IT compliance is the set of laws, contract requirements and voluntary standards that decide how technology companies protect data and run their systems. This directory lists 64 of them for software, SaaS and IT service companies, with what each covers, who needs it, where it applies and whether it is mandatory.
The first thing to know about any compliance item is whether you have a choice. Every entry carries one of these badges.
Law
Mandatory by law for organizations in scope.
For example: GDPR, HIPAA, the DPDP Act, NIS2
Regulation
Mandatory for regulated organizations in scope.
For example: EU AI Act, DORA, CERT-In Directions
Contract requirement
Mandatory once a contract, card brand or government buyer requires it.
For example: PCI DSS, CMMC, FedRAMP
Certifiable standard
Voluntary, with independent certification.
For example: ISO 27001, ISO 42001, ISO 22301
Attestation report
Voluntary, with an independent CPA report.
For example: SOC 2, SOC 1
Framework
Voluntary framework, no official certificate.
For example: NIST CSF, CIS Controls, COBIT
Guidance
Voluntary guidance, no official certificate.
For example: OWASP Top 10, ISO 27002
Directory
All 64 IT compliance standards, laws and frameworks
Search by name, filter by category or type, or pick what describes your company to see what is likely to apply. Status lines were checked on October 30, 2026.
This is a starting point based on typical triggers, not a legal assessment. Read each guide's "Who needs it?" section to confirm.
Information security management systems: requirements
ISO/IEC 27001 is the international standard for an information security management system (ISMS). It asks you to define a scope, assess information security risks, choose controls to treat them (Annex A lists 93), and keep improving through internal audits and management review. Accredited certification bodies audit against it and issue a three-year certificate with yearly surveillance audits. It is voluntary, but enterprise and public sector buyers often require it.
What it covers, who needs it and why
What it covers
Governance of information security: risk assessment and treatment, policies, roles, people, physical and technical controls, supplier security, incident management, continuity and continual improvement.
Who needs it
Software and SaaS companies, IT service and managed service providers, data centers and any organization whose customers ask for independent proof of security.
Why it matters
It is the most widely recognized security certificate in tenders and vendor questionnaires outside the US, and its risk-based structure is the base that ISO 27701, 27017, 27018 and 42001 build on.
Key objectives
Identify and treat information security risks in a defined scope
Select and justify controls in a Statement of Applicability
Prove the system works through internal audit and management review
Improve continually and correct nonconformities
Mandatory or voluntary
Voluntary, with independent certification.
Owner
ISO and IEC (JTC 1/SC 27)
Current version
ISO/IEC 27001:2022 with Amendment 1:2024. Certificates to the 2013 edition expired on 31 October 2025.
ISO/IEC 27002 is the companion guidance to ISO 27001. It describes each of the 93 information security controls in detail: the purpose, how to implement it and what to consider. The 2022 edition groups the controls into four themes (organizational, people, physical and technological) and adds attributes so you can sort them by purpose. You cannot be certified to ISO 27002; you use it to implement the Annex A controls of ISO 27001 well.
What it covers, who needs it and why
What it covers
Implementation guidance for 37 organizational, 8 people, 14 physical and 34 technological controls, including threat intelligence, cloud services, secure coding and data masking.
Who needs it
Teams implementing ISO 27001, security leads writing policies, and anyone mapping controls between frameworks.
Why it matters
Auditors read Annex A controls with ISO 27002 in mind, so it tells you what a reasonable implementation of each control looks like.
Key objectives
Explain the intent of each control
Give practical implementation guidance
Let organizations filter controls by attribute (control type, security property, concept)
System and Organization Controls 2 report on controls relevant to security, availability, processing integrity, confidentiality or privacy
SOC 2 is an independent report, issued by a licensed CPA firm, on the controls a service organization runs to meet the AICPA Trust Services Criteria. Security is always in scope; availability, processing integrity, confidentiality and privacy are added when relevant. A Type I report covers the design of controls at one date. A Type II report also tests whether they operated effectively over a period, usually 3 to 12 months. It is an attestation, not a certificate.
What it covers, who needs it and why
What it covers
Controls over the system that delivers your service: governance and risk, access, change management, operations and monitoring, incident response, vendor management and any additional criteria you choose.
Who needs it
SaaS and cloud companies, IT service providers and data processors that sell to US and enterprise customers.
Why it matters
US enterprise buyers often require a current SOC 2 Type II report before they sign or renew, and it replaces many custom security questionnaires.
Key objectives
Describe the system and its boundaries
Show controls meet the selected Trust Services Criteria
Prove controls operated over time (Type II)
Give customers and their auditors independent assurance
Mandatory or voluntary
Voluntary, with an independent CPA report.
Owner
AICPA (American Institute of Certified Public Accountants)
Current version
Trust Services Criteria (2017), with points of focus revised in 2022. Reports follow the AICPA SOC 2 guide.
System and Organization Controls 1 report on controls relevant to user entities' internal control over financial reporting
A SOC 1 report tells a customer's financial auditor whether a service provider's controls can be relied on for the customer's financial reporting. It matters when your system processes transactions, payroll, billing or other data that ends up in a customer's financial statements. Like SOC 2, it comes as Type I (design at a date) or Type II (operating effectiveness over a period) and is issued by a CPA firm. It is not a security report and does not replace SOC 2.
What it covers, who needs it and why
What it covers
Control objectives you define around transaction processing and the IT general controls that support them (access, change management, operations).
Who needs it
Payroll, billing, payment, fund administration, ERP hosting and other providers whose output affects customers' financial statements, often at the request of SOX-regulated customers.
Why it matters
Without one, a customer's auditor may have to test your controls directly, which is slow and disruptive for both sides.
Key objectives
Describe the service and control objectives
Show controls are designed to meet them
Test operating effectiveness over a period (Type II)
UK government-backed certification of five basic technical security controls
Cyber Essentials is a UK government-backed scheme that certifies five technical controls against common internet attacks: firewalls, secure configuration, user access control, malware protection and security update management. The basic level is a verified self-assessment. Cyber Essentials Plus adds a hands-on technical audit by an assessor. Certificates last 12 months. Many UK central government contracts that handle personal or sensitive information require it.
What it covers, who needs it and why
What it covers
Internet-connected devices, servers, cloud services and user accounts within the scope you define, against five technical control areas.
Who needs it
Any organization selling to UK government, and UK businesses whose customers or insurers ask for a baseline security certificate.
Why it matters
It is cheap and quick compared with ISO 27001, and for some UK public contracts it is a bid requirement.
Key objectives
Block common, low-skill internet attacks
Set a verifiable security baseline
Give buyers a simple yes or no check
Mandatory or voluntary
Voluntary, with independent certification.
Owner
UK National Cyber Security Centre (NCSC), delivered through IASME
Current version
Requirements for IT Infrastructure v3.3 with the "Danzell" question set, used for assessments from April 2026.
General Data Protection Regulation, Regulation (EU) 2016/679
The GDPR is the EU law on processing personal data. It applies to organizations established in the EU, and to organizations elsewhere that offer goods or services to people in the EU or monitor their behavior. It requires a lawful basis for each processing purpose, transparency, data minimization, security, breach notification within 72 hours, and respect for individual rights. Processors such as SaaS vendors have direct duties too. Fines reach 20 million euros or 4% of worldwide annual turnover.
What it covers, who needs it and why
What it covers
Any processing of personal data: customer and user data, employee data, marketing, analytics, AI training data and data you process for customers as a processor.
Who needs it
Every company with EU users, customers or employees, including software and SaaS companies outside the EU that sell into it.
Why it matters
It is binding law with large fines, and EU customers will not sign without a data processing agreement and proof of GDPR-ready processes.
Key objectives
Lawful, fair and transparent processing
Purpose limitation, minimization and storage limits
Security and accountability you can demonstrate
Rights for individuals, including access, erasure and objection
Mandatory or voluntary
Mandatory by law for organizations in scope.
Owner
European Union; enforced by national data protection authorities and the EDPB
Current version
In force since 25 May 2018. Digital Omnibus amendments proposed in November 2025 have a Council position (21 October 2026) but are not law, so the current text still applies.
Law United Kingdom, plus non-UK companies that target or monitor people there
UK GDPR and Data Protection Act 2018
United Kingdom General Data Protection Regulation and the Data Protection Act 2018
After Brexit the UK kept the GDPR as domestic law (the UK GDPR), alongside the Data Protection Act 2018. The core rules match the EU GDPR: lawful bases, transparency, security, breach notification within 72 hours and individual rights. The Data (Use and Access) Act 2025 adds changes, including recognized legitimate interests, more cookie exemptions and higher fines under the electronic marketing rules. The ICO can fine up to 17.5 million pounds or 4% of worldwide turnover.
What it covers, who needs it and why
What it covers
Processing of personal data of people in the UK, international transfers out of the UK, and, through PECR, cookies and electronic marketing.
Who needs it
Companies established in the UK and companies elsewhere that offer goods or services to people in the UK.
Why it matters
UK customers expect UK-specific contract terms and transfer tools, and the UK and EU rules are starting to diverge.
Key objectives
Keep EU-equivalent privacy protection in UK law
Set UK-specific transfer and enforcement rules
Ease some processing burdens through the 2025 Act
Mandatory or voluntary
Mandatory by law for organizations in scope.
Owner
UK Parliament; enforced by the Information Commissioner's Office (ICO)
Current version
Amended by the Data (Use and Access) Act 2025, whose changes are commencing in stages.
