARUnited States (State Department)8
Maslach Burnout Inventory (MBI) and Areas of Worklife Survey (AWS) ModelUnited States (origin), International applicability8
New Zealand Information Security Manual (NZISM)New Zealand (GCSB/NCSC)8
Nigeria Open Banking Regulatory Framework (CBN, 2023)Nigeria (CBN)8kit
NIST SP 800-115 (Technical Guide to Information Security Testing and Assessment)United States8kit
NIST SP 800-146United States8kit
NIST SP 800-37United States8kit
NIST SP 800-66United States8kit
NRF Cybersecurity and Data Privacy Framework (National Retail Federation)United States (NRF)8
OWASP API Security Top 10International8kit
PCAOB AS 2201United States (PCAOB)8kit
Taiwan PDPATaiwan8
ILO Nursing Personnel Convention C149 (1977)International8kit
Kids Online Safety Act (KOSA)United States8
NABERSAustralia8
NERC CIPNorth America8kit
NIST SP 800-39United States8kit
NIST SP 800-63 Digital Identity GuidelinesUnited States8kit
Notifiable Data Breaches Scheme (Australia)Australia8kit
OCC Heightened Standards (12 CFR Part 30, Appendix D)United States (OCC)8
US SEC Digital Assets and Crypto Regulatory FrameworkUnited States (SEC)8
ICMM Mining Principles (2024 Update)International (ICMM)8
India Account Aggregator Framework (RBI)India (RBI)8kit
ITU Radio Regulations and Space Security StandardsInternational (ITU — 193 member states)8
Jordan Draft Personal Data Protection Law (2022)Jordan8kit
Kenya Data Protection ActKenya8
Laos Law on Prevention and Combating Cybercrime (2015)Laos8
LEED v4.1International (USGBC — 185 countries)8kit
Lloyd's of London Cyber Insurance Requirements and Underwriting StandardsUnited Kingdom (Lloyd's of London)8
MiFID II / MiFIREuropean Union8
NATO Cyber Defence Policy and NATO Computer Incident Response Capability (NCIRC)International (NATO — 32 members)8
NATO STANAG 4774 (Confidentiality Metadata Labels) and STANAG 4778 (Metadata Binding)International (NATO)8kit
NIST AI 600-1: Generative AI ProfileUnited States8kit
ILO Tripartite Declaration of Principles concerning Multinational Enterprises (MNE Declaration)International (ILO)8
Latvia Personal Data Processing Law (Fizisko personu datu apstrades likums, 2018)Latvia8
Law on Personal Data Protection (Official Gazette No. 42/2020)North Macedonia8
Lebanon Electronic Transactions and Personal Data Protection Law (Law No. 81/2018)Lebanon8
Myanmar Cybersecurity Law (2023)Myanmar8
Ontario Accessibility for Ontarians with Disabilities Act (AODA)Canada (Ontario)8
Paraguay Law on Protection of Personal Data (Law No. 6534/2020)Paraguay8
Privacy and Other Legislation Amendment Act 2024 (Australia)Australia8kit
HKMA TM-G-1Hong Kong8kit
IRS Publication 1075United States8kit
Japan Act on Specified Commercial Transactions (ASCT)Japan (CAA)8
Kazakhstan Law on Personal Data and Their Protection (No. 94-V)Kazakhstan8
Kuwait Data Privacy Protection Regulation (KDPPR, 2021Kuwait8
Law No. 09-08 on the Protection of Individuals with Regard to the Processing of Personal DataMorocco8kit
Law No. 2013-450 of 19 June 2013 on the Protection of Personal DataCôte d'Ivoire8
Lithuania Law on Legal Protection of Personal Data (2018)Lithuania8kit
Lloyd's Minimum StandardsUnited Kingdom (Lloyd's)8
Luxembourg Law of 1 August 2018 on Data Protection (GDPR Implementation)Luxembourg8kit
Malta Data Protection Act (Cap. 586, 2018)Malta8
Montenegro Law on Personal Data Protection (2023)Montenegro8kit
Netherlands GDPR Implementation Act (UAVGNetherlands8
Oman Personal Data Protection Law (Royal Decree 6/2022)Oman8
Panama Law on Personal Data Protection (Law No. 81 of 2019)Panama8kit
Poland Act on Personal Data Protection (Ustawa o ochronie danych osobowych, 2018)Poland8kit
Portugal Law No. 58/2019Portugal8kit
RBI Cybersecurity Framework for BanksIndia8
HL7 FHIR Security FrameworkInternational (Healthcare)7kit
IRM Enterprise Risk Management Framework (Institute of Risk Management)International (IRM)7kit
US EPA Safe Drinking Water Act (SDWA)United States (EPA)7
Fiji Data Protection Bill (2020)Fiji7kit
Privacy by Design (PbD)International7kit
OWASP DevSecOps Maturity Model (DSOMM)International6kit
ICH Q10International (ICH)6
PAS 1192-5:2015United Kingdom (BSI/CPNI)6kit
ISO/IEC 17050-2:2004International6
UK GDPR (UK General Data Protection Regulation)United Kingdom6
California IoT Security LawUnited States - California6
Papua New Guinea National Cybersecurity Policy & Cybercrime Act (2016)Papua New Guinea6
US Children's Online Privacy Protection Act (COPPA) and COPPA 2.0 Proposed UpdatesUnited States (FTC)6
Philippines Cybercrime Prevention Act (RA 10175)Philippines6kit
Proposal for a Directive on improving working conditions in platform work (COM(2023) 491)European Union6
Singapore MAS TRM GuidelinesSingapore6
LEADS in a Caring EnvironmentInternational5
Trinidad and Tobago Data Protection Act 2011Trinidad and Tobago5
OWASP SAMMInternational5
UK AI Regulation FrameworkUnited Kingdom5
UK FCA/PRA Operational Resilience FrameworkUnited Kingdom5
US NRC 10 CFR 73.54United States (NRC)5kit
WCAG 2.2International5
PropTech Security StandardsInternational5
Protection of Privacy Law (1981)Israel5
Saudi NCA ECCSaudi Arabia5kit
Spain ENSSpain5
Sri Lanka Personal Data Protection Act (No. 9 of 2022)Sri Lanka5
The Leadership Challenge (Kouzes & Posner)International5
US Executive Order 14028United States5
WCO Authorised Economic Operator (AEO) FrameworkInternational (WCO)5
Zambia Data Protection Act (2021)Zambia5