California Consumer Privacy Act, as amended by the California Privacy Rights Act
The CCPA gives California residents rights over personal information that businesses collect: to know, delete, correct, opt out of sale or sharing, and limit use of sensitive data. It applies to for-profit businesses that meet a revenue threshold or handle large volumes of California data, and it binds their service providers by contract. Regulations finalized in 2025 add duties for automated decision-making, risk assessments and annual cybersecurity audits, phased in over the next few years.
What it covers, who needs it and why
What it covers
Personal information of California consumers, including employees and B2B contacts, plus contracts with service providers and contractors.
Who needs it
Businesses doing business in California above the thresholds, and the SaaS and IT vendors that process data for them as service providers.
Why it matters
It is the most detailed US privacy law, with an active regulator, and its contract terms flow down to every vendor in the chain.
Key objectives
Give consumers control over their personal information
Require notice and opt-outs for selling and sharing
Set security, risk assessment and audit duties for higher-risk processing
Mandatory or voluntary
Mandatory by law for organizations in scope.
Owner
State of California; enforced by the California Privacy Protection Agency (CPPA) and the Attorney General
Current version
CPPA regulations on automated decision-making technology, risk assessments and cybersecurity audits took effect 1 January 2026, with later compliance dates for each.
Comprehensive consumer privacy laws in Virginia, Colorado, Connecticut, Texas and other US states
Beyond California, roughly 20 US states have passed comprehensive consumer privacy laws, starting with Virginia in 2021. Most follow a similar model: thresholds based on the number of residents whose data you handle, rights to access, delete, correct and opt out of targeted advertising and sale, consent for sensitive data, data protection assessments, and processor contracts. Details differ, including thresholds, cure periods and children's data rules, so a multi-state program maps each one.
What it covers, who needs it and why
What it covers
Personal data of state residents acting as consumers. Most exclude employee and B2B data, unlike California.
Who needs it
Companies with customers or users across the US above each state's thresholds, and their processors.
Why it matters
There is no federal privacy law, so a national US business has to meet a patchwork of state rules.
Key objectives
Give residents core privacy rights
Require assessments for high-risk processing
Set processor contract terms
Mandatory or voluntary
Mandatory by law for organizations in scope.
Owner
Individual state legislatures; enforced mainly by state attorneys general
Current version
New laws keep taking effect; the list in the guide is re-checked at every review.
Privacy information management systems: requirements and guidance
ISO/IEC 27701 sets requirements for a privacy information management system (PIMS) for organizations that act as PII controllers, PII processors or both. The 2019 edition was an extension of ISO 27001; the 2025 edition can be certified on its own, though many companies still combine the two. It translates privacy principles into management system clauses and controls that map to laws such as the GDPR. Certification is voluntary and done by accredited bodies.
What it covers, who needs it and why
What it covers
How you govern personal data as a controller or processor: roles, records of processing, privacy risk, rights requests, processor obligations, transfers and breach handling.
Who needs it
SaaS companies, data processors and IT service providers that want an auditable, international proof of privacy management.
Why it matters
It gives customers and regulators a structured way to see privacy accountability, and its mapping to GDPR helps in procurement.
Key objectives
Run privacy as a managed system
Define controls for controllers and processors
Demonstrate accountability under privacy laws
Mandatory or voluntary
Voluntary, with independent certification.
Owner
ISO and IEC (JTC 1/SC 27)
Current version
ISO/IEC 27701:2025, now a standalone management system standard instead of an extension that required ISO 27001.
Children's Online Privacy Protection Act and the FTC COPPA Rule
COPPA requires operators of websites, apps and online services directed to children under 13, or that knowingly collect their personal information, to give notice and get verifiable parental consent before collecting it. It also sets limits on retention, security duties and parents' rights to review and delete. The 2025 amendments add separate consent for disclosure to third parties such as advertisers, a written security program and a written retention policy. The FTC enforces it with civil penalties per violation.
What it covers, who needs it and why
What it covers
Personal information from children under 13, including persistent identifiers, photos, voice and geolocation.
Who needs it
Edtech, gaming, apps and any online service aimed at children or used by them with the operator's knowledge, plus vendors serving schools.
Why it matters
Penalties are per violation and the FTC regularly brings cases against apps and platforms.
Key objectives
Put parents in control of children's data
Limit collection, use and retention
Require reasonable security
Mandatory or voluntary
Mandatory by law for organizations in scope.
Owner
US Federal Trade Commission (FTC)
Current version
The amended COPPA Rule published in April 2025 had a compliance date of 22 April 2026.
Directive 2002/58/EC on privacy and electronic communications (the "cookie law")
The ePrivacy Directive sets EU rules on confidentiality of communications, cookies and similar technologies, and electronic direct marketing. Its best-known rule, Article 5(3), requires consent before storing or reading information on a user's device unless it is strictly necessary for the service the user asked for. Each EU country implements it in national law, so details and enforcers vary. It sits alongside the GDPR and often decides what analytics and advertising tags a SaaS website may load.
What it covers, who needs it and why
What it covers
Cookies, SDKs, pixels and device fingerprinting, plus email and SMS marketing and the confidentiality of communications.
Who needs it
Any website, app or SaaS product used by people in the EU, and any company sending them electronic marketing.
Why it matters
Cookie consent is one of the most actively enforced areas of EU privacy law.
Key objectives
Protect the confidentiality of communications
Require consent for non-essential device access
Limit unsolicited electronic marketing
Mandatory or voluntary
Mandatory by law for organizations in scope.
Owner
European Union; enforced by national authorities
Current version
Directive 2002/58/EC as amended in 2009. The proposed ePrivacy Regulation was withdrawn by the Commission in 2025.
The NIST Cybersecurity Framework is a voluntary framework that helps any organization understand and reduce cybersecurity risk. Version 2.0 organizes outcomes into six functions (Govern, Identify, Protect, Detect, Respond and Recover), broken into categories and subcategories, with profiles to describe current and target states and tiers to describe rigor. It does not prescribe controls; it points to references such as NIST SP 800-53, ISO 27001 and CIS Controls. There is no certification.
What it covers, who needs it and why
What it covers
Cybersecurity governance and risk outcomes across the organization and its supply chain, from strategy to incident recovery.
Who needs it
Organizations of any size, especially US companies, critical infrastructure and suppliers whose customers or regulators reference it.
Why it matters
It is a common language for boards, regulators and customers, and many sector rules (SEBI CSCRF among them) reuse its functions.
Key objectives
Describe current and target cybersecurity posture
Prioritize improvements by risk
Communicate risk to leadership and partners
Mandatory or voluntary
Voluntary framework, no official certificate.
Owner
US National Institute of Standards and Technology (NIST)
Center for Internet Security Critical Security Controls
The CIS Controls are a prioritized set of 18 security controls and 153 safeguards drawn from real attack data. They are grouped into three Implementation Groups: IG1 is the essential hygiene every organization should have, and IG2 and IG3 add safeguards for more complex environments and more capable attackers. They are free, prescriptive and map to NIST CSF, ISO 27001 and PCI DSS, which makes them a practical starting point for a small IT company. There is no official certification.
What it covers, who needs it and why
What it covers
Asset and software inventory, data protection, secure configuration, account and access control, vulnerability management, logging, email and browser protection, malware defenses, backup, network defenses, awareness training, service providers, application security, incident response and penetration testing.
Who needs it
IT teams that want a concrete, ordered to-do list, and companies whose cyber insurers or customers reference it.
Why it matters
It turns broad frameworks into specific safeguards in priority order, so limited budgets go to what stops most attacks.
Directive (EU) 2022/2555 on measures for a high common level of cybersecurity across the Union
NIS2 is the EU directive that sets cybersecurity risk management and incident reporting duties for medium and large organizations in 18 critical sectors. Digital infrastructure and ICT service management are among them, so cloud providers, data centers, managed service providers and managed security providers are directly in scope. Entities must take risk management measures, report significant incidents (early warning within 24 hours), and their management bodies must approve measures and take training. Fines reach 10 million euros or 2% of turnover for essential entities.
What it covers, who needs it and why
What it covers
Network and information systems of essential and important entities, including supply chain security, incident handling, continuity, encryption and access control.
Who needs it
Medium and large companies in listed sectors in the EU, including cloud, data center, managed service and managed security providers, and some digital providers regardless of size.
Why it matters
It makes executives personally accountable and brings many IT providers under a regulator for the first time.
Key objectives
Raise a common baseline of cybersecurity
Require fast incident reporting
Hold management bodies accountable
Address supply chain risk
Mandatory or voluntary
Mandatory by law for organizations in scope.
Owner
European Union; enforced by national competent authorities
Current version
Member states had to transpose it by 17 October 2024. Several transposed late, so national laws are still arriving.
Regulation (EU) 2024/2847 on horizontal cybersecurity requirements for products with digital elements
The Cyber Resilience Act sets cybersecurity requirements for hardware and software products with digital elements sold in the EU. Manufacturers must design products to essential security requirements, handle vulnerabilities for the support period, provide security updates, document a software bill of materials, and carry a CE mark. Since 11 September 2026 they must report actively exploited vulnerabilities and severe incidents to ENISA's single reporting platform within 24 hours. Pure SaaS is mostly covered by NIS2 instead, except where it is remote data processing for a product.
What it covers, who needs it and why
What it covers
Software and connected products placed on the EU market, from design and vulnerability handling to updates, documentation and conformity assessment.
Who needs it
Manufacturers, importers and distributors of software and connected devices for the EU market, including non-EU software publishers.
Why it matters
It is the first EU law to put security-by-design duties on software makers, with fines up to 15 million euros or 2.5% of turnover.
Key objectives
Ship products with fewer vulnerabilities
Keep products secure through their support period
Give users clear security information
Report exploited vulnerabilities fast
Mandatory or voluntary
Mandatory for regulated organizations in scope.
Owner
European Union; market surveillance authorities and ENISA
Current version
In force since 10 December 2024. Reporting of actively exploited vulnerabilities and severe incidents applies from 11 September 2026; the remaining obligations from 11 December 2027.
Regulation United States (companies registered with the SEC)
SEC cybersecurity disclosure rules
US Securities and Exchange Commission rules on cybersecurity risk management, strategy, governance and incident disclosure
The SEC's 2023 rules require public companies to disclose material cybersecurity incidents on Form 8-K, generally within four business days of deciding an incident is material, and to describe their cybersecurity risk management, strategy and governance every year in Form 10-K. The rules do not prescribe controls, but they force a documented process for judging materiality and board oversight. IT vendors feel them through customers who now ask about incident notice timelines.
What it covers, who needs it and why
What it covers
Disclosure of material incidents, processes to assess and manage cyber risk, management's role and the board's oversight.
Who needs it
Companies listed in the US, including foreign private issuers (on Forms 6-K and 20-F), and indirectly their technology suppliers.
Why it matters
Late or misleading disclosure exposes the company and its officers to SEC enforcement.
Key objectives
Give investors timely incident information
Standardize disclosure of cyber governance
Push board-level oversight of cyber risk
Mandatory or voluntary
Mandatory for regulated organizations in scope.
Owner
US Securities and Exchange Commission (SEC)
Current version
Adopted July 2023. Form 8-K Item 1.05 incident disclosure has applied since 18 December 2023 for most registrants.
Control Objectives for Information and Related Technologies
COBIT is ISACA's framework for governing and managing enterprise information and technology. COBIT 2019 defines 40 governance and management objectives in five domains, design factors to tailor them, and capability levels to measure processes. It separates governance (evaluate, direct, monitor) from management (plan, build, run, monitor) and is popular with IT auditors and regulated sectors. It is voluntary; individuals can be certified, organizations cannot.
What it covers, who needs it and why
What it covers
IT strategy, risk, resources, portfolio, security, change, operations, assurance and the link between business goals and IT goals.
Who needs it
CIOs, IT auditors, banks and other regulated firms, and IT providers whose customers audit them against it.
Why it matters
It gives auditors and boards a structured way to judge whether IT is governed, which supports SOX and banking IT rules.
Key objectives
Align IT with business goals
Separate governance from management
Measure process capability
Mandatory or voluntary
Voluntary framework, no official certificate.
Owner
ISACA
Current version
COBIT 2019, with 40 governance and management objectives.
ITIL framework for IT and digital service management
ITIL is the most widely used framework of good practice for IT service management. ITIL 4 describes a service value system, guiding principles and 34 management practices, including incident, problem, change enablement and service level management. ITIL Version 5 is rolling out in 2026 with new modules, including AI governance. ITIL certifies people, not organizations; an organization that wants a certificate for its service management uses ISO/IEC 20000-1.
What it covers, who needs it and why
What it covers
How IT services are designed, delivered, supported and improved: service desk, incidents, problems, changes, releases, service levels, assets and continuity.
Who needs it
Managed service providers, internal IT departments, service desks and anyone bidding for IT service contracts.
Why it matters
Buyers often expect ITIL-aligned processes and ITIL-certified staff in managed service tenders.
Key objectives
Deliver value through services
Standardize service management practices
Improve services continually
Mandatory or voluntary
Voluntary framework, no official certificate.
Owner
PeopleCert (which acquired AXELOS)
Current version
ITIL 4 with 34 practices. ITIL Version 5 is being rolled out in phases during 2026, starting with Foundation.
ISO/IEC 20000-1 is the certifiable international standard for a service management system (SMS). It follows the same high-level structure as ISO 27001 and ISO 9001, and adds requirements for service portfolio, relationship and agreement management, supply and demand, service design and transition, resolution and fulfillment, and service assurance. Where ITIL certifies people, ISO 20000-1 lets an IT service provider certify the organization's service management.
What it covers, who needs it and why
What it covers
The full service lifecycle for the services in scope, plus the management system around it.
Who needs it
Managed service providers, outsourcers, data center and cloud operators, and internal IT shared services.
Why it matters
Some public sector and enterprise tenders ask for it as proof that services are run in a controlled way.
Key objectives
Plan and deliver services that meet agreed requirements
ISO 9001 is the international standard for a quality management system. It asks you to understand customer requirements, plan and control the processes that deliver your products and services, manage risks and opportunities, measure results and improve. For software and IT companies it is often a tender requirement, especially in government and manufacturing supply chains. The 2026 edition adds emphasis on quality culture and ethics, change management and organizational knowledge.
What it covers, who needs it and why
What it covers
Leadership, planning, support (people, competence, documented information), operations (design, development, delivery), performance evaluation and improvement.
Who needs it
Software development firms, IT service companies and any supplier whose customers require a certified quality system.
Why it matters
It is the most widely held management system certificate in the world and a common pre-qualification filter.
Key objectives
Consistently meet customer and legal requirements
Manage processes and risks
Improve customer satisfaction
Mandatory or voluntary
Voluntary, with independent certification.
Owner
ISO (TC 176)
Current version
ISO 9001:2026 was published on 16 September 2026, with a transition period of about three years. ISO 9001:2015 certificates stay valid during the transition.
Sarbanes-Oxley Act of 2002, Sections 302 and 404, with the COSO internal control framework
The Sarbanes-Oxley Act requires public companies to maintain and assess internal control over financial reporting. Section 404 requires management to report on those controls, and for larger filers an external auditor attests to them. Because financial data lives in IT systems, auditors test IT general controls: access to systems, change management, computer operations and program development. SOX does not apply to private IT vendors directly, but customers pass its control demands to them, often by asking for a SOC 1 report.
What it covers, who needs it and why
What it covers
IT general controls over systems that affect financial reporting: user access and segregation of duties, change management, operations, backups and interfaces.
Who needs it
US-listed companies and the IT and SaaS providers that host or run their financial systems.
Why it matters
Weak IT controls are a common cause of reported material weaknesses, and officers personally certify the reports.
Key objectives
Reliable financial reporting
Documented and tested internal controls
Accountability of executives for reported figures
Mandatory or voluntary
Mandatory by law for organizations in scope.
Owner
US Congress; SEC and PCAOB
Current version
The 2002 Act; most companies assess internal control against the COSO 2013 framework.
ISO 31000 gives principles, a framework and a process for managing any kind of risk in any organization. The process runs from establishing scope and context to risk identification, analysis and evaluation, treatment, monitoring and reporting. It is guidance, so it cannot be certified, but it shapes how ISO 27001, ISO 22301 and ISO 42001 expect risk to be handled and is a common reference for enterprise risk management programs.
What it covers, who needs it and why
What it covers
Enterprise and operational risk management principles, governance and process, applicable to IT, security, project and business risk.
Who needs it
Risk managers, security and compliance leads, and companies building one risk method across several standards.
Why it matters
A single, consistent risk method avoids running separate and conflicting risk registers for each standard.
Code of practice for information security controls for cloud services
ISO/IEC 27017 adds cloud-specific guidance to the ISO 27002 controls and seven extra controls for cloud services, for both cloud service providers and cloud customers. It covers shared responsibilities, removal of customer assets at contract end, segregation in virtual environments, virtual machine hardening, administrator operations, monitoring and network alignment. It is a code of practice, so organizations are certified to ISO 27001 with 27017 controls in the Statement of Applicability rather than to 27017 alone.
What it covers, who needs it and why
What it covers
Cloud provider and customer responsibilities, multi-tenancy, virtualization, admin access, logging and contract-end data return or deletion.
Who needs it
SaaS, PaaS and IaaS providers, and companies running significant workloads in public cloud.
Why it matters
It answers the cloud-specific questions that a plain ISO 27001 certificate leaves open for buyers.
Code of practice for protection of personally identifiable information (PII) in public clouds acting as PII processors
ISO/IEC 27018 is a code of practice for public cloud providers that process personal data on behalf of customers. It extends ISO 27002 controls with privacy commitments a processor should make: process PII only on customer instructions, do not use it for marketing without consent, disclose sub-processors and government access requests where allowed, notify breaches, and return or delete data at the end of the contract. Like 27017 it is usually certified as part of an ISO 27001 scope.
What it covers, who needs it and why
What it covers
Personal data that a public cloud provider processes for its customers, and the transparency and control the customer gets.
Who needs it
Public cloud and SaaS providers acting as processors, especially those selling into Europe.
Why it matters
It turns processor promises into audited controls, which shortens privacy reviews in procurement.
Cloud Security Alliance Security, Trust, Assurance and Risk registry
CSA STAR is a public registry where cloud providers publish their security posture against the Cloud Controls Matrix (CCM), a cloud-specific control framework. Level 1 is a self-assessment using the CAIQ questionnaire, free to publish. Level 2 adds third-party assurance, either STAR Certification (with ISO 27001) or STAR Attestation (with SOC 2). Buyers use the registry to pre-screen vendors, and the CCM maps to ISO 27001, NIST and PCI DSS.
What it covers, who needs it and why
What it covers
Cloud controls across 17 domains, including application security, data security, identity and access, infrastructure, logging and supply chain.
Who needs it
SaaS and cloud providers that want a public, cloud-specific trust signal.
Why it matters
A published CAIQ answers many security questionnaires in advance, and Level 2 combines with audits you may already have.
Key objectives
Make cloud security transparent
Give a cloud-specific control set
Reuse existing ISO and SOC audits
Mandatory or voluntary
Voluntary, with independent certification.
Owner
Cloud Security Alliance (CSA)
Current version
Cloud Controls Matrix (CCM) v4.1, with a published transition timeline from v4.0.
Regulation (EU) 2023/2854 on harmonised rules on fair access to and use of data
The EU Data Act gives users of connected products access to the data they generate and sets rules for data sharing between businesses. For IT companies its biggest effect is Chapter VI on switching between data processing services: cloud and SaaS providers must let customers move to another provider or on premises, with set notice periods, data export, contract terms and the end of switching charges from January 2027. It also limits unfair data clauses in B2B contracts.
What it covers, who needs it and why
What it covers
Data from connected products and related services, B2B data sharing terms, switching and interoperability for cloud and edge services, and safeguards against unlawful government access.
Who needs it
Cloud, SaaS, PaaS and IaaS providers serving EU customers, and makers of connected products.
Why it matters
It rewrites standard cloud contract terms on exit, data portability and fees.
Key objectives
Fair access to data from connected products
Easier switching between cloud providers
Balanced B2B data contracts
Mandatory or voluntary
Mandatory for regulated organizations in scope.
Owner
European Union; national competent authorities
Current version
Applies from 12 September 2025. Switching charges for cloud services must end by 12 January 2027.
Open Worldwide Application Security Project Top 10 web application security risks
The OWASP Top 10 is an awareness document listing the most critical security risks to web applications, based on data from real applications and a community survey. It is updated every few years; the 2025 edition keeps broken access control at the top and adds software supply chain failures. It is not a standard and cannot be certified, but PCI DSS, customers and penetration testers use it as the minimum set of risks your developers must understand and test for.
What it covers, who needs it and why
What it covers
Access control, misconfiguration, supply chain, cryptography, injection, insecure design, authentication, integrity, logging and alerting, and error handling.
Who needs it
Every team that builds web applications or APIs, and the security testers and buyers who assess them.
Why it matters
It is the shared baseline for secure coding training and application security testing.
The ASVS is a detailed list of security requirements for designing, building and testing web applications and APIs. Requirements are grouped by area and assigned to three levels: Level 1 for basic assurance, Level 2 for most applications that handle sensitive data, and Level 3 for the most critical systems. Where the Top 10 tells you what to worry about, the ASVS tells you what to verify. It is free and widely used to write security requirements into contracts and test plans.
What it covers, who needs it and why
What it covers
Authentication, session management, access control, validation and encoding, cryptography, error handling and logging, data protection, communications, configuration and API security.
Who needs it
Development teams, application security testers, and buyers who want measurable security requirements from software vendors.
Why it matters
It turns "secure software" into testable requirements a customer and vendor can agree on.
NIST SP 800-218, Secure Software Development Framework (SSDF)
The SSDF is a set of secure software development practices organized into four groups: prepare the organization, protect the software, produce well-secured software, and respond to vulnerabilities. It is outcome-based and works with any development method. US federal agencies require software producers to attest that they follow key SSDF practices, using CISA's secure software development attestation form, so it has become a real requirement for vendors selling software to the US government.
What it covers, who needs it and why
What it covers
Development environment security, code integrity, secure design and coding, testing, third-party components, vulnerability disclosure and remediation.
Who needs it
Software producers, especially those selling to US federal agencies or their prime contractors.
Why it matters
Federal buyers ask for the attestation, and it lines up well with the EU Cyber Resilience Act's vulnerability handling duties.
Key objectives
Reduce vulnerabilities in released software
Limit the impact of vulnerabilities that remain
Address root causes to prevent recurrence
Mandatory or voluntary
Voluntary framework, no official certificate.
Owner
NIST
Current version
SP 800-218 version 1.1, with an update in progress; re-checked at every review.
Software bill of materials (SPDX, CycloneDX) and supply chain frameworks such as SLSA
A software bill of materials (SBOM) is a machine-readable list of the components inside a piece of software, usually in the SPDX or CycloneDX format. It lets producers and customers find affected products quickly when a vulnerability appears in a library. Supply chain frameworks such as SLSA add levels of build integrity and provenance. The EU Cyber Resilience Act requires manufacturers to draw up an SBOM, and US federal buyers increasingly ask for one.
What it covers, who needs it and why
What it covers
Component inventory, dependency management, build provenance, signing and vulnerability response for third-party and open source code.
Who needs it
Software publishers, SaaS companies that ship agents or on-premises editions, and teams that rely heavily on open source.
Why it matters
Supply chain attacks and library vulnerabilities are now among the top application risks, and regulators expect you to know what you ship.
Key objectives
Know every component you ship
Prove build integrity
Respond fast to component vulnerabilities
Mandatory or voluntary
Voluntary guidance, no official certificate.
Owner
CISA, NTIA guidance, the Linux Foundation (SPDX), OWASP (CycloneDX) and OpenSSF (SLSA)
Current version
SBOM duties appear in the EU Cyber Resilience Act and in US federal software procurement.
CMMI is a model of best practices for developing products and delivering services, with maturity levels that describe how well an organization's processes are defined, managed and improved. Organizations are appraised by certified lead appraisers, and the results are published by ISACA, so a "CMMI Level 3" claim can be checked. It is voluntary but common in software outsourcing and government contracts, particularly for Indian IT services firms.
What it covers, who needs it and why
What it covers
Practice areas for planning, estimating, requirements, design, verification, configuration management, process improvement and, in v3.0, security, safety and data management.
Who needs it
Software development and IT services companies bidding for large outsourcing or government programs.
Why it matters
Some buyers require a specific maturity level as a bid condition.
Web Content Accessibility Guidelines 2.2, and the laws that reference them (ADA, Section 508, European Accessibility Act)
WCAG 2.2 is the W3C standard for making web content and software usable by people with disabilities, organized under four principles (perceivable, operable, understandable, robust) and three conformance levels, with AA the usual legal target. WCAG itself is voluntary, but laws point to it: Section 508 for US federal technology, ADA rules for state and local government websites, and the EN 301 549 standard behind the European Accessibility Act, which covers e-commerce, banking and e-books sold in the EU.
What it covers, who needs it and why
What it covers
Text alternatives, captions, keyboard access, focus, contrast, forms, error handling, consistent navigation and compatibility with assistive technology.
Who needs it
Software, SaaS and website owners selling to governments, public bodies, schools, or EU consumers in covered sectors.
Why it matters
Public buyers ask for an accessibility conformance report, and accessibility lawsuits and EU enforcement are growing.
Key objectives
Make digital products usable by everyone
Give testable success criteria
Support legal compliance
Mandatory or voluntary
Voluntary guidance, no official certificate.
Owner
W3C (WCAG); US Department of Justice and Access Board; European Union (EAA)
Current version
WCAG 2.2 published October 2023. The European Accessibility Act has applied since 28 June 2025.
PCI DSS is the security standard for any organization that stores, processes or transmits payment card data, or can affect the security of that environment. It has 12 principal requirements, from network security and secure configuration to access control, logging, testing and policy. It is not a law; it is required by contracts with the card brands, acquirers and payment partners. Depending on volume and role you validate with a self-assessment questionnaire or a report on compliance by a QSA.
What it covers, who needs it and why
What it covers
The cardholder data environment and every system connected to it or able to affect it, including service providers such as hosting, payment and SaaS vendors.
Who needs it
Merchants, payment processors, and IT and SaaS providers whose systems touch card data or the cardholder data environment.
Why it matters
Non-compliance can mean fines from the acquirer, higher fees or losing the ability to take cards, plus liability after a breach.
Key objectives
Protect stored and transmitted card data
Maintain secure systems and software
Restrict and monitor access
Test security regularly and keep a security policy
Mandatory or voluntary
Mandatory once a contract, card brand or government buyer requires it.
Owner
PCI Security Standards Council; enforced by the card brands and acquiring banks
Current version
PCI DSS v4.0.1 (June 2024). The future-dated requirements of v4.0 became mandatory on 31 March 2025.
PCI Software Security Framework: Secure Software Standard and Secure SLC Standard
The PCI Secure Software Standard sets security requirements for payment software that stores, processes or transmits card data, and the Secure Software Lifecycle (Secure SLC) Standard assesses how a vendor develops and maintains it. Software validated by an assessor appears on the PCI SSC list, which merchants and acquirers use when choosing payment applications. It replaced the older PA-DSS program.
What it covers, who needs it and why
What it covers
Payment software design, sensitive data protection, authentication, attack resistance, vendor security guidance, and the vendor's development lifecycle.
Who needs it
Vendors of payment applications, POS software, payment gateways and SDKs that handle card data.
Why it matters
Merchants and acquirers prefer or require listed software, and it simplifies their own PCI DSS scope.
Key objectives
Build payment software securely
Protect card data inside the application
Give merchants validated choices
Mandatory or voluntary
Mandatory once a contract, card brand or government buyer requires it.
Owner
PCI Security Standards Council
Current version
Part of the PCI Software Security Framework, which replaced PA-DSS (retired in 2022).
Regulation EU financial sector and its ICT providers
DORA
Digital Operational Resilience Act, Regulation (EU) 2022/2554
DORA sets a single set of digital operational resilience rules for EU banks, insurers, investment firms, payment institutions and other financial entities. It requires an ICT risk management framework, classification and reporting of major ICT incidents, resilience testing (including threat-led penetration testing for larger firms), and close management of ICT third-party risk, with mandatory contract terms. ICT providers designated as critical are overseen directly by EU supervisors.
What it covers, who needs it and why
What it covers
ICT risk management, incident reporting, testing, third-party contracts and the register of ICT providers, plus oversight of critical ICT providers.
Who needs it
EU financial entities, and every IT, cloud and SaaS vendor that supports their critical or important functions.
Why it matters
Financial customers must put DORA contract terms, audit rights and exit plans into vendor agreements.
Key objectives
Withstand and recover from ICT disruption
Report major incidents consistently
Control dependence on ICT providers
Mandatory or voluntary
Mandatory for regulated organizations in scope.
Owner
European Union; national financial supervisors and the European Supervisory Authorities
Current version
Applies from 17 January 2025. The first list of critical ICT third-party providers was designated in late 2025.
New York Department of Financial Services cybersecurity requirements, 23 NYCRR Part 500
Part 500 requires banks, insurers and other businesses licensed by New York DFS to run a cybersecurity program based on a risk assessment, with a CISO, written policies, access controls including multi-factor authentication, an asset inventory, encryption, incident response and continuity plans, annual security awareness training and third-party service provider policies. Covered entities report cybersecurity events within 72 hours and certify compliance each year by 15 April. Vendors feel it through contract requirements.
What it covers, who needs it and why
What it covers
Information systems and nonpublic information of DFS-licensed entities, and the service providers they rely on.
Who needs it
DFS-licensed financial services firms and the IT and SaaS providers that serve them.
Why it matters
DFS actively enforces it, and the annual certification is signed by the CEO and CISO.
Key objectives
Protect nonpublic information
Ensure governance and accountability
Require timely incident notice
Mandatory or voluntary
Mandatory for regulated organizations in scope.
Owner
New York State Department of Financial Services (DFS)
Current version
Second amendment adopted November 2023; the last phased requirements took effect on 1 November 2025.
FTC Standards for Safeguarding Customer Information, 16 CFR Part 314, under the Gramm-Leach-Bliley Act
The Safeguards Rule requires non-bank financial institutions under FTC jurisdiction (lenders, tax preparers, car dealers that finance, fintechs and others) to run a written information security program. It names a qualified individual, requires a risk assessment, access controls, encryption, multi-factor authentication, secure development, monitoring and testing, staff training, service provider oversight and a written incident response plan. Breaches affecting 500 or more consumers must be reported to the FTC within 30 days.
What it covers, who needs it and why
What it covers
Customer information held by covered financial institutions and their service providers.
Who needs it
Non-bank financial institutions in the US, broadly defined, and the IT and software vendors they use.
Why it matters
The FTC enforces it, and service provider oversight is an explicit requirement that reaches vendors.
Key objectives
Protect customer information
Require a documented security program
Notify the FTC of significant breaches
Mandatory or voluntary
Mandatory for regulated organizations in scope.
Owner
US Federal Trade Commission (FTC)
Current version
Updated rule in force since June 2023; breach notification to the FTC since 13 May 2024.
Health Insurance Portability and Accountability Act, with the Privacy, Security and Breach Notification Rules
HIPAA sets national rules for protecting protected health information (PHI). The Privacy Rule limits uses and disclosures, the Security Rule requires administrative, physical and technical safeguards for electronic PHI, and the Breach Notification Rule requires notice to individuals, HHS and sometimes the media. Software and IT vendors that handle PHI for healthcare clients are business associates: they must sign a business associate agreement and comply with the Security Rule directly.
What it covers, who needs it and why
What it covers
PHI held by covered entities (health plans, clearinghouses, most providers) and their business associates, in any form, with the Security Rule focused on electronic PHI.
Who needs it
Healthcare providers, health plans, and every SaaS, cloud, IT and software vendor that creates, receives, stores or transmits PHI for them.
Why it matters
OCR enforces it with tiered civil penalties, and hospitals will not buy from a vendor that cannot sign a BAA.
Key objectives
Protect the privacy of health information
Secure electronic PHI
Notify people when their data is breached
Mandatory or voluntary
Mandatory by law for organizations in scope.
Owner
US Department of Health and Human Services (HHS), Office for Civil Rights (OCR)
Current version
Security Rule amendments proposed in January 2025 are listed on HHS's regulatory agenda for a final rule in July 2027. The current rule still applies.
Certifiable standard United States, used internationally
HITRUST CSF
HITRUST Common Security Framework and assessment program
The HITRUST CSF is a certifiable framework that combines requirements from HIPAA, NIST, ISO, PCI DSS and other sources into one control set, scaled by risk factors. HITRUST offers three assessment levels: e1 (essential, 1 year), i1 (implemented, 1 year) and r2 (risk-based, 2 years). Assessments are done by authorized external assessors and quality-checked by HITRUST before certification. Many US health systems and payers ask vendors for HITRUST certification.
What it covers, who needs it and why
What it covers
Information security and privacy controls across 14 control categories, tailored to the organization's size, systems and regulatory factors.
Who needs it
Health tech, SaaS and IT vendors selling to US hospitals, health plans and pharmacy benefit managers.
Why it matters
One certification can satisfy many healthcare customers' security reviews and maps to HIPAA requirements.
Key objectives
Harmonize multiple frameworks
Scale controls to risk
Give a reliable, centrally reviewed certification
Mandatory or voluntary
Voluntary, with independent certification.
Owner
HITRUST Alliance
Current version
HITRUST CSF v11.x, updated several times a year; the current release is re-checked at every review.
Regulation United States (FDA-regulated activities)
21 CFR Part 11
FDA regulation on electronic records and electronic signatures, Title 21 Code of Federal Regulations Part 11
Part 11 sets the conditions under which the FDA treats electronic records and signatures as equivalent to paper. It applies to records that FDA predicate rules require pharmaceutical, biotech, medical device and food companies to keep. Systems must be validated, keep secure, computer-generated audit trails, limit access, and link electronic signatures to their records. FDA's 2003 guidance narrowed enforcement focus, so the first job is deciding which records are actually Part 11 records.
What it covers, who needs it and why
What it covers
Electronic records required by FDA rules and the systems that create, modify, store and sign them, including training, quality and clinical systems.
Who needs it
FDA-regulated life sciences companies and the software vendors whose systems hold their regulated records.
Why it matters
FDA inspectors cite Part 11 gaps in warning letters, and life sciences buyers validate vendors against it.
Key objectives
Trustworthy and reliable electronic records
Secure audit trails
Legally binding electronic signatures
Mandatory or voluntary
Mandatory for regulated organizations in scope.
Owner
US Food and Drug Administration (FDA)
Current version
The 1997 rule, read with FDA's 2003 guidance on scope and application.
Regulation EU, plus non-EU providers whose AI is placed on the EU market or used there
EU AI Act
Artificial Intelligence Act, Regulation (EU) 2024/1689, as amended by Regulation (EU) 2026/1744
The EU AI Act regulates AI by risk. A short list of practices is banned. High-risk systems, such as AI used in hiring, education, credit scoring or critical infrastructure, need risk management, data governance, documentation, logging, human oversight, accuracy and robustness, plus conformity assessment. Chatbots and generative AI carry transparency duties, and general-purpose AI model providers have their own obligations. It binds providers and deployers, including non-EU companies. The top fines reach 35 million euros or 7% of turnover.
What it covers, who needs it and why
What it covers
AI systems and general-purpose AI models placed on the EU market or used in the EU, across their lifecycle.
Who needs it
Companies that build AI features, sell AI products into the EU, or use high-risk AI in the EU, including HR tech, edtech and fintech vendors.
Why it matters
It is the first comprehensive AI law, its phased dates are already running, and customers now ask vendors about AI Act roles and duties.
Key objectives
Ban unacceptable AI practices
Make high-risk AI safe and accountable
Give people transparency when AI is used
Govern general-purpose AI models
Mandatory or voluntary
Mandatory for regulated organizations in scope.
Owner
European Union; the AI Office and national market surveillance authorities
Current version
Prohibitions apply since 2 February 2025 and general-purpose AI model duties since 2 August 2025. After the Digital Omnibus amendment (Regulation 2026/1744), Annex III high-risk duties apply from 2 December 2027 and Annex I from 2 August 2028.
ISO/IEC 42001 is the first certifiable management system standard for artificial intelligence. It asks organizations that develop, provide or use AI to set an AI policy, assess AI risks and impacts on people, apply controls from its Annex A (such as data quality, transparency, human oversight and supplier management), and improve through audit and review. It uses the same structure as ISO 27001, so the two are often combined. Certification is voluntary and done by accredited bodies.
What it covers, who needs it and why
What it covers
Governance of AI across its lifecycle: policy, roles, risk and impact assessment, data, development, operation, monitoring and third parties.
Who needs it
AI product companies, SaaS vendors with AI features and enterprises that deploy AI and want auditable governance.
Why it matters
It gives customers independent proof of AI governance and supports readiness for laws such as the EU AI Act.
NIST AI 100-1, Artificial Intelligence Risk Management Framework, with the generative AI profile NIST AI 600-1
The NIST AI RMF is a voluntary framework for managing risks of AI systems to people, organizations and society. It describes characteristics of trustworthy AI (valid and reliable, safe, secure and resilient, accountable and transparent, explainable, privacy-enhanced, and fair) and four functions: Govern, Map, Measure and Manage. The Generative AI Profile adds risks and actions specific to generative models. It is widely referenced by US agencies, state laws and enterprise buyers.
What it covers, who needs it and why
What it covers
AI risk governance, context mapping, measurement and testing, and risk treatment across the AI lifecycle.
Who needs it
Organizations that build or deploy AI, especially those selling to US government or US enterprises.
Why it matters
It is the most common AI risk reference in the US and gives a practical structure that pairs with ISO 42001.
Key objectives
Build trustworthy AI
Manage AI risk across its lifecycle
Give a shared vocabulary for AI risk
Mandatory or voluntary
Voluntary framework, no official certificate.
Owner
NIST
Current version
AI RMF 1.0 (January 2023) and the Generative AI Profile NIST AI 600-1 (July 2024).
OWASP Top 10 for Large Language Model Applications
The OWASP Top 10 for LLM Applications lists the most critical security risks in applications built on large language models, starting with prompt injection and including sensitive information disclosure, supply chain risks, data and model poisoning, improper output handling, excessive agency and unbounded consumption. Like the web Top 10, it is an awareness document, not a certifiable standard. It is the practical checklist most security reviewers now use for chatbots, AI assistants and agents.
What it covers, who needs it and why
What it covers
Prompt handling, model and data supply chain, output handling, plugin and tool permissions, data leakage, system prompts, vector stores and resource abuse.
Who needs it
Teams building chatbots, AI assistants, agents and other LLM features, and the security teams that test them.
Why it matters
LLM features open new attack paths that traditional application security testing misses.
Colorado was the first US state to pass a broad AI law. In May 2026 it replaced its original act (SB 24-205) with SB 26-189, which takes a notice-based approach. Developers of automated decision-making technology used in consequential decisions, such as hiring, lending, housing or education, must give deployers technical documentation. Deployers must tell people when such a system is used, explain adverse outcomes, allow correction of data and offer human review. It takes effect on 1 January 2027.
What it covers, who needs it and why
What it covers
Automated decision-making technology used to make or substantially support consequential decisions about Colorado consumers.
Who needs it
Developers and deployers of AI or automated decision tools used in employment, education, lending, housing, insurance, healthcare and similar decisions.
Why it matters
It is a model other states are watching, and HR and edtech vendors must support their customers' notice and review duties.
Key objectives
Tell consumers when automated decisions affect them
Explain adverse decisions
Give a route to correction and human review
Mandatory or voluntary
Mandatory by law for organizations in scope.
Owner
State of Colorado; enforced by the Attorney General
Current version
SB 26-189, signed 14 May 2026, takes effect on 1 January 2027. A legal challenge was expected, so the guide is re-checked before launch.
Security and resilience: business continuity management systems, requirements
ISO 22301 sets requirements for a business continuity management system (BCMS). You analyze which activities matter most and how long they can be down (business impact analysis), assess risks, choose continuity strategies, write and exercise plans, and review and improve. Certification by an accredited body is voluntary. For IT and SaaS companies it pairs with ISO/IEC 27031 and NIST SP 800-34 for disaster recovery of systems, and supports duties under DORA and NIS2.
What it covers, who needs it and why
What it covers
Business impact analysis, risk assessment, continuity strategies and solutions, plans and procedures, exercising and testing, and evaluation.
Who needs it
SaaS, cloud, data center and managed service providers whose customers depend on uptime, and firms in regulated sectors.
Why it matters
Customers and regulators want evidence that you can keep delivering through disruption, not just a backup policy.
Key objectives
Protect prioritized activities during disruption
Recover within agreed timeframes
Exercise and improve plans
Mandatory or voluntary
Voluntary, with independent certification.
Owner
ISO (TC 292)
Current version
ISO 22301:2019 with Amendment 1:2024. Related guidance: ISO/IEC 27031 (ICT readiness) and NIST SP 800-34 (contingency planning).
Law Canada (private sector, outside provinces with similar laws)
PIPEDA
Personal Information Protection and Electronic Documents Act (Canada)
PIPEDA governs how private sector organizations collect, use and disclose personal information in commercial activity in Canada, based on ten fair information principles, including accountability, consent, limiting collection and safeguards. Organizations must report breaches of security safeguards that pose a real risk of significant harm to the OPC and affected people, and keep records of all breaches for 24 months. Quebec, Alberta and British Columbia have their own private sector laws.
What it covers, who needs it and why
What it covers
Personal information handled in commercial activities, and employee data of federally regulated businesses.
Who needs it
Companies with Canadian customers or users, including foreign SaaS providers with a real connection to Canada.
Why it matters
Canadian buyers expect PIPEDA-aligned privacy terms, and breach reporting is mandatory.
Key objectives
Meaningful consent
Accountability for personal information
Breach reporting and record keeping
Mandatory or voluntary
Mandatory by law for organizations in scope.
Owner
Parliament of Canada; Office of the Privacy Commissioner of Canada (OPC)
Current version
Still in force: Bill C-27, which would have replaced it, died when Parliament was prorogued in January 2025.
Law Brazil, plus processing of data collected in Brazil
LGPD
Lei Geral de Proteção de Dados Pessoais, Brazil Law 13.709/2018
The LGPD is Brazil's general data protection law, modeled partly on the GDPR. It applies to processing carried out in Brazil, to offering goods or services to people in Brazil, and to data collected there. It sets ten legal bases, data subject rights, a data protection officer (encarregado), incident reporting to the ANPD and international transfer rules. Fines reach 2% of revenue in Brazil, capped at 50 million reais per infraction.
What it covers, who needs it and why
What it covers
Personal data of people in Brazil processed by public and private organizations, online and offline.
Who needs it
Companies with users or customers in Brazil, including foreign SaaS providers.
Why it matters
The ANPD is active, and Brazilian customers expect LGPD clauses and transfer tools.
Key objectives
Protect fundamental rights of privacy
Set legal bases for processing
Create accountability and enforcement
Mandatory or voluntary
Mandatory by law for organizations in scope.
Owner
Brazil; Autoridade Nacional de Proteção de Dados (ANPD)
Current version
In force since September 2020, with ANPD sanctions since August 2021.
Law China, plus processing abroad of data about people in China
China PIPL
Personal Information Protection Law of the People's Republic of China, with the Cybersecurity Law and the Data Security Law
The PIPL is China's comprehensive personal information law. It requires a legal basis such as consent (with separate consent for sensitive data and transfers abroad), personal information protection impact assessments, and one of the approved mechanisms for cross-border transfer: a CAC security assessment, the standard contract or certification. It reaches processing outside China aimed at people in China. With the Cybersecurity Law and the Data Security Law it forms China's data regime. Fines reach 50 million yuan or 5% of the previous year's turnover.
What it covers, who needs it and why
What it covers
Personal information of people in China, data localization for some operators, and cross-border transfers.
Who needs it
Companies with users, employees or operations in China, and foreign companies receiving data from China.
Why it matters
Transfer rules decide whether you can serve Chinese users from servers abroad.
Key objectives
Protect personal information rights
Control cross-border data flows
Assign duties to processors
Mandatory or voluntary
Mandatory by law for organizations in scope.
Owner
National People's Congress; Cyberspace Administration of China (CAC)
The PDPA governs how private organizations collect, use and disclose personal data in Singapore. Its obligations include consent, purpose limitation, notification, access and correction, accuracy, protection, retention limits, transfer limits and accountability. Since 2021 organizations must notify the PDPC of notifiable breaches within three calendar days of assessing them. Financial penalties reach 10% of Singapore turnover for organizations with annual turnover above 10 million Singapore dollars, or 1 million dollars otherwise.
What it covers, who needs it and why
What it covers
Personal data handled by organizations in Singapore, including data intermediaries that process for others.
Who needs it
Companies with Singapore customers or operations, including SaaS providers acting as data intermediaries.
Why it matters
Singapore is a regional hub, and the PDPC publishes its enforcement decisions.
Key objectives
Balance individual rights with organizational needs
Require reasonable protection
Mandate breach notification
Mandatory or voluntary
Mandatory by law for organizations in scope.
Owner
Personal Data Protection Commission (PDPC)
Current version
Amended in 2020, including mandatory breach notification since February 2021.
Privacy Act 1988 (Cth) and the Australian Privacy Principles
The Privacy Act regulates how Australian government agencies and most businesses with annual turnover above 3 million Australian dollars handle personal information, through 13 Australian Privacy Principles. The Notifiable Data Breaches scheme requires notice to the OAIC and affected people for eligible breaches. The 2024 amendments added a statutory tort for serious invasions of privacy, a children's online privacy code and transparency duties for automated decisions. Penalties for serious interference reach the greater of 50 million dollars, three times the benefit, or 30% of turnover.
What it covers, who needs it and why
What it covers
Personal information handled by APP entities, including overseas organizations with an Australian link.
Who needs it
Companies with Australian customers above the threshold, and some smaller businesses such as health service providers.
Why it matters
Penalties rose sharply after major Australian breaches, and reform is continuing.
Key objectives
Open and transparent handling of personal information
Security and breach notification
Individual access and correction
Mandatory or voluntary
Mandatory by law for organizations in scope.
Owner
Office of the Australian Information Commissioner (OAIC)
Current version
Amended in December 2024 (first tranche of reforms), with some changes phased in to December 2026.
Digital Personal Data Protection Act, 2023 and the Digital Personal Data Protection Rules, 2025 (India)
The DPDP Act is India's first comprehensive data protection law. Data fiduciaries must give clear notice, get free, specific and informed consent or rely on a listed legitimate use, protect data with reasonable security safeguards, report breaches to the Data Protection Board and affected people, erase data when the purpose ends, and honor data principals' rights. Significant data fiduciaries have extra duties such as a data protection officer, impact assessments and audits. Penalties reach 250 crore rupees.
What it covers, who needs it and why
What it covers
Digital personal data processed in India, and processing outside India connected to offering goods or services to people in India.
Who needs it
Every company that processes digital personal data of people in India, including Indian IT and SaaS companies and the processors they use.
Why it matters
It is binding law with large penalties and a fixed timeline, and Indian enterprise buyers are already asking vendors for DPDP readiness.
Key objectives
Lawful processing with consent or a legitimate use
Reasonable security and breach reporting
Rights for data principals
Accountability for data fiduciaries
Mandatory or voluntary
Mandatory by law for organizations in scope.
Owner
Ministry of Electronics and Information Technology (MeitY); Data Protection Board of India
Current version
Rules notified in November 2025. Board provisions apply now, consent manager rules from about 13 November 2026, and the main duties from about 13 May 2027. A proposal to shorten the 18 months to 12 had not been notified as of our last check.
Information Technology Act, 2000 (India), as amended in 2008, with the SPDI Rules 2011
The IT Act 2000 is India's core law on electronic records, digital signatures, cybercrime and intermediaries. It gives legal recognition to electronic records and signatures, defines offences such as hacking, identity theft and data theft, gives CERT-In its powers under Section 70B, and sets the safe harbor and due diligence conditions for intermediaries under Section 79. Until the DPDP Act fully commences, Section 43A and the SPDI Rules 2011 require reasonable security practices for sensitive personal data.
What it covers, who needs it and why
What it covers
Electronic records and signatures, cyber offences and penalties, intermediary liability, government powers to block, intercept and direct, and (for now) sensitive personal data security.
Who needs it
Every IT company, platform and intermediary operating in India.
Why it matters
It is the base under CERT-In directions, the IT Rules 2021 and many sector rules.
Key objectives
Legal validity for electronic commerce
Define and punish cyber offences
Set intermediary duties and protections
Mandatory or voluntary
Mandatory by law for organizations in scope.
Owner
Parliament of India; MeitY
Current version
As amended by the IT (Amendment) Act 2008. Section 43A and the SPDI Rules 2011 fall away once the DPDP Act fully commences.
Directions under Section 70B(6) of the IT Act relating to information security practices, procedure, prevention, response and reporting of cyber incidents (28 April 2022)
The CERT-In Directions apply to service providers, intermediaries, data centers, body corporates and government bodies. They require reporting of listed cyber incidents to CERT-In within 6 hours of noticing them, keeping ICT system logs for a rolling 180 days within India, synchronizing clocks to national NTP servers, and naming a point of contact. Data centers, VPS, cloud and VPN providers must also keep subscriber records for five years. They are among the strictest incident reporting timelines anywhere.
What it covers, who needs it and why
What it covers
Cyber incident reporting, log retention, time synchronization, points of contact and subscriber records for certain providers.
Who needs it
Practically every company with IT systems in India, including SaaS companies, data centers, cloud and hosting providers.
Why it matters
Non-compliance is punishable under Section 70B(7), and the 6-hour clock needs a tested process.
Key objectives
Fast national visibility of cyber incidents
Logs available for investigation
A named contact in every organization
Mandatory or voluntary
Mandatory for regulated organizations in scope.
Owner
Indian Computer Emergency Response Team (CERT-In), MeitY
Current version
Directions dated 28 April 2022, in force since June 2022, with FAQs. CERT-In issued Comprehensive Cyber Security Audit Policy Guidelines in July 2025.
IT (Intermediary Guidelines and Digital Media Ethics Code) Rules, 2021
Information Technology (Intermediary Guidelines and Digital Media Ethics Code) Rules, 2021 (India)
The IT Rules 2021 set due diligence duties that intermediaries must meet to keep safe harbor under Section 79 of the IT Act: publish rules and a privacy policy, act on takedown orders, appoint a grievance officer and resolve complaints within set times. Significant social media intermediaries have extra duties, including a chief compliance officer based in India. Amendments in 2026 require platforms to label AI-generated synthetic content and remove certain unlawful content much faster.
What it covers, who needs it and why
What it covers
Platforms, hosting providers, marketplaces, messaging and social media services, online gaming and digital news publishers.
Who needs it
Intermediaries serving users in India, from small hosting providers to large platforms, and companies offering generative AI features to Indian users.
Why it matters
Losing safe harbor makes the platform liable for its users' content.
Key objectives
Accountable intermediaries
Fast grievance redress
Transparency about synthetic content
Mandatory or voluntary
Mandatory for regulated organizations in scope.
Owner
MeitY (Part II) and the Ministry of Information and Broadcasting (Part III)
Current version
Amended in 2022, 2023 and again in 2026 with duties to label synthetically generated (AI) content and shorter takedown timelines.
Reserve Bank of India directions on IT governance, cyber security, technology risk and IT outsourcing for regulated entities
RBI requires banks, NBFCs, payment system operators and other regulated entities to govern IT and cyber risk at board level: an IT strategy and IT risk committees, information security and cyber resilience programs, business continuity and disaster recovery, IS audit, and controlled outsourcing of IT services and cloud, with audit and access rights for RBI. IT vendors serving Indian banks and NBFCs inherit many of these duties through contracts. RBI consolidated its instructions into entity-wise directions from late 2025, so the exact source depends on the type of entity.
What it covers, who needs it and why
What it covers
IT governance, information and cyber security, technology risk, BCP and DR, IS audit, and outsourcing of IT services for RBI-regulated entities.
Who needs it
Indian banks, NBFCs and payment entities, and the IT, cloud and SaaS vendors that serve them.
Why it matters
RBI supervises compliance closely, and vendor contracts must carry its audit and access rights.
Key objectives
Board-level IT governance
Managed IT and cyber risk
Controlled outsourcing
Mandatory or voluntary
Mandatory for regulated organizations in scope.
Owner
Reserve Bank of India (RBI)
Current version
The 2023 Master Direction on IT governance (effective 1 April 2024) set the current rules. In late 2025 RBI began consolidating its instructions into entity-wise directions (for NBFCs, a 2026 cybersecurity and technology risk direction), so the guide cites the direction that applies to each entity type.
Cybersecurity and Cyber Resilience Framework (CSCRF) for SEBI Regulated Entities
SEBI's CSCRF replaces earlier cybersecurity circulars with one framework for stock exchanges, depositories, brokers, mutual funds, portfolio managers and other regulated entities. It sorts entities into categories by size and importance and sets standards across the governance, identify, protect, detect, respond and recover functions, including a security operations center, periodic VAPT, cyber audits and incident reporting. Third-party service providers, including IT vendors, must meet requirements passed down through contracts.
What it covers, who needs it and why
What it covers
Cyber governance, risk, security controls, monitoring, incident response and recovery for SEBI-regulated entities and their technology providers.
Who needs it
Indian securities market entities and the software, cloud and managed security providers that serve them.
Why it matters
It is mandatory for regulated entities and audited, and vendors must support evidence requests.
Key objectives
Cyber resilience across the securities market
Proportional controls by category
Regular testing and audit
Mandatory or voluntary
Mandatory for regulated organizations in scope.
Owner
Securities and Exchange Board of India (SEBI)
Current version
Circular of 20 August 2024, with compliance deadlines extended into 2025 and later clarifications.
Contract requirement United States (federal government)
FedRAMP
Federal Risk and Authorization Management Program
FedRAMP is the US government program that assesses and authorizes cloud services for federal agency use. Traditionally, a provider implemented NIST SP 800-53 controls at a Low, Moderate or High baseline, was assessed by a 3PAO and gained an agency authorization. FedRAMP 20x, introduced in 2025, moves to automated, outcome-based validation with certification classes and faster reviews, and legacy Rev5 processing is winding down. Without FedRAMP, agencies generally cannot use your cloud service.
What it covers, who needs it and why
What it covers
Cloud services (SaaS, PaaS, IaaS) that process federal information, their security controls, assessment and continuous monitoring.
Who needs it
Cloud and SaaS providers selling to US federal agencies, directly or through resellers.
Why it matters
It is the entry ticket to the federal cloud market, and the program is changing fast.
Key objectives
Standard security assessment for federal cloud
Reuse of authorizations across agencies
Continuous monitoring
Mandatory or voluntary
Mandatory once a contract, card brand or government buyer requires it.
Owner
US General Services Administration (FedRAMP PMO), under the FedRAMP Authorization Act
Current version
FedRAMP 20x is the new path, with Class B and C certifications open to all providers since August 2026. Legacy Rev5 applications are accepted until 11 June 2027.
Law United States (federal agencies and their contractors)
FISMA
Federal Information Security Modernization Act of 2014
FISMA requires every US federal agency to run an agency-wide information security program and report on it each year. In practice it is implemented through the NIST Risk Management Framework (SP 800-37) and the SP 800-53 controls, with systems authorized to operate before use. Contractors that operate federal systems or handle federal information on an agency's behalf are bound through their contracts, which is why federal IT contracts carry FISMA language.
What it covers, who needs it and why
What it covers
Federal information and information systems, including those run by contractors for agencies.
Who needs it
Federal agencies and the IT contractors and service providers that run systems for them.
Why it matters
An authority to operate is needed before a federal system goes live.
Key objectives
Agency-wide security programs
Risk-based authorization of systems
Annual reporting and oversight
Mandatory or voluntary
Mandatory by law for organizations in scope.
Owner
US Congress; OMB, CISA and NIST
Current version
FISMA 2014, implemented through OMB guidance and NIST standards.
Security and Privacy Controls for Information Systems and Organizations
NIST SP 800-53 is the catalog of security and privacy controls used for US federal information systems and, through FedRAMP and FISMA, for their contractors. Revision 5 contains 20 control families, from access control and audit to supply chain risk management, with baselines (low, moderate, high and privacy) set in SP 800-53B. It is mandatory for federal systems and widely reused by states, regulators and companies as a detailed control library. Release 5.2.0 updated controls on software updates and patching.
What it covers, who needs it and why
What it covers
Technical, operational and management controls across 20 families, plus privacy controls and control enhancements.
Who needs it
Federal agencies, FedRAMP cloud providers, federal contractors, and organizations that want a detailed control catalog.
Why it matters
It is the control language of US government security and the basis of FedRAMP baselines.
Key objectives
Protect federal systems and information
Give a common control catalog
Support risk-based tailoring
Mandatory or voluntary
Voluntary framework, no official certificate.
Owner
NIST
Current version
Revision 5, release 5.2.0 (August 2025). Baselines are in SP 800-53B.
Contract requirement United States (federal contractors)
NIST SP 800-171
Protecting Controlled Unclassified Information in Nonfederal Systems and Organizations
NIST SP 800-171 sets security requirements for protecting controlled unclassified information (CUI) in contractor systems. Revision 2 has 110 requirements in 14 families; Revision 3 reorganizes them into 97 requirements in 17 families with organization-defined parameters. Defense contractors are required to implement it by DFARS clause 252.204-7012, report a self-assessment score in SPRS, and, under CMMC, prove it through assessment. Other agencies are moving toward similar requirements.
What it covers, who needs it and why
What it covers
Contractor information systems that process, store or transmit CUI, including cloud services they use for CUI.
Who needs it
Defense and federal contractors and subcontractors handling CUI, including IT and software providers in the supply chain.
Why it matters
False compliance claims have led to False Claims Act settlements, and CMMC makes it a condition of award.
Key objectives
Protect CUI outside federal systems
Give contractors one requirement set
Enable verification through assessment
Mandatory or voluntary
Mandatory once a contract, card brand or government buyer requires it.
Owner
NIST; required through DFARS 252.204-7012 and other contract clauses
Current version
Revision 3 (May 2024) is current at NIST; DoD contracts and CMMC Level 2 still assess against Revision 2 under a class deviation.
Contract requirement United States (Department of Defense supply chain)
CMMC 2.0
Cybersecurity Maturity Model Certification program (32 CFR Part 170)
CMMC verifies that defense contractors protect federal contract information and CUI. Level 1 covers 15 basic safeguarding requirements with an annual self-assessment. Level 2 covers the 110 NIST SP 800-171 Rev. 2 requirements, assessed every three years either by the contractor or by an authorized third-party assessor (C3PAO), as the contract specifies. Level 3 adds requirements from SP 800-172, assessed by the government. Since November 2025, contracts can make a CMMC status a condition of award, phased in over three years.
What it covers, who needs it and why
What it covers
Contractor systems that handle federal contract information or CUI, and flow-down to subcontractors.
Who needs it
Every company in the US defense industrial base supply chain, including software, IT and managed service providers.
Why it matters
Without the required CMMC status, a contractor cannot win or keep covered DoD contracts.
Key objectives
Verify contractor cybersecurity
Protect FCI and CUI
Hold the supply chain to one standard
Mandatory or voluntary
Mandatory once a contract, card brand or government buyer requires it.
Owner
US Department of Defense (DoD CIO); assessments by C3PAOs and DIBCAC
Current version
Program rule effective December 2024; the DFARS contract rule took effect 10 November 2025 (phase 1). Phase 2, requiring C3PAO Level 2 assessments where specified, starts 10 November 2026.
Contract requirement United States (criminal justice agencies and their vendors)
CJIS Security Policy
FBI Criminal Justice Information Services Security Policy
The CJIS Security Policy sets the minimum security requirements for accessing, storing and transmitting criminal justice information, such as fingerprints and criminal history. It applies to law enforcement agencies and every vendor whose systems or staff touch that data, through a security addendum signed by the vendor's personnel. Version 6.0 restructured the policy around NIST SP 800-53 controls, including multi-factor authentication, audit logging, incident response and security awareness training.
What it covers, who needs it and why
What it covers
Systems, cloud services and personnel with access to criminal justice information.
Who needs it
SaaS, cloud and IT vendors selling to police, courts, corrections and other criminal justice agencies.
Why it matters
Agencies cannot share CJI with a vendor that does not meet the policy, and state CJIS officers audit it.
Key objectives
Protect criminal justice information
Set common minimum controls
Vet and train personnel with access
Mandatory or voluntary
Mandatory once a contract, card brand or government buyer requires it.
Owner
FBI CJIS Division
Current version
Version 6.0 (December 2024), realigned to NIST SP 800-53 with phased requirements.
Every requirement is checked against the official text: the regulator, the standards body or the framework owner, linked from each entry.
Each entry says whether it is a law, a contract requirement, a certifiable standard, an attestation or a voluntary framework.
Guides show when they were published and last reviewed, and are reviewed again when a new edition, amendment or deadline lands.
Nothing here is legal advice. Where a rule is still a proposal, we say so.
Who we are
LMS Advisor is a learning management system
We build the LMS that companies use to run security, privacy and compliance training and keep the records auditors ask for. We wrote this hub because almost every framework below has a training requirement, and the same questions come up in every audit. We do not sell consulting, implementation or certification services, and LMS Advisor itself does not hold the certifications described here.
IT compliance means meeting the laws, contract requirements and standards that apply to how a technology company handles data and runs its systems. It covers security (ISO 27001, SOC 2), privacy laws (GDPR, the DPDP Act, CCPA), sector rules (PCI DSS, HIPAA, DORA) and newer areas such as AI governance (the EU AI Act, ISO 42001).
Which IT compliance standards are mandatory?
Laws and regulations such as the GDPR, the DPDP Act, HIPAA, NIS2 and the CERT-In Directions are mandatory for anyone in their scope. PCI DSS, CMMC and FedRAMP become mandatory through contracts. ISO 27001, SOC 2, ISO 42001 and frameworks such as NIST CSF are voluntary, although customers often make them a condition of a deal. Each entry in this directory says which applies.
Should a SaaS company start with ISO 27001 or SOC 2?
Start with the one your buyers ask for. US enterprise customers usually ask for a SOC 2 Type II report, while buyers in Europe, India, the Middle East and the public sector more often ask for an ISO 27001 certificate. The controls overlap heavily, so many companies build one control set and get both. Our ISO 27001 and SOC 2 guides compare them in detail.
Do these standards require staff training?
Almost all of them do. ISO 27001 requires awareness and competence (clauses 7.2 and 7.3), PCI DSS requires security awareness training at hire and every year (requirement 12.6), HIPAA requires workforce training, and the GDPR and DPDP Act expect staff who handle personal data to know their duties. Auditors ask for records that show who was trained, on what and when.
How often is this directory updated?
Every entry shows its current version or status, checked on the date at the top of the directory. Guides are reviewed every three months for laws with dated phases and every six months for voluntary standards, and straight away when a new edition, amendment or deadline lands. Each guide shows its last reviewed date.
Is this legal advice?
No. The hub explains requirements in plain terms and links to the official text, but it is not legal advice and it does not replace an accredited auditor or a lawyer for your situation. LMS Advisor is a learning management system; we do not sell compliance consulting or certification services.
Compliance training with proof
Run the training these frameworks ask for
ISO 27001, SOC 2, PCI DSS, HIPAA, GDPR and the DPDP Act all expect trained staff and proof of it. LMS Advisor assigns the courses, chases overdue learners and keeps dated completion records and certificates for your auditor.
Due dates, reminders and overdue reports for mandatory courses
Certificates that expire and renew on your retraining cycle
CSV, Excel and PDF exports of who completed what, and when
LMS Advisor is our product. It runs your training and keeps the records. It does not certify you against any standard.
Book a demo before Dec 1, 2026 and your quote comes with 30% off your first year of LMS Advisor: courses, proctored exams, certificates and AI authoring in one platform, in our cloud or on your own server.
Offer ends Dec 1, 2026, 11:59 PM ET
Cloud or self-hosted, proctoring included
The discount is applied in your written quote
We use cookies to see how visitors use this site and to measure our ads. Choose Continue to allow them, or Reject to browse without them. Privacy policy
LMS Advisor AI
AI product consultant
You're chatting with an AI. Answers can be wrong, so please don't type personal data here. Privacy ·
